conductor-oss 0.60.19 → 0.61.0

package/node_modules/@conductor-oss/core/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "main": "dist/index.js",
   "dependencies": {
-    "yaml": "^2.8.2",
+    "yaml": "^2.9.0",
     "zod": "^4.3.6"
   },
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conductor-oss",
-  "version": "0.60.19",
+  "version": "0.61.0",
   "license": "MIT",
   "type": "module",
   "main": "dist/launcher.js",
@@ -33,13 +33,13 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@conductor-oss/core": "0.60.19",
+    "@conductor-oss/core": "0.61.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "ora": "^9.3.0",
-    "yaml": "^2.8.2",
+    "yaml": "^2.9.0",
     "zod": "^4.3.6",
-    "@clerk/nextjs": "^7.2.7",
+    "@clerk/nextjs": "^7.4.1",
     "@codemirror/commands": "^6.10.3",
     "@codemirror/lang-markdown": "^6.5.0",
     "@codemirror/language-data": "^6.5.2",
@@ -63,7 +63,7 @@
     "geist": "^1.7.0",
     "jose": "^6.1.3",
     "lucide-react": "^0.576.0",
-    "next": "^16.2.1",
+    "next": "^16.2.6",
     "puppeteer-core": "^24.38.0",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
@@ -75,9 +75,9 @@
     "xterm": "^5.3.0"
   },
   "optionalDependencies": {
-    "conductor-oss-native-darwin-universal": "0.60.19",
-    "conductor-oss-native-linux-x64": "0.60.19",
-    "conductor-oss-native-win32-x64": "0.60.19"
+    "conductor-oss-native-darwin-universal": "0.61.0",
+    "conductor-oss-native-linux-x64": "0.61.0",
+    "conductor-oss-native-win32-x64": "0.61.0"
   },
   "files": [
     "dist/",

package/web/.next/standalone/node_modules/@next/env/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next/env",
-  "version": "16.2.1",
+  "version": "16.2.6",
   "keywords": [
     "react",
     "next",

package/web/.next/standalone/node_modules/@puppeteer/browsers/lib/cjs/CLI.js

@@ -54,7 +54,7 @@ function isValidPlatform(platform) {
 }
 // If moved update release-please config
 // x-release-please-start-version
-const packageVersion = '2.13.0';
+const packageVersion = '2.13.2';
 // x-release-please-end
 /**
  * @public

package/web/.next/standalone/node_modules/@puppeteer/browsers/lib/cjs/install.js

@@ -266,7 +266,7 @@ async function runSetup(installedBrowser) {
                 return;
             }
             (0, node_child_process_1.spawnSync)(node_path_1.default.join(browserDir, 'setup.exe'), [`--configure-browser-in-directory=` + browserDir], {
-                shell: true,
+                shell: false,
             });
             // TODO: Handle error here. Currently the setup.exe sometimes
             // errors although it sets the permissions correctly.

package/web/.next/standalone/node_modules/@puppeteer/browsers/lib/esm/CLI.js

@@ -18,7 +18,7 @@ function isValidPlatform(platform) {
 }
 // If moved update release-please config
 // x-release-please-start-version
-const packageVersion = '2.13.0';
+const packageVersion = '2.13.2';
 // x-release-please-end
 /**
  * @public

package/web/.next/standalone/node_modules/@puppeteer/browsers/lib/esm/install.js

@@ -255,7 +255,7 @@ async function runSetup(installedBrowser) {
                 return;
             }
             spawnSync(path.join(browserDir, 'setup.exe'), [`--configure-browser-in-directory=` + browserDir], {
-                shell: true,
+                shell: false,
             });
             // TODO: Handle error here. Currently the setup.exe sometimes
             // errors although it sets the permissions correctly.

package/web/.next/standalone/node_modules/@puppeteer/browsers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@puppeteer/browsers",
-  "version": "2.13.0",
+  "version": "2.13.2",
   "description": "Download and launch browsers",
   "scripts": {
     "build:docs": "wireit",
@@ -116,7 +116,7 @@
     "semver": "^7.7.4"
   },
   "devDependencies": {
-    "@types/debug": "4.1.12",
+    "@types/debug": "4.1.13",
     "@types/progress": "2.0.7",
     "@types/tar-fs": "2.0.4",
     "@types/yargs": "17.0.33",

package/web/.next/standalone/node_modules/basic-ftp/dist/Client.js

@@ -6,13 +6,13 @@ const path_1 = require("path");
 const tls_1 = require("tls");
 const util_1 = require("util");
 const FtpContext_1 = require("./FtpContext");
+const netUtils_1 = require("./netUtils");
+const parseControlResponse_1 = require("./parseControlResponse");
 const parseList_1 = require("./parseList");
+const parseListMLSD_1 = require("./parseListMLSD");
 const ProgressTracker_1 = require("./ProgressTracker");
 const StringWriter_1 = require("./StringWriter");
-const parseListMLSD_1 = require("./parseListMLSD");
-const netUtils_1 = require("./netUtils");
 const transfer_1 = require("./transfer");
-const parseControlResponse_1 = require("./parseControlResponse");
 // Use promisify to keep the library compatible with Node 8.
 const fsReadDir = (0, util_1.promisify)(fs_1.readdir);
 const fsMkDir = (0, util_1.promisify)(fs_1.mkdir);
@@ -21,7 +21,8 @@ const fsOpen = (0, util_1.promisify)(fs_1.open);
 const fsClose = (0, util_1.promisify)(fs_1.close);
 const fsUnlink = (0, util_1.promisify)(fs_1.unlink);
 const defaultClientOptions = {
-    allowSeparateTransferHost: true
+    allowSeparateTransferHost: true,
+    maxListingBytes: 40 * 1024 * 1024
 };
 const LIST_COMMANDS_DEFAULT = () => ["LIST -a", "LIST"];
 const LIST_COMMANDS_MLSD = () => ["MLSD", "LIST -a", "LIST"];
@@ -34,13 +35,15 @@ class Client {
      *
      * @param timeout  Timeout in milliseconds, use 0 for no timeout. Optional, default is 30 seconds.
      */
-    constructor(timeout = 30000, options = defaultClientOptions) {
+    constructor(timeout = 30000, userOptions = defaultClientOptions) {
         this.availableListCommands = LIST_COMMANDS_DEFAULT();
+        const options = { ...defaultClientOptions, ...userOptions };
         this.ftp = new FtpContext_1.FTPContext(timeout);
         this.prepareTransfer = this._enterFirstCompatibleMode([
             transfer_1.enterPassiveModeIPv6,
             options.allowSeparateTransferHost ? transfer_1.enterPassiveModeIPv4 : transfer_1.enterPassiveModeIPv4_forceControlHostIP
         ]);
+        this.options = options;
         this.parseList = parseList_1.parseList;
         this._progressTracker = new ProgressTracker_1.ProgressTracker();
     }
@@ -514,7 +517,7 @@ class Client {
      * @protected
      */
     async _requestListWithCommand(command) {
-        const buffer = new StringWriter_1.StringWriter();
+        const buffer = new StringWriter_1.StringWriter(this.options.maxListingBytes);
         await (0, transfer_1.downloadTo)(buffer, {
             ftp: this.ftp,
             tracker: this._progressTracker,

package/web/.next/standalone/node_modules/basic-ftp/dist/FtpContext.js

@@ -17,6 +17,8 @@ exports.FTPError = FTPError;
 function doNothing() {
     /** Do nothing */
 }
+// Limit the accepted size of the control response.
+const maxControlResponseLength = 2 ** 16;
 /**
  * FTPContext holds the control and data sockets of an FTP connection and provides a
  * simplified way to interact with an FTP server, handle responses, errors and timeouts.
@@ -175,6 +177,10 @@ class FTPContext {
      * Send an FTP command without waiting for or handling the result.
      */
     send(command) {
+        // Reject control character injection attempts.
+        if (/[\r\n\0]/.test(command)) {
+            throw new Error(`Invalid command: Contains control characters. (${command})`);
+        }
         const containsPassword = command.startsWith("PASS");
         const message = containsPassword ? "> PASS ###" : `> ${command}`;
         this.log(message);
@@ -271,7 +277,11 @@ class FTPContext {
      */
     _onControlSocketData(chunk) {
         this.log(`< ${chunk}`);
-        // This chunk might complete an earlier partial response.
+        // This chunk might complete an earlier partial response. Protect against unbounded response attack.
+        if (this._partialResponse.length + chunk.length > maxControlResponseLength) {
+            this.closeWithError(new Error("FTP control response exceeded maximum allowed size"));
+            return;
+        }
         const completeResponse = this._partialResponse + chunk;
         const parsed = (0, parseControlResponse_1.parseControlResponse)(completeResponse);
         // Remember any incomplete remainder.

package/web/.next/standalone/node_modules/basic-ftp/dist/StringWriter.js

@@ -3,21 +3,27 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.StringWriter = void 0;
 const stream_1 = require("stream");
 class StringWriter extends stream_1.Writable {
-    constructor() {
-        super(...arguments);
-        this.buf = Buffer.alloc(0);
+    constructor(maxByteLength = 1 * 1024 * 1024) {
+        super();
+        this.maxByteLength = maxByteLength;
+        this.byteLength = 0;
+        this.bufs = [];
     }
     _write(chunk, _, callback) {
-        if (chunk instanceof Buffer) {
-            this.buf = Buffer.concat([this.buf, chunk]);
-            callback(null);
+        if (!(chunk instanceof Buffer)) {
+            callback(new Error("StringWriter: expects chunks of type 'Buffer'."));
+            return;
         }
-        else {
-            callback(new Error("StringWriter expects chunks of type 'Buffer'."));
+        if (this.byteLength + chunk.byteLength > this.maxByteLength) {
+            callback(new Error(`StringWriter: Maximum bytes exceeded, maxByteLength=${this.maxByteLength}.`));
+            return;
         }
+        this.byteLength += chunk.byteLength;
+        this.bufs.push(chunk);
+        callback(null);
     }
     getText(encoding) {
-        return this.buf.toString(encoding);
+        return Buffer.concat(this.bufs).toString(encoding);
     }
 }
 exports.StringWriter = StringWriter;

package/web/.next/standalone/node_modules/basic-ftp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "basic-ftp",
-  "version": "5.2.0",
+  "version": "5.3.1",
   "description": "FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.",
   "main": "dist/index",
   "types": "dist/index",
@@ -38,15 +38,15 @@
     "node": ">=10.0.0"
   },
   "devDependencies": {
-    "@eslint/eslintrc": "3.3.3",
+    "@eslint/eslintrc": "3.3.5",
     "@eslint/js": "10.0.1",
     "@types/mocha": "10.0.10",
-    "@types/node": "25.3.0",
-    "@typescript-eslint/eslint-plugin": "8.56.0",
-    "@typescript-eslint/parser": "8.56.0",
-    "eslint": "10.0.1",
-    "globals": "17.3.0",
+    "@types/node": "25.6.0",
+    "@typescript-eslint/eslint-plugin": "8.59.1",
+    "@typescript-eslint/parser": "8.59.1",
+    "eslint": "10.2.1",
+    "globals": "17.5.0",
     "mocha": "11.7.5",
-    "typescript": "5.9.3"
+    "typescript": "6.0.3"
   }
 }

package/web/.next/standalone/node_modules/ip-address/dist/common.js

@@ -2,9 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isInSubnet = isInSubnet;
 exports.isCorrect = isCorrect;
+exports.prefixLengthFromMask = prefixLengthFromMask;
 exports.numberToPaddedHex = numberToPaddedHex;
 exports.stringToPaddedHex = stringToPaddedHex;
 exports.testBit = testBit;
+const address_error_1 = require("./address-error");
 function isInSubnet(address) {
     if (this.subnetMask < address.subnetMask) {
         return false;
@@ -25,6 +27,25 @@ function isCorrect(defaultBits) {
         return this.parsedSubnet === String(this.subnetMask);
     };
 }
+/**
+ * Returns the prefix length (number of leading 1 bits) of a contiguous
+ * subnet mask. Throws `AddressError` if the mask is non-contiguous (e.g.
+ * `255.0.255.0`).
+ */
+function prefixLengthFromMask(value, totalBits) {
+    const binary = value.toString(2).padStart(totalBits, '0');
+    if (binary.length > totalBits) {
+        throw new address_error_1.AddressError('Invalid subnet mask.');
+    }
+    const firstZero = binary.indexOf('0');
+    if (firstZero === -1) {
+        return totalBits;
+    }
+    if (binary.slice(firstZero).includes('1')) {
+        throw new address_error_1.AddressError('Invalid subnet mask.');
+    }
+    return firstZero;
+}
 function numberToPaddedHex(number) {
     return number.toString(16).padStart(2, '0');
 }