@zuplo/cli 7.0.2 → 7.1.1

package/node_modules/secure-json-parse/.github/workflows/ci.yml

@@ -1,14 +1,22 @@
 name: CI
+
 on:
   push:
+    branches:
+     - main
+     - next
+     - 'v*'
     paths-ignore:
-      - docs/**
+      - 'docs/**'
       - '*.md'
   pull_request:
     paths-ignore:
-      - docs/**
+      - 'docs/**'
       - '*.md'
 
+permissions:
+  contents: read
+
 jobs:
   dependency-review:
     name: Dependency Review
@@ -18,12 +26,12 @@ jobs:
       contents: read
     steps:
       - name: Check out repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
 
       - name: Dependency review
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0
 
   lint:
     name: Lint Code
@@ -32,13 +40,14 @@ jobs:
       contents: read
     steps:
       - name: Check out repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v5
         with:
+          check-latest: true
           node-version: lts/*
 
       - name: Install dependencies
@@ -54,18 +63,22 @@ jobs:
       contents: read
     steps:
       - name: Check out repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v5
         with:
+          check-latest: true
           node-version: lts/*
 
       - name: Install dependencies
         run: npm i
 
+      - name: Install Playwright
+        run: npx playwright install
+
       - name: Run tests
         run: npm run test:browser
 
@@ -76,25 +89,22 @@ jobs:
       contents: read
     strategy:
       matrix:
-        node-version: [6, 8, 10, 11, 12, 13, 14, 15, 16, 18]
+        node-version: [20, 22, 24]
     steps:
       - name: Check out repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
 
       - name: Setup Node ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v5
         with:
+          check-latest: true
           node-version: ${{ matrix.node-version }}
 
-      - name: Upgrade npm
-        if: ${{ success() && matrix.node-version == '6' }}
-        run: npm i npm@6.13.4 -g
-
       - name: Install dependencies
         run: npm i --ignore-scripts
-        
+
       - name: Run tests
         run: npm run test:unit
 
@@ -105,13 +115,14 @@ jobs:
       contents: read
     steps:
       - name: Check out repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v5
         with:
+          check-latest: true
           node-version: lts/*
 
       - name: Install dependencies
@@ -124,6 +135,7 @@ jobs:
     name: Automerge Dependabot PRs
     if: >
         github.event_name == 'pull_request' &&
+        github.event.pull_request.head.repo.full_name == github.repository &&
         github.event.pull_request.user.login == 'dependabot[bot]'
     needs: [browsers, lint, test, typescript]
     permissions:
@@ -131,7 +143,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: fastify/github-action-merge-dependabot@v3
+      - uses: fastify/github-action-merge-dependabot@e820d631adb1d8ab16c3b93e5afe713450884a4a # v3.11.1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           target: major

package/node_modules/{ieee754 → secure-json-parse}/LICENSE

@@ -1,4 +1,12 @@
-Copyright 2008 Fair Oaks Labs, Inc.
+Copyright (c) 2019, Sideway Inc, and project contributors
+Copyright (c) 2019-present The Fastify team
+All rights reserved.
+
+The Fastify team members are listed at https://github.com/fastify/fastify#team.
+
+The complete list of contributors can be found at:
+- https://github.com/hapijs/bourne/graphs/contributors
+- https://github.com/fastify/secure-json-parse/graphs/contributors
 
 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
 

package/node_modules/secure-json-parse/README.md

@@ -1,8 +1,8 @@
 # secure-json-parse
 
-![CI](https://github.com/fastify/secure-json-parse/workflows/CI/badge.svg)
+[![CI](https://github.com/fastify/secure-json-parse/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fastify/secure-json-parse/actions/workflows/ci.yml)
 [![NPM version](https://img.shields.io/npm/v/secure-json-parse.svg?style=flat)](https://www.npmjs.com/package/secure-json-parse)
-[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](https://standardjs.com/)
+[![neostandard javascript style](https://img.shields.io/badge/code_style-neostandard-brightgreen?style=flat)](https://github.com/neostandard/neostandard)
 
 `JSON.parse()` drop-in replacement with prototype poisoning protection.
 
@@ -47,8 +47,8 @@ const sjson = require('secure-json-parse')
 const goodJson = '{ "a": 5, "b": 6 }'
 const badJson = '{ "a": 5, "b": 6, "__proto__": { "x": 7 }, "constructor": {"prototype": {"bar": "baz"} } }'
 
-console.log(JSON.parse(goodJson), sjson.parse(goodJson, { protoAction: 'remove', constructorAction: 'remove' }))
-console.log(JSON.parse(badJson), sjson.parse(badJson, { protoAction: 'remove', constructorAction: 'remove' }))
+console.log(JSON.parse(goodJson), sjson.parse(goodJson, undefined, { protoAction: 'remove', constructorAction: 'remove' }))
+console.log(JSON.parse(badJson), sjson.parse(badJson, undefined, { protoAction: 'remove', constructorAction: 'remove' }))
 ```
 
 ## API
@@ -67,6 +67,9 @@ Parses a given JSON-formatted text into an object where:
         - `'error'` - throw a `SyntaxError` when a `constructor.prototype` key is found. This is the default value.
         - `'remove'` - deletes any `constructor` keys from the result object.
         - `'ignore'` - skips all validation (same as calling `JSON.parse()` directly).
+    - `safe` - optional boolean:
+        - `true` - returns `null` instead of throwing when a forbidden prototype property is found.
+        - `false` - default behavior (throws or removes based on `protoAction`/`constructorAction`).
 
 ### `sjson.scan(obj, [options])`
 
@@ -79,6 +82,9 @@ Scans a given object for prototype properties where:
     - `constructorAction` - optional string with one of:
         - `'error'` - throw a `SyntaxError` when a `constructor.prototype` key is found. This is the default value.
         - `'remove'` - deletes any `constructor` keys from the input `obj`.
+    - `safe` - optional boolean:
+        - `true` - returns `null` instead of throwing when a forbidden prototype property is found.
+        - `false` - default behavior (throws or removes based on `protoAction`/`constructorAction`).
 
 ## Benchmarks
 
@@ -117,10 +123,10 @@ reviver x 114,197 ops/sec ±0.63% (87 runs sampled)
 Fastest is JSON.parse
 ```
 
-# Acknowledgements
+## Acknowledgments
 This project has been forked from [hapijs/bourne](https://github.com/hapijs/bourne).
-All the credits before the commit [4690682](https://github.com/hapijs/bourne/commit/4690682c6cdaa06590da7b2485d5df91c09da889) goes to the hapijs/bourne project contributors.
+All credit before commit [4690682](https://github.com/hapijs/bourne/commit/4690682c6cdaa06590da7b2485d5df91c09da889) goes to the hapijs/bourne project contributors.
 After, the project will be maintained by the Fastify team.
 
-# License
-Licensed under BSD-3-Clause.
+## License
+Licensed under [BSD-3-Clause](./LICENSE).

package/node_modules/secure-json-parse/benchmarks/ignore.js

@@ -30,6 +30,6 @@ suite
   })
   .run({ async: true })
 
-internals.reviver = function (key, value) {
+internals.reviver = function (_key, value) {
   return value
 }

package/node_modules/secure-json-parse/benchmarks/throw.js

@@ -17,12 +17,12 @@ suite
   .add('JSON.parse error', () => {
     try {
       JSON.parse(internals.invalid)
-    } catch (ignoreErr) { }
+    } catch { }
   })
   .add('secure-json-parse parse', () => {
     try {
       sjson.parse(internals.invalid)
-    } catch (ignoreErr) { }
+    } catch { }
   })
   .add('secure-json-parse safeParse', () => {
     sjson.safeParse(internals.invalid)
@@ -30,7 +30,7 @@ suite
   .add('reviver', () => {
     try {
       JSON.parse(internals.invalid, internals.reviver)
-    } catch (ignoreErr) { }
+    } catch { }
   })
   .on('cycle', (event) => {
     console.log(String(event.target))

package/node_modules/secure-json-parse/index.js

@@ -4,6 +4,16 @@ const hasBuffer = typeof Buffer !== 'undefined'
 const suspectProtoRx = /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*:/
 const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/
 
+/**
+ * @description Internal parse function that parses JSON text with security checks.
+ * @private
+ * @param {string|Buffer} text - The JSON text string or Buffer to parse.
+ * @param {Function} [reviver] - The JSON.parse() optional reviver argument.
+ * @param {import('./types').ParseOptions} [options] - Optional configuration object.
+ * @returns {*} The parsed object.
+ * @throws {SyntaxError} If a forbidden prototype property is found and `options.protoAction` or
+ * `options.constructorAction` is `'error'`.
+ */
 function _parse (text, reviver, options) {
   // Normalize arguments
   if (options == null) {
@@ -56,6 +66,14 @@ function _parse (text, reviver, options) {
   return filter(obj, { protoAction, constructorAction, safe: options && options.safe })
 }
 
+/**
+ * @description Scans and filters an object for forbidden prototype properties.
+ * @param {Object} obj - The object being scanned.
+ * @param {import('./types').ParseOptions} [options] - Optional configuration object.
+ * @returns {Object|null} The filtered object, or `null` if safe mode is enabled and issues are found.
+ * @throws {SyntaxError} If a forbidden prototype property is found and `options.protoAction` or
+ * `options.constructorAction` is `'error'`.
+ */
 function filter (obj, { protoAction = 'error', constructorAction = 'error', safe } = {}) {
   let next = [obj]
 
@@ -76,6 +94,8 @@ function filter (obj, { protoAction = 'error', constructorAction = 'error', safe
 
       if (constructorAction !== 'ignore' &&
           Object.prototype.hasOwnProperty.call(node, 'constructor') &&
+          node.constructor !== null &&
+          typeof node.constructor === 'object' &&
           Object.prototype.hasOwnProperty.call(node.constructor, 'prototype')) { // Avoid calling node.hasOwnProperty directly
         if (safe === true) {
           return null
@@ -97,8 +117,17 @@ function filter (obj, { protoAction = 'error', constructorAction = 'error', safe
   return obj
 }
 
+/**
+ * @description Parses a given JSON-formatted text into an object.
+ * @param {string|Buffer} text - The JSON text string or Buffer to parse.
+ * @param {Function} [reviver] - The `JSON.parse()` optional reviver argument, or options object.
+ * @param {import('./types').ParseOptions} [options] - Optional configuration object.
+ * @returns {*} The parsed object.
+ * @throws {SyntaxError} If the JSON text is malformed or contains forbidden prototype properties
+ * when `options.protoAction` or `options.constructorAction` is `'error'`.
+ */
 function parse (text, reviver, options) {
-  const stackTraceLimit = Error.stackTraceLimit
+  const { stackTraceLimit } = Error
   Error.stackTraceLimit = 0
   try {
     return _parse(text, reviver, options)
@@ -107,13 +136,19 @@ function parse (text, reviver, options) {
   }
 }
 
+/**
+ * @description Safely parses a given JSON-formatted text into an object.
+ * @param {string|Buffer} text - The JSON text string or Buffer to parse.
+ * @param {Function} [reviver] - The `JSON.parse()` optional reviver argument.
+ * @returns {*|null|undefined} The parsed object, `null` if security issues found, or `undefined` on parse error.
+ */
 function safeParse (text, reviver) {
-  const stackTraceLimit = Error.stackTraceLimit
+  const { stackTraceLimit } = Error
   Error.stackTraceLimit = 0
   try {
     return _parse(text, reviver, { safe: true })
-  } catch (_e) {
-    return null
+  } catch {
+    return undefined
   } finally {
     Error.stackTraceLimit = stackTraceLimit
   }

package/node_modules/secure-json-parse/package.json

@@ -1,12 +1,14 @@
 {
   "name": "secure-json-parse",
-  "version": "2.7.0",
+  "version": "4.1.0",
   "description": "JSON parse with prototype poisoning protection",
   "main": "index.js",
+  "type": "commonjs",
   "types": "types/index.d.ts",
   "scripts": {
     "benchmark": "cd benchmarks && npm install && npm run all",
-    "lint": "standard",
+    "lint": "eslint",
+    "lint:fix": "eslint --fix",
     "test": "nyc npm run test:unit && npm run test:typescript",
     "test:unit": "tape \"test/*.test.js\"",
     "test:typescript": "tsd",
@@ -16,6 +18,26 @@
     "type": "git",
     "url": "git+https://github.com/fastify/secure-json-parse.git"
   },
+  "author": "Eran Hammer <eran@sideway.com>",
+  "contributors": [
+    {
+      "name": "Matteo Collina",
+      "email": "hello@matteocollina.com"
+    },
+    {
+      "name": "Tomas Della Vedova",
+      "url": "http://delved.org"
+    },
+    {
+      "name": "Aras Abbasi",
+      "email": "aras.abbasi@gmail.com"
+    },
+    {
+      "name": "Frazer Smith",
+      "email": "frazer.dev@icloud.com",
+      "url": "https://github.com/fdawgs"
+    }
+  ],
   "keywords": [
     "JSON",
     "parse",
@@ -29,13 +51,24 @@
     "url": "https://github.com/fastify/secure-json-parse/issues"
   },
   "homepage": "https://github.com/fastify/secure-json-parse#readme",
+  "funding": [
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/fastify"
+    },
+    {
+      "type": "opencollective",
+      "url": "https://opencollective.com/fastify"
+    }
+  ],
   "devDependencies": {
-    "airtap": "^4.0.1",
+    "airtap": "^5.0.0",
     "airtap-playwright": "^1.0.1",
-    "nyc": "^14.1.1",
-    "playwright": "^1.7.1",
-    "standard": "^17.0.0",
-    "tape": "^5.1.1",
-    "tsd": "^0.25.0"
+    "eslint": "^9.17.0",
+    "neostandard": "^0.12.0",
+    "nyc": "^17.0.0",
+    "playwright": "^1.43.1",
+    "tape": "^5.7.5",
+    "tsd": "^0.33.0"
   }
 }

package/node_modules/secure-json-parse/test/index.test.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const test = require('tape').test
+const { test } = require('tape')
 const j = require('..')
 
 test('parse', t => {
@@ -45,7 +45,7 @@ test('parse', t => {
   })
 
   t.test('parses object string (reviver)', t => {
-    const reviver = (key, value) => {
+    const reviver = (_key, value) => {
       return typeof value === 'number' ? value + 1 : value
     }
 
@@ -58,7 +58,7 @@ test('parse', t => {
 
   t.test('protoAction', t => {
     t.test('sanitizes object string (reviver, options)', t => {
-      const reviver = (key, value) => {
+      const reviver = (_key, value) => {
         return typeof value === 'number' ? value + 1 : value
       }
 
@@ -158,7 +158,7 @@ test('parse', t => {
 
   t.test('constructorAction', t => {
     t.test('sanitizes object string (reviver, options)', t => {
-      const reviver = (key, value) => {
+      const reviver = (_key, value) => {
         return typeof value === 'number' ? value + 1 : value
       }
 
@@ -257,6 +257,27 @@ test('parse', t => {
       t.end()
     })
 
+    t.test('handles constructor null safely', t => {
+      // Test that constructor: null doesn't trigger prototype pollution checks
+      t.deepEqual(
+        j.parse('{"constructor": null}', { constructorAction: 'remove' }),
+        { constructor: null }
+      )
+
+      // Test that constructor: null doesn't throw error when using error action
+      t.deepEqual(
+        j.parse('{"constructor": null}', { constructorAction: 'error' }),
+        { constructor: null }
+      )
+
+      // Test that constructor: null is preserved when using ignore action
+      t.deepEqual(
+        j.parse('{"constructor": null}', { constructorAction: 'ignore' }),
+        { constructor: null }
+      )
+      t.end()
+    })
+
     t.end()
   })
 
@@ -432,10 +453,10 @@ test('safeParse', t => {
     t.end()
   })
 
-  t.test('returns null on invalid object string', t => {
+  t.test('returns undefined on invalid object string', t => {
     t.strictEqual(
       j.safeParse('{"a": 5, "b": 6'),
-      null
+      undefined
     )
     t.end()
   })
@@ -503,3 +524,126 @@ test('scan handles optional options', t => {
   t.doesNotThrow(() => j.scan({ a: 'b' }))
   t.end()
 })
+
+test('safe option', t => {
+  t.test('parse with safe=true returns null on __proto__', t => {
+    const text = '{ "a": 5, "b": 6, "__proto__": { "x": 7 } }'
+    t.strictEqual(j.parse(text, { safe: true }), null)
+    t.end()
+  })
+
+  t.test('parse with safe=true returns null on constructor', t => {
+    const text = '{ "a": 5, "b": 6, "constructor": {"prototype": {"bar": "baz"}} }'
+    t.strictEqual(j.parse(text, { safe: true }), null)
+    t.end()
+  })
+
+  t.test('parse with safe=true returns object when valid', t => {
+    const text = '{ "a": 5, "b": 6 }'
+    t.deepEqual(j.parse(text, { safe: true }), { a: 5, b: 6 })
+    t.end()
+  })
+
+  t.test('parse with safe=true and reviver', t => {
+    const text = '{ "a": 5, "b": 6, "__proto__": { "x": 7 } }'
+    const reviver = (_key, value) => {
+      return typeof value === 'number' ? value + 1 : value
+    }
+    t.strictEqual(j.parse(text, reviver, { safe: true }), null)
+    t.end()
+  })
+
+  t.test('parse with safe=true and protoAction=remove returns null', t => {
+    const text = '{ "a": 5, "b": 6, "__proto__": { "x": 7 } }'
+    t.strictEqual(j.parse(text, { safe: true, protoAction: 'remove' }), null)
+    t.end()
+  })
+
+  t.test('parse with safe=true and constructorAction=remove returns null', t => {
+    const text = '{ "a": 5, "b": 6, "constructor": {"prototype": {"bar": "baz"}} }'
+    t.strictEqual(j.parse(text, { safe: true, constructorAction: 'remove' }), null)
+    t.end()
+  })
+
+  t.test('parse with safe=false throws on __proto__', t => {
+    const text = '{ "a": 5, "b": 6, "__proto__": { "x": 7 } }'
+    t.throws(() => j.parse(text, { safe: false }), SyntaxError)
+    t.end()
+  })
+
+  t.test('parse with safe=false throws on constructor', t => {
+    const text = '{ "a": 5, "b": 6, "constructor": {"prototype": {"bar": "baz"}} }'
+    t.throws(() => j.parse(text, { safe: false }), SyntaxError)
+    t.end()
+  })
+
+  t.test('scan with safe=true returns null on __proto__', t => {
+    const obj = JSON.parse('{ "a": 5, "b": 6, "__proto__": { "x": 7 } }')
+    t.strictEqual(j.scan(obj, { safe: true }), null)
+    t.end()
+  })
+
+  t.test('scan with safe=true returns null on constructor', t => {
+    const obj = JSON.parse('{ "a": 5, "b": 6, "constructor": {"prototype": {"bar": "baz"}} }')
+    t.strictEqual(j.scan(obj, { safe: true }), null)
+    t.end()
+  })
+
+  t.test('scan with safe=true returns object when valid', t => {
+    const obj = { a: 5, b: 6 }
+    t.deepEqual(j.scan(obj, { safe: true }), { a: 5, b: 6 })
+    t.end()
+  })
+
+  t.test('scan with safe=false throws on __proto__', t => {
+    const obj = JSON.parse('{ "a": 5, "b": 6, "__proto__": { "x": 7 } }')
+    t.throws(() => j.scan(obj, { safe: false }), SyntaxError)
+    t.end()
+  })
+
+  t.test('scan with safe=false throws on constructor', t => {
+    const obj = JSON.parse('{ "a": 5, "b": 6, "constructor": {"prototype": {"bar": "baz"}} }')
+    t.throws(() => j.scan(obj, { safe: false }), SyntaxError)
+    t.end()
+  })
+
+  t.test('parse with safe=true returns null on nested __proto__', t => {
+    const text = '{ "a": 5, "c": { "d": 0, "__proto__": { "y": 8 } } }'
+    t.strictEqual(j.parse(text, { safe: true }), null)
+    t.end()
+  })
+
+  t.test('parse with safe=true returns null on nested constructor', t => {
+    const text = '{ "a": 5, "c": { "d": 0, "constructor": {"prototype": {"bar": "baz"}} } }'
+    t.strictEqual(j.parse(text, { safe: true }), null)
+    t.end()
+  })
+
+  t.test('parse with safe=true and protoAction=ignore returns object', t => {
+    const text = '{ "a": 5, "b": 6, "__proto__": { "x": 7 } }'
+    t.deepEqual(
+      j.parse(text, { safe: true, protoAction: 'ignore' }),
+      JSON.parse(text)
+    )
+    t.end()
+  })
+
+  t.test('parse with safe=true and constructorAction=ignore returns object', t => {
+    const text = '{ "a": 5, "b": 6, "constructor": {"prototype": {"bar": "baz"}} }'
+    t.deepEqual(
+      j.parse(text, { safe: true, constructorAction: 'ignore' }),
+      JSON.parse(text)
+    )
+    t.end()
+  })
+
+  t.test('should reset stackTraceLimit with safe option', t => {
+    const text = '{ "a": 5, "b": 6, "__proto__": { "x": 7 } }'
+    Error.stackTraceLimit = 42
+    t.strictEqual(j.parse(text, { safe: true }), null)
+    t.same(Error.stackTraceLimit, 42)
+    t.end()
+  })
+
+  t.end()
+})

package/node_modules/secure-json-parse/types/index.d.ts

@@ -16,6 +16,8 @@ declare namespace parse {
      * - `'ignore'` - skips all validation (same as calling `JSON.parse()` directly).
      */
     constructorAction?: 'error' | 'remove' | 'ignore';
+    /** If `true`, returns `null` instead of throwing an error when a security issue is found. */
+    safe?: boolean;
   }
 
   export type ScanOptions = ParseOptions
@@ -33,13 +35,13 @@ declare namespace parse {
   export const parse: Parse
 
   /**
-   * Parses a given JSON-formatted text into an object.
+   * Safely parses a given JSON-formatted text into an object.
    *
    * @param text The JSON text string.
    * @param reviver The `JSON.parse()` optional `reviver` argument.
-   * @returns The parsed object, or `null` if there was an error or if the JSON contained possibly insecure properties.
+   * @returns The parsed object, or `undefined` if there was an error or if the JSON contained possibly insecure properties.
    */
-  export function safeParse(text: string | Buffer, reviver?: Reviver | null): any
+  export function safeParse (text: string | Buffer, reviver?: Reviver | null): any
 
   /**
    * Scans a given object for prototype properties.
@@ -48,10 +50,11 @@ declare namespace parse {
    * @param options Optional configuration object.
    * @returns The object, or `null` if onError is set to `nullify`
    */
-  export function scan(obj: { [key: string | number]: any }, options?: ParseOptions): any
+  export function scan (obj: { [key: string | number]: any }, options?: ParseOptions): any
 
-  export { parse as default}
+  export { parse as default }
 }
 
-declare function parse(text: string | Buffer, reviver?: parse.Reviver | null, options?: parse.ParseOptions): any
+declare function parse (text: string | Buffer, options?: parse.ParseOptions): any
+declare function parse (text: string | Buffer, reviver?: parse.Reviver | null, options?: parse.ParseOptions): any
 export = parse

package/node_modules/secure-json-parse/types/index.test-d.ts

@@ -8,6 +8,15 @@ sjson.parse('"test"', null, { protoAction: 'remove' })
 expectError(sjson.parse('"test"', null, { protoAction: 'incorrect' }))
 sjson.parse('"test"', null, { constructorAction: 'ignore' })
 expectError(sjson.parse('"test"', null, { constructorAction: 'incorrect' }))
+expectError(sjson.parse('"test"', { constructorAction: 'incorrect' }))
+sjson.parse('test', { constructorAction: 'remove' })
+sjson.parse('test', { protoAction: 'ignore' })
+sjson.parse('test', () => {}, { protoAction: 'ignore', constructorAction: 'remove' })
+sjson.parse('"test"', null, { safe: true })
+sjson.parse('"test"', { safe: true })
+sjson.parse('test', () => {}, { safe: false })
+sjson.parse('test', { protoAction: 'remove', safe: true })
+expectError(sjson.parse('"test"', null, { safe: 'incorrect' }))
 
 sjson.safeParse('"test"', null)
 sjson.safeParse('"test"')
@@ -17,7 +26,10 @@ sjson.scan({}, { protoAction: 'remove' })
 sjson.scan({}, { protoAction: 'ignore' })
 sjson.scan({}, { constructorAction: 'error' })
 sjson.scan({}, { constructorAction: 'ignore' })
-sjson.scan(new Array(), {})
+sjson.scan([], {})
+sjson.scan({}, { safe: true })
+sjson.scan({}, { protoAction: 'remove', safe: false })
+expectError(sjson.scan({}, { safe: 'incorrect' }))
 
 declare const input: Buffer
 sjson.parse(input)