lambda-live-debugger 1.12.8 → 1.12.9

package/node_modules/xml-naming/README.md

@@ -1,4 +1,7 @@
 # xml-naming
+[![xml-naming downloads](https://img.shields.io/npm/dw/xml-naming.svg)](https://npm-compare.com/xml-naming) 
+[![xml-naming version](https://img.shields.io/npm/v/xml-naming.svg)](https://www.npmjs.com/package/xml-naming)
+[![xml-naming license](https://img.shields.io/npm/l/xml-naming.svg)](https://github.com/NaturalIntelligence/xml-naming)
 
 Validates XML name productions as defined in the [XML 1.0](https://www.w3.org/TR/xml/) and [XML 1.1](https://www.w3.org/TR/xml11/) specifications.
 
@@ -71,6 +74,88 @@ name('\uD800\uDC00', { xmlVersion: '1.1' })  // true
 
 ---
 
+### ASCII-only fast path
+
+All validators, `validate`, `validateAll`, and `sanitize` also accept `{ asciiOnly: true }`.
+When set, matching is restricted to the ASCII subset of the NameStartChar/NameChar
+productions and skips unicode-aware regex matching entirely — no `\u00C0-\uFFFD`-style
+ranges, and (for XML 1.1) no `/u` regex flag. Unicode-aware regexes are measurably slower
+than plain ASCII matching in JS engines, so this is a real performance win when you know
+your input is ASCII-only, which is the common case for HTML/SVG ids and most XML tags.
+
+**This is opt-in and defaults to `false`** for backward compatibility: turning it on
+changes behavior, since it rejects legitimate non-ASCII XML names that would otherwise be
+valid. Only enable it when you control the input and know it's ASCII (e.g. internal
+identifiers, machine-generated names), not for validating arbitrary user- or
+externally-supplied XML/SVG content.
+
+```js
+import { name, sanitize } from 'xml-naming';
+
+name('café', { asciiOnly: true })   // false — 'é' is not ASCII, even though it's
+name('café')                        //  true    a valid XML 1.0/1.1 NameChar
+
+sanitize('café', 'name', { asciiOnly: true })  // 'caf_' — non-ASCII replaced too
+sanitize('café', 'name')                       // 'café' — left untouched by default
+```
+
+---
+
+### Memoized validator (`createValidator`)
+
+Real documents tend to reuse a small vocabulary of tag/attribute names across many
+siblings (`id`, `class`, `href`, ... repeated across hundreds of elements). Calling the
+plain boolean validators re-runs the regex on every call, even for names seen before.
+
+`createValidator(production, opts)` returns a memoized validator function: `xmlVersion`
+and `asciiOnly` are fixed at creation time (so the regex is resolved once, not per call),
+and repeated inputs after the first are served from an internal cache instead of
+re-matching the regex.
+
+```js
+import { createValidator } from 'xml-naming';
+
+const isQName = createValidator('qName', { xmlVersion: '1.0' });
+
+isQName('sku');   // false → regex test (cache miss), result cached
+isQName('sku');   // false → cache hit, no regex run
+```
+
+Use one instance per document/parse (or reuse across a session — your choice), rather
+than creating one per call:
+
+```js
+// e.g. inside a parser, once per parse call:
+const isValidTag = createValidator('qName', { asciiOnly: true });
+
+for (const tagName of tagNames) {
+  if (!isValidTag(tagName)) throw new Error(`Invalid tag name: ${tagName}`);
+}
+```
+
+Because the validator is a plain function, this loop already gets short-circuit
+behaviour (via `break`/`throw` on first failure) and zero extra allocation on the happy
+path — no separate "bulk" API is needed for that.
+
+**Cache bound:** the internal cache is capped by `maxCacheSize` (default `2048`). Once
+the cap is reached, new distinct strings are still validated correctly, they're just no
+longer cached — existing cached entries keep being served. This keeps memory bounded
+even against high-cardinality or adversarial input (e.g. externally-supplied names that
+never repeat), without the cost of a full LRU or the perf cliff of reset-and-refill.
+
+Call `.reset()` on the returned function to clear the cache manually, e.g. between
+unrelated parse calls if you're reusing one validator instance across a long-running
+process:
+
+```js
+isQName.reset();
+```
+
+The cache is private to each `createValidator()` instance — there's no shared/global
+cache, so unrelated callers never interfere with each other.
+
+---
+
 ### Diagnostic validation
 
 ```js
@@ -169,21 +254,34 @@ sanitize('my element', 'name', { replacement: '-' })  // 'my-element'
 
 `opts`:
 - `xmlVersion`: `'1.0'` (default) | `'1.1'`
+- `asciiOnly`: boolean (default `false`) — ASCII-only fast path, see above
+
+### `createValidator(production, opts?)` → memoized `(str) => boolean`, with `.reset()`
+
+`opts`:
+- `xmlVersion`: `'1.0'` (default) | `'1.1'`
+- `asciiOnly`: boolean (default `false`)
+- `maxCacheSize`: number (default `2048`) — cache stops accepting new entries once reached; existing entries keep serving hits
 
 ### `validate(str, production, opts?)` → `ValidationResult`
 
 `production`: `'name'` | `'ncName'` | `'qName'` | `'nmToken'` | `'nmTokens'`
 
+`opts`: same as boolean validators (`xmlVersion`, `asciiOnly`)
+
 ### `validateAll(strings[], production, opts?)` → `ValidationResult[]`
 
+`opts`: same as `validate`
+
 ### `sanitize(str, production?, opts?)` → `string`
 
 `opts`:
 - `xmlVersion`: `'1.0'` | `'1.1'`
 - `replacement`: string (default `'_'`)
+- `asciiOnly`: boolean (default `false`) — also replaces non-ASCII characters, not just XML-illegal ones
 
 ---
 
 ## License
 
-MIT
+MIT

package/node_modules/xml-naming/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xml-naming",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Validates XML name productions — Name, NCName, QName, NMToken, NMTokens — for XML 1.0 and 1.1",
   "type": "module",
   "main": "./src/index.js",
@@ -16,9 +16,11 @@
     "README.md"
   ],
   "scripts": {
-    "test": "jasmine specs/*spec.js"
+    "test": "jasmine specs/*spec.js",
+    "perf": "node specs/perf.js"
   },
   "keywords": [
+    "fast",
     "xml",
     "xml-name",
     "ncname",

package/node_modules/xml-naming/src/index.d.ts

@@ -1,6 +1,15 @@
 export interface ValidationOptions {
   /** XML specification version to validate against. Defaults to '1.0'. */
   xmlVersion?: '1.0' | '1.1';
+  /**
+   * Restrict matching to the ASCII subset of the NameStartChar/NameChar
+   * productions and skip unicode-aware regex matching entirely. Faster,
+   * especially for XML 1.1 (which otherwise requires the `/u` regex flag),
+   * but rejects legitimate non-ASCII XML names. Off by default for
+   * backward compatibility — opt in only when inputs are known to be ASCII.
+   * Defaults to false.
+   */
+  asciiOnly?: boolean;
 }
 
 export interface SanitizeOptions extends ValidationOptions {
@@ -55,6 +64,31 @@ export function nmToken(str: string, opts?: ValidationOptions): boolean;
  */
 export function nmTokens(str: string, opts?: ValidationOptions): boolean;
 
+export interface CreateValidatorOptions extends ValidationOptions {
+  /**
+   * Max number of distinct strings to cache. Once reached, new strings are
+   * still validated correctly but are no longer cached; existing cached
+   * entries keep being served. Defaults to 2048.
+   */
+  maxCacheSize?: number;
+}
+
+export interface MemoizedValidator {
+  (str: string): boolean;
+  /** Clears the internal cache. */
+  reset(): void;
+}
+
+/**
+ * Returns a memoized boolean validator function for a single production.
+ * `opts` (xmlVersion, asciiOnly) are fixed at creation time. Repeated calls
+ * with the same string after the first are served from an internal cache
+ * instead of re-running the regex — useful when validating a small, reused
+ * vocabulary of names (e.g. tag/attribute names across many siblings in a
+ * document) many times.
+ */
+export function createValidator(production: Production, opts?: CreateValidatorOptions): MemoizedValidator;
+
 /**
  * Validates a string against a named XML production and returns a detailed result.
  */

package/node_modules/xml-naming/src/index.js

@@ -110,8 +110,36 @@ const buildRegexes = (startChar, char, flags = '') => {
 const regexes10 = buildRegexes(nameStartChar10, nameChar10);       // no /u — BMP only
 const regexes11 = buildRegexes(nameStartChar11, nameChar11, 'u');  // /u — enables \u{10000}-\u{EFFFF}
 
-const getRegexes = (xmlVersion = '1.0') =>
-  xmlVersion === '1.1' ? regexes11 : regexes10;
+// ---------------------------------------------------------------------------
+// ASCII-only fast path (opt-in, off by default)
+//
+// The XML 1.0 vs 1.1 NameStartChar/NameChar productions differ *only* in
+// their non-ASCII ranges (merged vs split Latin-1 ranges, \u0487, and
+// supplementary planes). Restricted to ASCII, both versions collapse to the
+// same character classes, so a single regex pair covers both xmlVersion
+// values — no /u flag needed.
+//
+// Rationale: unicode-aware regexes (the /u flag, required for XML 1.1's
+// supplementary-plane range) are measurably slower in V8 than plain
+// non-unicode regexes on the same input, even when the input is pure ASCII.
+// For the common case — HTML/SVG ids, XML tags — names are ASCII, so callers
+// who know this can opt in to skip the unicode-aware matching path entirely.
+// This is a real but *conditional* win: mainly for XML 1.1 input (avoids /u),
+// or at scale where the larger unicode character classes add engine
+// overhead. It also changes behaviour (rejects legitimate non-ASCII XML
+// 1.0/1.1 names), so it must never be silently enabled — hence off by
+// default.
+// ---------------------------------------------------------------------------
+
+const nameStartCharAscii = ':A-Za-z_';
+const nameCharAscii = nameStartCharAscii + '\\-\\.\\d';
+
+const regexesAscii = buildRegexes(nameStartCharAscii, nameCharAscii); // no /u — ASCII only
+
+const getRegexes = (xmlVersion = '1.0', asciiOnly = false) => {
+  if (asciiOnly) return regexesAscii;
+  return xmlVersion === '1.1' ? regexes11 : regexes10;
+};
 
 // ---------------------------------------------------------------------------
 // Boolean validators
@@ -121,57 +149,131 @@ const getRegexes = (xmlVersion = '1.0') =>
  * Returns true if the string is a valid XML Name.
  * Colons are allowed anywhere (Name production).
  * Used for: DOCTYPE entity names, notation names, DTD element declarations.
+ *
+ * @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
+ *   asciiOnly: skip unicode-aware matching, ASCII names only (default false).
  */
-export const name = (str, { xmlVersion = '1.0' } = {}) =>
-  getRegexes(xmlVersion).name.test(str);
+export const name = (str, { xmlVersion = '1.0', asciiOnly = false } = {}) =>
+  getRegexes(xmlVersion, asciiOnly).name.test(str);
 
 /**
  * Returns true if the string is a valid NCName (Non-Colonized Name).
  * Colons are not permitted.
  * Used for: namespace prefixes, local names, SVG id attributes.
+ *
+ * @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
+ *   asciiOnly: skip unicode-aware matching, ASCII names only (default false).
  */
-export const ncName = (str, { xmlVersion = '1.0' } = {}) =>
-  getRegexes(xmlVersion).ncName.test(str);
+export const ncName = (str, { xmlVersion = '1.0', asciiOnly = false } = {}) =>
+  getRegexes(xmlVersion, asciiOnly).ncName.test(str);
 
 /**
  * Returns true if the string is a valid QName (Qualified Name).
  * Allows exactly one colon as a prefix separator: prefix:localName.
  * Used for: element and attribute names in namespace-aware XML/SVG.
+ *
+ * @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
+ *   asciiOnly: skip unicode-aware matching, ASCII names only (default false).
  */
-export const qName = (str, { xmlVersion = '1.0' } = {}) =>
-  getRegexes(xmlVersion).qName.test(str);
+export const qName = (str, { xmlVersion = '1.0', asciiOnly = false } = {}) =>
+  getRegexes(xmlVersion, asciiOnly).qName.test(str);
 
 /**
  * Returns true if the string is a valid NMToken.
  * Like Name but no restriction on the first character.
  * Used for: DTD NMTOKEN attribute values.
+ *
+ * @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
+ *   asciiOnly: skip unicode-aware matching, ASCII names only (default false).
  */
-export const nmToken = (str, { xmlVersion = '1.0' } = {}) =>
-  getRegexes(xmlVersion).nmToken.test(str);
+export const nmToken = (str, { xmlVersion = '1.0', asciiOnly = false } = {}) =>
+  getRegexes(xmlVersion, asciiOnly).nmToken.test(str);
 
 /**
  * Returns true if the string is a valid NMTokens value.
  * A whitespace-separated list of NMToken values.
  * Used for: DTD NMTOKENS attribute values.
+ *
+ * @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
+ *   asciiOnly: skip unicode-aware matching, ASCII names only (default false).
  */
-export const nmTokens = (str, { xmlVersion = '1.0' } = {}) =>
-  getRegexes(xmlVersion).nmTokens.test(str);
+export const nmTokens = (str, { xmlVersion = '1.0', asciiOnly = false } = {}) =>
+  getRegexes(xmlVersion, asciiOnly).nmTokens.test(str);
 
 // ---------------------------------------------------------------------------
-// Diagnostic validator
+// Memoized validator factory
+//
+// Real documents reuse a small vocabulary of tag/attribute names across many
+// siblings (e.g. `id`, `class`, `href` repeated across hundreds of elements).
+// The plain boolean validators above re-run the regex on every call
+// regardless of repeats. `createValidator` returns a closure with a private
+// string -> boolean cache, so repeated names after the first become O(1)
+// lookups instead of regex tests.
+//
+// - opts (xmlVersion, asciiOnly) are fixed at creation time, so the regex is
+//   resolved once, not on every call.
+// - The cache is private to the returned closure — no shared/global state,
+//   no cross-caller pollution.
+// - `maxCacheSize` bounds memory: once the cache reaches this many entries,
+//   it stops accepting new ones (existing entries keep serving hits; new
+//   misses just fall through to the regex, uncached). This avoids unbounded
+//   growth against adversarial/high-cardinality input (e.g. validating
+//   attacker-supplied names with no repeats) without the cost/complexity of
+//   a full LRU, and without the perf cliff of reset-and-refill thrashing.
+// - Call `.reset()` on the returned function to clear the cache manually
+//   (e.g. between unrelated parse calls).
 // ---------------------------------------------------------------------------
 
 const PRODUCTIONS = ['name', 'ncName', 'qName', 'nmToken', 'nmTokens'];
 
+/**
+ * Returns a memoized boolean validator function for a single production,
+ * with opts fixed at creation time.
+ *
+ * @param {'name'|'ncName'|'qName'|'nmToken'|'nmTokens'} production
+ * @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean, maxCacheSize?: number }} [opts]
+ *   maxCacheSize: max number of distinct strings to cache (default 2048).
+ *   Once reached, new strings are validated but not cached; existing cached
+ *   entries keep being served.
+ * @returns {((str: string) => boolean) & { reset: () => void }}
+ */
+export const createValidator = (production, { xmlVersion = '1.0', asciiOnly = false, maxCacheSize = 2048 } = {}) => {
+  if (!PRODUCTIONS.includes(production)) {
+    throw new TypeError(
+      `Unknown production "${production}". Must be one of: ${PRODUCTIONS.join(', ')}`
+    );
+  }
+
+  const regex = getRegexes(xmlVersion, asciiOnly)[production];
+  let cache = new Map();
+
+  const validator = (str) => {
+    const cached = cache.get(str);
+    if (cached !== undefined) return cached;
+
+    const result = regex.test(str);
+    if (cache.size < maxCacheSize) cache.set(str, result);
+    return result;
+  };
+
+  validator.reset = () => { cache = new Map(); };
+
+  return validator;
+};
+
+// ---------------------------------------------------------------------------
+// Diagnostic validator
+// ---------------------------------------------------------------------------
+
 /**
  * Validates a string against a named production and returns a detailed result.
  *
  * @param {string} str
  * @param {'name'|'ncName'|'qName'|'nmToken'|'nmTokens'} production
- * @param {{ xmlVersion?: '1.0'|'1.1' }} [opts]
+ * @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
  * @returns {{ valid: boolean, production: string, input: string, reason?: string, position?: number }}
  */
-export const validate = (str, production, { xmlVersion = '1.0' } = {}) => {
+export const validate = (str, production, { xmlVersion = '1.0', asciiOnly = false } = {}) => {
   if (!PRODUCTIONS.includes(production)) {
     throw new TypeError(
       `Unknown production "${production}". Must be one of: ${PRODUCTIONS.join(', ')}`
@@ -179,13 +281,20 @@ export const validate = (str, production, { xmlVersion = '1.0' } = {}) => {
   }
 
   const validators = { name, ncName, qName, nmToken, nmTokens };
-  const isValid = validators[production](str, { xmlVersion });
+  const isValid = validators[production](str, { xmlVersion, asciiOnly });
 
   if (isValid) return { valid: true, production, input: str };
 
   let reason = 'Does not match the production rules';
   let position;
 
+  // Diagnostic fallback char checks must mirror the same character set the
+  // boolean validator above used, or the reported reason/position could
+  // contradict the `valid: false` result (e.g. flagging a char as illegal
+  // that the unicode-aware check would have accepted).
+  const startCharPattern = asciiOnly ? /^[:A-Za-z_]/ : /^[:A-Za-z_\u00C0-\uFFFD]/;
+  const namePattern = asciiOnly ? /[\w\-\\.:]/ : /[\w\-\\.:\u00B7\u00C0-\uFFFD]/;
+
   if (str.length === 0) {
     reason = 'Input is empty';
   } else if (production === 'ncName' && str.includes(':')) {
@@ -202,13 +311,13 @@ export const validate = (str, production, { xmlVersion = '1.0' } = {}) => {
     position = str.lastIndexOf(':');
   } else if (
     ['name', 'ncName', 'qName'].includes(production) &&
-    !/^[:A-Za-z_\u00C0-\uFFFD]/.test(str[0])
+    !startCharPattern.test(str[0])
   ) {
     reason = `First character "${str[0]}" is not a valid NameStartChar`;
     position = 0;
   } else {
     for (let i = 0; i < str.length; i++) {
-      if (!/[\w\-\\.:\u00B7\u00C0-\uFFFD]/.test(str[i])) {
+      if (!namePattern.test(str[i])) {
         reason = `Character "${str[i]}" at position ${i} is not a valid NameChar`;
         position = i;
         break;
@@ -228,7 +337,7 @@ export const validate = (str, production, { xmlVersion = '1.0' } = {}) => {
  *
  * @param {string[]} strings
  * @param {'name'|'ncName'|'qName'|'nmToken'|'nmTokens'} production
- * @param {{ xmlVersion?: '1.0'|'1.1' }} [opts]
+ * @param {{ xmlVersion?: '1.0'|'1.1', asciiOnly?: boolean }} [opts]
  * @returns {Array<{ valid: boolean, production: string, input: string, reason?: string, position?: number }>}
  */
 export const validateAll = (strings, production, opts = {}) =>
@@ -243,10 +352,12 @@ export const validateAll = (strings, production, opts = {}) =>
  *
  * @param {string} str
  * @param {'name'|'ncName'|'qName'|'nmToken'|'nmTokens'} production
- * @param {{ replacement?: string }} [opts]
+ * @param {{ replacement?: string, asciiOnly?: boolean }} [opts]
+ *   asciiOnly: also replace any non-ASCII character, not just XML-illegal
+ *   ones (default false).
  * @returns {string}
  */
-export const sanitize = (str, production = 'name', { replacement = '_' } = {}) => {
+export const sanitize = (str, production = 'name', { replacement = '_', asciiOnly = false } = {}) => {
   if (!str) return replacement;
 
   let result = str;
@@ -257,7 +368,8 @@ export const sanitize = (str, production = 'name', { replacement = '_' } = {}) =
   }
 
   // Replace illegal characters
-  result = result.replace(/[^\w\-\.:\u00B7\u00C0-\uFFFD]/g, replacement);
+  const allowedCharPattern = asciiOnly ? /[^\w\-\.:]/g : /[^\w\-\.:\u00B7\u00C0-\uFFFD]/g;
+  result = result.replace(allowedCharPattern, replacement);
 
   // Fix invalid start character for Name / NCName / QName
   if (production !== 'nmToken' && production !== 'nmTokens') {

package/node_modules/yaml/browser/dist/compose/resolve-flow-scalar.js

@@ -64,46 +64,47 @@ function plainValue(source, onError) {
     }
     if (badChar)
         onError(0, 'BAD_SCALAR_START', `Plain value cannot start with ${badChar}`);
-    return foldLines(source);
+    return unfoldLines(source);
 }
 function singleQuotedValue(source, onError) {
     if (source[source.length - 1] !== "'" || source.length === 1)
         onError(source.length, 'MISSING_CHAR', "Missing closing 'quote");
-    return foldLines(source.slice(1, -1)).replace(/''/g, "'");
+    return unfoldLines(source.slice(1, -1)).replace(/''/g, "'");
 }
-function foldLines(source) {
+function unfoldLines(source) {
+    const line = /(.*?)\r?\n/sy;
+    let match = line.exec(source);
+    if (!match)
+        return source;
     /**
-     * The negative lookbehind here and in the `re` RegExp is to
+     * The negative lookbehinds in these RegExps are to
      * prevent causing a polynomial search time in certain cases.
      *
-     * The try-catch is for Safari, which doesn't support this yet:
+     * The try-catch is for Safari < 16.4 and other old browsers:
      * https://caniuse.com/js-regexp-lookbehind
      */
-    let first, line;
+    let trimEnd, trimBoth;
     try {
-        first = new RegExp('(.*?)(?<![ \t])[ \t]*\r?\n', 'sy');
-        line = new RegExp('[ \t]*(.*?)(?:(?<![ \t])[ \t]*)?\r?\n', 'sy');
+        trimEnd = new RegExp('(?<![ \t])[ \t]+$');
+        trimBoth = new RegExp('^[ \t]+|(?<![ \t])[ \t]+$', 'g');
     }
     catch {
-        first = /(.*?)[ \t]*\r?\n/sy;
-        line = /[ \t]*(.*?)[ \t]*\r?\n/sy;
+        trimEnd = /[ \t]+$/;
+        trimBoth = /^[ \t]+|[ \t]+$/g;
     }
-    let match = first.exec(source);
-    if (!match)
-        return source;
-    let res = match[1];
+    let res = match[1].replace(trimEnd, '');
     let sep = ' ';
-    let pos = first.lastIndex;
-    line.lastIndex = pos;
+    let pos = line.lastIndex;
     while ((match = line.exec(source))) {
-        if (match[1] === '') {
+        const lm = match[1].replace(trimBoth, '');
+        if (lm === '') {
             if (sep === '\n')
                 res += sep;
             else
                 sep = '\n';
         }
         else {
-            res += sep + match[1];
+            res += sep + lm;
             sep = ' ';
         }
         pos = line.lastIndex;

package/node_modules/yaml/browser/dist/nodes/Alias.js

@@ -43,38 +43,40 @@ class Alias extends NodeBase {
             if (node.anchor === this.source)
                 found = node;
         }
+        if (found && ctx) {
+            const { anchors, doc, maxAliasCount } = ctx;
+            let data = anchors.get(found);
+            if (!data) {
+                // Resolve anchors for Node.prototype.toJS()
+                toJS(found, null, ctx);
+                data = anchors.get(found);
+            }
+            /* istanbul ignore if */
+            if (data?.res === undefined) {
+                const msg = 'This should not happen: Alias anchor was not resolved?';
+                throw new ReferenceError(msg);
+            }
+            if (maxAliasCount >= 0) {
+                data.count += 1;
+                if (data.aliasCount === 0)
+                    data.aliasCount = getAliasCount(doc, found, anchors);
+                if (data.count * data.aliasCount > maxAliasCount) {
+                    const msg = 'Excessive alias count indicates a resource exhaustion attack';
+                    throw new ReferenceError(msg);
+                }
+            }
+        }
         return found;
     }
     toJSON(_arg, ctx) {
         if (!ctx)
             return { source: this.source };
-        const { anchors, doc, maxAliasCount } = ctx;
-        const source = this.resolve(doc, ctx);
+        const source = this.resolve(ctx.doc, ctx);
         if (!source) {
             const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
             throw new ReferenceError(msg);
         }
-        let data = anchors.get(source);
-        if (!data) {
-            // Resolve anchors for Node.prototype.toJS()
-            toJS(source, null, ctx);
-            data = anchors.get(source);
-        }
-        /* istanbul ignore if */
-        if (data?.res === undefined) {
-            const msg = 'This should not happen: Alias anchor was not resolved?';
-            throw new ReferenceError(msg);
-        }
-        if (maxAliasCount >= 0) {
-            data.count += 1;
-            if (data.aliasCount === 0)
-                data.aliasCount = getAliasCount(doc, source, anchors);
-            if (data.count * data.aliasCount > maxAliasCount) {
-                const msg = 'Excessive alias count indicates a resource exhaustion attack';
-                throw new ReferenceError(msg);
-            }
-        }
-        return data.res;
+        return ctx.anchors.get(source).res;
     }
     toString(ctx, _onComment, _onChompKeep) {
         const src = `*${this.source}`;

package/node_modules/yaml/dist/compose/resolve-flow-scalar.js

@@ -66,46 +66,47 @@ function plainValue(source, onError) {
     }
     if (badChar)
         onError(0, 'BAD_SCALAR_START', `Plain value cannot start with ${badChar}`);
-    return foldLines(source);
+    return unfoldLines(source);
 }
 function singleQuotedValue(source, onError) {
     if (source[source.length - 1] !== "'" || source.length === 1)
         onError(source.length, 'MISSING_CHAR', "Missing closing 'quote");
-    return foldLines(source.slice(1, -1)).replace(/''/g, "'");
+    return unfoldLines(source.slice(1, -1)).replace(/''/g, "'");
 }
-function foldLines(source) {
+function unfoldLines(source) {
+    const line = /(.*?)\r?\n/sy;
+    let match = line.exec(source);
+    if (!match)
+        return source;
     /**
-     * The negative lookbehind here and in the `re` RegExp is to
+     * The negative lookbehinds in these RegExps are to
      * prevent causing a polynomial search time in certain cases.
      *
-     * The try-catch is for Safari, which doesn't support this yet:
+     * The try-catch is for Safari < 16.4 and other old browsers:
      * https://caniuse.com/js-regexp-lookbehind
      */
-    let first, line;
+    let trimEnd, trimBoth;
     try {
-        first = new RegExp('(.*?)(?<![ \t])[ \t]*\r?\n', 'sy');
-        line = new RegExp('[ \t]*(.*?)(?:(?<![ \t])[ \t]*)?\r?\n', 'sy');
+        trimEnd = new RegExp('(?<![ \t])[ \t]+$');
+        trimBoth = new RegExp('^[ \t]+|(?<![ \t])[ \t]+$', 'g');
     }
     catch {
-        first = /(.*?)[ \t]*\r?\n/sy;
-        line = /[ \t]*(.*?)[ \t]*\r?\n/sy;
+        trimEnd = /[ \t]+$/;
+        trimBoth = /^[ \t]+|[ \t]+$/g;
     }
-    let match = first.exec(source);
-    if (!match)
-        return source;
-    let res = match[1];
+    let res = match[1].replace(trimEnd, '');
     let sep = ' ';
-    let pos = first.lastIndex;
-    line.lastIndex = pos;
+    let pos = line.lastIndex;
     while ((match = line.exec(source))) {
-        if (match[1] === '') {
+        const lm = match[1].replace(trimBoth, '');
+        if (lm === '') {
             if (sep === '\n')
                 res += sep;
             else
                 sep = '\n';
         }
         else {
-            res += sep + match[1];
+            res += sep + lm;
             sep = ' ';
         }
         pos = line.lastIndex;