@zowe/db2-for-zowe-cli 6.1.17 → 6.1.19

package/README.md

@@ -25,19 +25,21 @@ Before you install and use the plug-in:
 
 -   [Install Zowe CLI](https://docs.zowe.org/stable/user-guide/cli-installcli.html) on your computer.
 
+-   Use Node.js 22 or newer. CI covers Node.js 22, 24, and 26.
+
 -   Have a license file for IBM Db2 Database for z/OS.
 
     For connectivity to Db2 for z/OS, the Db2 region should be `db2connectactivated` or a `db2connect` license file should be provided. Copy the `db2connect` license file to the `[db2 plugin folder]/node_modules/ibm_db/installer/clidriver/license/` folder. For more information, see [Addressing the license requirement](https://docs.zowe.org/stable/user-guide/cli-db2plugin.html#addressing-the-license-requirement) on the Zowe Docs site. 
 
-- **(Linux and MacOS only)** Download and install [node-gyp](https://www.npmjs.com/package/node-gyp) globally by running `npm install -g node-gyp`
+- **(Linux and MacOS source builds only)** Download and install [node-gyp](https://www.npmjs.com/package/node-gyp) globally by running `npm install -g node-gyp`
 
-- **(MacOS only)** Download and Install [Xcode](https://developer.apple.com/xcode/resources/) and [Python 3](https://www.python.org/downloads/mac-osx/).
+- **(MacOS source builds only)** Download and Install [Xcode](https://developer.apple.com/xcode/resources/) and [Python 3](https://www.python.org/downloads/mac-osx/).
 
-- **(Linux only - Debian, Ubuntu)** Download and Install the following via apt: `python3 make g++`
+- **(Linux source builds only - Debian, Ubuntu)** Download and Install the following via apt: `python3 make g++`
 
-- **(Linux only - CentOS, RHEL)** Download and Install the following via yum: `python3 make gcc-c++`
+- **(Linux source builds only - CentOS, RHEL)** Download and Install the following via yum: `python3 make gcc-c++`
 
-- Note: Reinstallation is required when Node is upgraded to a new major version. When installed, the plug-in builds a native binary that is needed to interact with Db2. If a new major version of Node is installed, you must uninstall and reinstall the IBM Db2 Database Plug-in to update the binary. 
+- The plug-in bundles `ibm_db` 4, which uses [Node-API](https://github.com/ibmdb/node-ibm_db/tree/v4.0.1#prerequisite) instead of NAN. Its native binding does not need to be rebuilt solely because you upgrade to a newer compatible Node.js version on the same operating system and architecture. The native binding and IBM Db2 ODBC CLI driver must still be installed; see [The `ibm_db` module is not installed](#the-ibm_db-module-is-not-installed) if installation is incomplete. Precompiled bindings are available for supported Windows, Linux, and MacOS platforms when source compilation is unavailable.
 
 ## Installing
 
@@ -171,9 +173,9 @@ IBM® Db2® Plug-in for Zowe CLI was installed, but its required 'ibm_db' module
 Db2 commands will fail until the installation of 'ibm_db' is completed.
 ```
 
-The plug-in itself is installed and registered with Zowe CLI when this failure occurs. Only the `ibm_db` module is incomplete, so you do not need to reinstall the plug-in.
+The IBM Db2 Plug-in for Zowe CLI is installed and registered with Zowe CLI when this failure occurs. Only the `ibm_db` module is incomplete, so you do not need to reinstall the plug-in.
 
-**Cause**: The plug-in delivers `ibm_db` as a bundled dependency, so that the plug-in can be installed without access to a public npm registry. However, `ibm_db` is a native module. Its own npm install script must download the IBM Db2 ODBC CLI driver and build the binding for your platform. npm does not run the lifecycle scripts of a bundled dependency, so that install script does not run when the plug-in is installed. The `--allow-scripts` option of `zowe plugins install` does not change that behavior, because npm skips the scripts of bundled dependencies even when scripts are allowed.
+**Cause**: The plug-in delivers `ibm_db` as a bundled dependency, so that the plug-in can be installed without access to a public npm registry. However, `ibm_db` is a native module. Its own npm install script must download the IBM Db2 ODBC CLI driver and install the binding for your platform, either by compiling it or using a precompiled binary. npm does not run the lifecycle scripts of a bundled dependency, so that install script does not run when the plug-in is installed. The `--allow-scripts` option of the `zowe plugins install` command does not change that behavior, because npm skips the scripts of bundled dependencies even when scripts are allowed.
 
 **Action**: Run the `ibm_db` install script yourself. The error message contains the full path to the `ibm_db` directory on your system, which is normally the following path:
 
@@ -181,7 +183,7 @@ The plug-in itself is installed and registered with Zowe CLI when this failure o
 <zowe home>/plugins/installed/node_modules/@zowe/db2-for-zowe-cli/node_modules/ibm_db
 ```
 
-Change to that directory and run its install script:
+Change to that directory and run the `ibm_db` install script:
 
 ```bash
 cd "<zowe home>/plugins/installed/node_modules/@zowe/db2-for-zowe-cli/node_modules/ibm_db"
@@ -192,14 +194,14 @@ If npm is not available, run the same script directly with `node installer/drive
 
 The script downloads the CLI driver from `https://public.dhe.ibm.com`, so the system needs network access to that site. If the system already has a Db2 client, a Db2 server, or a copy of the CLI driver, set the `IBM_DB_HOME` environment variable to that directory before you run the script to skip the download. For more `ibm_db` installation options, see the `README.md` file in the `ibm_db` directory.
 
-### Node.js version incompatible with plug-in
+### Native binary from an older plug-in installation
 
 **Error message**:
 ```
 The module 'C:\Users\User\.zowe\plugins\installed\node_modules\@zowe\db2-for-zowe-cli\node_modules\ibm_db\build\Release\odbc_bindings.node' was compiled against a different Node.js version using NODE_MODULE_VERSION ###. This version of Node.js requires NODE_MODULE_VERSION ###. Please try re-compiling or re-installing this module (for instance, using npm rebuild or npm install).
 ```
 
-**Action**: Uninstall and reinstall the IBM Db2 Database Plug-in for Zowe CLI. The Node version installed on the system has changed since the IBM Db2 Database Plug-in for Zowe CLI was installed on the system, and the native binary is no longer compatible.
+**Action**: Upgrade or reinstall the IBM Db2 Database Plug-in for Zowe CLI to replace the old native binary with the bundled `ibm_db` 4 binding. This error can occur with an older `ibm_db` 3 binding compiled for a different Node.js major version. `ibm_db` 4 uses Node-API, so changing between compatible Node.js versions on the same operating system and architecture does not require rebuilding the binding. If the updated module cannot be loaded, follow [The `ibm_db` module is not installed](#the-ibm_db-module-is-not-installed).
 
 ## Contributing
 

package/lib/Db2PluginLifeCycle.d.ts

@@ -20,14 +20,6 @@ declare class Db2PluginLifeCycle extends AbstractPluginLifeCycle {
      * @memberof Db2PluginLifeCycle
      */
     static readonly NATIVE_MODULE_NM: string;
-    /**
-     * A horizontal rule used to make the reported steps stand out among the
-     * other messages that are displayed while a plug-in is installed.
-     * @type {string}
-     * @static
-     * @memberof Db2PluginLifeCycle
-     */
-    private static readonly DIVIDER;
     /**
      * Confirm that the bundled native module can be loaded after the plug-in
      * has been installed. When it cannot be loaded, report the steps that the
@@ -51,7 +43,7 @@ declare class Db2PluginLifeCycle extends AbstractPluginLifeCycle {
      *
      * @private
      * @static
-     * @throws When the native module has not been completely installed.
+     * @throws If the native module is missing or installation is incomplete.
      * @memberof Db2PluginLifeCycle
      */
     private static loadNativeModule;
@@ -76,5 +68,15 @@ declare class Db2PluginLifeCycle extends AbstractPluginLifeCycle {
      * @memberof Db2PluginLifeCycle
      */
     private static findNativeModuleDir;
+    /**
+     * A horizontal rule used to make the reported steps stand out among the
+     * other messages that are displayed while a plug-in is installed.
+     *
+     * @private
+     * @static
+     * @returns {string}
+     * @memberof Db2PluginLifeCycle
+     */
+    private static get dividerLine();
 }
 export = Db2PluginLifeCycle;

package/lib/Db2PluginLifeCycle.js

@@ -37,7 +37,6 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
      * @memberof Db2PluginLifeCycle
      */
     postInstall() {
-        var _a;
         const impLogger = imperative_1.Logger.getImperativeLogger();
         try {
             Db2PluginLifeCycle.loadNativeModule();
@@ -45,7 +44,7 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
                 `after the installation of ${Constants_1.Constants.DISPLAY_NAME}.`);
         }
         catch (err) {
-            const warningMsg = Db2PluginLifeCycle.formIncompleteInstallMsg((_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err);
+            const warningMsg = Db2PluginLifeCycle.formIncompleteInstallMsg(err instanceof Error ? err.message : String(err));
             impLogger.warn(warningMsg);
             throw new imperative_1.ImperativeError({ msg: warningMsg });
         }
@@ -64,7 +63,7 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
      *
      * @private
      * @static
-     * @throws When the native module has not been completely installed.
+     * @throws If the native module is missing or installation is incomplete.
      * @memberof Db2PluginLifeCycle
      */
     static loadNativeModule() {
@@ -83,7 +82,7 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
     static formIncompleteInstallMsg(reason) {
         const nativeMod = Db2PluginLifeCycle.NATIVE_MODULE_NM;
         const nativeModDir = Db2PluginLifeCycle.findNativeModuleDir();
-        return `\n${Db2PluginLifeCycle.DIVIDER}\n` +
+        return `\n${Db2PluginLifeCycle.dividerLine}\n` +
             `${Constants_1.Constants.DISPLAY_NAME} was installed, but its required '${nativeMod}' module could not be loaded.\n` +
             `Db2 commands will fail until the installation of '${nativeMod}' is completed.\n` +
             `\n` +
@@ -110,7 +109,7 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
             `skip the download.\n` +
             `\n` +
             `See ${path.join(nativeModDir, "README.md")} for more '${nativeMod}' installation options.\n` +
-            `${Db2PluginLifeCycle.DIVIDER}\n`;
+            `${Db2PluginLifeCycle.dividerLine}\n`;
     }
     /**
      * Find the directory into which the native module was installed, so that
@@ -134,6 +133,20 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
             return path.resolve(__dirname, "..", "node_modules", nativeMod);
         }
     }
+    /**
+     * A horizontal rule used to make the reported steps stand out among the
+     * other messages that are displayed while a plug-in is installed.
+     *
+     * @private
+     * @static
+     * @returns {string}
+     * @memberof Db2PluginLifeCycle
+     */
+    static get dividerLine() {
+        var _a;
+        const defaultWidth = 100;
+        return "_".repeat(Math.min(((_a = process.stdout) === null || _a === void 0 ? void 0 : _a.columns) || Infinity, defaultWidth));
+    }
 }
 /**
  * The name of the native module that Db2 commands require.
@@ -142,13 +155,5 @@ class Db2PluginLifeCycle extends imperative_1.AbstractPluginLifeCycle {
  * @memberof Db2PluginLifeCycle
  */
 Db2PluginLifeCycle.NATIVE_MODULE_NM = "ibm_db";
-/**
- * A horizontal rule used to make the reported steps stand out among the
- * other messages that are displayed while a plug-in is installed.
- * @type {string}
- * @static
- * @memberof Db2PluginLifeCycle
- */
-Db2PluginLifeCycle.DIVIDER = "____________________________________________________________________________________________________";
 module.exports = Db2PluginLifeCycle;
 //# sourceMappingURL=Db2PluginLifeCycle.js.map

package/lib/Db2PluginLifeCycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"Db2PluginLifeCycle.js","sourceRoot":"","sources":["../src/Db2PluginLifeCycle.ts"],"names":[],"mappings":";AAAA;;;;;;;;;EASE;AAEF,6BAA6B;AAC7B,iDAAoF;AACpF,2CAAwC;AAExC;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAmB,SAAQ,oCAAuB;IAmBpD;;;;;;;;;OASG;IACI,WAAW;;QACd,MAAM,SAAS,GAAG,mBAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACD,kBAAkB,CAAC,gBAAgB,EAAE,CAAC;YACtC,SAAS,CAAC,KAAK,CAAC,QAAQ,kBAAkB,CAAC,gBAAgB,mCAAmC;gBAC1F,6BAA6B,qBAAS,CAAC,YAAY,GAAG,CACzD,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,OAAO,mCAAI,GAAG,CAAC,CAAC;YACpF,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3B,MAAM,IAAI,4BAAe,CAAC,EAAC,GAAG,EAAE,UAAU,EAAC,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,YAAY;QACf,gBAAgB;IACpB,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,gBAAgB;QAC3B,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;OASG;IACK,MAAM,CAAC,wBAAwB,CAAC,MAAc;QAClD,MAAM,SAAS,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;QACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,mBAAmB,EAAE,CAAC;QAE9D,OAAO,KAAK,kBAAkB,CAAC,OAAO,IAAI;YACtC,GAAG,qBAAS,CAAC,YAAY,qCAAqC,SAAS,iCAAiC;YACxG,qDAAqD,SAAS,mBAAmB;YACjF,IAAI;YACJ,YAAY,MAAM,IAAI;YACtB,IAAI;YACJ,yBAAyB,SAAS,mEAAmE;YACrG,sDAAsD,SAAS,6CAA6C;YAC5G,sGAAsG;YACtG,qGAAqG;YACrG,oGAAoG;YACpG,gFAAgF;YAChF,IAAI;YACJ,iEAAiE;YACjE,IAAI;YACJ,WAAW,YAAY,KAAK;YAC5B,uBAAuB;YACvB,IAAI;YACJ,oEAAoE,SAAS,6BAA6B;YAC1G,sCAAsC;YACtC,IAAI;YACJ,oGAAoG;YACpG,oGAAoG;YACpG,mGAAmG;YACnG,sBAAsB;YACtB,IAAI;YACJ,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,SAAS,2BAA2B;YAC7F,GAAG,kBAAkB,CAAC,OAAO,IAAI,CAAC;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,mBAAmB;QAC9B,MAAM,SAAS,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;QACtD,IAAI,CAAC;YACD;;eAEG;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,eAAe,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,wEAAwE;YACxE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;;AAhID;;;;;GAKG;AACoB,mCAAgB,GAAW,QAAQ,CAAC;AAE3D;;;;;;GAMG;AACqB,0BAAO,GAC3B,sGAAsG,CAAC;AAmH/G,iBAAS,kBAAkB,CAAC"}
+{"version":3,"file":"Db2PluginLifeCycle.js","sourceRoot":"","sources":["../src/Db2PluginLifeCycle.ts"],"names":[],"mappings":";AAAA;;;;;;;;;EASE;AAEF,6BAA6B;AAC7B,iDAAoF;AACpF,2CAAwC;AAExC;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAmB,SAAQ,oCAAuB;IASpD;;;;;;;;;OASG;IACI,WAAW;QACd,MAAM,SAAS,GAAG,mBAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/C,IAAI,CAAC;YACD,kBAAkB,CAAC,gBAAgB,EAAE,CAAC;YACtC,SAAS,CAAC,KAAK,CAAC,QAAQ,kBAAkB,CAAC,gBAAgB,mCAAmC;gBAC1F,6BAA6B,qBAAS,CAAC,YAAY,GAAG,CACzD,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACjH,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3B,MAAM,IAAI,4BAAe,CAAC,EAAC,GAAG,EAAE,UAAU,EAAC,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,YAAY;QACf,gBAAgB;IACpB,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,gBAAgB;QAC3B,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;OASG;IACK,MAAM,CAAC,wBAAwB,CAAC,MAAc;QAClD,MAAM,SAAS,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;QACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,mBAAmB,EAAE,CAAC;QAE9D,OAAO,KAAK,kBAAkB,CAAC,WAAW,IAAI;YAC1C,GAAG,qBAAS,CAAC,YAAY,qCAAqC,SAAS,iCAAiC;YACxG,qDAAqD,SAAS,mBAAmB;YACjF,IAAI;YACJ,YAAY,MAAM,IAAI;YACtB,IAAI;YACJ,yBAAyB,SAAS,mEAAmE;YACrG,sDAAsD,SAAS,6CAA6C;YAC5G,sGAAsG;YACtG,qGAAqG;YACrG,oGAAoG;YACpG,gFAAgF;YAChF,IAAI;YACJ,iEAAiE;YACjE,IAAI;YACJ,WAAW,YAAY,KAAK;YAC5B,uBAAuB;YACvB,IAAI;YACJ,oEAAoE,SAAS,6BAA6B;YAC1G,sCAAsC;YACtC,IAAI;YACJ,oGAAoG;YACpG,oGAAoG;YACpG,mGAAmG;YACnG,sBAAsB;YACtB,IAAI;YACJ,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,SAAS,2BAA2B;YAC7F,GAAG,kBAAkB,CAAC,WAAW,IAAI,CAAC;IAC9C,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,mBAAmB;QAC9B,MAAM,SAAS,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;QACtD,IAAI,CAAC;YACD;;eAEG;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,eAAe,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,wEAAwE;YACxE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,KAAK,WAAW;;QAC1B,MAAM,YAAY,GAAG,GAAG,CAAC;QACzB,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,OAAO,KAAI,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IACnF,CAAC;;AApID;;;;;GAKG;AACoB,mCAAgB,GAAW,QAAQ,CAAC;AAiI/D,iBAAS,kBAAkB,CAAC"}

package/node_modules/adm-zip/adm-zip.js

@@ -498,7 +498,11 @@ module.exports = function (/**String*/ input, /** object */ options) {
         addLocalFolderAsync2: function (options, callback) {
             const self = this;
             options = typeof options === "object" ? options : { localPath: options };
-            const localPath = pth.resolve(fixPath(options.localPath));
+            // Resolve the local filesystem path with the platform resolver. Do NOT
+            // run it through fixPath: that normalizes ZIP-internal paths to POSIX
+            // and prepends "/", which turns a Windows path like C:\dir into
+            // \C:\dir, so readdir finds nothing and the archive comes out empty.
+            const localPath = pth.resolve(options.localPath);
             let { zipPath, filter, namefix } = options;
 
             if (filter instanceof RegExp) {
@@ -533,14 +537,21 @@ module.exports = function (/**String*/ input, /** object */ options) {
 
             filetools.fs.open(localPath, "r", function (err) {
                 if (err && err.code === "ENOENT") {
-                    callback(undefined, Utils.Errors.FILE_NOT_FOUND(localPath));
+                    // callback is (err, done); errors belong in the first argument,
+                    // otherwise addLocalFolderPromise treats the error as "done" and
+                    // resolves instead of rejecting.
+                    callback(Utils.Errors.FILE_NOT_FOUND(localPath), false);
                 } else if (err) {
-                    callback(undefined, err);
+                    callback(err, false);
                 } else {
                     filetools.findFilesAsync(localPath, function (err, fileEntries) {
-                        if (err) return callback(err);
+                        if (err) return callback(err, false);
                         fileEntries = fileEntries.filter((dir) => filter(relPathFix(dir)));
-                        if (!fileEntries.length) callback(undefined, false);
+                        // Nothing to add (empty folder or everything filtered out) is a
+                        // success, not an error. Report done and stop, otherwise the
+                        // reduce below runs and the callback fires a second time -- and
+                        // signalling done=false left addLocalFolderPromise hanging.
+                        if (!fileEntries.length) return callback(undefined, true);
 
                         setImmediate(
                             fileEntries.reverse().reduce(function (next, entry) {
@@ -575,7 +586,7 @@ module.exports = function (/**String*/ input, /** object */ options) {
         addLocalFolderPromise: function (localPath, props) {
             return new Promise((resolve, reject) => {
                 this.addLocalFolderAsync2(Object.assign({ localPath }, props), (err, done) => {
-                    if (err) reject(err);
+                    if (err) return reject(err);
                     if (done) resolve(this);
                 });
             });
@@ -709,6 +720,8 @@ module.exports = function (/**String*/ input, /** object */ options) {
                     // collapsed subdirectories together (issue #306).
                     var name = canonical(maintainEntryPath ? child.entryName : child.entryName.substring(item.entryName.length));
                     var childName = sanitize(targetPath, name);
+                    // reject writing through a pre-existing symlink inside the target
+                    filetools.assertPathSafe(targetPath, childName);
                     // The reverse operation for attr depend on method addFile()
                     const fileAttr = keepOriginalPermission ? child.header.fileAttr : undefined;
                     filetools.writeFileTo(childName, content, overwrite, fileAttr);
@@ -719,6 +732,9 @@ module.exports = function (/**String*/ input, /** object */ options) {
             var content = item.getData(_zip.password);
             if (!content) throw Utils.Errors.CANT_EXTRACT_FILE();
 
+            // reject writing through a pre-existing symlink inside the target
+            filetools.assertPathSafe(targetPath, target);
+
             if (filetools.fs.existsSync(target) && !overwrite) {
                 throw Utils.Errors.CANT_OVERRIDE();
             }
@@ -775,6 +791,8 @@ module.exports = function (/**String*/ input, /** object */ options) {
             const dirEntries = [];
             _zip.entries.forEach(function (entry) {
                 var entryName = sanitize(targetPath, canonical(entry.entryName));
+                // reject writing through a pre-existing symlink inside the target
+                filetools.assertPathSafe(targetPath, entryName);
                 if (entry.isDirectory) {
                     filetools.makeDir(entryName);
                     // defer restoring the directory permission until its files are written
@@ -854,6 +872,8 @@ module.exports = function (/**String*/ input, /** object */ options) {
                 // The reverse operation for attr depend on method addFile()
                 const dirAttr = keepOriginalPermission ? entry.header.fileAttr : undefined;
                 try {
+                    // reject writing through a pre-existing symlink inside the target
+                    filetools.assertPathSafe(targetPath, dirPath);
                     filetools.makeDir(dirPath);
                 } catch (er) {
                     callback(getError("Unable to create folder", dirPath));
@@ -890,6 +910,12 @@ module.exports = function (/**String*/ input, /** object */ options) {
                     } else {
                         const entryName = pth.normalize(canonical(entry.entryName));
                         const filePath = sanitize(targetPath, entryName);
+                        try {
+                            // reject writing through a pre-existing symlink inside the target
+                            filetools.assertPathSafe(targetPath, filePath);
+                        } catch (er) {
+                            return next(er);
+                        }
                         entry.getDataAsync(function (content, err_1) {
                             if (err_1) {
                                 next(err_1);

package/node_modules/adm-zip/headers/entryHeader.js

@@ -185,7 +185,12 @@ module.exports = function () {
 
         // get Unix file permissions
         get fileAttr() {
-            return (_attr || 0) >> 16 & 0xfff;
+            // Mask to the 9 rwxrwxrwx bits only. The setuid (0o4000), setgid
+            // (0o2000) and sticky (0o1000) bits are attacker-controlled archive
+            // metadata; preserving them on extraction (keepOriginalPermission)
+            // lets a crafted zip plant a setuid-root binary when extracting as
+            // root, a local privilege escalation (GHSA-679w-jf3m-wh39).
+            return ((_attr || 0) >> 16) & 0o777;
         },
 
         get offset() {
@@ -212,6 +217,13 @@ module.exports = function () {
         },
 
         loadLocalHeaderFromBinary: function (/*Buffer*/ input) {
+            // The LOC offset comes from the central directory and is attacker
+            // controlled. Reject one that would read past the end of the buffer,
+            // otherwise readUInt32LE below throws a raw RangeError instead of a
+            // clean INVALID_LOC (and escapes the async error path).
+            if (_offset < 0 || _offset + Constants.LOCHDR > input.length) {
+                throw Utils.Errors.INVALID_LOC();
+            }
             var data = input.slice(_offset, _offset + Constants.LOCHDR);
             // 30 bytes and should start with "PK\003\004"
             if (data.readUInt32LE(0) !== Constants.LOCSIG) {

package/node_modules/adm-zip/methods/inflater.js

@@ -1,8 +1,15 @@
 const version = +(process?.versions?.node ?? "").split(".")[0] || 0;
+const Errors = require("../util/errors");
 
 module.exports = function (/*Buffer*/ inbuf, /*number*/ expectedLength) {
     var zlib = require("zlib");
-    const option = version >= 15 && expectedLength > 0 ? { maxOutputLength: expectedLength } : {};
+    // Cap decompression output at the entry's declared uncompressed size to bound
+    // decompression bombs (CVE-2026-39244). A declared size of 0 must not disable
+    // the cap: a genuinely empty entry inflates to 0 bytes, so a 1-byte floor
+    // still lets it through while stopping a bomb that lies about its size
+    // (GHSA-rcw4-f5rp-g42v). zlib requires maxOutputLength >= 1.
+    const maxOutputLength = expectedLength > 0 ? expectedLength : 1;
+    const option = version >= 15 ? { maxOutputLength } : {};
 
     return {
         inflate: function () {
@@ -12,12 +19,35 @@ module.exports = function (/*Buffer*/ inbuf, /*number*/ expectedLength) {
         inflateAsync: function (/*Function*/ callback) {
             var tmp = zlib.createInflateRaw(option),
                 parts = [],
-                total = 0;
+                total = 0,
+                done = false;
+            const fail = function (err) {
+                if (done) return;
+                done = true;
+                tmp.destroy();
+                callback && callback(Buffer.alloc(0), err);
+            };
+            // Route stream errors (e.g. Z_DATA_ERROR on malformed input) through the
+            // callback. Without an "error" listener zlib re-throws the event as an
+            // uncaught exception on a later tick, crashing the host process instead
+            // of failing the call (GHSA-8238-w5pm-2374).
+            tmp.on("error", function (err) {
+                fail(err);
+            });
             tmp.on("data", function (data) {
-                parts.push(data);
+                if (done) return;
                 total += data.length;
+                // The streaming API ignores maxOutputLength, so enforce the cap by
+                // hand; otherwise the async path decompresses without limit while the
+                // sync path is capped (GHSA-v429-h5qx-84wm, GHSA-c6fg-446q-cg94).
+                if (total > maxOutputLength) {
+                    return fail(Errors.MAX_OUTPUT_EXCEEDED());
+                }
+                parts.push(data);
             });
             tmp.on("end", function () {
+                if (done) return;
+                done = true;
                 var buf = Buffer.alloc(total),
                     written = 0;
                 buf.fill(0);

package/node_modules/adm-zip/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adm-zip",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Javascript implementation of zip for nodejs with support for electron original-fs. Allows user to create or extract zip files both in memory or to/from disk",
   "scripts": {
     "test": "mocha -R spec",
@@ -49,7 +49,7 @@
   "devDependencies": {
     "chai": "^6.2.2",
     "iconv-lite": "^0.7.2",
-    "mocha": "12.0.0-beta-10",
+    "mocha": "^12.0.0",
     "prettier": "^3.8.1",
     "rimraf": "^3.0.2"
   }

package/node_modules/adm-zip/util/errors.js

@@ -12,6 +12,7 @@ const errors = {
     /* ZipEntry error messages*/
     NO_DATA: "Nothing to decompress",
     BAD_CRC: "CRC32 checksum failed {0}",
+    MAX_OUTPUT_EXCEEDED: "Decompressed data exceeds the declared uncompressed size",
     FILE_IN_THE_WAY: "There is a file in the way: {0}",
     UNKNOWN_METHOD: "Invalid/unsupported compression method",
 
@@ -33,11 +34,13 @@ const errors = {
     DISK_ENTRY_TOO_LARGE: "Number of disk entries is too large",
     NO_ZIP: "No zip file was loaded",
     NO_ENTRY: "Entry doesn't exist",
+    DUPLICATE_ENTRY: "Duplicate entry name {0}",
     DIRECTORY_CONTENT_ERROR: "A directory cannot have content",
     FILE_NOT_FOUND: 'File not found: "{0}"',
     NOT_IMPLEMENTED: "Not implemented",
     INVALID_FILENAME: "Invalid filename",
     INVALID_FORMAT: "Invalid or unsupported zip format. No END header found",
+    ZIP64_VALUE_TOO_LARGE: "Zip64 value exceeds the maximum safe integer",
     INVALID_PASS_PARAM: "Incompatible password parameter",
     WRONG_PASSWORD: "Wrong Password",
 

package/node_modules/adm-zip/util/utils.js

@@ -159,8 +159,59 @@ Utils.prototype.writeFileToAsync = function (/*String*/ path, /*Buffer*/ content
     });
 };
 
+// Guard extraction against writing through a symlink that already exists inside
+// the target directory. sanitize() only proves the textual path stays under the
+// root; it cannot see that a component on disk is a symlink pointing elsewhere,
+// so open()/mkdir() would follow it and write outside the root. Walk every path
+// component strictly below root and reject any that is a symlink. Components at
+// or above root are the caller's own choice and are left untouched, so a root
+// that itself lives under a symlink (e.g. /tmp on macOS) still extracts.
+Utils.prototype.assertPathSafe = function (/*String*/ root, /*String*/ target) {
+    const self = this;
+    if (typeof self.fs.lstatSync !== "function") return;
+
+    const resolvedRoot = pth.resolve(root);
+    const resolvedTarget = pth.resolve(target);
+    if (resolvedTarget === resolvedRoot) return;
+
+    const rel = pth.relative(resolvedRoot, resolvedTarget);
+    // Not under root: sanitize() is responsible for that case; nothing to walk.
+    if (!rel || rel === ".." || rel.startsWith(".." + pth.sep) || pth.isAbsolute(rel)) return;
+
+    let cur = resolvedRoot;
+    for (const part of rel.split(pth.sep)) {
+        if (!part || part === ".") continue;
+        cur = pth.join(cur, part);
+        let stat;
+        try {
+            stat = self.fs.lstatSync(cur);
+        } catch (e) {
+            break; // component does not exist yet: nothing below it can be a symlink
+        }
+        if (stat.isSymbolicLink()) throw Errors.FILE_IN_THE_WAY(`"${cur}"`);
+    }
+};
+
 Utils.prototype.findFiles = function (/*String*/ path) {
     const self = this;
+    const canLstat = typeof self.fs.lstatSync === "function";
+    const rootReal = self.fs.realpathSync(path);
+
+    // A symlink whose target lies outside the folder being archived must not be
+    // followed: statSync would dereference it and copy the target's contents into
+    // the archive, disclosing files outside the root (GHSA-wx42-xcp7-pgr4). Allow
+    // symlinks that resolve to a location inside the root, reject any that escape.
+    function escapesRoot(/*String*/ p) {
+        if (!canLstat) return false;
+        if (!self.fs.lstatSync(p).isSymbolicLink()) return false;
+        let real;
+        try {
+            real = self.fs.realpathSync(p);
+        } catch (e) {
+            return true; // dangling or unresolvable symlink: do not follow
+        }
+        return !(real === rootReal || real.startsWith(rootReal + pth.sep));
+    }
 
     function findSync(/*String*/ dir, /*RegExp*/ pattern, /*Boolean*/ recursive, /*Set*/ visited) {
         if (typeof pattern === "boolean") {
@@ -170,6 +221,9 @@ Utils.prototype.findFiles = function (/*String*/ path) {
         let files = [];
         self.fs.readdirSync(dir).forEach(function (file) {
             const path = pth.join(dir, file);
+
+            if (escapesRoot(path)) return;
+
             const stat = self.fs.statSync(path);
 
             if (!pattern || pattern.test(path)) {
@@ -191,7 +245,7 @@ Utils.prototype.findFiles = function (/*String*/ path) {
         return files;
     }
 
-    return findSync(path, undefined, true, new Set([self.fs.realpathSync(path)]));
+    return findSync(path, undefined, true, new Set([rootReal]));
 };
 
 /**
@@ -217,6 +271,25 @@ Utils.prototype.findFilesAsync = function (dir, cb) {
         cb(err, err ? undefined : results);
     };
 
+    const canLstat = typeof self.fs.lstat === "function";
+    let rootReal = null;
+
+    // Reject a symlink whose target escapes the root being archived, so its
+    // contents are not dereferenced and copied into the archive
+    // (GHSA-wx42-xcp7-pgr4). A symlink resolving to a location inside the root is
+    // allowed; a dangling or escaping one is skipped. Calls back (err, escapes).
+    const escapesRoot = function (file, cb) {
+        if (!canLstat) return cb(null, false);
+        self.fs.lstat(file, function (err, lst) {
+            if (err) return cb(err);
+            if (!lst || !lst.isSymbolicLink()) return cb(null, false);
+            self.fs.realpath(file, function (err, real) {
+                if (err) return cb(null, true); // dangling: do not follow
+                cb(null, !(real === rootReal || real.startsWith(rootReal + pth.sep)));
+            });
+        });
+    };
+
     // Descend by resolved real path and skip directories already visited, so a
     // symlink pointing back to an ancestor cannot recurse forever (issue #541).
     const walk = function (dir, visited, done) {
@@ -226,27 +299,34 @@ Utils.prototype.findFilesAsync = function (dir, cb) {
             if (!pending) return done();
             list.forEach(function (name) {
                 const file = pth.join(dir, name);
-                self.fs.stat(file, function (err, stat) {
+                escapesRoot(file, function (err, escapes) {
                     if (err) return done(err);
-                    if (!stat) {
-                        if (!--pending) done();
-                        return;
-                    }
-                    results.push(pth.normalize(file) + (stat.isDirectory() ? self.sep : ""));
-                    if (!stat.isDirectory()) {
+                    if (escapes) {
                         if (!--pending) done();
                         return;
                     }
-                    self.fs.realpath(file, function (err, realDir) {
+                    self.fs.stat(file, function (err, stat) {
                         if (err) return done(err);
-                        if (visited.has(realDir)) {
+                        if (!stat) {
                             if (!--pending) done();
                             return;
                         }
-                        visited.add(realDir);
-                        walk(file, visited, function (err) {
-                            if (err) return done(err);
+                        results.push(pth.normalize(file) + (stat.isDirectory() ? self.sep : ""));
+                        if (!stat.isDirectory()) {
                             if (!--pending) done();
+                            return;
+                        }
+                        self.fs.realpath(file, function (err, realDir) {
+                            if (err) return done(err);
+                            if (visited.has(realDir)) {
+                                if (!--pending) done();
+                                return;
+                            }
+                            visited.add(realDir);
+                            walk(file, visited, function (err) {
+                                if (err) return done(err);
+                                if (!--pending) done();
+                            });
                         });
                     });
                 });
@@ -256,6 +336,7 @@ Utils.prototype.findFilesAsync = function (dir, cb) {
 
     self.fs.realpath(dir, function (err, realDir) {
         if (err) return finish(err);
+        rootReal = realDir;
         walk(dir, new Set([realDir]), finish);
     });
 };
@@ -365,7 +446,14 @@ Utils.toBuffer = function toBuffer(/*buffer, Uint8Array, string*/ input, /* func
 Utils.readBigUInt64LE = function (/*Buffer*/ buffer, /*int*/ index) {
     const lo = buffer.readUInt32LE(index);
     const hi = buffer.readUInt32LE(index + 4);
-    return hi * 0x100000000 + lo;
+    const value = hi * 0x100000000 + lo;
+    // The result is a JS number, so values above 2^53 - 1 cannot be represented
+    // exactly. These are zip64 sizes/offsets/counts used as buffer indices; a
+    // silently rounded value would misparse the archive. Reject instead.
+    if (value > Number.MAX_SAFE_INTEGER) {
+        throw Errors.ZIP64_VALUE_TOO_LARGE();
+    }
+    return value;
 };
 
 Utils.writeBigUInt64LE = function (/*Buffer*/ buffer, /*Number*/ value, /*int*/ index) {