git-watchtower 1.11.5 → 1.11.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "1.11.5",
+  "version": "1.11.7",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/polling/engine.js

@@ -87,7 +87,7 @@ function sortBranches(branches, prStatusMap) {
     if (!aMerged && bMerged && !a.isDeleted) return -1;
     if (a.isNew && !b.isNew) return -1;
     if (!a.isNew && b.isNew) return 1;
-    return b.date - a.date;
+    return (b.date || 0) - (a.date || 0);
   });
 }
 

package/src/utils/version-check.js

@@ -38,6 +38,12 @@ function compareVersions(a, b) {
   return 0;
 }
 
+/**
+ * Maximum response body size for npm registry queries (64 KiB).
+ * The expected response is a small JSON object (~200 bytes).
+ */
+const MAX_RESPONSE_SIZE = 64 * 1024;
+
 /**
  * Check npm registry for a newer version of git-watchtower
  * @returns {Promise<string|null>} Latest version string if newer, or null
@@ -54,7 +60,16 @@ function checkForUpdate() {
           return;
         }
         let data = '';
-        res.on('data', (chunk) => { data += chunk; });
+        let size = 0;
+        res.on('data', (chunk) => {
+          size += chunk.length;
+          if (size > MAX_RESPONSE_SIZE) {
+            req.destroy();
+            resolve(null);
+            return;
+          }
+          data += chunk;
+        });
         res.on('end', () => {
           try {
             const { version } = JSON.parse(data);