anhedral 0.8.4 → 0.8.6

package/assets/security/braces-regression.mjs

@@ -0,0 +1,102 @@
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+
+// Golden results were captured from the original registry package braces 3.0.3.
+const fixtures = [
+  {"input":"{a,b}","options":{},"expected":{"create":"(a|b)","compile":"(a|b)","expand":["a","b"],"stringify":"{a,b}"},"main":["(a|b)"]},
+  {"input":"a/{b,c}/d","options":{},"expected":{"create":"a/(b|c)/d","compile":"a/(b|c)/d","expand":["a/b/d","a/c/d"],"stringify":"a/{b,c}/d"},"main":["a/(b|c)/d"]},
+  {"input":"{01..05}","options":{},"expected":{"create":"(0[1-5])","compile":"(0[1-5])","expand":["01","02","03","04","05"],"stringify":"{01..05}"},"main":["(0[1-5])"]},
+  {"input":"{-3..3}","options":{},"expected":{"create":"(-[1-3]|[0-3])","compile":"(-[1-3]|[0-3])","expand":["-3","-2","-1","0","1","2","3"],"stringify":"{-3..3}"},"main":["(-[1-3]|[0-3])"]},
+  {"input":"{10..2..2}","options":{},"expected":{"create":"(2|4|6|8|10)","compile":"(2|4|6|8|10)","expand":["10","8","6","4","2"],"stringify":"{10..2..2}"},"main":["(2|4|6|8|10)"]},
+  {"input":"{a..z..3}","options":{},"expected":{"create":"(a|d|g|j|m|p|s|v|y)","compile":"(a|d|g|j|m|p|s|v|y)","expand":["a","d","g","j","m","p","s","v","y"],"stringify":"{a..z..3}"},"main":["(a|d|g|j|m|p|s|v|y)"]},
+  {"input":"{a,{b,c}}","options":{},"expected":{"create":"(a|(b|c))","compile":"(a|(b|c))","expand":["a","b","c"],"stringify":"{a,{b,c}}"},"main":["(a|(b|c))"]},
+  {"input":"{,a,,b,}","options":{},"expected":{"create":"(|a|b|)","compile":"(|a|b|)","expand":["","a","","b",""],"stringify":"{,a,,b,}"},"main":["(|a|b|)"]},
+  {"input":"\\{literal\\}","options":{"keepEscaping":true},"expected":{"create":"\\{literal\\}","compile":"\\{literal\\}","expand":["\\{literal\\}"],"stringify":"\\{literal\\}"},"main":["\\{literal\\}"]},
+  {"input":"file[{}].js","options":{},"expected":{"create":"file[{}].js","compile":"file[{}].js","expand":["file[{}].js"],"stringify":"file[{}].js"},"main":["file[{}].js"]},
+  {"input":"(x){a,b}","options":{},"expected":{"create":"(x)(a|b)","compile":"(x)(a|b)","expand":["(x)a","(x)b"],"stringify":"(x){a,b}"},"main":["(x)(a|b)"]},
+  {"input":"${name}","options":{},"expected":{"create":"${name}","compile":"${name}","expand":["${name}"],"stringify":"${name}"},"main":["${name}"]},
+  {"input":"{unclosed","options":{"escapeInvalid":true},"expected":{"create":"\\{unclosed","compile":"\\{unclosed","expand":["{unclosed"],"stringify":"{unclosed"},"main":["\\{unclosed"]},
+  {"input":"\"{a,b}\"","options":{"keepQuotes":true},"expected":{"create":"\"{a,b}\"","compile":"\"{a,b}\"","expand":["\"{a,b}\""],"stringify":"\"{a,b}\""},"main":["\"{a,b}\""]},
+  {"input":"{a,a,,b}","options":{"nodupes":true,"noempty":true},"expected":{"create":"(a|a|b)","compile":"(a|a|b)","expand":["a","b"],"stringify":"{a,a,,b}"},"main":["(a|a|b)"]},
+  {"input":"user-{200..300}","options":{},"expected":{"create":"user-(20[0-9]|2[1-9][0-9]|300)","compile":"user-(20[0-9]|2[1-9][0-9]|300)","expand":["user-200","user-201","user-202","user-203","user-204","user-205","user-206","user-207","user-208","user-209","user-210","user-211","user-212","user-213","user-214","user-215","user-216","user-217","user-218","user-219","user-220","user-221","user-222","user-223","user-224","user-225","user-226","user-227","user-228","user-229","user-230","user-231","user-232","user-233","user-234","user-235","user-236","user-237","user-238","user-239","user-240","user-241","user-242","user-243","user-244","user-245","user-246","user-247","user-248","user-249","user-250","user-251","user-252","user-253","user-254","user-255","user-256","user-257","user-258","user-259","user-260","user-261","user-262","user-263","user-264","user-265","user-266","user-267","user-268","user-269","user-270","user-271","user-272","user-273","user-274","user-275","user-276","user-277","user-278","user-279","user-280","user-281","user-282","user-283","user-284","user-285","user-286","user-287","user-288","user-289","user-290","user-291","user-292","user-293","user-294","user-295","user-296","user-297","user-298","user-299","user-300"],"stringify":"user-{200..300}"},"main":["user-(20[0-9]|2[1-9][0-9]|300)"]},
+  {"input":"","options":{},"expected":{"create":[""],"compile":"","expand":[],"stringify":""},"main":[""]},
+  {"input":"x","options":{},"expected":{"create":["x"],"compile":"x","expand":["x"],"stringify":"x"},"main":["x"]},
+  {"input":"{..3}","options":{},"expected":{"create":"{..3}","compile":"{..3}","expand":["{..3}"],"stringify":"{..3}"},"main":["{..3}"]},
+  {"input":"{1..3}","options":{"step":2},"expected":{"create":"(1|3)","compile":"(1|3)","expand":["1","3"],"stringify":"{1..3}"},"main":["(1|3)"]}
+];
+
+const normalize = value => JSON.parse(JSON.stringify(value, (key, item) => ['parent', 'prev'].includes(key) ? undefined : item));
+
+const bounded = fn => assert.throws(fn, error => error instanceof RangeError && /safe resource limits/.test(error.message));
+
+function verifyCompatibility(braces) {
+  for (const { input, options, expected, main } of fixtures) {
+    assert.deepEqual(braces(input, options), main, `braces ${input}`);
+    const parsed = braces.parse(input, options);
+    assert.equal(parsed.type, 'root');
+    assert.equal(parsed.input, input);
+    assert.equal(braces.stringify(parsed, options), expected.stringify);
+    for (const method of ['create', 'compile', 'expand', 'stringify']) {
+      assert.deepEqual(normalize(braces[method](input, options)), expected[method], `${method} ${input}`);
+    }
+  }
+  assert.deepEqual(braces(['{a,b}', '{1..3}'], { expand: true }), ['a', 'b', '1', '2', '3']);
+  assert.deepEqual(braces(['{a,a}', '{a,b}'], { expand: true, nodupes: true }), ['a', 'b']);
+  assert.throws(() => braces.expand('{1..1001}'), /range limit/);
+  assert.deepEqual(braces.expand('{1..3}', { rangeLimit: false }), ['1', '2', '3']);
+  assert.match(braces.compile('{1..1000000000}'), /./, 'Optimized numeric regex compilation remains available');
+  assert.equal(braces.expand('{1..100000}', { rangeLimit: false }).length, 100000);
+
+}
+
+function verifyNestedStrings(braces) {
+  for (const method of ['create', 'compile', 'expand', 'parse', 'stringify']) {
+    bounded(() => braces[method]('{'.repeat(4000) + 'a,b' + '}'.repeat(4000)));
+    bounded(() => braces[method]('('.repeat(4000) + 'x' + ')'.repeat(4000)));
+  }
+}
+
+function verifyAstBounds(braces) {
+  for (const method of ['compile', 'expand', 'stringify']) {
+    let ast = { type: 'text', value: 'x' };
+    for (let i = 0; i < 101; i++) ast = { type: 'root', nodes: [ast] };
+    bounded(() => braces[method](ast));
+    const cycle = { type: 'root', nodes: [] }; cycle.nodes.push(cycle);
+    bounded(() => braces[method](cycle));
+    const parentCycle = { type: 'root', nodes: [] }; parentCycle.parent = parentCycle;
+    bounded(() => braces[method](parentCycle));
+    const foreignParents = Array.from({ length: 201 }, () => {
+      let parent;
+      for (let i = 0; i < 100; i++) parent = { parent };
+      return { type: 'text', value: 'x', parent };
+    });
+    bounded(() => braces[method]({ type: 'root', nodes: foreignParents }));
+    const leaf = { type: 'text', value: 'x' };
+    const dag = { type: 'root', nodes: [leaf, leaf] };
+    assert.deepEqual(braces[method](dag), method === 'expand' ? ['xx'] : 'xx', `${method} accepts an acyclic shared node`);
+    bounded(() => braces[method]({ type: 'root', nodes: Array.from({ length: 20001 }, () => ({ type: 'text', value: 'x' })) }));
+  }
+}
+
+function verifyExpansionBounds(braces) {
+  for (const input of ['{1..100001}', '{100001..1}', '{-100001..-1}', '{a,b}'.repeat(17)]) {
+    bounded(() => braces.expand(input, { rangeLimit: false }));
+  }
+  bounded(() => braces.compile('{1..300000..2}'));
+  bounded(() => braces.expand(`{${'0'.repeat(200)}1..${'0'.repeat(200)}100000}`, { rangeLimit: false }));
+  bounded(() => braces.expand('{100000000000000000000..100000000000000000001}', { rangeLimit: false }));
+  bounded(() => braces(['{a,b}'.repeat(16), '{a,b}'.repeat(16)], { expand: true }));
+  bounded(() => braces(Array(100001).fill('a')));
+}
+
+export function verifyBraces(packageRoot) {
+  const require = createRequire(import.meta.url);
+  const braces = require(path.join(packageRoot, 'index.js'));
+  assert.equal(require(path.join(packageRoot, 'package.json')).version, '3.0.3');
+  verifyCompatibility(braces);
+  verifyNestedStrings(braces);
+  verifyAstBounds(braces);
+  verifyExpansionBounds(braces);
+  return { normalPatterns: fixtures.length, depthLimit: 100, nodeLimit: 20000, expansionLimit: 100000, characterLimit: 10485760 };
+}

package/assets/security/braces@3.0.3.patch

@@ -0,0 +1,285 @@
+diff --git a/index.js b/index.js
+--- a/index.js
++++ b/index.js
+@@ -1,4 +1,6 @@
+ 'use strict';
++
++const limits = require('./lib/limits');
+ 
+ const stringify = require('./lib/stringify');
+ const compile = require('./lib/compile');
+@@ -23,11 +25,18 @@
+   let output = [];
+ 
+   if (Array.isArray(input)) {
++    if (input.length > limits.MAX_RESULTS) limits.fail();
++    let chars = 0;
+     for (const pattern of input) {
+       const result = braces.create(pattern, options);
+       if (Array.isArray(result)) {
+-        output.push(...result);
++        const size = limits.measure(result);
++        chars += size.chars;
++        if (output.length + size.count > limits.MAX_RESULTS || chars > limits.MAX_CHARS) limits.fail();
++        for (const value of result) output.push(value);
+       } else {
++        chars += String(result).length;
++        if (output.length >= limits.MAX_RESULTS || chars > limits.MAX_CHARS) limits.fail();
+         output.push(result);
+       }
+     }
+diff --git a/lib/compile.js b/lib/compile.js
+--- a/lib/compile.js
++++ b/lib/compile.js
+@@ -1,9 +1,12 @@
+ 'use strict';
++
++const limits = require('./limits');
+ 
+ const fill = require('fill-range');
+ const utils = require('./utils');
+ 
+ const compile = (ast, options = {}) => {
++  limits.ast(ast);
+   const walk = (node, parent = {}) => {
+     const invalidBlock = utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+@@ -38,6 +41,7 @@
+ 
+     if (node.nodes && node.ranges > 0) {
+       const args = utils.reduce(node.nodes);
++      limits.range(args, options, true);
+       const range = fill(...args, { ...options, wrap: false, toRegex: true, strictZeros: true });
+ 
+       if (range.length !== 0) {
+@@ -48,13 +52,14 @@
+     if (node.nodes) {
+       for (const child of node.nodes) {
+         output += walk(child, node);
++        limits.string(output);
+       }
+     }
+ 
+     return output;
+   };
+ 
+-  return walk(ast);
++  return limits.string(walk(ast));
+ };
+ 
+ module.exports = compile;
+diff --git a/lib/expand.js b/lib/expand.js
+--- a/lib/expand.js
++++ b/lib/expand.js
+@@ -1,4 +1,6 @@
+ 'use strict';
++
++const limits = require('./limits');
+ 
+ const fill = require('fill-range');
+ const stringify = require('./stringify');
+@@ -9,6 +11,7 @@
+ 
+   queue = [].concat(queue);
+   stash = [].concat(stash);
++  limits.append(queue, stash, enclose);
+ 
+   if (!stash.length) return queue;
+   if (!queue.length) {
+@@ -31,6 +34,7 @@
+ };
+ 
+ const expand = (ast, options = {}) => {
++  limits.ast(ast);
+   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
+ 
+   const walk = (node, parent = {}) => {
+@@ -61,6 +65,7 @@
+         throw new RangeError('expanded array length exceeds range limit. Use options.rangeLimit to increase or disable the limit.');
+       }
+ 
++      limits.range(args, options);
+       let range = fill(...args, options);
+       if (range.length === 0) {
+         range = stringify(node, options);
+@@ -107,7 +112,9 @@
+     return queue;
+   };
+ 
+-  return utils.flatten(walk(ast));
++  const result = utils.flatten(walk(ast));
++  limits.measure(result);
++  return result;
+ };
+ 
+ module.exports = expand;
+diff --git a/lib/limits.js b/lib/limits.js
+new file mode 100644
+--- /dev/null
++++ b/lib/limits.js
+@@ -0,0 +1,102 @@
++'use strict';
++
++// Anhedral's local 3.0.3 security backport. Limits cannot be disabled by options.
++const MAX_DEPTH = 100;
++const MAX_NODES = 20000;
++const MAX_RESULTS = 100000;
++const MAX_CHARS = 10 * 1024 * 1024;
++const fail = () => { throw new RangeError('Brace operation exceeds safe resource limits'); };
++const string = value => {
++  if (String(value).length > MAX_CHARS) fail();
++  return value;
++};
++
++const ast = root => {
++  const work = [[root, 0, false]];
++  const active = new Set();
++  const parentDepths = new Map();
++  let count = 0;
++  let chars = 0;
++  while (work.length) {
++    const [node, depth, leaving] = work.pop();
++    if (leaving) { active.delete(node); continue; }
++    if (!node || (typeof node !== 'object' && typeof node !== 'function')) throw new TypeError('Expected an AST node');
++    if (depth > MAX_DEPTH || ++count > MAX_NODES || active.has(node)) fail();
++    chars += node.value ? String(node.value).length : 0;
++    if (chars > MAX_CHARS) fail();
++    // expand follows parent links independently of the child traversal.
++    const parents = new Set();
++    let parent = node;
++    while (parent && !parentDepths.has(parent)) {
++      if (parents.has(parent) || parents.size > MAX_DEPTH) fail();
++      if (parentDepths.size + parents.size >= MAX_NODES) fail();
++      parents.add(parent);
++      parent = parent.parent;
++    }
++    let parentDepth = parent ? parentDepths.get(parent) : 0;
++    for (const value of [...parents].reverse()) {
++      if (++parentDepth > MAX_DEPTH + 1) fail();
++      parentDepths.set(value, parentDepth);
++    }
++    if (node.nodes) {
++      if (!Array.isArray(node.nodes)) throw new TypeError('Expected AST children');
++      if (node.nodes.length > MAX_NODES || work.length + node.nodes.length > MAX_NODES * 2) fail();
++      active.add(node);
++      work.push([node, depth, true]);
++      for (let i = node.nodes.length - 1; i >= 0; i--) work.push([node.nodes[i], depth + 1, false]);
++    }
++  }
++};
++
++const measure = value => {
++  const work = [[value, 0, false]];
++  const active = new Set();
++  let count = 0;
++  let chars = 0;
++  let visits = 0;
++  while (work.length) {
++    const [item, depth, leaving] = work.pop();
++    if (leaving) { active.delete(item); continue; }
++    if (depth > MAX_DEPTH || ++visits > MAX_RESULTS + MAX_NODES) fail();
++    if (Array.isArray(item)) {
++      if (active.has(item) || item.length > MAX_RESULTS || work.length + item.length > MAX_RESULTS + MAX_NODES) fail();
++      active.add(item);
++      work.push([item, depth, true]);
++      for (let i = item.length - 1; i >= 0; i--) work.push([item[i], depth + 1, false]);
++    } else if (item !== undefined) {
++      count++;
++      chars += String(item).length;
++      if (count > MAX_RESULTS || chars > MAX_CHARS) fail();
++    }
++  }
++  return { count, chars };
++};
++
++const append = (queue, stash, enclose) => {
++  const left = measure(queue);
++  const right = measure(stash);
++  const count = left.count ? left.count * right.count : right.count;
++  const chars = left.count ? left.chars * right.count + right.chars * left.count : right.chars;
++  if (count > MAX_RESULTS || chars + (enclose ? count * 2 : 0) > MAX_CHARS) fail();
++};
++
++// fill-range enumerates descending ranges too; rangeLimit:false must not bypass the cap.
++const range = (args, options, compiling = false) => {
++  const [start, end] = args;
++  const step = Math.max(Math.abs(Number(args[2] === undefined ? options.step || 1 : args[2])), 1);
++  if (compiling && step === 1) return; // Numeric regex ranges do not allocate each member.
++  let a = Number(start);
++  let b = Number(end);
++  if (!Number.isInteger(a) || !Number.isInteger(b)) {
++    if (String(start).length !== 1 || String(end).length !== 1) return;
++    a = String(start).charCodeAt(0);
++    b = String(end).charCodeAt(0);
++  }
++  if (!Number.isSafeInteger(a) || !Number.isSafeInteger(b)) fail();
++  if (!Number.isFinite(step)) return; // fill-range handles invalid steps.
++  const count = Math.floor(Math.abs(b - a) / step) + 1;
++  const width = Math.max(String(start).length, String(end).length, String(args[2] || '').length, 1);
++  if (count > MAX_RESULTS || count * (width + (compiling ? 2 : 0)) > MAX_CHARS) fail();
++};
++
++module.exports = { MAX_DEPTH, MAX_RESULTS, MAX_CHARS, fail, string, ast, measure, append, range };
+diff --git a/lib/parse.js b/lib/parse.js
+--- a/lib/parse.js
++++ b/lib/parse.js
+@@ -1,4 +1,6 @@
+ 'use strict';
++
++const limits = require('./limits');
+ 
+ const stringify = require('./stringify');
+ 
+@@ -143,6 +145,7 @@
+      */
+ 
+     if (value === CHAR_LEFT_PARENTHESES) {
++      if (stack.length >= limits.MAX_DEPTH) limits.fail();
+       block = push({ type: 'paren', nodes: [] });
+       stack.push(block);
+       push({ type: 'text', value });
+@@ -195,6 +198,7 @@
+      */
+ 
+     if (value === CHAR_LEFT_CURLY_BRACE) {
++      if (stack.length >= limits.MAX_DEPTH) limits.fail();
+       depth++;
+ 
+       const dollar = prev.value && prev.value.slice(-1) === '$' || block.dollar === true;
+@@ -325,6 +329,7 @@
+   } while (stack.length > 0);
+ 
+   push({ type: 'eos' });
++  limits.ast(ast);
+   return ast;
+ };
+ 
+diff --git a/lib/stringify.js b/lib/stringify.js
+--- a/lib/stringify.js
++++ b/lib/stringify.js
+@@ -1,8 +1,11 @@
+ 'use strict';
++
++const limits = require('./limits');
+ 
+ const utils = require('./utils');
+ 
+ module.exports = (ast, options = {}) => {
++  limits.ast(ast);
+   const stringify = (node, parent = {}) => {
+     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+@@ -22,11 +25,12 @@
+     if (node.nodes) {
+       for (const child of node.nodes) {
+         output += stringify(child);
++        limits.string(output);
+       }
+     }
+     return output;
+   };
+ 
+-  return stringify(ast);
++  return limits.string(stringify(ast));
+ };
+ 

package/assets/security/decode-uri-component@0.2.2.patch

@@ -0,0 +1,149 @@
+diff --git a/index.js b/index.js
+index 24e7db0cc55aa22d0f98358b73298067deb33b52..896c03cce865e681bc95ef0d0ed7d64b18488224 100644
+--- a/index.js
++++ b/index.js
+@@ -1,42 +1,122 @@
+ 'use strict';
+-var token = '%[a-f0-9]{2}';
+-var singleMatcher = new RegExp('(' + token + ')|([^%]+?)', 'gi');
+-var multiMatcher = new RegExp('(' + token + ')+', 'gi');
++// Matches one or more consecutive percent-encoded bytes (e.g. `%C3%A5`).
++const token = '%[a-f0-9]{2}';
++const multiMatcher = new RegExp(`(${token})+`, 'gi');
+ 
+-function decodeComponents(components, split) {
+-	try {
+-		// Try to decode the entire string first
+-		return [decodeURIComponent(components.join(''))];
+-	} catch (err) {
+-		// Do nothing
++const hexPair = /^[a-f\d]{2}$/i;
++
++// Read a `%XX` sequence at `position`, returning the byte value and where to continue scanning.
++function parsePercentByte(input, position) {
++	if (input.codePointAt(position) !== 37 || position + 3 > input.length) {
++		return;
+ 	}
+ 
+-	if (components.length === 1) {
+-		return components;
++	const digits = input.slice(position + 1, position + 3);
++
++	if (!hexPair.test(digits)) {
++		return;
+ 	}
+ 
+-	split = split || 1;
++	return {byte: Number.parseInt(digits, 16), next: position + 3};
++}
++
++/**
++ * Return how many bytes a UTF-8 code point needs based on its lead byte.
++ * Returns 0 for continuation bytes and other invalid lead bytes.
++ */
++function utf8SequenceLength(byte) {
++	if (byte <= 0x7F) {
++		return 1;
++	}
+ 
+-	// Split the array in 2 parts
+-	var left = components.slice(0, split);
+-	var right = components.slice(split);
++	// Start at 0xC2 to exclude overlong 2-byte encodings (0xC0/0xC1).
++	if (byte >= 0xC2 && byte <= 0xDF) {
++		return 2;
++	}
+ 
+-	return Array.prototype.concat.call([], decodeComponents(left), decodeComponents(right));
++	if (byte >= 0xE0 && byte <= 0xEF) {
++		return 3;
++	}
++
++	if (byte >= 0xF0 && byte <= 0xF4) {
++		return 4;
++	}
++
++	return 0;
+ }
+ 
++function isContinuationByte(byte) {
++	return byte >= 0x80 && byte <= 0xBF;
++}
++
++/**
++ * Decode as much of `input` as possible without throwing.
++ *Scans left-to-right in O(n), decoding valid UTF-8 runs and leaving the rest literal.
++ */
+ function decode(input) {
+ 	try {
+ 		return decodeURIComponent(input);
+-	} catch (err) {
+-		var tokens = input.match(singleMatcher) || [];
++	} catch {
++		let output = '';
++		let position = 0;
++
++		while (position < input.length) {
++			if (input.codePointAt(position) !== 37) {
++				output += input.charAt(position);
++				position++;
++				continue;
++			}
++
++			const firstByte = parsePercentByte(input, position);
++
++			// `%` not followed by two hex digits (e.g. `%` or `%G`).
++			if (!firstByte) {
++				output += input.charAt(position);
++				position++;
++				continue;
++			}
++
++			const sequenceLength = utf8SequenceLength(firstByte.byte);
++
++			// Continuation byte or invalid lead byte — emit one `%XX` literally.
++			if (sequenceLength === 0) {
++				output += input.slice(position, position + 3);
++				position += 3;
++				continue;
++			}
+ 
+-		for (var i = 1; i < tokens.length; i++) {
+-			input = decodeComponents(tokens, i).join('');
++			let end = firstByte.next;
++			let validSequence = true;
++
++			for (let index = 1; index < sequenceLength; index++) {
++				const nextByte = parsePercentByte(input, end);
++
++				if (!nextByte || !isContinuationByte(nextByte.byte)) {
++					validSequence = false;
++					break;
++				}
++
++				end = nextByte.next;
++			}
++
++			if (validSequence) {
++				const encodedSequence = input.slice(position, end);
++
++				try {
++					output += decodeURIComponent(encodedSequence);
++					position = end;
++					continue;
++				} catch {
++					// Invalid UTF-8 despite correct structure — emit the first byte literally.
++				}
++			}
+ 
+-			tokens = input.match(singleMatcher) || [];
++			// Missing continuation bytes or decode failure — emit the first byte literally.
++			output += input.slice(position, position + 3);
++			position += 3;
+ 		}
+ 
+-		return input;
++		return output;
+ 	}
+ }
+ 

package/assets/security/decoder-regression.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+
+// Upstream fa479da scanner backport retains the legacy CommonJS/plus API.
+export async function verifyDecoder(packageRoot) {
+  const require = createRequire(join(packageRoot, 'package.json'));
+  const decode = require(join(packageRoot, 'index.js'));
+  assert.equal(typeof decode, 'function', 'Decoder CommonJS export changed');
+  for (const [input, expected] of [
+    ['', ''], ['a+b%2Bc', 'a b+c'], ['%25', '%'], ['%2525', '%25'],
+    ['st%C3%A5le%', 'ståle%'], ['%E4%BD%A0%E5%A5%BD', '你好'],
+    ['%F0%9F%98%80', '😀'], ['%F4%8F%BF%BF', '\u{10FFFF}'],
+    ['%C2', '\uFFFD'], ['%C2%B5%C2', 'µ\uFFFD'],
+    ['%FE%FF', '\uFFFD\uFFFD'], ['%FF%FE', '\uFFFD\uFFFD'],
+    ['%F0%9F%98', '%F0%9F%98'], ['%ED%A0%80', '%ED%A0%80'],
+    ['%C0%AF', '%C0%AF'], ['%F4%90%80%80', '%F4%90%80%80'],
+    ['%C3%5A%A5', '%C3Z%A5'], ['%G0%C3%A5%ab', '%G0å%ab'],
+    ['%84%D7%25%88%90', '%84%D7%%88%90'], ['%20%20%25%80', '  %%80'],
+  ]) assert.equal(decode(input), expected, `Decoder compatibility failure: ${input}`);
+  for (const value of [undefined, null, 1, {}, [], Symbol('x')]) {
+    assert.throws(() => decode(value), TypeError);
+  }
+  // Execute hostile runs in an isolated, hard-bounded process: the old recursive
+  // fallback exhausts its stack or CPU; the scanner leaves invalid bytes literal.
+  const script = `
+    const assert = require('node:assert/strict');
+    const decode = require(${JSON.stringify(join(packageRoot, 'index.js'))});
+    assert.equal(decode('%AB'.repeat(10000)), '%AB'.repeat(10000));
+    assert.equal(decode('%C3%5A%A5'.repeat(10000)), '%C3Z%A5'.repeat(10000));
+    assert.equal(decode('%E0%80%80'.repeat(10000)), '%E0%80%80'.repeat(10000));
+  `;
+  execFileSync(process.execPath, ['--input-type=commonjs', '--eval', script], {
+    timeout: 5000, maxBuffer: 128 * 1024, stdio: 'pipe',
+  });
+}

package/assets/security/forge-regression.mjs

@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict';
+import { Buffer } from 'node:buffer';
+import { createHash, generateKeyPairSync, privateEncrypt, constants } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+
+// PR1152 validates nested DigestAlgorithm children; Anhedral also enforces empty
+// DER NULL parameters. Fixture keys never leave memory.
+export async function verifyForge(packageRoot) {
+  const require = createRequire(join(packageRoot, 'package.json'));
+  const forge = require(join(packageRoot, 'lib/index.js'));
+  const { publicKey, privateKey } = generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicExponent: 65537,
+  });
+  const key = forge.pki.publicKeyFromPem(publicKey.export({ type: 'spki', format: 'pem' }));
+  const digest = createHash('sha256').update('Anhedral RSA validation fixture').digest();
+  const asn1 = forge.asn1;
+  const node = (type, value, constructed = false) =>
+    asn1.create(asn1.Class.UNIVERSAL, type, constructed, value);
+  const oid = () => node(asn1.Type.OID, asn1.oidToDer(forge.oids.sha256).getBytes());
+  const nil = (value = '') => node(asn1.Type.NULL, value);
+  const garbage = () => node(asn1.Type.OCTETSTRING, 'unconsumed');
+  const verify = (algorithm, extraOuter = []) => {
+    const info = node(asn1.Type.SEQUENCE, [
+      node(asn1.Type.SEQUENCE, algorithm, true),
+      node(asn1.Type.OCTETSTRING, digest.toString('binary')),
+      ...extraOuter,
+    ], true);
+    const der = Buffer.from(asn1.toDer(info).getBytes(), 'binary');
+    // Use normal PKCS#1 padding, never Forge's internal padding bypass options.
+    const encoded = Buffer.concat([
+      Buffer.from([0, 1]), Buffer.alloc(256 - der.length - 3, 255), Buffer.from([0]), der,
+    ]);
+    const signature = privateEncrypt({ key: privateKey, padding: constants.RSA_NO_PADDING }, encoded);
+    return key.verify(digest.toString('binary'), signature.toString('binary'));
+  };
+  assert.equal(verify([oid(), nil()]), true, 'Valid RSA SHA-256 with NULL parameters rejected');
+  assert.equal(verify([oid()]), true, 'Valid RSA SHA-256 without parameters rejected');
+  for (const algorithm of [[oid(), nil(), garbage()], [oid(), garbage()], [oid(), nil('garbage')], [oid(), nil('\x00')]]) {
+    assert.throws(() => verify(algorithm), /valid RSASSA-PKCS1-v1_5 DigestInfo/,
+      'RSA verification accepted malformed DigestAlgorithm parameters');
+  }
+  assert.throws(() => verify([oid(), nil()], [garbage()]), /valid RSASSA-PKCS1-v1_5 DigestInfo/,
+    'RSA verification accepted an extra outer DigestInfo element');
+}