@zowe/cli 8.37.1 → 8.39.0

package/node_modules/markdown-it/lib/rules_core/smartquotes.mjs

@@ -6,6 +6,19 @@ import { isWhiteSpace, isPunctCharCode, isMdAsciiPunct } from '../common/utils.m
 const QUOTE_TEST_RE = /['"]/
 const QUOTE_RE = /['"]/g
 const APOSTROPHE = '\u2019' /* ’ */
+// Caps memory on malicious input
+const MAX_OPENERS = 1000
+
+function truncateStack (stack, heads, length) {
+  while (stack.length > length) {
+    const item = stack.pop()
+    if (item.isSingleQuote) {
+      heads.single = item.prevSameQuoteIdx
+    } else {
+      heads.double = item.prevSameQuoteIdx
+    }
+  }
+}
 
 function addReplacement (replacements, tokenIdx, pos, ch) {
   if (!replacements[tokenIdx]) {
@@ -35,6 +48,8 @@ function process_inlines (tokens, state) {
   let j
 
   const stack = []
+  // stack indexes of topmost openers of each type (-1 if none)
+  const heads = { single: -1, double: -1 }
   // token index -> list of replacements in the original token content
   const replacements = {}
 
@@ -46,7 +61,7 @@ function process_inlines (tokens, state) {
     for (j = stack.length - 1; j >= 0; j--) {
       if (stack[j].level <= thisLevel) { break }
     }
-    stack.length = j + 1
+    truncateStack(stack, heads, j + 1)
 
     if (token.type !== 'text') { continue }
 
@@ -150,39 +165,45 @@ function process_inlines (tokens, state) {
       }
 
       if (canClose) {
-        // this could be a closing quote, rewind the stack to get a match
-        for (j = stack.length - 1; j >= 0; j--) {
-          let item = stack[j]
-          if (stack[j].level < thisLevel) { break }
-          if (item.single === isSingle && stack[j].level === thisLevel) {
-            item = stack[j]
-
-            let openQuote
-            let closeQuote
-            if (isSingle) {
-              openQuote = state.md.options.quotes[2]
-              closeQuote = state.md.options.quotes[3]
-            } else {
-              openQuote = state.md.options.quotes[0]
-              closeQuote = state.md.options.quotes[1]
-            }
-
-            addReplacement(replacements, i, t.index, closeQuote)
-            addReplacement(replacements, item.token, item.pos, openQuote)
-
-            stack.length = j
-            continue OUTER
+        // Stack levels never decrease, so an opener of this type below
+        // the current level means there is no match
+        j = isSingle ? heads.single : heads.double
+        if (j >= 0 && stack[j].level === thisLevel) {
+          const item = stack[j]
+
+          let openQuote
+          let closeQuote
+          if (isSingle) {
+            openQuote = state.md.options.quotes[2]
+            closeQuote = state.md.options.quotes[3]
+          } else {
+            openQuote = state.md.options.quotes[0]
+            closeQuote = state.md.options.quotes[1]
           }
+
+          addReplacement(replacements, i, t.index, closeQuote)
+          addReplacement(replacements, item.tokenIdx, item.contentPos, openQuote)
+
+          truncateStack(stack, heads, j)
+          continue OUTER
         }
       }
 
       if (canOpen) {
+        if (stack.length >= MAX_OPENERS) { return }
         stack.push({
-          token: i,
-          pos: t.index,
-          single: isSingle,
-          level: thisLevel
+          tokenIdx: i,
+          contentPos: t.index,
+          isSingleQuote: isSingle,
+          level: thisLevel,
+          // stack index of the previous opener of the same quote type, -1 if none
+          prevSameQuoteIdx: isSingle ? heads.single : heads.double
         })
+        if (isSingle) {
+          heads.single = stack.length - 1
+        } else {
+          heads.double = stack.length - 1
+        }
       } else if (canClose && isSingle) {
         addReplacement(replacements, i, t.index, APOSTROPHE)
       }

package/node_modules/markdown-it/lib/rules_inline/autolink.mjs

@@ -1,7 +1,7 @@
 // Process autolinks '<protocol:...>'
 
 /* eslint max-len:0 */
-const EMAIL_RE    = /^([a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*)$/
+const EMAIL_RE = /^([a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*)$/
 /* eslint-disable-next-line no-control-regex */
 const AUTOLINK_RE = /^([a-zA-Z][a-zA-Z0-9+.-]{1,31}):([^<>\x00-\x20]*)$/
 
@@ -29,17 +29,17 @@ export default function autolink (state, silent) {
     if (!state.md.validateLink(fullUrl)) { return false }
 
     if (!silent) {
-      const token_o   = state.push('link_open', 'a', 1)
-      token_o.attrs   = [['href', fullUrl]]
-      token_o.markup  = 'autolink'
-      token_o.info    = 'auto'
+      const token_o = state.push('link_open', 'a', 1)
+      token_o.attrs = [['href', fullUrl]]
+      token_o.markup = 'autolink'
+      token_o.info = 'auto'
 
-      const token_t   = state.push('text', '', 0)
+      const token_t = state.push('text', '', 0)
       token_t.content = state.md.normalizeLinkText(url)
 
-      const token_c   = state.push('link_close', 'a', -1)
-      token_c.markup  = 'autolink'
-      token_c.info    = 'auto'
+      const token_c = state.push('link_close', 'a', -1)
+      token_c.markup = 'autolink'
+      token_c.info = 'auto'
     }
 
     state.pos += url.length + 2
@@ -51,17 +51,17 @@ export default function autolink (state, silent) {
     if (!state.md.validateLink(fullUrl)) { return false }
 
     if (!silent) {
-      const token_o   = state.push('link_open', 'a', 1)
-      token_o.attrs   = [['href', fullUrl]]
-      token_o.markup  = 'autolink'
-      token_o.info    = 'auto'
+      const token_o = state.push('link_open', 'a', 1)
+      token_o.attrs = [['href', fullUrl]]
+      token_o.markup = 'autolink'
+      token_o.info = 'auto'
 
-      const token_t   = state.push('text', '', 0)
+      const token_t = state.push('text', '', 0)
       token_t.content = state.md.normalizeLinkText(url)
 
-      const token_c   = state.push('link_close', 'a', -1)
-      token_c.markup  = 'autolink'
-      token_c.info    = 'auto'
+      const token_c = state.push('link_close', 'a', -1)
+      token_c.markup = 'autolink'
+      token_c.info = 'auto'
     }
 
     state.pos += url.length + 2

package/node_modules/markdown-it/lib/rules_inline/balance_pairs.mjs

@@ -85,8 +85,8 @@ function processDelimiters (delimiters) {
           jumps[closerIdx] = closerIdx - openerIdx + lastJump
           jumps[openerIdx] = lastJump
 
-          closer.open  = false
-          opener.end   = closerIdx
+          closer.open = false
+          opener.end = closerIdx
           opener.close = false
           newMinOpenerIdx = -1
           // treat next token as start of run,

package/node_modules/markdown-it/lib/rules_inline/emphasis.mjs

@@ -80,18 +80,18 @@ function postProcess (state, delimiters) {
 
     const ch = String.fromCharCode(startDelim.marker)
 
-    const token_o   = state.tokens[startDelim.token]
-    token_o.type    = isStrong ? 'strong_open' : 'em_open'
-    token_o.tag     = isStrong ? 'strong' : 'em'
+    const token_o = state.tokens[startDelim.token]
+    token_o.type = isStrong ? 'strong_open' : 'em_open'
+    token_o.tag = isStrong ? 'strong' : 'em'
     token_o.nesting = 1
-    token_o.markup  = isStrong ? ch + ch : ch
+    token_o.markup = isStrong ? ch + ch : ch
     token_o.content = ''
 
-    const token_c   = state.tokens[endDelim.token]
-    token_c.type    = isStrong ? 'strong_close' : 'em_close'
-    token_c.tag     = isStrong ? 'strong' : 'em'
+    const token_c = state.tokens[endDelim.token]
+    token_c.type = isStrong ? 'strong_close' : 'em_close'
+    token_c.tag = isStrong ? 'strong' : 'em'
     token_c.nesting = -1
-    token_c.markup  = isStrong ? ch + ch : ch
+    token_c.markup = isStrong ? ch + ch : ch
     token_c.content = ''
 
     if (isStrong) {

package/node_modules/markdown-it/lib/rules_inline/entity.mjs

@@ -4,7 +4,7 @@ import { decodeHTMLStrict } from 'entities'
 import { isValidEntityCode, fromCodePoint } from '../common/utils.mjs'
 
 const DIGITAL_RE = /^&#((?:x[a-f0-9]{1,6}|[0-9]{1,7}));/i
-const NAMED_RE   = /^&([a-z][a-z0-9]{1,31});/i
+const NAMED_RE = /^&([a-z][a-z0-9]{1,31});/i
 
 export default function entity (state, silent) {
   const pos = state.pos
@@ -22,10 +22,10 @@ export default function entity (state, silent) {
       if (!silent) {
         const code = match[1][0].toLowerCase() === 'x' ? parseInt(match[1].slice(1), 16) : parseInt(match[1], 10)
 
-        const token   = state.push('text_special', '', 0)
+        const token = state.push('text_special', '', 0)
         token.content = isValidEntityCode(code) ? fromCodePoint(code) : fromCodePoint(0xFFFD)
-        token.markup  = match[0]
-        token.info    = 'entity'
+        token.markup = match[0]
+        token.info = 'entity'
       }
       state.pos += match[0].length
       return true
@@ -36,10 +36,10 @@ export default function entity (state, silent) {
       const decoded = decodeHTMLStrict(match[0])
       if (decoded !== match[0]) {
         if (!silent) {
-          const token   = state.push('text_special', '', 0)
+          const token = state.push('text_special', '', 0)
           token.content = decoded
-          token.markup  = match[0]
-          token.info    = 'entity'
+          token.markup = match[0]
+          token.info = 'entity'
         }
         state.pos += match[0].length
         return true

package/node_modules/markdown-it/lib/rules_inline/escape.mjs

@@ -38,6 +38,20 @@ export default function escape (state, silent) {
     return true
   }
 
+  // '\' before a space is a literal backslash. Don't consume the space, so a
+  // trailing two-space hard line break is still detected by the newline rule.
+  if (ch1 === 0x20) {
+    if (!silent) {
+      const token = state.push('text_special', '', 0)
+      token.content = '\\'
+      token.markup = '\\'
+      token.info = 'escape'
+    }
+
+    state.pos = pos
+    return true
+  }
+
   let escapedStr = state.src[pos]
 
   if (ch1 >= 0xD800 && ch1 <= 0xDBFF && pos + 1 < max) {
@@ -61,7 +75,7 @@ export default function escape (state, silent) {
     }
 
     token.markup = origStr
-    token.info   = 'escape'
+    token.info = 'escape'
   }
 
   state.pos = pos + 1

package/node_modules/markdown-it/lib/rules_inline/html_inline.mjs

@@ -42,7 +42,7 @@ export default function html_inline (state, silent) {
     const token = state.push('html_inline', '', 0)
     token.content = match[0]
 
-    if (isLinkOpen(token.content))  state.linkLevel++
+    if (isLinkOpen(token.content)) state.linkLevel++
     if (isLinkClose(token.content)) state.linkLevel--
   }
   state.pos += match[0].length

package/node_modules/markdown-it/lib/rules_inline/link.mjs

@@ -121,7 +121,7 @@ export default function link (state, silent) {
 
     const token_o = state.push('link_open', 'a', 1)
     const attrs = [['href', href]]
-    token_o.attrs  = attrs
+    token_o.attrs = attrs
     if (title) {
       attrs.push(['title', title])
     }

package/node_modules/markdown-it/lib/rules_inline/linkify.mjs

@@ -1,7 +1,17 @@
-// Process links like https://example.org/
+// Early process links like https://example.org/ to have priority
+// over emphasis, etc.
 
 // RFC3986: scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
-const SCHEME_RE = /(?:^|[^a-z0-9.+-])([a-z][a-z0-9.+-]*)$/i
+function isAsciiAlpha (code) {
+  return (code >= 0x41 && code <= 0x5A) || (code >= 0x61 && code <= 0x7A)
+}
+
+function isSchemeChar (code) {
+  return (code >= 0x41 && code <= 0x5A) ||
+    (code >= 0x61 && code <= 0x7A) ||
+    (code >= 0x30 && code <= 0x39) ||
+    code === 0x2B || code === 0x2D || code === 0x2E
+}
 
 export default function linkify (state, silent) {
   if (!state.md.options.linkify) return false
@@ -15,19 +25,27 @@ export default function linkify (state, silent) {
   if (state.src.charCodeAt(pos + 1) !== 0x2F/* / */) return false
   if (state.src.charCodeAt(pos + 2) !== 0x2F/* / */) return false
 
-  const match = state.pending.match(SCHEME_RE)
-  if (!match) return false
+  // Search backwards for the scheme, but no more than 10 characters, the length
+  // of the pending string, or the length of the source prefix.
+  // Use state.src instead of state.pending because it is faster to access.
+  const protoMin = pos - Math.min(10, state.pending.length, pos)
+  let protoStart = pos
+  while (protoStart > protoMin && isSchemeChar(state.src.charCodeAt(protoStart - 1))) {
+    protoStart--
+  }
+
+  if (protoStart === pos || !isAsciiAlpha(state.src.charCodeAt(protoStart))) return false
 
-  const proto = match[1]
+  const protoLength = pos - protoStart
 
-  const link = state.md.linkify.matchAtStart(state.src.slice(pos - proto.length))
+  const link = state.md.linkify.matchAtStart(state.src.slice(protoStart))
   if (!link) return false
 
   let url = link.url
 
   // invalid link, but still detected by linkify somehow;
   // need to check to prevent infinite loop below
-  if (url.length <= proto.length) return false
+  if (url.length <= protoLength) return false
 
   // disallow '*' at the end of the link (conflicts with emphasis)
   // do manual backsearch to avoid perf issues with regex /\*+$/ on "****...****a".
@@ -43,7 +61,7 @@ export default function linkify (state, silent) {
   if (!state.md.validateLink(fullUrl)) return false
 
   if (!silent) {
-    state.pending = state.pending.slice(0, -proto.length)
+    state.pending = state.pending.slice(0, -protoLength)
 
     const token_o = state.push('link_open', 'a', 1)
     token_o.attrs = [['href', fullUrl]]
@@ -58,6 +76,6 @@ export default function linkify (state, silent) {
     token_c.info = 'auto'
   }
 
-  state.pos += url.length - proto.length
+  state.pos += url.length - protoLength
   return true
 }

package/node_modules/markdown-it/lib/rules_inline/state_inline.mjs

@@ -142,8 +142,8 @@ StateInline.prototype.scanDelims = function (start, canSplitWord) {
   const right_flanking =
     !isLastWhiteSpace && (!isLastPunctChar || isNextWhiteSpace || isNextPunctChar)
 
-  const can_open  = left_flanking  && (canSplitWord || !right_flanking || isLastPunctChar)
-  const can_close = right_flanking && (canSplitWord || !left_flanking  || isNextPunctChar)
+  const can_open = left_flanking && (canSplitWord || !right_flanking || isLastPunctChar)
+  const can_close = right_flanking && (canSplitWord || !left_flanking || isNextPunctChar)
 
   return { can_open, can_close, length: count }
 }

package/node_modules/markdown-it/lib/rules_inline/strikethrough.mjs

@@ -20,13 +20,13 @@ function strikethrough_tokenize (state, silent) {
   let token
 
   if (len % 2) {
-    token         = state.push('text', '', 0)
+    token = state.push('text', '', 0)
     token.content = ch
     len--
   }
 
   for (let i = 0; i < len; i += 2) {
-    token         = state.push('text', '', 0)
+    token = state.push('text', '', 0)
     token.content = ch + ch
 
     state.delimiters.push({
@@ -62,18 +62,18 @@ function postProcess (state, delimiters) {
 
     const endDelim = delimiters[startDelim.end]
 
-    token         = state.tokens[startDelim.token]
-    token.type    = 's_open'
-    token.tag     = 's'
+    token = state.tokens[startDelim.token]
+    token.type = 's_open'
+    token.tag = 's'
     token.nesting = 1
-    token.markup  = '~~'
+    token.markup = '~~'
     token.content = ''
 
-    token         = state.tokens[endDelim.token]
-    token.type    = 's_close'
-    token.tag     = 's'
+    token = state.tokens[endDelim.token]
+    token.type = 's_close'
+    token.tag = 's'
     token.nesting = -1
-    token.markup  = '~~'
+    token.markup = '~~'
     token.content = ''
 
     if (state.tokens[endDelim.token - 1].type === 'text' &&

package/node_modules/markdown-it/lib/token.mjs

@@ -15,28 +15,28 @@ function Token (type, tag, nesting) {
    *
    * Type of the token (string, e.g. "paragraph_open")
    **/
-  this.type     = type
+  this.type = type
 
   /**
    * Token#tag -> String
    *
    * html tag name, e.g. "p"
    **/
-  this.tag      = tag
+  this.tag = tag
 
   /**
    * Token#attrs -> Array
    *
    * Html attributes. Format: `[ [ name1, value1 ], [ name2, value2 ] ]`
    **/
-  this.attrs    = null
+  this.attrs = null
 
   /**
    * Token#map -> Array
    *
    * Source map info. Format: `[ line_begin, line_end ]`
    **/
-  this.map      = null
+  this.map = null
 
   /**
    * Token#nesting -> Number
@@ -47,14 +47,14 @@ function Token (type, tag, nesting) {
    * -  `0` means the tag is self-closing
    * - `-1` means the tag is closing
    **/
-  this.nesting  = nesting
+  this.nesting = nesting
 
   /**
    * Token#level -> Number
    *
    * nesting level, the same as `state.level`
    **/
-  this.level    = 0
+  this.level = 0
 
   /**
    * Token#children -> Array
@@ -69,14 +69,14 @@ function Token (type, tag, nesting) {
    * In a case of self-closing tag (code, html, fence, etc.),
    * it has contents of this tag.
    **/
-  this.content  = ''
+  this.content = ''
 
   /**
    * Token#markup -> String
    *
    * '*' or '_' for emphasis, fence string for fence, etc.
    **/
-  this.markup   = ''
+  this.markup = ''
 
   /**
    * Token#info -> String
@@ -87,14 +87,14 @@ function Token (type, tag, nesting) {
    * - The value "auto" for autolink "link_open" and "link_close" tokens
    * - The string value of the item marker for ordered-list "list_item_open" tokens
    **/
-  this.info     = ''
+  this.info = ''
 
   /**
    * Token#meta -> Object
    *
    * A place for plugins to store an arbitrary data
    **/
-  this.meta     = null
+  this.meta = null
 
   /**
    * Token#block -> Boolean
@@ -102,7 +102,7 @@ function Token (type, tag, nesting) {
    * True for block-level tokens, false for inline tokens.
    * Used in renderer to calculate line breaks
    **/
-  this.block    = false
+  this.block = false
 
   /**
    * Token#hidden -> Boolean
@@ -110,7 +110,7 @@ function Token (type, tag, nesting) {
    * If it's true, ignore this element when rendering. Used for tight lists
    * to hide paragraphs.
    **/
-  this.hidden   = false
+  this.hidden = false
 }
 
 /**

package/node_modules/markdown-it/package.json

@@ -1,6 +1,6 @@
 {
   "name": "markdown-it",
-  "version": "14.2.0",
+  "version": "14.3.2",
   "description": "Markdown-it - modern pluggable markdown parser.",
   "keywords": [
     "markdown",
@@ -38,49 +38,47 @@
   },
   "scripts": {
     "lint": "eslint .",
-    "test": "npm run lint && cross-env CJS_ONLY=1 npm run build && c8 --exclude dist --exclude test -r text -r html -r lcov mocha && node support/specsplit.mjs",
+    "test": "npm run lint && npm run test:cmspec && npm run test:markdown-it && npm run test:build",
+    "test:cmspec": "node --test --test-reporter=dot test/cmspec/**/*.test.mjs",
+    "test:markdown-it": "node --test test/markdown-it/**/*.test.mjs",
+    "test:build": "npm run build && node --test test/build/**/*.test.mjs",
+    "pathological:track-ref": "node support/track-ref-pathological.mjs",
+    "pathological:update-hash": "node support/track-ref-pathological.mjs --update",
+    "coverage": "npm run build && c8 --include 'lib/**' -r text -r html -r lcov node --test --test-reporter=dot",
     "doc": "node support/build_doc.mjs",
     "gh-doc": "npm run doc && gh-pages -d apidoc -f",
     "demo": "npm run lint && node support/build_demo.mjs",
     "gh-demo": "npm run demo && gh-pages -d demo -f -b master -r git@github.com:markdown-it/markdown-it.github.io.git",
-    "build": "rollup -c support/rollup.config.mjs",
-    "benchmark-deps": "npm install --prefix benchmark/extra/ -g marked@0.3.6 commonmark@0.26.0 markdown-it/markdown-it.git#2.2.1",
+    "build": "node support/build-dist.mjs",
+    "benchmark-deps": "npm install --prefix benchmark/extra/",
     "specsplit": "support/specsplit.mjs good -o test/fixtures/commonmark/good.txt && support/specsplit.mjs bad -o test/fixtures/commonmark/bad.txt && support/specsplit.mjs",
     "todo": "grep 'TODO' -n -r ./lib 2>/dev/null",
-    "prepublishOnly": "npm test && npm run build && npm run gh-demo && npm run gh-doc"
+    "prepack": "npm test && npm run build"
   },
   "files": [
     "index.mjs",
     "lib/",
     "dist/"
   ],
+  "publishConfig": {
+    "tag": "v14-legacy"
+  },
   "dependencies": {
     "argparse": "^2.0.1",
-    "entities": "^4.4.0",
-    "linkify-it": "^5.0.1",
+    "entities": "^4.5.0",
+    "linkify-it": "^5.0.2",
     "mdurl": "^2.0.0",
     "punycode.js": "^2.3.1",
     "uc.micro": "^2.1.0"
   },
   "devDependencies": {
-    "@rollup/plugin-babel": "^6.0.4",
-    "@rollup/plugin-commonjs": "^25.0.7",
-    "@rollup/plugin-node-resolve": "^15.2.3",
-    "@rollup/plugin-terser": "^0.4.4",
-    "ansi": "^0.3.0",
-    "benchmark": "~2.1.0",
-    "c8": "^8.0.1",
-    "chai": "^4.2.0",
-    "cross-env": "^7.0.3",
-    "eslint": "^8.4.1",
-    "eslint-config-standard": "^17.1.0",
-    "express": "^4.14.0",
-    "gh-pages": "^6.1.0",
-    "highlight.js": "^11.9.0",
-    "jest-worker": "^29.7.0",
+    "c8": "^11.0.0",
+    "eslint": "^9.39.4",
+    "gh-pages": "^6.3.0",
+    "highlight.js": "^11.11.1",
     "markdown-it-abbr": "^2.0.0",
     "markdown-it-container": "^4.0.0",
-    "markdown-it-deflist": "^3.0.0",
+    "markdown-it-deflist": "^3.0.1",
     "markdown-it-emoji": "^3.0.0",
     "markdown-it-footnote": "^4.0.0",
     "markdown-it-for-inline": "^2.0.1",
@@ -88,16 +86,11 @@
     "markdown-it-mark": "^4.0.0",
     "markdown-it-sub": "^2.0.0",
     "markdown-it-sup": "^2.0.0",
-    "markdown-it-testgen": "^0.1.3",
-    "mocha": "^10.2.0",
-    "ndoc": "^6.0.0",
-    "needle": "^3.0.0",
-    "rollup": "^4.5.0",
-    "shelljs": "^0.8.4",
-    "supertest": "^6.0.1"
-  },
-  "mocha": {
-    "inline-diffs": true,
-    "timeout": 60000
+    "ndoc": "^6.0.1",
+    "neostandard": "^0.13.0",
+    "terser": "^5.48.0",
+    "tinybench": "^6.0.2",
+    "vite": "^8.1.2",
+    "vite-plugin-singlefile": "^2.3.3"
   }
 }