helm-env-delta 1.15.0 → 1.15.2

package/README.md

@@ -66,7 +66,7 @@ HelmEnvDelta (`hed`) automates environment synchronization for GitOps workflows
 
 ⚡ **High Performance** - Intelligent caching and parallel processing. Formatting rules, compiled regexes, and array normalization are all cached for fast repeated runs.
 
-🔐 **Security Hardened** - Regex inputs (stop rules, transforms, pattern files) are validated against ReDoS (catastrophic backtracking). Fixed values are validated against prototype pollution attacks.
+🔐 **Security Hardened** - Regex inputs (stop rules, transforms, pattern files) are validated against ReDoS (catastrophic backtracking) — covers nested quantifiers, optional groups, and alternation patterns. Fixed values and YAML file content are guarded against prototype pollution. HTML report paths are HTML-escaped to prevent XSS from filename transforms.
 
 🔔 **Auto Updates** - Notifies when newer versions are available (skips in CI/CD).
 
@@ -428,7 +428,7 @@ requiredVersion: '1.10.0' # Optional: Minimum tool version required to process t
 
 **Note:** Source and destination paths cannot resolve to the same folder.
 
-**`requiredVersion`:** When set, the CLI checks that the installed version of helm-env-delta meets this minimum. If the installed version is older, the CLI exits immediately with a clear upgrade message. This prevents running configs that depend on newer features with an outdated tool version. Supports `"1.2.3"` or `"v1.2.3"` format.
+**`requiredVersion`:** When set, the CLI checks that the installed version of helm-env-delta meets this minimum. If the installed version is older, the CLI exits immediately with a clear upgrade message. This prevents running configs that depend on newer features with an outdated tool version. Supports `"1.2.3"` or `"v1.2.3"` format. Setting `requiredVersion` also suppresses the auto-update notification — a pinned version requirement signals intentional version targeting.
 
 ---
 
@@ -680,7 +680,7 @@ stopRules:
 
 **Override:** Use `--force` to bypass stop rules when needed.
 
-**Regex safety:** All `regex` patterns (inline and from files) are validated against catastrophic backtracking (ReDoS). Patterns with nested quantifiers on groups (e.g., `(a+)+`) are rejected at config load time.
+**Regex safety:** All `regex` patterns (inline and from files) are validated against catastrophic backtracking (ReDoS). Rejected patterns include: nested quantifiers on groups (e.g., `(a+)+`), optional groups with inner quantifiers (e.g., `(a+)?`), and alternation groups with outer repetition (e.g., `(a|ab)*`).
 
 **Visibility:** Stop rule violations appear in console output, JSON reports, and HTML reports (dry-run mode only, as a collapsible table in the header area).
 

package/dist/index.js

@@ -78,6 +78,8 @@ const main = async () => {
         (0, node_fs_1.writeFileSync)(firstRunMarker, new Date().toISOString());
     }
     const config = (0, config_1.loadConfigFile)(command.config, command.quiet, logger, { formatOnly: command.formatOnly });
+    if (config.requiredVersion)
+        configHasRequiredVersion = true;
     if (command.showConfig) {
         console.log(chalk_1.default.cyan('\n⚙️  Resolved Configuration:\n'));
         console.log(YAML.stringify(config, { indent: 2 }));
@@ -354,6 +356,7 @@ const main = async () => {
     if (command.diffJson)
         (0, reporters_1.generateJsonReport)(diffResult, formattedFiles, validationResult, syncConfig, command.dryRun, package_json_1.default.version);
 };
+let configHasRequiredVersion = false;
 (async () => {
     try {
         await main();
@@ -393,7 +396,7 @@ const main = async () => {
     }
     finally {
         const command = (0, commandLine_1.parseCommandLine)();
-        if (!command.quiet)
+        if (!command.quiet && !configHasRequiredVersion)
             void (0, versionChecker_1.checkForUpdates)(package_json_1.default.version);
     }
 })();

package/dist/pipeline/fileUpdater.js

@@ -115,8 +115,9 @@ const deepMerge = (fullTarget, filteredSource, filteredTarget, currentPath = [],
         const fullTargetObject = fullTarget;
         const filteredTargetObject = filteredTarget || {};
         const result = { ...sourceObject };
+        const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
         for (const [key, value] of Object.entries(fullTargetObject))
-            if (!(key in filteredTargetObject) && !(key in sourceObject))
+            if (!DANGEROUS_KEYS.has(key) && !(key in filteredTargetObject) && !(key in sourceObject))
                 result[key] = value;
         for (const [key, value] of Object.entries(sourceObject))
             if (key in fullTargetObject)

package/dist/reporters/htmlReporter.js

@@ -51,13 +51,13 @@ const countDiffLines = (unifiedDiff) => {
 };
 const generateFileSummary = (file) => {
     if (!file.originalPath)
-        return file.path;
-    return `<span class="filename-transform">${file.originalPath} → ${file.path}</span>`;
+        return (0, treeRenderer_1.escapeHtml)(file.path);
+    return `<span class="filename-transform">${(0, treeRenderer_1.escapeHtml)(file.originalPath)} → ${(0, treeRenderer_1.escapeHtml)(file.path)}</span>`;
 };
 const generateAddedFileSummary = (file) => {
     if (!file.originalPath)
-        return file.path;
-    return `<span class="filename-transform">${file.originalPath} → ${file.path}</span>`;
+        return (0, treeRenderer_1.escapeHtml)(file.path);
+    return `<span class="filename-transform">${(0, treeRenderer_1.escapeHtml)(file.originalPath)} → ${(0, treeRenderer_1.escapeHtml)(file.path)}</span>`;
 };
 const JUMP_TO_SIDEBAR_ICON = `<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 16 16" fill="currentColor" aria-hidden="true"><path d="M2 2h3v12H2V2zm0-1a1 1 0 0 0-1 1v12a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1V2a1 1 0 0 0-1-1H2zm5 4h7v1H7V5zm0 3h7v1H7V8zm0 3h5v1H7v-1z"/></svg>`;
 const generateAddedFileSection = (file, fileId, open) => {

package/dist/suggestionEngine.js

@@ -548,9 +548,9 @@ const calculateLevenshteinDistance = (string1, string2) => {
         matrix[0][col] = col;
     for (let row = 1; row <= string2.length; row++)
         for (let col = 1; col <= string1.length; col++)
-            if (string2.charAt(row - 1) === string1.charAt(col - 1))
-                matrix[row][col] = matrix[row - 1][col - 1];
-            else
-                matrix[row][col] = Math.min(matrix[row - 1][col - 1] + 1, matrix[row][col - 1] + 1, matrix[row - 1][col] + 1);
+            matrix[row][col] =
+                string2.charAt(row - 1) === string1.charAt(col - 1)
+                    ? matrix[row - 1][col - 1]
+                    : Math.min(matrix[row - 1][col - 1] + 1, matrix[row][col - 1] + 1, matrix[row - 1][col] + 1);
     return matrix[string2.length][string1.length];
 };

package/dist/utils/gitFilter.js

@@ -63,7 +63,7 @@ const getGitModifiedPaths = async (git, author, days, absoluteSourceDirectory) =
     }
 };
 const filterFileMapsByGitAuthor = async (sourceFiles, destinationFiles, absoluteSourceDirectory, author, days) => {
-    const git = (0, simple_git_1.default)();
+    const git = (0, simple_git_1.default)(absoluteSourceDirectory);
     const gitRoot = await getGitRoot(git);
     const gitModifiedPaths = await getGitModifiedPaths(git, author, days, absoluteSourceDirectory);
     const matchingKeys = new Set();

package/dist/utils/regexSafety.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isSafeRegex = void 0;
 const isSafeRegex = (pattern) => {
-    if (/\([^()]*[*+][^()]*\)[*+{]/.test(pattern))
+    if (/\([^()]*[*+][^()]*\)[*+?{]/.test(pattern))
+        return false;
+    if (/\([^()]*\|[^()]*\)[*+{]/.test(pattern))
         return false;
     return true;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "helm-env-delta",
-  "version": "1.15.0",
+  "version": "1.15.2",
   "description": "HelmEnvDelta – environment-aware YAML delta and sync for GitOps",
   "author": "BCsabaEngine",
   "license": "ISC",
@@ -67,27 +67,27 @@
     "@eslint/js": "^10.0.1",
     "@types/node": "^25.5.0",
     "@types/picomatch": "^4.0.2",
-    "@typescript-eslint/eslint-plugin": "^8.57.1",
-    "@vitest/coverage-v8": "^4.1.0",
-    "eslint": "^10.0.3",
+    "@typescript-eslint/eslint-plugin": "^8.57.2",
+    "@vitest/coverage-v8": "^4.1.2",
+    "eslint": "^10.1.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-simple-import-sort": "^12.1.1",
-    "eslint-plugin-unicorn": "^63.0.0",
+    "eslint-plugin-unicorn": "^64.0.0",
     "prettier": "^3.8.1",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.0"
+    "vitest": "^4.1.2"
   },
   "dependencies": {
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
-    "diff": "^8.0.3",
+    "diff": "^8.0.4",
     "diff2html": "3.4.56",
     "open": "^11.0.0",
-    "picomatch": "^4.0.3",
+    "picomatch": "^4.0.4",
     "simple-git": "^3.33.0",
     "tinyglobby": "^0.2.15",
-    "yaml": "^2.8.2",
+    "yaml": "^2.8.3",
     "zod": "^4.3.6"
   }
 }