@zuplo/cli 6.73.30 → 6.73.31

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -2670,6 +2670,8 @@ export declare interface AzureEventHubsRequestLoggerPluginOptions<T> {
   batchPeriodSeconds: number;
 }
 
+/* Excluded from this release type: BackgroundDispatchDebugLog */
+
 /**
  * Utility for batching and dispatching events in the background.
  * Useful for aggregating logs, metrics, or other data before sending to external services.
@@ -2729,6 +2731,22 @@ export declare class BackgroundDispatcher<TPayload> {
   enqueue: (payload: TPayload) => void;
 }
 
+/**
+ * A background dispatch failure with an optional diagnostic that is
+ * safe to write at debug level.
+ *
+ * @public
+ */
+export declare class BackgroundDispatchError extends Error {
+  readonly debugLog: BackgroundDispatchDebugLog | undefined;
+  constructor(
+    message: string,
+    options?: ErrorOptions & {
+      debugLog?: BackgroundDispatchDebugLog;
+    }
+  );
+}
+
 /**
  * A utility for loading and caching data in the background with automatic refresh
  * @public

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.73.30",
+  "version": "6.73.31",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/fast-uri/index.js

@@ -26,7 +26,12 @@ function normalize (uri, options) {
  */
 function resolve (baseURI, relativeURI, options) {
   const schemelessOptions = options ? Object.assign({ scheme: 'null' }, options) : { scheme: 'null' }
-  const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true)
+  const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions)
+  const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions)
+  if (baseMalformed || relativeMalformed) {
+    throw new Error(baseParsed.error || relativeParsed.error || 'URI is malformed.')
+  }
+  const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true)
   schemelessOptions.skipEscape = true
   return serialize(resolved, schemelessOptions)
 }
@@ -206,6 +211,15 @@ const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:
 // with or without a scheme prefix, for the literal-backslash rejection below.
 const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/
 
+// Captures the leading authority-introducer region after an optional scheme: a
+// run of forward slashes, backslashes, and the characters the WHATWG URL parser
+// removes before parsing (TAB U+0009, LF U+000A, CR U+000D). A valid introducer
+// is exactly "//". Node treats "\" as "/" on special schemes and strips those
+// characters first, so forms like "\\", "/\", "\/", "/<TAB>/", or a leading
+// "<TAB>//" reach an authority in Node while fast-uri's URI_PARSE folds them into
+// the path group (host confusion / SSRF / redirect bypass).
+const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/
+
 /**
  * @param {import('./types/index').URIComponent} parsed
  * @param {RegExpMatchArray} matches
@@ -265,6 +279,28 @@ function parseWithStatus (uri, opts) {
     malformedAuthorityOrPort = true
   }
 
+  // Reject a malformed or whitespace-smuggled authority introducer. fast-uri
+  // only recognizes a literal "//"; anything else in the leading separator run
+  // (a backslash, or a "//" that appears only after removing the TAB/LF/CR that
+  // Node strips) means the authority fast-uri parses differs from the one Node's
+  // URL resolves. Reject rather than rewrite, mirroring the literal-backslash
+  // guard above. Percent-encoded forms (%5C, %09) are untouched, valid data.
+  const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION)
+  if (introducerMatch !== null) {
+    const region = introducerMatch[1]
+    const normalizedRegion = region.replace(/[\t\n\r]/g, '')
+    // Two or more leading separators introduce an authority.
+    if (normalizedRegion.length >= 2) {
+      if (normalizedRegion.slice(0, 2) !== '//') {
+        parsed.error = parsed.error || 'URI authority must not contain a literal backslash.'
+        malformedAuthorityOrPort = true
+      } else if (region.length !== normalizedRegion.length) {
+        parsed.error = parsed.error || 'URI authority introducer must not contain whitespace.'
+        malformedAuthorityOrPort = true
+      }
+    }
+  }
+
   const matches = uri.match(URI_PARSE)
 
   if (matches) {

package/node_modules/fast-uri/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "3.1.4",
+  "version": "3.1.5",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/node_modules/fast-uri/test/security.test.js

@@ -221,3 +221,139 @@ test('parse does not reject a literal backslash in the query or fragment', (t) =
   t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
   t.equal(parsed.host, 'host.example.com', 'host parsed normally')
 })
+
+test('parse rejects a malformed authority introducer (\\\\, /\\, \\/) in place of //', (t) => {
+  // Regression: "\\", "/\\", "\\/" after the scheme colon are not valid authority
+  // introducers. Node's URL treats "\\" as interchangeable with "/" on special
+  // schemes, so "http:\\\\evil.com/path" would be parsed as host "evil.com" by
+  // Node, but fast-uri must reject it as malformed to prevent SSRF/redirect bypass.
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path',
+    'http:\\/evil.com/path',
+    'ws:\\\\evil.com/chat',
+    'wss:\\\\evil.com/chat',
+    'ftp:\\\\evil.com/',
+    '\\\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a malformed-authority-introducer URI', (t) => {
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('equal returns false for malformed-authority-introducer URIs', (t) => {
+  const pairs = [
+    ['http:\\\\evil.com/path', 'http://evil.com/path'],
+    ['http:/\\evil.com/path', 'http://evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([left, right]) => {
+    t.equal(fastURI.equal(left, right), false, `${left} != ${right}`)
+  })
+})
+
+test('resolve throws on malformed authority introducer', (t) => {
+  // resolve() returns a plain string with no error field, so the only safe
+  // behavior is to throw when either component has a malformed authority.
+  const pairs = [
+    ['https://allowed.com/', '\\\\evil.com/path'],
+    ['\\\\evil.com/path', 'https://allowed.com/'],
+    ['https://allowed.com/', 'http:/\\evil.com/path'],
+    ['https://allowed.com/', 'http:\\/evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority must not contain a literal backslash/,
+      `${base} + ${rel}`
+    )
+  })
+})
+
+test('parse rejects a whitespace-split authority introducer (TAB, LF, CR)', (t) => {
+  // The WHATWG URL parser removes TAB (U+0009), LF (U+000A) and CR (U+000D) from
+  // the input before parsing, so a stripped character wedged into the introducer
+  // ("/<TAB>\\", "/<TAB>/", or a leading "<TAB>//") reaches an authority in Node
+  // while fast-uri would otherwise fold it into the path. These must be rejected
+  // like the adjacent "\\", "/\\", "\\/" forms.
+  const cases = [
+    { input: '/\t\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '/\n\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\r\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '\t//evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '\t/\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: 'https:/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' }
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach(({ input, expectedError }) => {
+    t.equal(fastURI.parse(input).error, expectedError, JSON.stringify(input))
+  })
+})
+
+test('resolve throws on a whitespace-split authority introducer', (t) => {
+  const pairs = [
+    ['https://allowed.com/', '/\t\\evil.com/path'],
+    ['https://allowed.com/', '/\t/evil.com/path'],
+    ['https://allowed.com/', '/\n\\evil.com/path'],
+    ['/\t/evil.com/path', 'https://allowed.com/']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority (must not contain a literal backslash|introducer must not contain whitespace)/,
+      `${JSON.stringify(base)} + ${JSON.stringify(rel)}`
+    )
+  })
+})
+
+test('parse does not reject valid authority introducer patterns', (t) => {
+  // No false positives: "//" introducer and scheme-less "//" must be valid.
+  const cases = [
+    'http://good.com/',
+    'https://good.com/',
+    'ws://good.com/chat',
+    'wss://good.com/chat',
+    'ftp://good.com/',
+    '//good.com/path',
+    '/absolute/path',
+    'relative/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, input)
+  })
+})

package/node_modules/hono/dist/cjs/jsx/hooks/index.js

@@ -330,19 +330,22 @@ const useSyncExternalStore = (subscribe, getSnapshot, getServerSnapshot) => {
     }
     return getServerSnapshot();
   }
-  const [serverSnapshotIsUsed] = useState(!!(buildData[0][4] && getServerSnapshot));
-  const [state, setState] = useState(
-    () => serverSnapshotIsUsed ? getServerSnapshot() : getSnapshot()
-  );
+  const snapshot = buildData[0][4] && getServerSnapshot ? getServerSnapshot() : getSnapshot();
+  const [, setVersion] = useState(0);
+  const latestSnapshot = useRef([snapshot, getSnapshot]);
+  latestSnapshot.current = [snapshot, getSnapshot];
+  const unsubscribeRef = useRef(null);
   useEffect(() => {
-    if (serverSnapshotIsUsed) {
-      setState(getSnapshot());
+    const update2 = () => setVersion((version) => version + 1);
+    unsubscribeRef.current?.();
+    unsubscribeRef.current = subscribe(update2);
+    const [snapshot2, getSnapshot2] = latestSnapshot.current;
+    if (!Object.is(snapshot2, getSnapshot2())) {
+      update2();
     }
-    return subscribe(() => {
-      setState(getSnapshot());
-    });
-  }, []);
-  return state;
+  }, [subscribe]);
+  useEffect(() => () => unsubscribeRef.current?.(), []);
+  return snapshot;
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/node_modules/hono/dist/cjs/utils/cookie.js

@@ -47,6 +47,7 @@ const verifySignature = async (base64Signature, value, secret) => {
   }
 };
 const validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+const relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/;
 const validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
 const trimCookieWhitespace = (value) => {
   let start = 0;
@@ -79,7 +80,7 @@ const parse = (cookie, name) => {
       continue;
     }
     const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
-    if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
+    if (name && name !== cookieName || !relaxedCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
       continue;
     }
     let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));

package/node_modules/hono/dist/jsx/hooks/index.js

@@ -289,19 +289,22 @@ var useSyncExternalStore = (subscribe, getSnapshot, getServerSnapshot) => {
     }
     return getServerSnapshot();
   }
-  const [serverSnapshotIsUsed] = useState(!!(buildData[0][4] && getServerSnapshot));
-  const [state, setState] = useState(
-    () => serverSnapshotIsUsed ? getServerSnapshot() : getSnapshot()
-  );
+  const snapshot = buildData[0][4] && getServerSnapshot ? getServerSnapshot() : getSnapshot();
+  const [, setVersion] = useState(0);
+  const latestSnapshot = useRef([snapshot, getSnapshot]);
+  latestSnapshot.current = [snapshot, getSnapshot];
+  const unsubscribeRef = useRef(null);
   useEffect(() => {
-    if (serverSnapshotIsUsed) {
-      setState(getSnapshot());
+    const update2 = () => setVersion((version) => version + 1);
+    unsubscribeRef.current?.();
+    unsubscribeRef.current = subscribe(update2);
+    const [snapshot2, getSnapshot2] = latestSnapshot.current;
+    if (!Object.is(snapshot2, getSnapshot2())) {
+      update2();
     }
-    return subscribe(() => {
-      setState(getSnapshot());
-    });
-  }, []);
-  return state;
+  }, [subscribe]);
+  useEffect(() => () => unsubscribeRef.current?.(), []);
+  return snapshot;
 };
 export {
   STASH_EFFECT,

package/node_modules/hono/dist/utils/cookie.js

@@ -23,6 +23,7 @@ var verifySignature = async (base64Signature, value, secret) => {
   }
 };
 var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
+var relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/;
 var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
 var trimCookieWhitespace = (value) => {
   let start = 0;
@@ -55,7 +56,7 @@ var parse = (cookie, name) => {
       continue;
     }
     const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
-    if (name && name !== cookieName || !validCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
+    if (name && name !== cookieName || !relaxedCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
       continue;
     }
     let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));

package/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.12.32",
+  "version": "4.12.33",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",
@@ -667,7 +667,7 @@
   ],
   "devDependencies": {
     "@hono/eslint-config": "^2.1.1",
-    "@hono/node-server": "^2.0.2",
+    "@hono/node-server": "^2.0.12",
     "@types/jsdom": "^21.1.7",
     "@types/node": "^24.3.0",
     "@types/ws": "^8.18.1",
@@ -685,7 +685,6 @@
     "prettier": "3.7.4",
     "publint": "0.3.15",
     "typescript": "^6.0.3",
-    "undici": "^6.27.0",
     "vite-plugin-fastly-js-compute": "^0.4.2",
     "vitest": "^4.1.9",
     "wrangler": "4.107.0",