depcurfew 1.4.0 → 1.4.1

package/README.md

@@ -617,7 +617,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: DevXord/depcurfew@acb23f6f7e85ffce7190593a7fc98cfb73231549 # v1.3.0
+      - uses: DevXord/depcurfew@20fcc21389f308180a2f9a3a404a486f08705c15 # v1.4.0
 ```
 <!-- END GENERATED: action-workflow -->
 

package/dist/cli.js

@@ -38,7 +38,7 @@ function dropKnownWarnings() {
 	});
 }
 dropKnownWarnings();
-import("./run-NcyQxpTd.js").then((n) => n.n).then(({ run }) => run(process.argv.slice(2), {
+import("./run-CjAxgfPK.js").then((n) => n.n).then(({ run }) => run(process.argv.slice(2), {
 	stdout: quietWhenClosed(process.stdout),
 	stderr: quietWhenClosed(process.stderr),
 	colors: {

package/dist/index.d.ts

@@ -2292,6 +2292,10 @@ interface DetectOptions {
   /** The directories listed in projects in depcurfew.json, relative to the root (decision D-137). */
   projects?: readonly string[];
 }
+/**
+ * Describes the repository at `root`. Never executes anything from the repository and never leaves it;
+ * problems with individual files become warnings.
+ */
 export declare function detectProject(root: string, tools?: readonly ToolKnowledge[], environment?: EnvironmentKnowledge, options?: DetectOptions): Detection;
 /** Every doctor rule, in the order they are documented. unreadable-config runs last, after every other rule has read its files. */
 export declare const RULES: readonly Rule[];

package/dist/index.js

@@ -1,3 +1,3 @@
-import { A as toDurationString, C as warningText, D as validatePolicy, E as parsePolicy, F as SCHEMA_URL, I as renderPolicy, L as detectProject, M as parseDuration, N as DEFAULT_POLICY, O as convertCooldown, P as POLICY_FILE, R as getVersion, S as APPLY_WARNINGS, T as formatIssue, _ as botDuration, a as toSarif, b as planRepository, c as renderText, d as scanCommandLine, f as checkSpec, g as applyProject, h as PolicyError, i as runDoctor, j as formatDuration, k as convertMinutes, l as PopularNames, m as ApplyWriteError, o as RULES, p as checkSpecs, r as runDoctorWithOsv, s as countLevels, t as run, u as queryOsv, v as loadPolicy, w as unifiedDiff, x as APPLY_ERRORS, y as planApply } from "./run-NcyQxpTd.js";
+import { A as toDurationString, C as warningText, D as validatePolicy, E as parsePolicy, F as SCHEMA_URL, I as renderPolicy, L as detectProject, M as parseDuration, N as DEFAULT_POLICY, O as convertCooldown, P as POLICY_FILE, R as getVersion, S as APPLY_WARNINGS, T as formatIssue, _ as botDuration, a as toSarif, b as planRepository, c as renderText, d as scanCommandLine, f as checkSpec, g as applyProject, h as PolicyError, i as runDoctor, j as formatDuration, k as convertMinutes, l as PopularNames, m as ApplyWriteError, o as RULES, p as checkSpecs, r as runDoctorWithOsv, s as countLevels, t as run, u as queryOsv, v as loadPolicy, w as unifiedDiff, x as APPLY_ERRORS, y as planApply } from "./run-CjAxgfPK.js";
 import { n as EXIT_OK, r as EXIT_USAGE, t as EXIT_FAILURE } from "./io-eBMDYKV0.js";
 export { APPLY_ERRORS, APPLY_WARNINGS, ApplyWriteError, DEFAULT_POLICY, EXIT_FAILURE, EXIT_OK, EXIT_USAGE, POLICY_FILE, PolicyError, PopularNames, RULES, SCHEMA_URL, applyProject, botDuration, checkSpec, checkSpecs, convertCooldown, convertMinutes, countLevels, detectProject, formatDuration, formatIssue, getVersion, loadPolicy, parseDuration, parsePolicy, planApply, planRepository, queryOsv, renderPolicy, renderText, run, runDoctor, runDoctorWithOsv, scanCommandLine, toDurationString, toSarif, unifiedDiff, validatePolicy, warningText };

package/dist/{run-NcyQxpTd.js → run-CjAxgfPK.js}

@@ -7138,7 +7138,7 @@ const uv$2 = {
 		environmentNames: release14$1.verified([{
 			prefix: "",
 			match: "exact"
-		}], CLI, "The options take their variables through clap (env = EnvVars::UV_PROJECT and the others), and clap_builder Arg::env reads the variable with env::var_os(name) (https://github.com/clap-rs/clap/blob/v4.5.40/clap_builder/src/builder/arg.rs), which outside Windows finds only that spelling, so uv_project sets nothing (decision D-143)."),
+		}], CLI, "The options take their variables through clap (env = EnvVars::UV_PROJECT and the others), and clap_builder Arg::env reads the variable with env::var_os(name) (https://github.com/clap-rs/clap/blob/v4.6.7/clap_builder/src/builder/arg.rs, the clap_builder version in the Cargo.lock of uv), which outside Windows finds only that spelling, so uv_project sets nothing (decision D-143)."),
 		registrySettings: release13.verified([
 			{
 				file: "pyproject.toml",
@@ -12276,10 +12276,6 @@ function configFiles(repository, manager, directories, project) {
 	return directories.flatMap((directory) => [...manager.configFiles.map((file) => joinPath(directory, file)).filter((file) => repository.isFile(file)), ...table !== void 0 && tomlAt(readToml(repository, joinPath(directory, project)), table) !== void 0 ? [joinPath(directory, project)] : []]).sort(byPath);
 }
 /**
-* Describes the repository at `root`. Never executes anything from the repository and never leaves it;
-* problems with individual files become warnings.
-*/
-/**
 * What the project .npmrc of the repository says about optional dependencies (omit, include and optional, as npm
 * reads them: the last line of a key wins, key[] lines add to the list), for the npm installs of CI jobs and
 * Dockerfiles, whose command line and variables override it key by key (decision D-143). The installs are read with
@@ -12326,6 +12322,10 @@ function withProjectOptional(facts, repository) {
 		}
 	};
 }
+/**
+* Describes the repository at `root`. Never executes anything from the repository and never leaves it;
+* problems with individual files become warnings.
+*/
 function detectProject(root, tools = knowledgeBase, environment$2 = environment, options = {}) {
 	const repository = new Repository(root);
 	const facts = withProjectOptional(detectionFacts(tools, environment$2), repository);
@@ -32696,7 +32696,29 @@ function wordSets(text, command, shell) {
 	for (const match of text.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?:\[[^\][]*\])?:?=/gu)) noteSet(match[1], command, shell);
 	if (![...text.matchAll(IDENTIFIERS)].some((match) => variableKey(match[0], shell) !== void 0)) return;
 	for (const match of text.matchAll(/\[([^\][]*)\]/gu)) arithmeticSets(match[1], command, shell);
-	for (const match of text.matchAll(/\$\{[A-Za-z_][A-Za-z0-9_]*(?:\[[^\][]*\])?:(?![-=+?])([^}]{0,4096})\}/gu)) arithmeticSets(match[1], command, shell);
+	offsetSets(text, command, shell);
+}
+/** The start of ${NAME:offset} or ${NAME[i]:offset}, not ${NAME:-…}, ${NAME:=…}, ${NAME:+…} or ${NAME:?…}. */
+const OFFSET_START = /\$\{[A-Za-z_][A-Za-z0-9_]*(?:\[[^\][]*\])?:(?![-=+?])/gu;
+/** The longest body of an offset whose arithmetic is read. */
+const MAX_OFFSET = 4096;
+/**
+* The arithmetic of the offsets of ${s:offset:length}: a body runs from its start to the first } after it, up to
+* MAX_OFFSET characters. Starts before the same } share it, so the body of the first of them that is short enough
+* holds the others, and it is read once: one pass, so a word of many starts without a } is read in linear time instead
+* of scanning up to MAX_OFFSET characters from each start (decision D-146).
+*/
+function offsetSets(text, command, shell) {
+	let close = -1;
+	let read = -1;
+	for (const match of text.matchAll(OFFSET_START)) {
+		const body = match.index + match[0].length;
+		if (close < body) close = text.indexOf("}", body);
+		if (close === -1) return;
+		if (close === read || close - body > MAX_OFFSET) continue;
+		arithmeticSets(text.slice(body, close), command, shell);
+		read = close;
+	}
 }
 /**
 * An assignment word (NAME=…, NAME+=…, NAME[…]=…): the name when its value is not read as written, and the names in a
@@ -49077,13 +49099,26 @@ function pinsOf(scope) {
 /** The installs a command list makes with the pinned tool. */
 const installsWith = (tool) => (command) => command.kind === "install" && command.tool === tool;
 /**
+* The one release an install spec names, read as manager-version-too-old reads npm install -g npm@<spec>: 11.19.1,
+* v11.19.1, =11.19.1 and 11.19.1+sha512... all name 11.19.1 (decision D-146); a range, a tag or a variable names none.
+*/
+function exactRelease(spec) {
+	const exact = parseVersion$1(spec);
+	if (exact !== void 0) return exact;
+	const lowest = lowestVersion(spec);
+	return lowest.kind === "exact" && lowest.prerelease === void 0 ? lowest.version : void 0;
+}
+/**
 * The tool installing a release of itself before the install (npm install -g npm@11.19.1, decision D-144): the pinned
-* release then runs there without Corepack, so nothing is reported; another release runs instead of the pin.
+* release then runs there without Corepack, so nothing is reported; another release runs instead of the pin. The spec
+* and the pin are compared as releases, not as text (decision D-146).
 */
 function ownRelease(before, pin) {
 	const own = before.filter((command) => command.kind === "upgrade" && command.tool === pin.tool && command.version !== void 0).at(-1);
 	if (own === void 0) return {};
-	return own.version === pin.version ? void 0 : { other: own };
+	const installed = exactRelease(own.version ?? "");
+	const pinned = parseVersion$1(pin.version);
+	return installed !== void 0 && pinned !== void 0 && compareVersions$3(installed, pinned) === 0 ? void 0 : { other: own };
 }
 /** The stage a Dockerfile declaration belongs to, by its name or its number from 0. */
 function stageOf(file, declaration) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "depcurfew",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "One supply-chain security policy for npm, pnpm, Yarn, Bun, Deno, uv, pip, Poetry, PDM, Pipenv, Composer, Renovate and Dependabot, plus a doctor that finds config that silently does nothing.",
   "license": "MIT",
   "author": "depcurfew",