lambda-live-debugger 1.12.7 → 1.12.9

package/node_modules/inquirer/README.md

@@ -54,21 +54,53 @@ A collection of common interactive command line user interfaces.
 
 <table>
 <tr>
-  <th>npm</th>
   <th>yarn</th>
+  <th>pnpm</th>
 </tr>
 <tr>
 <td>
 
 ```sh
-npm install inquirer
+yarn add inquirer
 ```
 
 </td>
 <td>
 
 ```sh
-yarn add inquirer
+pnpm add inquirer
+```
+
+</td>
+</tr>
+<tr>
+  <th>bun</th>
+  <th>deno</th>
+</tr>
+<tr>
+<td>
+
+```sh
+bun add inquirer
+```
+
+</td>
+<td>
+
+```sh
+deno add npm:inquirer
+```
+
+</td>
+</tr>
+<tr>
+<th colSpan="2">npm</th>
+</tr>
+<tr>
+<td colSpan="2">
+
+```sh
+npm install inquirer
 ```
 
 </td>
@@ -79,9 +111,7 @@ yarn add inquirer
 import inquirer from 'inquirer';
 
 inquirer
-  .prompt([
-    /* Pass your questions in here */
-  ])
+  .prompt([/* Pass your questions in here */])
   .then((answers) => {
     // Use user feedback for... whatever!!
   })
@@ -335,12 +365,8 @@ const prompts = new Rx.Subject();
 inquirer.prompt(prompts);
 
 // At some point in the future, push new questions
-prompts.next({
-  /* question... */
-});
-prompts.next({
-  /* question... */
-});
+prompts.next({/* question... */});
+prompts.next({/* question... */});
 
 // When you're done
 prompts.complete();

package/node_modules/inquirer/dist/index.d.ts

@@ -3,7 +3,6 @@
  * A collection of common interactive command line user interfaces.
  */
 import { Separator } from '@inquirer/prompts';
-import type { Prettify } from '@inquirer/type';
 import PromptsRunner from './ui/prompt.ts';
 import type { PromptCollection, LegacyPromptConstructor, PromptFn } from './ui/prompt.ts';
 import type { Answers, StreamOptions, QuestionMap, PromptSession, PromptModulePublicQuestion, PromptModuleSpecificQuestion, PromptModuleNamedQuestion, QuestionSequence, MergedAnswers, DictionaryAnswers } from './types.ts';
@@ -22,8 +21,8 @@ type PromptModuleApi<Prompts extends Record<string, Record<string, unknown>> = n
     restoreDefaultPrompts(): void;
 };
 export type { QuestionMap, Question, DistinctQuestion, Answers, PromptSession, } from './types.ts';
-type PromptReturnType<T> = Promise<Prettify<T>> & {
-    ui: PromptsRunner<Prettify<T>>;
+type PromptReturnType<T extends Answers> = Promise<T> & {
+    ui: PromptsRunner<T>;
 };
 /**
  * Create a new self-contained prompt module.

package/node_modules/inquirer/dist/index.js

@@ -3,7 +3,7 @@
  * A collection of common interactive command line user interfaces.
  */
 import { input, select, number, confirm, rawlist, expand, checkbox, password, editor, search, Separator, } from '@inquirer/prompts';
-import PromptsRunner from "./ui/prompt.js";
+import PromptsRunner from './ui/prompt.js';
 const builtInPrompts = {
     input,
     select,
@@ -39,12 +39,13 @@ export function createPromptModule(opt) {
     promptModule.restoreDefaultPrompts = function () {
         promptModule.prompts = { ...builtInPrompts };
     };
-    // oxlint-disable-next-line typescript/no-unsafe-type-assertion
+    // oxlint-disable-next-line typescript/no-unsafe-type-assertion, typescript/no-unnecessary-type-assertion
     return promptModule;
 }
 /**
  * Public CLI helper interface
  */
+// eslint-disable-next-line @typescript-eslint/no-generated-empty-object-type -- `Omit` intentionally resolves to `{}` when `QuestionMap` is not augmented; module augmentation of `QuestionMap` still adds custom prompt types dynamically.
 const prompt = createPromptModule();
 // Expose helper functions on the top level for easiest usage by common users
 function registerPrompt(name, newPrompt) {

package/node_modules/inquirer/dist/types.d.ts

@@ -24,7 +24,7 @@ type WidenAnswerLiterals<T> = T extends string ? string : T extends number ? num
 type MergeAnswerObjects<Base, Override> = Prettify<Omit<Base, keyof Override> & Override>;
 export type AsyncGetterFunction<T, A extends Answers> = (this: {
     async: () => (...args: [error: null | undefined, value: T] | [error: Error, value: undefined]) => void;
-}, answers: NoInfer<Prettify<Partial<A>>>) => void | T | Promise<T>;
+}, answers: NoInfer<Partial<A>>) => void | T | Promise<T>;
 type MaybeAsyncValue<T, A extends Answers> = T | AsyncGetterFunction<T, A>;
 /**
  * Allows to inject a custom question type into inquirer module.
@@ -73,9 +73,9 @@ export type CustomQuestion<A extends Answers, Q extends Record<string, Record<st
     [key in Extract<keyof Q, string>]: Readonly<QuestionWithGetters<key, Q[key], A>>;
 }[Extract<keyof Q, string>];
 export type PromptModuleSpecificQuestion<A extends Answers, Prompts extends Record<string, Record<string, any>> = never> = UnnamedDistinctQuestion<A> | CustomQuestion<A, Prompts>;
-export type PromptModuleNamedQuestion<A extends Answers, Prompts extends Record<string, Record<string, any>> = never, Flat extends Answers = A> = Prettify<PromptModuleSpecificQuestion<A, Prompts> & {
+export type PromptModuleNamedQuestion<A extends Answers, Prompts extends Record<string, Record<string, any>> = never, Flat extends Answers = A> = PromptModuleSpecificQuestion<A, Prompts> & {
     name: Extract<keyof Flat, string>;
-}>;
+};
 export type DistinctQuestion<A extends Answers = Answers> = PromptModuleNamedQuestion<A>;
 export type PromptSession<A extends Answers = Answers, Q extends Question<A> = Question<A>> = readonly Q[] | Record<string, Omit<Q, 'name'>> | Observable<Q> | Q;
 export type QuestionSequence<Q> = Q | readonly Q[] | Observable<Q>;

package/node_modules/inquirer/dist/ui/prompt.js

@@ -4,7 +4,7 @@ import runAsync from 'run-async';
 import MuteStream from 'mute-stream';
 import { AbortPromptError } from '@inquirer/core';
 import { cursorShow } from '@inquirer/ansi';
-import { EMPTY, createObservableController, isObservableLike, observableToAsyncIterable, } from "../utils/observable.js";
+import { EMPTY, createObservableController, isObservableLike, observableToAsyncIterable, } from '../utils/observable.js';
 export const _ = {
     set: (obj, path = '', value) => {
         let pointer = obj;
@@ -212,8 +212,9 @@ export default class PromptsRunner {
                     reject(new AbortPromptError({ cause: signal.reason }));
                     return;
                 }
-                // oxlint-disable-next-line typescript/no-unsafe-type-assertion
+                /* oxlint-disable typescript/no-unsafe-type-assertion */
                 const rl = readline.createInterface(setupReadlineOptions(opt));
+                /* oxlint-enable typescript/no-unsafe-type-assertion */
                 /**
                  * Handle the ^C exit
                  */

package/node_modules/inquirer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inquirer",
-  "version": "14.0.2",
+  "version": "14.2.5",
   "description": "A collection of common interactive command line user interfaces.",
   "keywords": [
     "answer",
@@ -41,7 +41,7 @@
     "yo",
     "zsh"
   ],
-  "homepage": "https://github.com/SBoudrias/Inquirer.js/blob/main/packages/inquirer/README.md",
+  "homepage": "https://github.com/SBoudrias/Inquirer.js/blob/HEAD/packages/inquirer/README.md",
   "license": "MIT",
   "author": "Simon Boudrias <admin@simonboudrias.com>",
   "repository": {
@@ -67,17 +67,18 @@
     "tsc": "tsc"
   },
   "dependencies": {
-    "@inquirer/ansi": "^2.0.7",
-    "@inquirer/core": "^11.2.1",
-    "@inquirer/prompts": "^8.5.2",
-    "@inquirer/type": "^4.0.7",
+    "@inquirer/ansi": "^2.0.10",
+    "@inquirer/core": "^12.0.6",
+    "@inquirer/prompts": "^8.7.5",
+    "@inquirer/type": "4.2.1",
     "mute-stream": "^3.0.0",
     "run-async": "^4.0.6"
   },
   "devDependencies": {
+    "@repo/tsconfig": "0.0.0",
     "@types/mute-stream": "^0.0.4",
     "rxjs": "^7.8.2",
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   },
   "peerDependencies": {
     "@types/node": ">=18"
@@ -92,5 +93,5 @@
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
-  "gitHead": "bfd8710229e3d3c9784bef3bbfbd84c7bd09bb9e"
+  "gitHead": "672b77f0486388d7f5c35487d89a5ff63f4c54dd"
 }

package/node_modules/is-unsafe/README.md

@@ -41,6 +41,15 @@ When `@nodable/entities` resolves `&xss;`, it produces a raw string containing `
 npm install is-unsafe
 ```
 
+> **Always check the final string.** If your code builds a value by concatenating parts, call `isUnsafe` on the *result*, not on the pieces. Two harmless strings can become unsafe only once joined:
+>
+> ```js
+> const a = 'java', b = 'script:alert(1)';
+> isUnsafe(a, HTML);      // false
+> isUnsafe(b, HTML);      // false
+> isUnsafe(a + b, HTML);  // true  ← check this one
+> ```
+
 ---
 
 ## Quick start
@@ -175,8 +184,28 @@ const result = whyUnsafe('https://api.internal/admin', INTERNAL_RULES);
 
 Without setting `.label`, `MatchResult.context` will be `'CUSTOM'`.
 
+#### Entity decoding (v2.0.3+)
+
+The built-in `HTML`, `XML` and `SVG` contexts test each rule against both the raw string and an entity-decoded copy, because browsers decode character references (`:`, `:`, `:`, `	`, `
`) before interpreting a URL.
+
+A custom `PatternList` does **not** do this by default. Set `decodeEntities` to opt in:
+
+```js
+const INTERNAL_RULES = [
+  { id: 'no-js-url', description: 'Blocks javascript: URLs', pattern: /javascript:/i },
+];
+
+isUnsafe('javascript:alert(1)', INTERNAL_RULES);   // false (raw match only)
+
+INTERNAL_RULES.decodeEntities = true;
+isUnsafe('javascript:alert(1)', INTERNAL_RULES);   // true  (decoded copy also tested)
+```
+
+Enable it only for markup contexts. Leave it off for SQL, shell, log and similar rules, which should match the string exactly as supplied.
 ---
 
+
+
 ### `VALID_CONTEXTS`
 
 A convenience object that re-exports all contexts under their canonical names. Useful for tooling or exhaustive checks across all contexts.
@@ -214,7 +243,7 @@ XSS vectors when a string is rendered as HTML:
 | `html-data-svg` | `data:image/svg+xml` URI |
 | `html-inline-event-handler` | `onclick=`, `onerror=`, `onload=`, etc. |
 | `html-entity-obfuscated-script` | `<script`, `<script`, `<script` |
-| `html-entity-obfuscated-javascript` | Hex/decimal entity encoding of `javascript:` |
+| `html-entity-obfuscated-javascript` | Entity-encoded leading letters of `javascript:` (colon/letter/tab encodings are also caught — see *Entity decoding* below) |
 | `html-style-expression` | CSS `expression()` — IE code execution |
 | `html-object-embed` | `<object>` and `<embed>` tags |
 | `html-base-tag` | `<base href=` — relative URL hijacking |
@@ -225,6 +254,10 @@ XSS vectors when a string is rendered as HTML:
 
 ---
 
+**Entity decoding (HTML, XML, SVG).** Browsers decode character references before interpreting a URL, so `javascript&#58;alert(1)` is a `javascript:` URL. These three contexts therefore test every rule against the raw input **and** an entity-decoded copy. Decoded forms: decimal/hex numeric references (any leading zeros, semicolon optional), `&colon;`, `&Tab;`, `&NewLine;`. Named references are case-sensitive and need `;`. `&amp;` is intentionally not decoded (double-encoded text renders as text). Other contexts (SQL, SHELL, LOG, …) are matched byte-for-byte.
+
+---
+
 ### `XML`
 
 Parser-level attacks in XML documents (distinct from HTML XSS):

package/node_modules/is-unsafe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "is-unsafe",
-  "version": "2.0.0",
+  "version": "2.0.3",
   "description": "Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across HTML, XML, SVG, SQL, SHELL, and REGEX contexts",
   "type": "module",
   "main": "./src/index.js",
@@ -38,7 +38,7 @@
     "type": "git",
     "url": "https://github.com/NaturalIntelligence/is-unsafe"
   },
-  "author": "Amit Gupta (https://solothought.work/)",
+  "author": "Amit Gupta (https://solothought.com/)",
   "license": "MIT",
   "funding": [
     {
@@ -47,7 +47,7 @@
     }
   ],
   "devDependencies": {
-    "jasmine": "^5.1.0"
+    "jasmine": "^6.3.0"
   },
   "files": [
     "src/",

package/node_modules/is-unsafe/src/contexts/xml.js

@@ -56,7 +56,8 @@ const XML_PATTERNS = [
   {
     id: 'xml-namespace-confusion',
     description: 'xmlns: attribute injection — can redefine namespaces to confuse parsers',
-    pattern: /\bxmlns\s*(?::\w{1,40})?\s*=/i,
+    // pattern: /\bxmlns\s*(?::\w{1,40})?\s*=/i,
+    pattern: /\bxmlns(?::\w{1,40})?\s*=/i,
   },
   {
     id: 'xml-comment-injection',

package/node_modules/is-unsafe/src/index.d.ts

@@ -23,7 +23,15 @@ export interface Rule {
  * whyUnsafe('danger', MY_RULES); // → { context: 'MY_CONTEXT', ... }
  * ```
  */
-export type PatternList = Rule[] & { label?: string };
+export type PatternList = Rule[] & {
+  label?: string;
+  /**
+   * When `true`, each rule is tested against the raw input AND a copy with
+   * HTML character references decoded (numeric, hex, :, 	, 
).
+   * Set on HTML, XML and SVG. Leave unset for non-markup contexts.
+   */
+  decodeEntities?: boolean;
+};
 
 /**
  * Valid context argument:

package/node_modules/is-unsafe/src/index.js

@@ -27,6 +27,11 @@ export { default as LOG     } from './contexts/log.js';
 import SQL_STRICT from './contexts/sql-strict.js';
 export { SQL_STRICT };
 
+// Markup contexts are also matched against an entity-decoded copy of the input,
+// because browsers decode HTML character references before interpreting a URL
+// scheme (e.g. javascript:… is a javascript: URL).
+import decodeEntities from './util/decode-entities.js';
+
 // ─── VALID_CONTEXTS convenience re-export ─────────────────────────────────
 // Importing this pulls in ALL contexts. Use it only when you need all of them
 // (e.g. for validation UI, tooling, or exhaustive audits).
@@ -49,6 +54,12 @@ import LOG     from './contexts/log.js';
 HTML.label       = 'HTML';
 XML.label        = 'XML';
 SVG.label        = 'SVG';
+
+// Markup contexts: also test an entity-decoded copy (see util/decode-entities.js).
+// Non-markup contexts (SQL, SHELL, LOG, …) are matched byte-for-byte as supplied.
+HTML.decodeEntities = true;
+XML.decodeEntities  = true;
+SVG.decodeEntities  = true;
 SQL.label        = 'SQL';
 SQL_STRICT.label = 'SQL-STRICT';
 SHELL.label      = 'SHELL';
@@ -143,6 +154,20 @@ function normalise(context) {
   return { lists: [context], regex: null };
 }
 
+/**
+ * For markup contexts, return an entity-decoded copy of `value` to test
+ * alongside the raw input, or null when there is nothing extra to test.
+ *
+ * @param {string} value
+ * @param {Rule[]} list
+ * @returns {string|null}
+ */
+function decodedCopy(value, list) {
+  if (!list.decodeEntities) return null;
+  const decoded = decodeEntities(value);
+  return decoded === value ? null : decoded;
+}
+
 /**
  * Test value against a single PatternList. Returns the first MatchResult or null.
  *
@@ -152,8 +177,9 @@ function normalise(context) {
  */
 function matchList(value, list) {
   const label = list.label ?? 'CUSTOM';
+  const decoded = decodedCopy(value, list);
   for (const rule of list) {
-    if (rule.pattern.test(value)) {
+    if (rule.pattern.test(value) || (decoded !== null && rule.pattern.test(decoded))) {
       return { context: label, id: rule.id, description: rule.description, pattern: rule.pattern };
     }
   }
@@ -251,8 +277,9 @@ function allUnsafe(value, context) {
 
   for (const list of lists) {
     const label = list.label ?? 'CUSTOM';
+    const decoded = decodedCopy(value, list);
     for (const rule of list) {
-      if (rule.pattern.test(value)) {
+      if (rule.pattern.test(value) || (decoded !== null && rule.pattern.test(decoded))) {
         results.push({ context: label, id: rule.id, description: rule.description, pattern: rule.pattern });
       }
     }

package/node_modules/is-unsafe/src/util/decode-entities.js

@@ -0,0 +1,48 @@
+/**
+ * Decode the HTML character references that matter for markup-context
+ * detection.
+ *
+ * Browsers decode character references in attribute values before they
+ * interpret a URL, so `javascript:alert(1)` in an href is the
+ * `javascript:` scheme. The HTML/XML/SVG rules match literal characters, so
+ * without this step such payloads slip through.
+ *
+ * Deliberately NOT a full entity decoder. It decodes only:
+ *   - decimal refs  :  :  :  &#58   (any leading zeros,
+ *                   trailing ; optional — browsers accept both)
+ *   - hex refs      : : : &#x3a   (same)
+ *   - named refs    :  	  

+ *       Named refs are CASE-SENSITIVE and REQUIRE the trailing ';', exactly
+ *       like a browser (so `:` and `&colon` are not decoded).
+ *       	 / 
 matter because the URL parser strips tab/newline,
+ *       so `java	script:` is still a javascript: URL.
+ *
+ * It does NOT decode & (single pass only), so double-encoded text such as
+ * "<script>" stays literal — a browser renders that as text.
+ *
+ * All quantifiers are bounded; no ReDoS risk.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+const NAMED = Object.freeze({
+  colon: ':',
+  Tab: '\t',
+  NewLine: '\n',
+});
+
+const ENTITY_RE =
+  /&(?:#[xX]0*([0-9a-fA-F]{1,6});?|#0*([0-9]{1,7});?|([a-zA-Z][a-zA-Z0-9]{1,15});)/g;
+
+export default function decodeEntities(input) {
+  if (input.indexOf('&') === -1) return input;
+
+  return input.replace(ENTITY_RE, (match, hex, dec, name) => {
+    if (name !== undefined) {
+      return Object.prototype.hasOwnProperty.call(NAMED, name) ? NAMED[name] : match;
+    }
+    const cp = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);
+    if (!Number.isFinite(cp) || cp > 0x10ffff) return match;
+    return String.fromCodePoint(cp);
+  });
+}

package/node_modules/strnum/CHANGELOG.md

@@ -1,4 +1,16 @@
 
+**2.5.1 / 2026-10-10**
+- fix - enotation and leading zero cases with surrounding spaces
+
+**2.5.0 / 2026-10-10**
+- fix: lib should return original non-infinity non-numeric strings
+
+**2.4.2 / 2026-08-14**
+- fix: trimZeros to avoid quadratic complexity
+
+**2.4.1 / 2026-06-18**
+- deps: update anynum to 1.0.1
+
 **2.4.0 / 2026-06-09**
 - support unicode numerals using 'anynum'
 

package/node_modules/strnum/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strnum",
-  "version": "2.4.1",
+  "version": "2.5.1",
   "description": "Parse String to Number based on configuration",
   "type": "module",
   "main": "strnum.js",

package/node_modules/strnum/strnum.js

@@ -37,8 +37,10 @@ export default function toNumber(str, options = {}) {
         return parse_int(trimmedStr, 2);
     } else if (options.octal && octRegex.test(trimmedStr)) {
         return parse_int(trimmedStr, 8);
-    } else if (!isFinite(trimmedStr)) { //Infinity
-        return handleInfinity(str, Number(trimmedStr), options);
+    } else if (!isFinite(trimmedStr)) { //Infinity or not a number
+        const num = Number(trimmedStr);
+        if (Number.isNaN(num)) return str; //not a number: always the original string
+        return handleInfinity(str, num, options); //only +/-Infinity reaches here
     } else if (trimmedStr.includes('e') || trimmedStr.includes('E')) { //eNotation
         return resolveEnotation(str, trimmedStr, options);
     } else {
@@ -50,8 +52,8 @@ export default function toNumber(str, options = {}) {
             const leadingZeros = match[2];
             let numTrimmedByZeros = trimZeros(match[3]); //complete num without leading zeros
             const decimalAdjacentToLeadingZeros = sign ? // 0., -00., 000.
-                str[leadingZeros.length + 1] === "."
-                : str[leadingZeros.length] === ".";
+                trimmedStr[leadingZeros.length + 1] === "."
+                : trimmedStr[leadingZeros.length] === ".";
 
             //trim ending zeros for floating number
             if (!options.leadingZeros //leading zeros are not allowed
@@ -99,8 +101,8 @@ function resolveEnotation(str, trimmedStr, options) {
         const eChar = notation[3].indexOf("e") === -1 ? "E" : "e";
         const leadingZeros = notation[2];
         const eAdjacentToLeadingZeros = sign ? // 0E.
-            str[leadingZeros.length + 1] === eChar
-            : str[leadingZeros.length] === eChar;
+            trimmedStr[leadingZeros.length + 1] === eChar
+            : trimmedStr[leadingZeros.length] === eChar;
 
         if (leadingZeros.length > 1 && eAdjacentToLeadingZeros) return str;
         else if (leadingZeros.length === 1
@@ -109,8 +111,7 @@ function resolveEnotation(str, trimmedStr, options) {
         } else if (leadingZeros.length > 0) {
             // Has leading zeros — only accept if leadingZeros option allows it
             if (options.leadingZeros && !eAdjacentToLeadingZeros) {
-                trimmedStr = (notation[1] || "") + notation[3];
-                return Number(trimmedStr);
+                return Number(trimmedStr); // Number() accepts leading zeros; stripping can leave a mantissa-less ".e0"
             } else return str;
         } else {
             // No leading zeros — always valid e-notation, parse it
@@ -128,7 +129,11 @@ function resolveEnotation(str, trimmedStr, options) {
  */
 function trimZeros(numStr) {
     if (numStr && numStr.indexOf(".") !== -1) {//float
-        numStr = numStr.replace(/0+$/, ""); //remove ending zeros
+        //remove ending zeros without the O(n^2) backtracking that /0+$/ hits
+        //when the string doesn't end in 0 but has a long internal zero-run
+        let end = numStr.length;
+        while (end > 0 && numStr.charCodeAt(end - 1) === 48 /* '0' */) end--;
+        numStr = numStr.slice(0, end);
         if (numStr === ".") numStr = "0";
         else if (numStr[0] === ".") numStr = "0" + numStr;
         else if (numStr[numStr.length - 1] === ".") numStr = numStr.substring(0, numStr.length - 1);
@@ -168,4 +173,4 @@ function handleInfinity(str, num, options) {
         default:
             return str; // Return original string like "1e1000"
     }
-}
+}