helm-env-delta 1.15.1 → 1.15.3

package/README.md

@@ -66,7 +66,7 @@ HelmEnvDelta (`hed`) automates environment synchronization for GitOps workflows
 
 ⚡ **High Performance** - Intelligent caching and parallel processing. Formatting rules, compiled regexes, and array normalization are all cached for fast repeated runs.
 
-🔐 **Security Hardened** - Regex inputs (stop rules, transforms, pattern files) are validated against ReDoS (catastrophic backtracking). Fixed values are validated against prototype pollution attacks.
+🔐 **Security Hardened** - Regex inputs (stop rules, transforms, pattern files) are validated against ReDoS (catastrophic backtracking) — covers nested quantifiers, optional groups, and alternation patterns. Fixed values and YAML file content are guarded against prototype pollution. HTML report paths are HTML-escaped to prevent XSS from filename transforms.
 
 🔔 **Auto Updates** - Notifies when newer versions are available (skips in CI/CD).
 
@@ -428,7 +428,7 @@ requiredVersion: '1.10.0' # Optional: Minimum tool version required to process t
 
 **Note:** Source and destination paths cannot resolve to the same folder.
 
-**`requiredVersion`:** When set, the CLI checks that the installed version of helm-env-delta meets this minimum. If the installed version is older, the CLI exits immediately with a clear upgrade message. This prevents running configs that depend on newer features with an outdated tool version. Supports `"1.2.3"` or `"v1.2.3"` format.
+**`requiredVersion`:** When set, the CLI checks that the installed version of helm-env-delta meets this minimum. If the installed version is older, the CLI exits immediately with a clear upgrade message. This prevents running configs that depend on newer features with an outdated tool version. Supports `"1.2.3"` or `"v1.2.3"` format. Setting `requiredVersion` also suppresses the auto-update notification — a pinned version requirement signals intentional version targeting.
 
 ---
 
@@ -680,7 +680,7 @@ stopRules:
 
 **Override:** Use `--force` to bypass stop rules when needed.
 
-**Regex safety:** All `regex` patterns (inline and from files) are validated against catastrophic backtracking (ReDoS). Patterns with nested quantifiers on groups (e.g., `(a+)+`) are rejected at config load time.
+**Regex safety:** All `regex` patterns (inline and from files) are validated against catastrophic backtracking (ReDoS). Rejected patterns include: nested quantifiers on groups (e.g., `(a+)+`), optional groups with inner quantifiers (e.g., `(a+)?`), and alternation groups with outer repetition (e.g., `(a|ab)*`).
 
 **Visibility:** Stop rule violations appear in console output, JSON reports, and HTML reports (dry-run mode only, as a collapsible table in the header area).
 

package/dist/consoleFormatter.js

@@ -4,18 +4,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatProgressMessage = exports.colorizeFileOperation = exports.formatStopRuleViolation = exports.formatBox = void 0;
-const chalk_1 = __importDefault(require("chalk"));
+const ansi_colors_1 = __importDefault(require("ansi-colors"));
 const formatBox = (title, content, style = 'info', width = 60) => {
     const getColorFunction = (boxStyle) => {
         switch (boxStyle) {
             case 'success':
-                return chalk_1.default.green;
+                return ansi_colors_1.default.green;
             case 'warning':
-                return chalk_1.default.yellow;
+                return ansi_colors_1.default.yellow;
             case 'error':
-                return chalk_1.default.red;
+                return ansi_colors_1.default.red;
             default:
-                return chalk_1.default.cyan;
+                return ansi_colors_1.default.cyan;
         }
     };
     const colorFunction = getColorFunction(style);
@@ -44,7 +44,7 @@ const formatStopRuleViolation = (violation, mode) => {
         return violationMode === 'error' ? 'error' : 'warning';
     };
     const labelWidth = 10;
-    const formatLabel = (label) => chalk_1.default.dim(label.padEnd(labelWidth));
+    const formatLabel = (label) => ansi_colors_1.default.dim(label.padEnd(labelWidth));
     const content = [
         `${formatLabel('File:')} ${violation.file}`,
         `${formatLabel('Path:')} ${violation.path}`,
@@ -61,13 +61,13 @@ const colorizeFileOperation = (operation, filePath, isDryRun, alreadyDeleted = f
     const getOperationDisplay = (op) => {
         switch (op) {
             case 'add':
-                return { symbol: '+', verb: 'add', colorFn: chalk_1.default.green };
+                return { symbol: '+', verb: 'add', colorFn: ansi_colors_1.default.green };
             case 'update':
-                return { symbol: '~', verb: 'update', colorFn: chalk_1.default.yellow };
+                return { symbol: '~', verb: 'update', colorFn: ansi_colors_1.default.yellow };
             case 'delete':
-                return { symbol: '-', verb: 'delete', colorFn: chalk_1.default.red };
+                return { symbol: '-', verb: 'delete', colorFn: ansi_colors_1.default.red };
             case 'format':
-                return { symbol: '≈', verb: 'format', colorFn: chalk_1.default.cyan };
+                return { symbol: '≈', verb: 'format', colorFn: ansi_colors_1.default.cyan };
         }
     };
     const { symbol, verb, colorFn } = getOperationDisplay(operation);
@@ -91,9 +91,9 @@ const formatProgressMessage = (message, style) => {
     const getColorFunction = (progressStyle) => {
         switch (progressStyle) {
             case 'success':
-                return chalk_1.default.green;
+                return ansi_colors_1.default.green;
             default:
-                return chalk_1.default.cyan;
+                return ansi_colors_1.default.cyan;
         }
     };
     const icon = getIcon(style);

package/dist/index.js

@@ -40,7 +40,7 @@ const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
 const node_path_1 = __importDefault(require("node:path"));
-const chalk_1 = __importDefault(require("chalk"));
+const ansi_colors_1 = __importDefault(require("ansi-colors"));
 const YAML = __importStar(require("yaml"));
 const package_json_1 = __importDefault(require("../package.json"));
 const commandLine_1 = require("./commandLine");
@@ -60,7 +60,7 @@ const versionChecker_1 = require("./utils/versionChecker");
 const main = async () => {
     const command = (0, commandLine_1.parseCommandLine)();
     if (command.noColor)
-        chalk_1.default.level = 0;
+        ansi_colors_1.default.enabled = false;
     const verbosityLevel = command.verbose ? 'verbose' : command.quiet ? 'quiet' : 'normal';
     const logger = new logger_1.Logger({ level: verbosityLevel, isDiffJson: command.diffJson });
     logger.log(`Now you run ${package_json_1.default.name} v${package_json_1.default.version}...`);
@@ -68,18 +68,20 @@ const main = async () => {
     const firstRunMarker = node_path_1.default.join(configDirectory, 'first-run');
     const isFirstRun = !(0, node_fs_1.existsSync)(firstRunMarker);
     if (isFirstRun && !command.quiet) {
-        console.log(chalk_1.default.cyan('\n👋 First time using helm-env-delta?\n'));
-        console.log(chalk_1.default.dim('  Tips:'));
-        console.log(chalk_1.default.dim('  • Always use --dry-run first to preview changes'));
-        console.log(chalk_1.default.dim('  • Use --diff-html to review diffs in your browser'));
-        console.log(chalk_1.default.dim('  • See examples: https://github.com/balazscsaba2006/helm-env-delta/tree/main/example'));
-        console.log(chalk_1.default.dim('  • Run with --help to see all options\n'));
+        console.log(ansi_colors_1.default.cyan('\n👋 First time using helm-env-delta?\n'));
+        console.log(ansi_colors_1.default.dim('  Tips:'));
+        console.log(ansi_colors_1.default.dim('  • Always use --dry-run first to preview changes'));
+        console.log(ansi_colors_1.default.dim('  • Use --diff-html to review diffs in your browser'));
+        console.log(ansi_colors_1.default.dim('  • See examples: https://github.com/balazscsaba2006/helm-env-delta/tree/main/example'));
+        console.log(ansi_colors_1.default.dim('  • Run with --help to see all options\n'));
         (0, node_fs_1.mkdirSync)(configDirectory, { recursive: true });
         (0, node_fs_1.writeFileSync)(firstRunMarker, new Date().toISOString());
     }
     const config = (0, config_1.loadConfigFile)(command.config, command.quiet, logger, { formatOnly: command.formatOnly });
+    if (config.requiredVersion)
+        configHasRequiredVersion = true;
     if (command.showConfig) {
-        console.log(chalk_1.default.cyan('\n⚙️  Resolved Configuration:\n'));
+        console.log(ansi_colors_1.default.cyan('\n⚙️  Resolved Configuration:\n'));
         console.log(YAML.stringify(config, { indent: 2 }));
         return;
     }
@@ -93,9 +95,9 @@ const main = async () => {
         const warningResult = (0, config_1.validateConfigWarnings)(validationConfig);
         let hasAnyWarnings = warningResult.hasWarnings;
         if (warningResult.hasWarnings) {
-            console.warn(chalk_1.default.yellow('\n⚠️  Configuration Warnings (non-fatal):\n'));
+            console.warn(ansi_colors_1.default.yellow('\n⚠️  Configuration Warnings (non-fatal):\n'));
             for (const warning of warningResult.warnings)
-                console.warn(chalk_1.default.yellow(`  • ${warning}`));
+                console.warn(ansi_colors_1.default.yellow(`  • ${warning}`));
         }
         logger.log('\n' + (0, consoleFormatter_1.formatProgressMessage)('Loading files for validation...', 'loading'));
         const sourceResult = await (0, pipeline_1.loadFiles)({
@@ -133,12 +135,12 @@ const main = async () => {
         const usageResult = (0, pipeline_1.validatePatternUsage)(validationConfig, sourceFiles, destinationFiles);
         hasAnyWarnings = hasAnyWarnings || usageResult.hasWarnings;
         if (usageResult.hasWarnings) {
-            console.warn(chalk_1.default.yellow('\n⚠️  Pattern Usage Warnings (non-fatal):\n'));
+            console.warn(ansi_colors_1.default.yellow('\n⚠️  Pattern Usage Warnings (non-fatal):\n'));
             for (const warning of usageResult.warnings) {
-                const contextString = warning.context ? chalk_1.default.dim(` (${warning.context})`) : '';
-                console.warn(chalk_1.default.yellow(`  • ${warning.message}${contextString}`));
+                const contextString = warning.context ? ansi_colors_1.default.dim(` (${warning.context})`) : '';
+                console.warn(ansi_colors_1.default.yellow(`  • ${warning.message}${contextString}`));
                 if (warning.hint)
-                    console.warn(chalk_1.default.dim(`    Hint: ${warning.hint}`));
+                    console.warn(ansi_colors_1.default.dim(`    Hint: ${warning.hint}`));
             }
         }
         if (hasAnyWarnings)
@@ -159,7 +161,7 @@ const main = async () => {
     }
     if (command.formatOnly) {
         if (!config.outputFormat) {
-            logger.log(chalk_1.default.yellow('\n⚠️  No outputFormat configured. Nothing to format.'));
+            logger.log(ansi_colors_1.default.yellow('\n⚠️  No outputFormat configured. Nothing to format.'));
             return;
         }
         logger.log('\n' + (0, consoleFormatter_1.formatProgressMessage)('Loading destination files...', 'loading'));
@@ -174,10 +176,10 @@ const main = async () => {
         logger.progress(`Loaded ${destinationFiles.size} destination file(s)`, 'success');
         if (command.listFiles) {
             const filesList = [...destinationFiles.keys()].toSorted();
-            console.log(chalk_1.default.cyan('\n📋 Files to be formatted:\n'));
-            console.log(chalk_1.default.yellow(`Destination files: ${filesList.length}`));
+            console.log(ansi_colors_1.default.cyan('\n📋 Files to be formatted:\n'));
+            console.log(ansi_colors_1.default.yellow(`Destination files: ${filesList.length}`));
             for (const file of filesList)
-                console.log(`  ${chalk_1.default.dim(file)}`);
+                console.log(`  ${ansi_colors_1.default.dim(file)}`);
             return;
         }
         logger.log('\n' + (0, consoleFormatter_1.formatProgressMessage)('Formatting files...', 'info'));
@@ -263,13 +265,13 @@ const main = async () => {
     if (command.listFiles) {
         const sourceFilesList = [...sourceFiles.keys()].toSorted();
         const destinationFilesList = [...destinationFiles.keys()].toSorted();
-        console.log(chalk_1.default.cyan('\n📋 Files to be synced:\n'));
-        console.log(chalk_1.default.green(`Source files: ${sourceFilesList.length}`));
+        console.log(ansi_colors_1.default.cyan('\n📋 Files to be synced:\n'));
+        console.log(ansi_colors_1.default.green(`Source files: ${sourceFilesList.length}`));
         for (const file of sourceFilesList)
-            console.log(`  ${chalk_1.default.dim(file)}`);
-        console.log(chalk_1.default.yellow(`\nDestination files: ${destinationFilesList.length}`));
+            console.log(`  ${ansi_colors_1.default.dim(file)}`);
+        console.log(ansi_colors_1.default.yellow(`\nDestination files: ${destinationFilesList.length}`));
         for (const file of destinationFilesList)
-            console.log(`  ${chalk_1.default.dim(file)}`);
+            console.log(`  ${ansi_colors_1.default.dim(file)}`);
         return;
     }
     logger.log('\n' + (0, consoleFormatter_1.formatProgressMessage)('Computing differences...', 'info'));
@@ -290,13 +292,13 @@ const main = async () => {
         try {
             const suggestions = (0, suggestionEngine_1.analyzeDifferencesForSuggestions)(diffResult, syncConfig, command.suggestThreshold);
             const yaml = (0, suggestionEngine_1.formatSuggestionsAsYaml)(suggestions);
-            console.log(chalk_1.default.cyan('\n💡 Suggested Configuration:\n'));
+            console.log(ansi_colors_1.default.cyan('\n💡 Suggested Configuration:\n'));
             console.log(yaml);
             if (suggestions.metadata.changedFiles === 0)
-                console.log(chalk_1.default.yellow('\nℹ️  No changes detected. Files are already in sync.'));
+                console.log(ansi_colors_1.default.yellow('\nℹ️  No changes detected. Files are already in sync.'));
             else {
-                console.log(chalk_1.default.dim('\n---'));
-                console.log(chalk_1.default.dim('💡 Tip: Copy relevant sections to your config.yaml and test with --dry-run'));
+                console.log(ansi_colors_1.default.dim('\n---'));
+                console.log(ansi_colors_1.default.dim('💡 Tip: Copy relevant sections to your config.yaml and test with --dry-run'));
             }
             return;
         }
@@ -324,29 +326,29 @@ const main = async () => {
             process.exit(1);
         }
     if (!command.dryRun && !command.quiet) {
-        console.log(chalk_1.default.cyan('\n📊 Sync Summary:'));
-        console.log(chalk_1.default.dim('─'.repeat(60)));
-        console.log(`  ${chalk_1.default.green('Added:')}     ${diffResult.addedFiles.length} files`);
-        console.log(`  ${chalk_1.default.yellow('Changed:')}   ${diffResult.changedFiles.length} files`);
-        console.log(`  ${chalk_1.default.red('Deleted:')}   ${diffResult.deletedFiles.length} files (${syncConfig.prune ? 'prune enabled' : 'prune disabled'})`);
-        console.log(`  ${chalk_1.default.blue('Unchanged:')} ${diffResult.unchangedFiles.length} files`);
-        console.log(chalk_1.default.dim('─'.repeat(60)));
+        console.log(ansi_colors_1.default.cyan('\n📊 Sync Summary:'));
+        console.log(ansi_colors_1.default.dim('─'.repeat(60)));
+        console.log(`  ${ansi_colors_1.default.green('Added:')}     ${diffResult.addedFiles.length} files`);
+        console.log(`  ${ansi_colors_1.default.yellow('Changed:')}   ${diffResult.changedFiles.length} files`);
+        console.log(`  ${ansi_colors_1.default.red('Deleted:')}   ${diffResult.deletedFiles.length} files (${syncConfig.prune ? 'prune enabled' : 'prune disabled'})`);
+        console.log(`  ${ansi_colors_1.default.blue('Unchanged:')} ${diffResult.unchangedFiles.length} files`);
+        console.log(ansi_colors_1.default.dim('─'.repeat(60)));
         if (diffResult.deletedFiles.length > 0 && syncConfig.prune) {
-            console.warn(chalk_1.default.red('⚠️  Warning: Prune is enabled. The following files will be permanently deleted:'));
+            console.warn(ansi_colors_1.default.red('⚠️  Warning: Prune is enabled. The following files will be permanently deleted:'));
             for (const f of diffResult.deletedFiles)
-                console.warn(chalk_1.default.red(`    - ${f}`));
+                console.warn(ansi_colors_1.default.red(`    - ${f}`));
         }
         if (syncConfig.confirmationDelay > 0) {
             const totalSeconds = Math.ceil(syncConfig.confirmationDelay / 1000);
-            console.log(chalk_1.default.dim('\nPress Ctrl+C to cancel.\n'));
+            console.log(ansi_colors_1.default.dim('\nPress Ctrl+C to cancel.\n'));
             for (let remaining = totalSeconds; remaining > 0; remaining--) {
-                process.stdout.write(chalk_1.default.dim(`  Proceeding in ${remaining}s...\r`));
+                process.stdout.write(ansi_colors_1.default.dim(`  Proceeding in ${remaining}s...\r`));
                 await new Promise((resolve) => setTimeout(resolve, 1000));
             }
             process.stdout.write(' '.repeat(40) + '\r');
         }
         else
-            console.log(chalk_1.default.dim('\nPress Ctrl+C to cancel, or use --dry-run to preview changes first.\n'));
+            console.log(ansi_colors_1.default.dim('\nPress Ctrl+C to cancel, or use --dry-run to preview changes first.\n'));
     }
     const formattedFiles = await (0, pipeline_1.updateFiles)(diffResult, sourceFiles, destinationFiles, syncConfig, command.dryRun, command.skipFormat, logger);
     if (command.diffHtml && !command.quiet)
@@ -354,6 +356,7 @@ const main = async () => {
     if (command.diffJson)
         (0, reporters_1.generateJsonReport)(diffResult, formattedFiles, validationResult, syncConfig, command.dryRun, package_json_1.default.version);
 };
+let configHasRequiredVersion = false;
 (async () => {
     try {
         await main();
@@ -393,7 +396,7 @@ const main = async () => {
     }
     finally {
         const command = (0, commandLine_1.parseCommandLine)();
-        if (!command.quiet)
+        if (!command.quiet && !configHasRequiredVersion)
             void (0, versionChecker_1.checkForUpdates)(package_json_1.default.version);
     }
 })();

package/dist/pipeline/fileUpdater.js

@@ -115,8 +115,9 @@ const deepMerge = (fullTarget, filteredSource, filteredTarget, currentPath = [],
         const fullTargetObject = fullTarget;
         const filteredTargetObject = filteredTarget || {};
         const result = { ...sourceObject };
+        const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
         for (const [key, value] of Object.entries(fullTargetObject))
-            if (!(key in filteredTargetObject) && !(key in sourceObject))
+            if (!DANGEROUS_KEYS.has(key) && !(key in filteredTargetObject) && !(key in sourceObject))
                 result[key] = value;
         for (const [key, value] of Object.entries(sourceObject))
             if (key in fullTargetObject)

package/dist/reporters/browserLauncher.js

@@ -1,37 +1,4 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -46,7 +13,7 @@ exports.BrowserLauncherError = BrowserLauncherError;
 exports.isBrowserLauncherError = (0, errors_1.createErrorTypeGuard)(BrowserLauncherError);
 const openInBrowser = async (filePath) => {
     try {
-        const openModule = await Promise.resolve().then(() => __importStar(require('open')));
+        const openModule = await import('open');
         const open = openModule.default;
         const absolutePath = node_path_1.default.resolve(filePath);
         await open(absolutePath);

package/dist/reporters/consoleDiffReporter.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.showConsoleDiff = void 0;
-const chalk_1 = __importDefault(require("chalk"));
+const ansi_colors_1 = __importDefault(require("ansi-colors"));
 const pipeline_1 = require("../pipeline");
 const diffGenerator_1 = require("../utils/diffGenerator");
 const fileType_1 = require("../utils/fileType");
@@ -14,36 +14,36 @@ const colorizeUnifiedDiff = (diff) => {
         .split('\n')
         .map((line) => {
         if (line.startsWith('+') && !line.startsWith('+++'))
-            return chalk_1.default.green(line);
+            return ansi_colors_1.default.green(line);
         if (line.startsWith('-') && !line.startsWith('---'))
-            return chalk_1.default.red(line);
+            return ansi_colors_1.default.red(line);
         if (line.startsWith('@@'))
-            return chalk_1.default.cyan(line);
-        return chalk_1.default.gray(line);
+            return ansi_colors_1.default.cyan(line);
+        return ansi_colors_1.default.gray(line);
     })
         .join('\n');
 };
 const formatAddedFiles = (files) => {
     if (files.length === 0)
         return '';
-    const header = chalk_1.default.green.bold(`\nAdded Files (${files.length}):`);
-    const fileList = files.map((file) => chalk_1.default.green(`  + ${file.path}`)).join('\n');
+    const header = ansi_colors_1.default.green.bold(`\nAdded Files (${files.length}):`);
+    const fileList = files.map((file) => ansi_colors_1.default.green(`  + ${file.path}`)).join('\n');
     return `${header}\n${fileList}\n`;
 };
 const formatDeletedFiles = (files) => {
     if (files.length === 0)
         return '';
-    const header = chalk_1.default.red.bold(`\nDeleted Files (${files.length}):`);
-    const fileList = files.map((file) => chalk_1.default.red(`  - ${file}`)).join('\n');
+    const header = ansi_colors_1.default.red.bold(`\nDeleted Files (${files.length}):`);
+    const fileList = files.map((file) => ansi_colors_1.default.red(`  - ${file}`)).join('\n');
     return `${header}\n${fileList}\n`;
 };
 const formatChangedFile = (file, config) => {
     const isYaml = (0, fileType_1.isYamlFile)(file.path);
-    const separator = chalk_1.default.yellow('━'.repeat(60));
+    const separator = ansi_colors_1.default.yellow('━'.repeat(60));
     const skipPaths = (0, pipeline_1.getSkipPathsForFile)(file.path, config.skipPath);
     const skipPathInfo = skipPaths.length > 0
-        ? chalk_1.default.dim(`SkipPath patterns applied: ${skipPaths.join(', ')}`)
-        : chalk_1.default.dim('No skipPath patterns applied');
+        ? ansi_colors_1.default.dim(`SkipPath patterns applied: ${skipPaths.join(', ')}`)
+        : ansi_colors_1.default.dim('No skipPath patterns applied');
     const destinationContent = isYaml
         ? (0, serialization_1.serializeForDiff)(file.processedDestContent, true)
         : String(file.processedDestContent);
@@ -54,7 +54,7 @@ const formatChangedFile = (file, config) => {
     const colorizedDiff = colorizeUnifiedDiff(unifiedDiff);
     return `
 ${separator}
-${chalk_1.default.yellow.bold(`File: ${file.path}`)}
+${ansi_colors_1.default.yellow.bold(`File: ${file.path}`)}
 ${skipPathInfo}
 
 ${colorizedDiff}
@@ -63,39 +63,39 @@ ${colorizedDiff}
 const formatChangedFiles = (files, config) => {
     if (files.length === 0)
         return '';
-    const header = chalk_1.default.yellow.bold(`\nChanged Files (${files.length}):`);
+    const header = ansi_colors_1.default.yellow.bold(`\nChanged Files (${files.length}):`);
     const fileContent = files.map((file) => formatChangedFile(file, config)).join('\n');
     return `${header}\n${fileContent}`;
 };
 const formatSummaryBox = (diffResult, pruneEnabled) => {
     const width = 60;
-    const topBorder = chalk_1.default.cyan(`╭─ Diff Summary ${'─'.repeat(width - 14)}╮`);
-    const bottomBorder = chalk_1.default.cyan(`╰${'─'.repeat(width + 1)}╯`);
-    const addedLine = chalk_1.default.cyan(`│  ${chalk_1.default.green('✚ Added:')}     ${diffResult.addedFiles.length.toString().padEnd(width - 15)} │`);
-    const changedLine = chalk_1.default.cyan(`│  ${chalk_1.default.yellow('✎ Changed:')}   ${diffResult.changedFiles.length.toString().padEnd(width - 15)} │`);
+    const topBorder = ansi_colors_1.default.cyan(`╭─ Diff Summary ${'─'.repeat(width - 14)}╮`);
+    const bottomBorder = ansi_colors_1.default.cyan(`╰${'─'.repeat(width + 1)}╯`);
+    const addedLine = ansi_colors_1.default.cyan(`│  ${ansi_colors_1.default.green('✚ Added:')}     ${diffResult.addedFiles.length.toString().padEnd(width - 15)} │`);
+    const changedLine = ansi_colors_1.default.cyan(`│  ${ansi_colors_1.default.yellow('✎ Changed:')}   ${diffResult.changedFiles.length.toString().padEnd(width - 15)} │`);
     const deletedText = pruneEnabled
         ? `${diffResult.deletedFiles.length} (prune enabled)`
         : `${diffResult.deletedFiles.length} (prune disabled)`;
-    const deletedLine = chalk_1.default.cyan(`│  ${chalk_1.default.red('✖ Deleted:')}   ${deletedText.padEnd(width - 15)} │`);
-    const unchangedLine = chalk_1.default.cyan(`│  ${chalk_1.default.gray('✓ Unchanged:')} ${diffResult.unchangedFiles.length.toString().padEnd(width - 15)} │`);
+    const deletedLine = ansi_colors_1.default.cyan(`│  ${ansi_colors_1.default.red('✖ Deleted:')}   ${deletedText.padEnd(width - 15)} │`);
+    const unchangedLine = ansi_colors_1.default.cyan(`│  ${ansi_colors_1.default.gray('✓ Unchanged:')} ${diffResult.unchangedFiles.length.toString().padEnd(width - 15)} │`);
     return `${topBorder}\n${addedLine}\n${changedLine}\n${deletedLine}\n${unchangedLine}\n${bottomBorder}\n`;
 };
 const showConsoleDiff = (diffResult, config) => {
     console.log('');
     console.log(formatSummaryBox(diffResult, config.prune));
-    console.log(chalk_1.default.bold('\nInclude patterns:'), config.include.join(', '));
-    console.log(chalk_1.default.bold('Exclude patterns:'), config.exclude.length > 0 ? config.exclude.join(', ') : chalk_1.default.dim('(none)'));
+    console.log(ansi_colors_1.default.bold('\nInclude patterns:'), config.include.join(', '));
+    console.log(ansi_colors_1.default.bold('Exclude patterns:'), config.exclude.length > 0 ? config.exclude.join(', ') : ansi_colors_1.default.dim('(none)'));
     if (diffResult.addedFiles.length === 0 &&
         diffResult.changedFiles.length === 0 &&
         diffResult.deletedFiles.length === 0) {
         const totalCompared = diffResult.unchangedFiles.length;
         const hasSkipPath = config.skipPath && Object.keys(config.skipPath).length > 0;
-        const skipNote = hasSkipPath ? chalk_1.default.dim(' (some paths may be excluded via skipPath)') : '';
+        const skipNote = hasSkipPath ? ansi_colors_1.default.dim(' (some paths may be excluded via skipPath)') : '';
         if (totalCompared === 0)
-            console.log(chalk_1.default.yellow.bold('\n⚠ No files matched the include/exclude patterns\n'));
+            console.log(ansi_colors_1.default.yellow.bold('\n⚠ No files matched the include/exclude patterns\n'));
         else
-            console.log(chalk_1.default.green.bold(`\n✓ No differences found`) +
-                chalk_1.default.dim(` — ${totalCompared} file(s) compared, all identical`) +
+            console.log(ansi_colors_1.default.green.bold(`\n✓ No differences found`) +
+                ansi_colors_1.default.dim(` — ${totalCompared} file(s) compared, all identical`) +
                 skipNote +
                 '\n');
         return;

package/dist/reporters/htmlReporter.js

@@ -51,13 +51,13 @@ const countDiffLines = (unifiedDiff) => {
 };
 const generateFileSummary = (file) => {
     if (!file.originalPath)
-        return file.path;
-    return `<span class="filename-transform">${file.originalPath} → ${file.path}</span>`;
+        return (0, treeRenderer_1.escapeHtml)(file.path);
+    return `<span class="filename-transform">${(0, treeRenderer_1.escapeHtml)(file.originalPath)} → ${(0, treeRenderer_1.escapeHtml)(file.path)}</span>`;
 };
 const generateAddedFileSummary = (file) => {
     if (!file.originalPath)
-        return file.path;
-    return `<span class="filename-transform">${file.originalPath} → ${file.path}</span>`;
+        return (0, treeRenderer_1.escapeHtml)(file.path);
+    return `<span class="filename-transform">${(0, treeRenderer_1.escapeHtml)(file.originalPath)} → ${(0, treeRenderer_1.escapeHtml)(file.path)}</span>`;
 };
 const JUMP_TO_SIDEBAR_ICON = `<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 16 16" fill="currentColor" aria-hidden="true"><path d="M2 2h3v12H2V2zm0-1a1 1 0 0 0-1 1v12a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1V2a1 1 0 0 0-1-1H2zm5 4h7v1H7V5zm0 3h7v1H7V8zm0 3h5v1H7v-1z"/></svg>`;
 const generateAddedFileSection = (file, fileId, open) => {

package/dist/suggestionEngine.js

@@ -548,9 +548,9 @@ const calculateLevenshteinDistance = (string1, string2) => {
         matrix[0][col] = col;
     for (let row = 1; row <= string2.length; row++)
         for (let col = 1; col <= string1.length; col++)
-            if (string2.charAt(row - 1) === string1.charAt(col - 1))
-                matrix[row][col] = matrix[row - 1][col - 1];
-            else
-                matrix[row][col] = Math.min(matrix[row - 1][col - 1] + 1, matrix[row][col - 1] + 1, matrix[row - 1][col] + 1);
+            matrix[row][col] =
+                string2.charAt(row - 1) === string1.charAt(col - 1)
+                    ? matrix[row - 1][col - 1]
+                    : Math.min(matrix[row - 1][col - 1] + 1, matrix[row][col - 1] + 1, matrix[row - 1][col] + 1);
     return matrix[string2.length][string1.length];
 };

package/dist/utils/regexSafety.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isSafeRegex = void 0;
 const isSafeRegex = (pattern) => {
-    if (/\([^()]*[*+][^()]*\)[*+{]/.test(pattern))
+    if (/\([^()]*[*+][^()]*\)[*+?{]/.test(pattern))
+        return false;
+    if (/\([^()]*\|[^()]*\)[*+{]/.test(pattern))
         return false;
     return true;
 };

package/dist/utils/versionChecker.js

@@ -5,7 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkForUpdates = exports.isNewerVersion = exports.parseVersion = exports.isVersionCheckerError = exports.VersionCheckerError = void 0;
 const node_https_1 = __importDefault(require("node:https"));
-const chalk_1 = __importDefault(require("chalk"));
+const ansi_colors_1 = __importDefault(require("ansi-colors"));
 const package_json_1 = __importDefault(require("../../package.json"));
 const errors_1 = require("./errors");
 const VersionCheckerErrorClass = (0, errors_1.createErrorClass)('Version Checker Error', {
@@ -102,8 +102,8 @@ const fetchLatestVersion = (packageName, timeout) => {
     });
 };
 const displayUpdateNotification = (currentVersion, latestVersion) => {
-    console.log('\n' + chalk_1.default.yellow(`⚠ Update available! v${currentVersion} → v${latestVersion}`));
-    console.log(chalk_1.default.yellow('Run: npm install -g helm-env-delta@latest'));
+    console.log('\n' + ansi_colors_1.default.yellow(`⚠ Update available! v${currentVersion} → v${latestVersion}`));
+    console.log(ansi_colors_1.default.yellow('Run: npm install -g helm-env-delta@latest'));
 };
 const checkForUpdates = async (currentVersion) => {
     if (isCiEnvironment())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "helm-env-delta",
-  "version": "1.15.1",
+  "version": "1.15.3",
   "description": "HelmEnvDelta – environment-aware YAML delta and sync for GitOps",
   "author": "BCsabaEngine",
   "license": "ISC",
@@ -65,29 +65,30 @@
   ],
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^25.5.0",
-    "@types/picomatch": "^4.0.2",
-    "@typescript-eslint/eslint-plugin": "^8.57.1",
-    "@vitest/coverage-v8": "^4.1.0",
-    "eslint": "^10.0.3",
+    "@types/ansi-colors": "^3.2.0",
+    "@types/node": "^25.5.2",
+    "@types/picomatch": "^4.0.3",
+    "@typescript-eslint/eslint-plugin": "^8.58.0",
+    "@vitest/coverage-v8": "^4.1.2",
+    "eslint": "^10.2.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-simple-import-sort": "^12.1.1",
-    "eslint-plugin-unicorn": "^63.0.0",
+    "eslint-plugin-simple-import-sort": "^13.0.0",
+    "eslint-plugin-unicorn": "^64.0.0",
     "prettier": "^3.8.1",
     "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.0"
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.2"
   },
   "dependencies": {
-    "chalk": "^5.6.2",
+    "ansi-colors": "^4.1.3",
     "commander": "^14.0.3",
-    "diff": "^8.0.3",
+    "diff": "^8.0.4",
     "diff2html": "3.4.56",
     "open": "^11.0.0",
-    "picomatch": "^4.0.3",
-    "simple-git": "^3.33.0",
+    "picomatch": "^4.0.4",
+    "simple-git": "^3.35.2",
     "tinyglobby": "^0.2.15",
-    "yaml": "^2.8.2",
+    "yaml": "^2.8.3",
     "zod": "^4.3.6"
   }
 }