mrs-toolbox-cli 10.0.14 → 10.0.15

package/npm-cache/_cacache/content-v2/sha512/{4a/25/e356e06915cc5ee0cd81814201fc05127da9e8e8520fb0c8be38ef20e50435a1a300aa9a591f6df61b2a0495281e58ccb94e8ff47849aa55a5c23b39e51f → 4d/06/a4234240725b0cc266426ed58f469068ec3eac87d80d6c8c59ed016822f19f5d4dc17ae02171ca3b4d749bf5f9f6023778af24c1510e8fc0fbd81de465de}

@@ -3753,7 +3753,7 @@
   "dist-tags": {
     "latest": "2.0.2"
   },
-  "_rev": "1238-47fa9558957c5d84",
+  "_rev": "1357-f1451fe788b045e1",
   "_id": "path-scurry",
   "readme": "# path-scurry\n\nExtremely high performant utility for building tools that read\nthe file system, minimizing filesystem and path string munging\noperations to the greatest degree possible.\n\n## Ugh, yet another file traversal thing on npm?\n\nYes. None of the existing ones gave me exactly what I wanted.\n\n## Well what is it you wanted?\n\nWhile working on [glob](http://npm.im/glob), I found that I\nneeded a module to very efficiently manage the traversal over a\nfolder tree, such that:\n\n1. No `readdir()` or `stat()` would ever be called on the same\n   file or directory more than one time.\n2. No `readdir()` calls would be made if we can be reasonably\n   sure that the path is not a directory. (Ie, a previous\n   `readdir()` or `stat()` covered the path, and\n   `ent.isDirectory()` is false.)\n3. `path.resolve()`, `dirname()`, `basename()`, and other\n   string-parsing/munging operations are be minimized. This means\n   it has to track \"provisional\" child nodes that may not exist\n   (and if we find that they _don't_ exist, store that\n   information as well, so we don't have to ever check again).\n4. The API is not limited to use as a stream/iterator/etc. There\n   are many cases where an API like node's `fs` is preferrable.\n5. It's more important to prevent excess syscalls than to be up\n   to date, but it should be smart enough to know what it\n   _doesn't_ know, and go get it seamlessly when requested.\n6. Do not blow up the JS heap allocation if operating on a\n   directory with a huge number of entries.\n7. Handle all the weird aspects of Windows paths, like UNC paths\n   and drive letters and wrongway slashes, so that the consumer\n   can return canonical platform-specific paths without having to\n   parse or join or do any error-prone string munging.\n\n## PERFORMANCE\n\nJavaScript people throw around the word \"blazing\" a lot. I hope\nthat this module doesn't blaze anyone. But it does go very fast,\nin the cases it's optimized for, if used properly.\n\nPathScurry provides ample opportunities to get extremely good\nperformance, as well as several options to trade performance for\nconvenience.\n\nBenchmarks can be run by executing `npm run bench`.\n\nAs is always the case, doing more means going slower, doing less\nmeans going faster, and there are trade offs between speed and\nmemory usage.\n\nPathScurry makes heavy use of [LRUCache](http://npm.im/lru-cache)\nto efficiently cache whatever it can, and `Path` objects remain\nin the graph for the lifetime of the walker, so repeated calls\nwith a single PathScurry object will be extremely fast. However,\nadding items to a cold cache means \"doing more\", so in those\ncases, we pay a price. Nothing is free, but every effort has been\nmade to reduce costs wherever possible.\n\nAlso, note that a \"cache as long as possible\" approach means that\nchanges to the filesystem may not be reflected in the results of\nrepeated PathScurry operations.\n\nFor resolving string paths, `PathScurry` ranges from 5-50 times\nfaster than `path.resolve` on repeated resolutions, but around\n100 to 1000 times _slower_ on the first resolution. If your\nprogram is spending a lot of time resolving the _same_ paths\nrepeatedly (like, thousands or millions of times), then this can\nbe beneficial. But both implementations are pretty fast, and\nspeeding up an infrequent operation from 4µs to 400ns is not\ngoing to move the needle on your app's performance.\n\nFor walking file system directory trees, a lot depends on how\noften a given PathScurry object will be used, and also on the\nwalk method used.\n\nWith default settings on a folder tree of 100,000 items,\nconsisting of around a 10-to-1 ratio of normal files to\ndirectories, PathScurry performs comparably to\n[@nodelib/fs.walk](http://npm.im/@nodelib/fs.walk), which is the\nfastest and most reliable file system walker I could find. As far\nas I can tell, it's almost impossible to go much faster in a\nNode.js program, just based on how fast you can push syscalls out\nto the fs thread pool.\n\nOn my machine, that is about 1000-1200 completed walks per second\nfor async or stream walks, and around 500-600 walks per second\nsynchronously.\n\nIn the warm cache state, PathScurry's performance increases\naround 4x for async `for await` iteration, 10-15x faster for\nstreams and synchronous `for of` iteration, and anywhere from 30x\nto 80x faster for the rest.\n\n```\n# walk 100,000 fs entries, 10/1 file/dir ratio\n# operations / ms\n New PathScurry object  |  Reuse PathScurry object\n     stream:  1112.589  |  13974.917\nsync stream:   492.718  |  15028.343\n async walk:  1095.648  |  32706.395\n  sync walk:   527.632  |  46129.772\n async iter:  1288.821  |   5045.510\n  sync iter:   498.496  |  17920.746\n```\n\nA hand-rolled walk calling `entry.readdir()` and recursing\nthrough the entries can benefit even more from caching, with\ngreater flexibility and without the overhead of streams or\ngenerators.\n\nThe cold cache state is still limited by the costs of file system\noperations, but with a warm cache, the only bottleneck is CPU\nspeed and VM optimizations. Of course, in that case, some care\nmust be taken to ensure that you don't lose performance as a\nresult of silly mistakes, like calling `readdir()` on entries\nthat you know are not directories.\n\n```\n# manual recursive iteration functions\n      cold cache  |  warm cache\nasync:  1164.901  |  17923.320\n   cb:  1101.127  |  40999.344\nzalgo:  1082.240  |  66689.936\n sync:   526.935  |  87097.591\n```\n\nIn this case, the speed improves by around 10-20x in the async\ncase, 40x in the case of using `entry.readdirCB` with protections\nagainst synchronous callbacks, and 50-100x with callback\ndeferrals disabled, and _several hundred times faster_ for\nsynchronous iteration.\n\nIf you can think of a case that is not covered in these\nbenchmarks, or an implementation that performs significantly\nbetter than PathScurry, please [let me\nknow](https://github.com/isaacs/path-scurry/issues).\n\n## USAGE\n\n```ts\n// hybrid module, load with either method\nimport { PathScurry, Path } from 'path-scurry'\n// or:\nconst { PathScurry, Path } = require('path-scurry')\n\n// very simple example, say we want to find and\n// delete all the .DS_Store files in a given path\n// note that the API is very similar to just a\n// naive walk with fs.readdir()\nimport { unlink } from 'fs/promises'\n\n// easy way, iterate over the directory and do the thing\nconst pw = new PathScurry(process.cwd())\nfor await (const entry of pw) {\n  if (entry.isFile() && entry.name === '.DS_Store') {\n    unlink(entry.fullpath())\n  }\n}\n\n// here it is as a manual recursive method\nconst walk = async (entry: Path) => {\n  const promises: Promise<any> = []\n  // readdir doesn't throw on non-directories, it just doesn't\n  // return any entries, to save stack trace costs.\n  // Items are returned in arbitrary unsorted order\n  for (const child of await pw.readdir(entry)) {\n    // each child is a Path object\n    if (child.name === '.DS_Store' && child.isFile()) {\n      // could also do pw.resolve(entry, child.name),\n      // just like fs.readdir walking, but .fullpath is\n      // a *slightly* more efficient shorthand.\n      promises.push(unlink(child.fullpath()))\n    } else if (child.isDirectory()) {\n      promises.push(walk(child))\n    }\n  }\n  return Promise.all(promises)\n}\n\nwalk(pw.cwd).then(() => {\n  console.log('all .DS_Store files removed')\n})\n\nconst pw2 = new PathScurry('/a/b/c') // pw2.cwd is the Path for /a/b/c\nconst relativeDir = pw2.cwd.resolve('../x') // Path entry for '/a/b/x'\nconst relative2 = pw2.cwd.resolve('/a/b/d/../x') // same path, same entry\nassert.equal(relativeDir, relative2)\n```\n\n## API\n\n[Full TypeDoc API](https://isaacs.github.io/path-scurry)\n\nThere are platform-specific classes exported, but for the most\npart, the default `PathScurry` and `Path` exports are what you\nmost likely need, unless you are testing behavior for other\nplatforms.\n\nIntended public API is documented here, but the full\ndocumentation does include internal types, which should not be\naccessed directly.\n\n### Interface `PathScurryOpts`\n\nThe type of the `options` argument passed to the `PathScurry`\nconstructor.\n\n- `nocase`: Boolean indicating that file names should be compared\n  case-insensitively. Defaults to `true` on darwin and win32\n  implementations, `false` elsewhere.\n\n  **Warning** Performing case-insensitive matching on a\n  case-sensitive filesystem will result in occasionally very\n  bizarre behavior. Performing case-sensitive matching on a\n  case-insensitive filesystem may negatively impact performance.\n\n- `childrenCacheSize`: Number of child entries to cache, in order\n  to speed up `resolve()` and `readdir()` calls. Defaults to\n  `16 * 1024` (ie, `16384`).\n\n  Setting it to a higher value will run the risk of JS heap\n  allocation errors on large directory trees. Setting it to `256`\n  or smaller will significantly reduce the construction time and\n  data consumption overhead, but with the downside of operations\n  being slower on large directory trees. Setting it to `0` will\n  mean that effectively no operations are cached, and this module\n  will be roughly the same speed as `fs` for file system\n  operations, and _much_ slower than `path.resolve()` for\n  repeated path resolution.\n\n- `fs` An object that will be used to override the default `fs`\n  methods. Any methods that are not overridden will use Node's\n  built-in implementations.\n\n  - lstatSync\n  - readdir (callback `withFileTypes` Dirent variant, used for\n    readdirCB and most walks)\n  - readdirSync\n  - readlinkSync\n  - realpathSync\n  - promises: Object containing the following async methods:\n    - lstat\n    - readdir (Dirent variant only)\n    - readlink\n    - realpath\n\n### Interface `WalkOptions`\n\nThe options object that may be passed to all walk methods.\n\n- `withFileTypes`: Boolean, default true. Indicates that `Path`\n  objects should be returned. Set to `false` to get string paths\n  instead.\n- `follow`: Boolean, default false. Attempt to read directory\n  entries from symbolic links. Otherwise, only actual directories\n  are traversed. Regardless of this setting, a given target path\n  will only ever be walked once, meaning that a symbolic link to\n  a previously traversed directory will never be followed.\n\n  Setting this imposes a slight performance penalty, because\n  `readlink` must be called on all symbolic links encountered, in\n  order to avoid infinite cycles.\n\n- `filter`: Function `(entry: Path) => boolean`. If provided,\n  will prevent the inclusion of any entry for which it returns a\n  falsey value. This will not prevent directories from being\n  traversed if they do not pass the filter, though it will\n  prevent the directories themselves from being included in the\n  results. By default, if no filter is provided, then all entries\n  are included in the results.\n- `walkFilter`: Function `(entry: Path) => boolean`. If provided,\n  will prevent the traversal of any directory (or in the case of\n  `follow:true` symbolic links to directories) for which the\n  function returns false. This will not prevent the directories\n  themselves from being included in the result set. Use `filter`\n  for that.\n\nNote that TypeScript return types will only be inferred properly\nfrom static analysis if the `withFileTypes` option is omitted, or\na constant `true` or `false` value.\n\n### Class `PathScurry`\n\nThe main interface. Defaults to an appropriate class based on the\ncurrent platform.\n\nUse `PathScurryWin32`, `PathScurryDarwin`, or `PathScurryPosix`\nif implementation-specific behavior is desired.\n\nAll walk methods may be called with a `WalkOptions` argument to\nwalk over the object's current working directory with the\nsupplied options.\n\n#### `async pw.walk(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nWalk the directory tree according to the options provided,\nresolving to an array of all entries found.\n\n#### `pw.walkSync(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nWalk the directory tree according to the options provided,\nreturning an array of all entries found.\n\n#### `pw.iterate(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nIterate over the directory asynchronously, for use with `for\nawait of`. This is also the default async iterator method.\n\n#### `pw.iterateSync(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nIterate over the directory synchronously, for use with `for of`.\nThis is also the default sync iterator method.\n\n#### `pw.stream(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nReturn a [Minipass](http://npm.im/minipass) stream that emits\neach entry or path string in the walk. Results are made available\nasynchronously.\n\n#### `pw.streamSync(entry?: string | Path | WalkOptions, opts?: WalkOptions)`\n\nReturn a [Minipass](http://npm.im/minipass) stream that emits\neach entry or path string in the walk. Results are made available\nsynchronously, meaning that the walk will complete in a single\ntick if the stream is fully consumed.\n\n#### `pw.cwd`\n\nPath object representing the current working directory for the\nPathScurry.\n\n#### `pw.chdir(path: string)`\n\nSet the new effective current working directory for the scurry\nobject, so that `path.relative()` and `path.relativePosix()`\nreturn values relative to the new cwd path.\n\n#### `pw.depth(path?: Path | string): number`\n\nReturn the depth of the specified path (or the PathScurry cwd)\nwithin the directory tree.\n\nRoot entries have a depth of `0`.\n\n#### `pw.resolve(...paths: string[])`\n\nCaching `path.resolve()`.\n\nSignificantly faster than `path.resolve()` if called repeatedly\nwith the same paths. Significantly slower otherwise, as it builds\nout the cached Path entries.\n\nTo get a `Path` object resolved from the `PathScurry`, use\n`pw.cwd.resolve(path)`. Note that `Path.resolve` only takes a\nsingle string argument, not multiple.\n\n#### `pw.resolvePosix(...paths: string[])`\n\nCaching `path.resolve()`, but always using posix style paths.\n\nThis is identical to `pw.resolve(...paths)` on posix systems (ie,\neverywhere except Windows).\n\nOn Windows, it returns the full absolute UNC path using `/`\nseparators. Ie, instead of `'C:\\\\foo\\\\bar`, it would return\n`//?/C:/foo/bar`.\n\n#### `pw.relative(path: string | Path): string`\n\nReturn the relative path from the PathWalker cwd to the supplied\npath string or entry.\n\nIf the nearest common ancestor is the root, then an absolute path\nis returned.\n\n#### `pw.relativePosix(path: string | Path): string`\n\nReturn the relative path from the PathWalker cwd to the supplied\npath string or entry, using `/` path separators.\n\nIf the nearest common ancestor is the root, then an absolute path\nis returned.\n\nOn posix platforms (ie, all platforms except Windows), this is\nidentical to `pw.relative(path)`.\n\nOn Windows systems, it returns the resulting string as a\n`/`-delimited path. If an absolute path is returned (because the\ntarget does not share a common ancestor with `pw.cwd`), then a\nfull absolute UNC path will be returned. Ie, instead of\n`'C:\\\\foo\\\\bar`, it would return `//?/C:/foo/bar`.\n\n#### `pw.basename(path: string | Path): string`\n\nReturn the basename of the provided string or Path.\n\n#### `pw.dirname(path: string | Path): string`\n\nReturn the parent directory of the supplied string or Path.\n\n#### `async pw.readdir(dir = pw.cwd, opts = { withFileTypes: true })`\n\nRead the directory and resolve to an array of strings if\n`withFileTypes` is explicitly set to `false` or Path objects\notherwise.\n\nCan be called as `pw.readdir({ withFileTypes: boolean })` as\nwell.\n\nReturns `[]` if no entries are found, or if any error occurs.\n\nNote that TypeScript return types will only be inferred properly\nfrom static analysis if the `withFileTypes` option is omitted, or\na constant `true` or `false` value.\n\n#### `pw.readdirSync(dir = pw.cwd, opts = { withFileTypes: true })`\n\nSynchronous `pw.readdir()`\n\n#### `async pw.readlink(link = pw.cwd, opts = { withFileTypes: false })`\n\nCall `fs.readlink` on the supplied string or Path object, and\nreturn the result.\n\nCan be called as `pw.readlink({ withFileTypes: boolean })` as\nwell.\n\nReturns `undefined` if any error occurs (for example, if the\nargument is not a symbolic link), or a `Path` object if\n`withFileTypes` is explicitly set to `true`, or a string\notherwise.\n\nNote that TypeScript return types will only be inferred properly\nfrom static analysis if the `withFileTypes` option is omitted, or\na constant `true` or `false` value.\n\n#### `pw.readlinkSync(link = pw.cwd, opts = { withFileTypes: false })`\n\nSynchronous `pw.readlink()`\n\n#### `async pw.lstat(entry = pw.cwd)`\n\nCall `fs.lstat` on the supplied string or Path object, and fill\nin as much information as possible, returning the updated `Path`\nobject.\n\nReturns `undefined` if the entry does not exist, or if any error\nis encountered.\n\nNote that some `Stats` data (such as `ino`, `dev`, and `mode`)\nwill not be supplied. For those things, you'll need to call\n`fs.lstat` yourself.\n\n#### `pw.lstatSync(entry = pw.cwd)`\n\nSynchronous `pw.lstat()`\n\n#### `pw.realpath(entry = pw.cwd, opts = { withFileTypes: false })`\n\nCall `fs.realpath` on the supplied string or Path object, and\nreturn the realpath if available.\n\nReturns `undefined` if any error occurs.\n\nMay be called as `pw.realpath({ withFileTypes: boolean })` to run\non `pw.cwd`.\n\n#### `pw.realpathSync(entry = pw.cwd, opts = { withFileTypes: false })`\n\nSynchronous `pw.realpath()`\n\n### Class `Path` implements [fs.Dirent](https://nodejs.org/docs/latest/api/fs.html#class-fsdirent)\n\nObject representing a given path on the filesystem, which may or\nmay not exist.\n\nNote that the actual class in use will be either `PathWin32` or\n`PathPosix`, depending on the implementation of `PathScurry` in\nuse. They differ in the separators used to split and join path\nstrings, and the handling of root paths.\n\nIn `PathPosix` implementations, paths are split and joined using\nthe `'/'` character, and `'/'` is the only root path ever in use.\n\nIn `PathWin32` implementations, paths are split using either\n`'/'` or `'\\\\'` and joined using `'\\\\'`, and multiple roots may\nbe in use based on the drives and UNC paths encountered. UNC\npaths such as `//?/C:/` that identify a drive letter, will be\ntreated as an alias for the same root entry as their associated\ndrive letter (in this case `'C:\\\\'`).\n\n#### `path.name`\n\nName of this file system entry.\n\n**Important**: _always_ test the path name against any test\nstring using the `isNamed` method, and not by directly comparing\nthis string. Otherwise, unicode path strings that the system sees\nas identical will not be properly treated as the same path,\nleading to incorrect behavior and possible security issues.\n\n#### `path.isNamed(name: string): boolean`\n\nReturn true if the path is a match for the given path name. This\nhandles case sensitivity and unicode normalization.\n\nNote: even on case-sensitive systems, it is **not** safe to test\nthe equality of the `.name` property to determine whether a given\npathname matches, due to unicode normalization mismatches.\n\nAlways use this method instead of testing the `path.name`\nproperty directly.\n\n#### `path.isCWD`\n\nSet to true if this `Path` object is the current working\ndirectory of the `PathScurry` collection that contains it.\n\n#### `path.getType()`\n\nReturns the type of the Path object, `'File'`, `'Directory'`,\netc.\n\n#### `path.isType(t: type)`\n\nReturns true if `is{t}()` returns true.\n\nFor example, `path.isType('Directory')` is equivalent to\n`path.isDirectory()`.\n\n#### `path.depth()`\n\nReturn the depth of the Path entry within the directory tree.\nRoot paths have a depth of `0`.\n\n#### `path.fullpath()`\n\nThe fully resolved path to the entry.\n\n#### `path.fullpathPosix()`\n\nThe fully resolved path to the entry, using `/` separators.\n\nOn posix systems, this is identical to `path.fullpath()`. On\nwindows, this will return a fully resolved absolute UNC path\nusing `/` separators. Eg, instead of `'C:\\\\foo\\\\bar'`, it will\nreturn `'//?/C:/foo/bar'`.\n\n#### `path.isFile()`, `path.isDirectory()`, etc.\n\nSame as the identical `fs.Dirent.isX()` methods.\n\n#### `path.isUnknown()`\n\nReturns true if the path's type is unknown. Always returns true\nwhen the path is known to not exist.\n\n#### `path.resolve(p: string)`\n\nReturn a `Path` object associated with the provided path string\nas resolved from the current Path object.\n\n#### `path.relative(): string`\n\nReturn the relative path from the PathWalker cwd to the supplied\npath string or entry.\n\nIf the nearest common ancestor is the root, then an absolute path\nis returned.\n\n#### `path.relativePosix(): string`\n\nReturn the relative path from the PathWalker cwd to the supplied\npath string or entry, using `/` path separators.\n\nIf the nearest common ancestor is the root, then an absolute path\nis returned.\n\nOn posix platforms (ie, all platforms except Windows), this is\nidentical to `pw.relative(path)`.\n\nOn Windows systems, it returns the resulting string as a\n`/`-delimited path. If an absolute path is returned (because the\ntarget does not share a common ancestor with `pw.cwd`), then a\nfull absolute UNC path will be returned. Ie, instead of\n`'C:\\\\foo\\\\bar`, it would return `//?/C:/foo/bar`.\n\n#### `async path.readdir()`\n\nReturn an array of `Path` objects found by reading the associated\npath entry.\n\nIf path is not a directory, or if any error occurs, returns `[]`,\nand marks all children as provisional and non-existent.\n\n#### `path.readdirSync()`\n\nSynchronous `path.readdir()`\n\n#### `async path.readlink()`\n\nReturn the `Path` object referenced by the `path` as a symbolic\nlink.\n\nIf the `path` is not a symbolic link, or any error occurs,\nreturns `undefined`.\n\n#### `path.readlinkSync()`\n\nSynchronous `path.readlink()`\n\n#### `async path.lstat()`\n\nCall `lstat` on the path object, and fill it in with details\ndetermined.\n\nIf path does not exist, or any other error occurs, returns\n`undefined`, and marks the path as \"unknown\" type.\n\n#### `path.lstatSync()`\n\nSynchronous `path.lstat()`\n\n#### `async path.realpath()`\n\nCall `realpath` on the path, and return a Path object\ncorresponding to the result, or `undefined` if any error occurs.\n\n#### `path.realpathSync()`\n\nSynchornous `path.realpath()`",
   "_attachments": {}

package/npm-cache/_cacache/content-v2/sha512/{9f/13/83d84b31ee07a0f8f2d1fc56885bbe35f0ef7ad1719a04758d2e8555002a749c5ec7daeb8a72f974125b845c96328b8f50f0e550dc54e75609495299dcb3 → 4f/27/800c84ce59f94322e832a8a7d3a32a2190a8c688779533085d37d8150f1667ece6651c9a2961989a96ec6f7d04bf07c2a53e90a1e2ed79695fc39c391a17}

@@ -2702,7 +2702,7 @@
     "latest": "6.0.6",
     "n-api": "4.0.0-napi"
   },
-  "_rev": "368-0e0d6fdecdd3bc58",
+  "_rev": "381-dd6fe7d44cbd2e9b",
   "_id": "utf-8-validate",
   "readme": "# utf-8-validate\n\n[![Version npm](https://img.shields.io/npm/v/utf-8-validate.svg?logo=npm)](https://www.npmjs.com/package/utf-8-validate)\n[![Linux/macOS/Windows Build](https://img.shields.io/github/actions/workflow/status/websockets/utf-8-validate/ci.yml?branch=master&label=build&logo=github)](https://github.com/websockets/utf-8-validate/actions?query=workflow%3ACI+branch%3Amaster)\n\nCheck if a buffer contains valid UTF-8 encoded text.\n\n## Installation\n\n```\nnpm install utf-8-validate --save-optional\n```\n\nThe `--save-optional` flag tells npm to save the package in your package.json\nunder the\n[`optionalDependencies`](https://docs.npmjs.com/files/package.json#optionaldependencies)\nkey.\n\n## API\n\nThe module exports a single function that takes one argument. To maximize\nperformance, the argument is not validated. It is the caller's responsibility to\nensure that it is correct.\n\n### `isValidUTF8(buffer)`\n\nChecks whether a buffer contains valid UTF-8.\n\n#### Arguments\n\n- `buffer` - The buffer to check.\n\n#### Return value\n\n`true` if the buffer contains only correct UTF-8, else `false`.\n\n#### Example\n\n```js\n'use strict';\n\nconst isValidUTF8 = require('utf-8-validate');\n\nconst buf = Buffer.from([0xf0, 0x90, 0x80, 0x80]);\n\nconsole.log(isValidUTF8(buf));\n// => true\n```\n\n## License\n\n[MIT](LICENSE)",
   "_attachments": {}

package/npm-cache/_cacache/content-v2/sha512/{62/ed/43ebd9bf2310bb5c9ccb57c40f280a6dc6c62dd3e0fc7cfd59367cd8116249ef0aa9ed5a23450cf84caab8a8f7449a26a22783ed8f40717c42dce35deac9 → 51/c1/74d772e24806c4adc730f1eba877346fe6aa01400310d2cb304355966073b450d67bbebc0968908c630dbf9e6f522146f718c8225ad41d98c9f74713ba45}

@@ -2278,7 +2278,7 @@
     "latest": "10.0.0",
     "next": "2.1.0-candidate"
   },
-  "_rev": "3338-0b1e439c1aa7f3aa",
+  "_rev": "3516-d34cadd655b491e6",
   "_id": "wrap-ansi",
   "readme": "# wrap-ansi\n\n> Wordwrap a string with [ANSI escape codes](https://en.wikipedia.org/wiki/ANSI_escape_code#Colors_and_Styles)\n\n## Install\n\n```sh\nnpm install wrap-ansi\n```\n\n## Usage\n\n```js\nimport chalk from 'chalk';\nimport wrapAnsi from 'wrap-ansi';\n\nconst input = 'The quick brown ' + chalk.red('fox jumped over ') +\n\t'the lazy ' + chalk.green('dog and then ran away with the unicorn.');\n\nconsole.log(wrapAnsi(input, 20));\n```\n\n<img width=\"331\" src=\"screenshot.png\">\n\n## API\n\n### wrapAnsi(string, columns, options?)\n\nWrap words to the specified column width.\n\n#### string\n\nType: `string`\n\nA string with ANSI escape codes, like one styled by [`chalk`](https://github.com/chalk/chalk).\n\nNewline characters will be normalized to `\\n`.\n\nTab characters are expanded to spaces using 8-column tab stops before wrapping.\n\n#### columns\n\nType: `number`\n\nThe number of columns to wrap the text to.\n\n#### options\n\nType: `object`\n\n##### hard\n\nType: `boolean`\\\nDefault: `false`\n\nBy default the wrap is soft, meaning long words may extend past the column width. Setting this to `true` will make it hard wrap at the column width.\n\n##### wordWrap\n\nType: `boolean`\\\nDefault: `true`\n\nBy default, an attempt is made to split words at spaces, ensuring that they don't extend past the configured columns. If wordWrap is `false`, each column will instead be completely filled splitting words as necessary.\n\n##### trim\n\nType: `boolean`\\\nDefault: `true`\n\nWhitespace on all lines is removed by default. Set this option to `false` if you don't want to trim.\n\n## Related\n\n- [slice-ansi](https://github.com/chalk/slice-ansi) - Slice a string with ANSI escape codes\n- [cli-truncate](https://github.com/sindresorhus/cli-truncate) - Truncate a string to a specific width in the terminal\n- [chalk](https://github.com/chalk/chalk) - Terminal string styling done right\n- [jsesc](https://github.com/mathiasbynens/jsesc) - Generate ASCII-only output from Unicode strings. Useful for creating test fixtures.",
   "_attachments": {}

package/npm-cache/_cacache/content-v2/sha512/{7d/a7/ffb12af7ea4f9234e7c65b492c5ab29eb1e75c2aff1bdf01cb1d282ec8238ac99aae629708e97df8cfa4a584d139f16f48e92a98f174cea85ed9ffbf90ce → 52/f7/bc4784a84d00a113abda0fb5120003bfb63154e32a435353dde918cd983636e305eab29309e23c45a08eb910d54f2dbc9401dcffbbb7d5966dae021a9e76}

@@ -378,7 +378,7 @@
   "dist-tags": {
     "latest": "1.1.2"
   },
-  "_rev": "3841-5c7c4483711e3f9f",
+  "_rev": "3994-334f2f9849051a6c",
   "_id": "buffer-from",
   "readme": "# Buffer From\n\nA [ponyfill](https://ponyfill.com) for `Buffer.from`, uses native implementation if available.\n\n## Installation\n\n```sh\nnpm install --save buffer-from\n```\n\n## Usage\n\n```js\nconst bufferFrom = require('buffer-from')\n\nconsole.log(bufferFrom([1, 2, 3, 4]))\n//=> <Buffer 01 02 03 04>\n\nconst arr = new Uint8Array([1, 2, 3, 4])\nconsole.log(bufferFrom(arr.buffer, 1, 2))\n//=> <Buffer 02 03>\n\nconsole.log(bufferFrom('test', 'utf8'))\n//=> <Buffer 74 65 73 74>\n\nconst buf = bufferFrom('test')\nconsole.log(bufferFrom(buf))\n//=> <Buffer 74 65 73 74>\n```\n\n## API\n\n### bufferFrom(array)\n\n- `array` &lt;Array&gt;\n\nAllocates a new `Buffer` using an `array` of octets.\n\n### bufferFrom(arrayBuffer[, byteOffset[, length]])\n\n- `arrayBuffer` &lt;ArrayBuffer&gt; The `.buffer` property of a TypedArray or ArrayBuffer\n- `byteOffset` &lt;Integer&gt; Where to start copying from `arrayBuffer`. **Default:** `0`\n- `length` &lt;Integer&gt; How many bytes to copy from `arrayBuffer`. **Default:** `arrayBuffer.length - byteOffset`\n\nWhen passed a reference to the `.buffer` property of a TypedArray instance, the\nnewly created `Buffer` will share the same allocated memory as the TypedArray.\n\nThe optional `byteOffset` and `length` arguments specify a memory range within\nthe `arrayBuffer` that will be shared by the `Buffer`.\n\n### bufferFrom(buffer)\n\n- `buffer` &lt;Buffer&gt; An existing `Buffer` to copy data from\n\nCopies the passed `buffer` data onto a new `Buffer` instance.\n\n### bufferFrom(string[, encoding])\n\n- `string` &lt;String&gt; A string to encode.\n- `encoding` &lt;String&gt; The encoding of `string`. **Default:** `'utf8'`\n\nCreates a new `Buffer` containing the given JavaScript string `string`. If\nprovided, the `encoding` parameter identifies the character encoding of\n`string`.\n\n## See also\n\n- [buffer-alloc](https://github.com/LinusU/buffer-alloc) A ponyfill for `Buffer.alloc`\n- [buffer-alloc-unsafe](https://github.com/LinusU/buffer-alloc-unsafe) A ponyfill for `Buffer.allocUnsafe`",
   "_attachments": {}

package/npm-cache/_cacache/content-v2/sha512/{a1/d0/f59acf7fa8121037e5198a35a47ad517a59f1fd3b4134e2a481c8531167a03d5b41a1e1dbd759753c08bcc035d52308996783bae82ddebf1970ebcae9d4a → 54/5b/49f3cc38399fd2e116a9ef571deb2da57de300d0c2fb2477892b5c9e52293a9ead5f9d19ad11da0588b0813bf47259ebcdf62088da94a62a5bf2891192f5}

@@ -9780,7 +9780,7 @@
   "dist-tags": {
     "latest": "6.0.3"
   },
-  "_rev": "2034-457bc00dcdedb4ae",
+  "_rev": "2146-da81eff31f17f497",
   "_id": "buffer",
   "readme": "# buffer [![travis][travis-image]][travis-url] [![npm][npm-image]][npm-url] [![downloads][downloads-image]][downloads-url] [![javascript style guide][standard-image]][standard-url]\n\n[travis-image]: https://img.shields.io/travis/feross/buffer/master.svg\n[travis-url]: https://travis-ci.org/feross/buffer\n[npm-image]: https://img.shields.io/npm/v/buffer.svg\n[npm-url]: https://npmjs.org/package/buffer\n[downloads-image]: https://img.shields.io/npm/dm/buffer.svg\n[downloads-url]: https://npmjs.org/package/buffer\n[standard-image]: https://img.shields.io/badge/code_style-standard-brightgreen.svg\n[standard-url]: https://standardjs.com\n\n#### The buffer module from [node.js](https://nodejs.org/), for the browser.\n\n[![saucelabs][saucelabs-image]][saucelabs-url]\n\n[saucelabs-image]: https://saucelabs.com/browser-matrix/buffer.svg\n[saucelabs-url]: https://saucelabs.com/u/buffer\n\nWith [browserify](http://browserify.org), simply `require('buffer')` or use the `Buffer` global and you will get this module.\n\nThe goal is to provide an API that is 100% identical to\n[node's Buffer API](https://nodejs.org/api/buffer.html). Read the\n[official docs](https://nodejs.org/api/buffer.html) for the full list of properties,\ninstance methods, and class methods that are supported.\n\n## features\n\n- Manipulate binary data like a boss, in all browsers!\n- Super fast. Backed by Typed Arrays (`Uint8Array`/`ArrayBuffer`, not `Object`)\n- Extremely small bundle size (**6.75KB minified + gzipped**, 51.9KB with comments)\n- Excellent browser support (Chrome, Firefox, Edge, Safari 11+, iOS 11+, Android, etc.)\n- Preserves Node API exactly, with one minor difference (see below)\n- Square-bracket `buf[4]` notation works!\n- Does not modify any browser prototypes or put anything on `window`\n- Comprehensive test suite (including all buffer tests from node.js core)\n\n## install\n\nTo use this module directly (without browserify), install it:\n\n```bash\nnpm install buffer\n```\n\nThis module was previously called **native-buffer-browserify**, but please use **buffer**\nfrom now on.\n\nIf you do not use a bundler, you can use the [standalone script](https://bundle.run/buffer).\n\n## usage\n\nThe module's API is identical to node's `Buffer` API. Read the\n[official docs](https://nodejs.org/api/buffer.html) for the full list of properties,\ninstance methods, and class methods that are supported.\n\nAs mentioned above, `require('buffer')` or use the `Buffer` global with\n[browserify](http://browserify.org) and this module will automatically be included\nin your bundle. Almost any npm module will work in the browser, even if it assumes that\nthe node `Buffer` API will be available.\n\nTo depend on this module explicitly (without browserify), require it like this:\n\n```js\nvar Buffer = require('buffer/').Buffer  // note: the trailing slash is important!\n```\n\nTo require this module explicitly, use `require('buffer/')` which tells the node.js module\nlookup algorithm (also used by browserify) to use the **npm module** named `buffer`\ninstead of the **node.js core** module named `buffer`!\n\n\n## how does it work?\n\nThe Buffer constructor returns instances of `Uint8Array` that have their prototype\nchanged to `Buffer.prototype`. Furthermore, `Buffer` is a subclass of `Uint8Array`,\nso the returned instances will have all the node `Buffer` methods and the\n`Uint8Array` methods. Square bracket notation works as expected -- it returns a\nsingle octet.\n\nThe `Uint8Array` prototype remains unmodified.\n\n\n## tracking the latest node api\n\nThis module tracks the Buffer API in the latest (unstable) version of node.js. The Buffer\nAPI is considered **stable** in the\n[node stability index](https://nodejs.org/docs/latest/api/documentation.html#documentation_stability_index),\nso it is unlikely that there will ever be breaking changes.\nNonetheless, when/if the Buffer API changes in node, this module's API will change\naccordingly.\n\n## related packages\n\n- [`buffer-reverse`](https://www.npmjs.com/package/buffer-reverse) - Reverse a buffer\n- [`buffer-xor`](https://www.npmjs.com/package/buffer-xor) - Bitwise xor a buffer\n- [`is-buffer`](https://www.npmjs.com/package/is-buffer) - Determine if an object is a Buffer without including the whole `Buffer` package\n\n## conversion packages\n\n### convert typed array to buffer\n\nUse [`typedarray-to-buffer`](https://www.npmjs.com/package/typedarray-to-buffer) to convert any kind of typed array to a `Buffer`. Does not perform a copy, so it's super fast.\n\n### convert buffer to typed array\n\n`Buffer` is a subclass of `Uint8Array` (which is a typed array). So there is no need to explicitly convert to typed array. Just use the buffer as a `Uint8Array`.\n\n### convert blob to buffer\n\nUse [`blob-to-buffer`](https://www.npmjs.com/package/blob-to-buffer) to convert a `Blob` to a `Buffer`.\n\n### convert buffer to blob\n\nTo convert a `Buffer` to a `Blob`, use the `Blob` constructor:\n\n```js\nvar blob = new Blob([ buffer ])\n```\n\nOptionally, specify a mimetype:\n\n```js\nvar blob = new Blob([ buffer ], { type: 'text/html' })\n```\n\n### convert arraybuffer to buffer\n\nTo convert an `ArrayBuffer` to a `Buffer`, use the `Buffer.from` function. Does not perform a copy, so it's super fast.\n\n```js\nvar buffer = Buffer.from(arrayBuffer)\n```\n\n### convert buffer to arraybuffer\n\nTo convert a `Buffer` to an `ArrayBuffer`, use the `.buffer` property (which is present on all `Uint8Array` objects):\n\n```js\nvar arrayBuffer = buffer.buffer.slice(\n  buffer.byteOffset, buffer.byteOffset + buffer.byteLength\n)\n```\n\nAlternatively, use the [`to-arraybuffer`](https://www.npmjs.com/package/to-arraybuffer) module.\n\n## performance\n\nSee perf tests in `/perf`.\n\n`BrowserBuffer` is the browser `buffer` module (this repo). `Uint8Array` is included as a\nsanity check (since `BrowserBuffer` uses `Uint8Array` under the hood, `Uint8Array` will\nalways be at least a bit faster). Finally, `NodeBuffer` is the node.js buffer module,\nwhich is included to compare against.\n\nNOTE: Performance has improved since these benchmarks were taken. PR welcome to update the README.\n\n### Chrome 38\n\n| Method | Operations | Accuracy | Sampled | Fastest |\n|:-------|:-----------|:---------|:--------|:-------:|\n| BrowserBuffer#bracket-notation | 11,457,464 ops/sec | ±0.86% | 66 | ✓ |\n| Uint8Array#bracket-notation | 10,824,332 ops/sec | ±0.74% | 65 | |\n| | | | |\n| BrowserBuffer#concat | 450,532 ops/sec | ±0.76% | 68 | |\n| Uint8Array#concat | 1,368,911 ops/sec | ±1.50% | 62 | ✓ |\n| | | | |\n| BrowserBuffer#copy(16000) | 903,001 ops/sec | ±0.96% | 67 | |\n| Uint8Array#copy(16000) | 1,422,441 ops/sec | ±1.04% | 66 | ✓ |\n| | | | |\n| BrowserBuffer#copy(16) | 11,431,358 ops/sec | ±0.46% | 69 | |\n| Uint8Array#copy(16) | 13,944,163 ops/sec | ±1.12% | 68 | ✓ |\n| | | | |\n| BrowserBuffer#new(16000) | 106,329 ops/sec | ±6.70% | 44 | |\n| Uint8Array#new(16000) | 131,001 ops/sec | ±2.85% | 31 | ✓ |\n| | | | |\n| BrowserBuffer#new(16) | 1,554,491 ops/sec | ±1.60% | 65 | |\n| Uint8Array#new(16) | 6,623,930 ops/sec | ±1.66% | 65 | ✓ |\n| | | | |\n| BrowserBuffer#readDoubleBE | 112,830 ops/sec | ±0.51% | 69 | ✓ |\n| DataView#getFloat64 | 93,500 ops/sec | ±0.57% | 68 | |\n| | | | |\n| BrowserBuffer#readFloatBE | 146,678 ops/sec | ±0.95% | 68 | ✓ |\n| DataView#getFloat32 | 99,311 ops/sec | ±0.41% | 67 | |\n| | | | |\n| BrowserBuffer#readUInt32LE | 843,214 ops/sec | ±0.70% | 69 | ✓ |\n| DataView#getUint32 | 103,024 ops/sec | ±0.64% | 67 | |\n| | | | |\n| BrowserBuffer#slice | 1,013,941 ops/sec | ±0.75% | 67 | |\n| Uint8Array#subarray | 1,903,928 ops/sec | ±0.53% | 67 | ✓ |\n| | | | |\n| BrowserBuffer#writeFloatBE | 61,387 ops/sec | ±0.90% | 67 | |\n| DataView#setFloat32 | 141,249 ops/sec | ±0.40% | 66 | ✓ |\n\n\n### Firefox 33\n\n| Method | Operations | Accuracy | Sampled | Fastest |\n|:-------|:-----------|:---------|:--------|:-------:|\n| BrowserBuffer#bracket-notation | 20,800,421 ops/sec | ±1.84% | 60 | |\n| Uint8Array#bracket-notation | 20,826,235 ops/sec | ±2.02% | 61 | ✓ |\n| | | | |\n| BrowserBuffer#concat | 153,076 ops/sec | ±2.32% | 61 | |\n| Uint8Array#concat | 1,255,674 ops/sec | ±8.65% | 52 | ✓ |\n| | | | |\n| BrowserBuffer#copy(16000) | 1,105,312 ops/sec | ±1.16% | 63 | |\n| Uint8Array#copy(16000) | 1,615,911 ops/sec | ±0.55% | 66 | ✓ |\n| | | | |\n| BrowserBuffer#copy(16) | 16,357,599 ops/sec | ±0.73% | 68 | |\n| Uint8Array#copy(16) | 31,436,281 ops/sec | ±1.05% | 68 | ✓ |\n| | | | |\n| BrowserBuffer#new(16000) | 52,995 ops/sec | ±6.01% | 35 | |\n| Uint8Array#new(16000) | 87,686 ops/sec | ±5.68% | 45 | ✓ |\n| | | | |\n| BrowserBuffer#new(16) | 252,031 ops/sec | ±1.61% | 66 | |\n| Uint8Array#new(16) | 8,477,026 ops/sec | ±0.49% | 68 | ✓ |\n| | | | |\n| BrowserBuffer#readDoubleBE | 99,871 ops/sec | ±0.41% | 69 | |\n| DataView#getFloat64 | 285,663 ops/sec | ±0.70% | 68 | ✓ |\n| | | | |\n| BrowserBuffer#readFloatBE | 115,540 ops/sec | ±0.42% | 69 | |\n| DataView#getFloat32 | 288,722 ops/sec | ±0.82% | 68 | ✓ |\n| | | | |\n| BrowserBuffer#readUInt32LE | 633,926 ops/sec | ±1.08% | 67 | ✓ |\n| DataView#getUint32 | 294,808 ops/sec | ±0.79% | 64 | |\n| | | | |\n| BrowserBuffer#slice | 349,425 ops/sec | ±0.46% | 69 | |\n| Uint8Array#subarray | 5,965,819 ops/sec | ±0.60% | 65 | ✓ |\n| | | | |\n| BrowserBuffer#writeFloatBE | 59,980 ops/sec | ±0.41% | 67 | |\n| DataView#setFloat32 | 317,634 ops/sec | ±0.63% | 68 | ✓ |\n\n### Safari 8\n\n| Method | Operations | Accuracy | Sampled | Fastest |\n|:-------|:-----------|:---------|:--------|:-------:|\n| BrowserBuffer#bracket-notation | 10,279,729 ops/sec | ±2.25% | 56 | ✓ |\n| Uint8Array#bracket-notation | 10,030,767 ops/sec | ±2.23% | 59 | |\n| | | | |\n| BrowserBuffer#concat | 144,138 ops/sec | ±1.38% | 65 | |\n| Uint8Array#concat | 4,950,764 ops/sec | ±1.70% | 63 | ✓ |\n| | | | |\n| BrowserBuffer#copy(16000) | 1,058,548 ops/sec | ±1.51% | 64 | |\n| Uint8Array#copy(16000) | 1,409,666 ops/sec | ±1.17% | 65 | ✓ |\n| | | | |\n| BrowserBuffer#copy(16) | 6,282,529 ops/sec | ±1.88% | 58 | |\n| Uint8Array#copy(16) | 11,907,128 ops/sec | ±2.87% | 58 | ✓ |\n| | | | |\n| BrowserBuffer#new(16000) | 101,663 ops/sec | ±3.89% | 57 | |\n| Uint8Array#new(16000) | 22,050,818 ops/sec | ±6.51% | 46 | ✓ |\n| | | | |\n| BrowserBuffer#new(16) | 176,072 ops/sec | ±2.13% | 64 | |\n| Uint8Array#new(16) | 24,385,731 ops/sec | ±5.01% | 51 | ✓ |\n| | | | |\n| BrowserBuffer#readDoubleBE | 41,341 ops/sec | ±1.06% | 67 | |\n| DataView#getFloat64 | 322,280 ops/sec | ±0.84% | 68 | ✓ |\n| | | | |\n| BrowserBuffer#readFloatBE | 46,141 ops/sec | ±1.06% | 65 | |\n| DataView#getFloat32 | 337,025 ops/sec | ±0.43% | 69 | ✓ |\n| | | | |\n| BrowserBuffer#readUInt32LE | 151,551 ops/sec | ±1.02% | 66 | |\n| DataView#getUint32 | 308,278 ops/sec | ±0.94% | 67 | ✓ |\n| | | | |\n| BrowserBuffer#slice | 197,365 ops/sec | ±0.95% | 66 | |\n| Uint8Array#subarray | 9,558,024 ops/sec | ±3.08% | 58 | ✓ |\n| | | | |\n| BrowserBuffer#writeFloatBE | 17,518 ops/sec | ±1.03% | 63 | |\n| DataView#setFloat32 | 319,751 ops/sec | ±0.48% | 68 | ✓ |\n\n\n### Node 0.11.14\n\n| Method | Operations | Accuracy | Sampled | Fastest |\n|:-------|:-----------|:---------|:--------|:-------:|\n| BrowserBuffer#bracket-notation | 10,489,828 ops/sec | ±3.25% | 90 | |\n| Uint8Array#bracket-notation | 10,534,884 ops/sec | ±0.81% | 92 | ✓ |\n| NodeBuffer#bracket-notation | 10,389,910 ops/sec | ±0.97% | 87 | |\n| | | | |\n| BrowserBuffer#concat | 487,830 ops/sec | ±2.58% | 88 | |\n| Uint8Array#concat | 1,814,327 ops/sec | ±1.28% | 88 | ✓ |\n| NodeBuffer#concat | 1,636,523 ops/sec | ±1.88% | 73 | |\n| | | | |\n| BrowserBuffer#copy(16000) | 1,073,665 ops/sec | ±0.77% | 90 | |\n| Uint8Array#copy(16000) | 1,348,517 ops/sec | ±0.84% | 89 | ✓ |\n| NodeBuffer#copy(16000) | 1,289,533 ops/sec | ±0.82% | 93 | |\n| | | | |\n| BrowserBuffer#copy(16) | 12,782,706 ops/sec | ±0.74% | 85 | |\n| Uint8Array#copy(16) | 14,180,427 ops/sec | ±0.93% | 92 | ✓ |\n| NodeBuffer#copy(16) | 11,083,134 ops/sec | ±1.06% | 89 | |\n| | | | |\n| BrowserBuffer#new(16000) | 141,678 ops/sec | ±3.30% | 67 | |\n| Uint8Array#new(16000) | 161,491 ops/sec | ±2.96% | 60 | |\n| NodeBuffer#new(16000) | 292,699 ops/sec | ±3.20% | 55 | ✓ |\n| | | | |\n| BrowserBuffer#new(16) | 1,655,466 ops/sec | ±2.41% | 82 | |\n| Uint8Array#new(16) | 14,399,926 ops/sec | ±0.91% | 94 | ✓ |\n| NodeBuffer#new(16) | 3,894,696 ops/sec | ±0.88% | 92 | |\n| | | | |\n| BrowserBuffer#readDoubleBE | 109,582 ops/sec | ±0.75% | 93 | ✓ |\n| DataView#getFloat64 | 91,235 ops/sec | ±0.81% | 90 | |\n| NodeBuffer#readDoubleBE | 88,593 ops/sec | ±0.96% | 81 | |\n| | | | |\n| BrowserBuffer#readFloatBE | 139,854 ops/sec | ±1.03% | 85 | ✓ |\n| DataView#getFloat32 | 98,744 ops/sec | ±0.80% | 89 | |\n| NodeBuffer#readFloatBE | 92,769 ops/sec | ±0.94% | 93 | |\n| | | | |\n| BrowserBuffer#readUInt32LE | 710,861 ops/sec | ±0.82% | 92 | |\n| DataView#getUint32 | 117,893 ops/sec | ±0.84% | 91 | |\n| NodeBuffer#readUInt32LE | 851,412 ops/sec | ±0.72% | 93 | ✓ |\n| | | | |\n| BrowserBuffer#slice | 1,673,877 ops/sec | ±0.73% | 94 | |\n| Uint8Array#subarray | 6,919,243 ops/sec | ±0.67% | 90 | ✓ |\n| NodeBuffer#slice | 4,617,604 ops/sec | ±0.79% | 93 | |\n| | | | |\n| BrowserBuffer#writeFloatBE | 66,011 ops/sec | ±0.75% | 93 | |\n| DataView#setFloat32 | 127,760 ops/sec | ±0.72% | 93 | ✓ |\n| NodeBuffer#writeFloatBE | 103,352 ops/sec | ±0.83% | 93 | |\n\n### iojs 1.8.1\n\n| Method | Operations | Accuracy | Sampled | Fastest |\n|:-------|:-----------|:---------|:--------|:-------:|\n| BrowserBuffer#bracket-notation | 10,990,488 ops/sec | ±1.11% | 91 | |\n| Uint8Array#bracket-notation | 11,268,757 ops/sec | ±0.65% | 97 | |\n| NodeBuffer#bracket-notation | 11,353,260 ops/sec | ±0.83% | 94 | ✓ |\n| | | | |\n| BrowserBuffer#concat | 378,954 ops/sec | ±0.74% | 94 | |\n| Uint8Array#concat | 1,358,288 ops/sec | ±0.97% | 87 | |\n| NodeBuffer#concat | 1,934,050 ops/sec | ±1.11% | 78 | ✓ |\n| | | | |\n| BrowserBuffer#copy(16000) | 894,538 ops/sec | ±0.56% | 84 | |\n| Uint8Array#copy(16000) | 1,442,656 ops/sec | ±0.71% | 96 | |\n| NodeBuffer#copy(16000) | 1,457,898 ops/sec | ±0.53% | 92 | ✓ |\n| | | | |\n| BrowserBuffer#copy(16) | 12,870,457 ops/sec | ±0.67% | 95 | |\n| Uint8Array#copy(16) | 16,643,989 ops/sec | ±0.61% | 93 | ✓ |\n| NodeBuffer#copy(16) | 14,885,848 ops/sec | ±0.74% | 94 | |\n| | | | |\n| BrowserBuffer#new(16000) | 109,264 ops/sec | ±4.21% | 63 | |\n| Uint8Array#new(16000) | 138,916 ops/sec | ±1.87% | 61 | |\n| NodeBuffer#new(16000) | 281,449 ops/sec | ±3.58% | 51 | ✓ |\n| | | | |\n| BrowserBuffer#new(16) | 1,362,935 ops/sec | ±0.56% | 99 | |\n| Uint8Array#new(16) | 6,193,090 ops/sec | ±0.64% | 95 | ✓ |\n| NodeBuffer#new(16) | 4,745,425 ops/sec | ±1.56% | 90 | |\n| | | | |\n| BrowserBuffer#readDoubleBE | 118,127 ops/sec | ±0.59% | 93 | ✓ |\n| DataView#getFloat64 | 107,332 ops/sec | ±0.65% | 91 | |\n| NodeBuffer#readDoubleBE | 116,274 ops/sec | ±0.94% | 95 | |\n| | | | |\n| BrowserBuffer#readFloatBE | 150,326 ops/sec | ±0.58% | 95 | ✓ |\n| DataView#getFloat32 | 110,541 ops/sec | ±0.57% | 98 | |\n| NodeBuffer#readFloatBE | 121,599 ops/sec | ±0.60% | 87 | |\n| | | | |\n| BrowserBuffer#readUInt32LE | 814,147 ops/sec | ±0.62% | 93 | |\n| DataView#getUint32 | 137,592 ops/sec | ±0.64% | 90 | |\n| NodeBuffer#readUInt32LE | 931,650 ops/sec | ±0.71% | 96 | ✓ |\n| | | | |\n| BrowserBuffer#slice | 878,590 ops/sec | ±0.68% | 93 | |\n| Uint8Array#subarray | 2,843,308 ops/sec | ±1.02% | 90 | |\n| NodeBuffer#slice | 4,998,316 ops/sec | ±0.68% | 90 | ✓ |\n| | | | |\n| BrowserBuffer#writeFloatBE | 65,927 ops/sec | ±0.74% | 93 | |\n| DataView#setFloat32 | 139,823 ops/sec | ±0.97% | 89 | ✓ |\n| NodeBuffer#writeFloatBE | 135,763 ops/sec | ±0.65% | 96 | |\n| | | | |\n\n## Testing the project\n\nFirst, install the project:\n\n    npm install\n\nThen, to run tests in Node.js, run:\n\n    npm run test-node\n\nTo test locally in a browser, you can run:\n\n    npm run test-browser-es5-local # For ES5 browsers that don't support ES6\n    npm run test-browser-es6-local # For ES6 compliant browsers\n\nThis will print out a URL that you can then open in a browser to run the tests, using [airtap](https://www.npmjs.com/package/airtap).\n\nTo run automated browser tests using Saucelabs, ensure that your `SAUCE_USERNAME` and `SAUCE_ACCESS_KEY` environment variables are set, then run:\n\n    npm test\n\nThis is what's run in Travis, to check against various browsers. The list of browsers is kept in the `bin/airtap-es5.yml` and `bin/airtap-es6.yml` files.\n\n## JavaScript Standard Style\n\nThis module uses [JavaScript Standard Style](https://github.com/feross/standard).\n\n[![JavaScript Style Guide](https://cdn.rawgit.com/feross/standard/master/badge.svg)](https://github.com/feross/standard)\n\nTo test that the code conforms to the style, `npm install` and run:\n\n    ./node_modules/.bin/standard\n\n## credit\n\nThis was originally forked from [buffer-browserify](https://github.com/toots/buffer-browserify).\n\n## Security Policies and Procedures\n\nThe `buffer` team and community take all security bugs in `buffer` seriously. Please see our [security policies and procedures](https://github.com/feross/security) document to learn how to report issues.\n\n## license\n\nMIT. Copyright (C) [Feross Aboukhadijeh](http://feross.org), and other contributors. Originally forked from an MIT-licensed module by Romain Beauxis.",
   "_attachments": {}

package/npm-cache/_cacache/content-v2/sha512/{7c/3d/6778ba0a7faefeca2af86d39a8b97193a94ae2810c99b3c555b30834fe1fe16e8d33bbb7a267ad30fb1d56cbc76793f3010efd5b45c67b9cad3d2b3d18d3 → 55/3b/ab6c1866c4736970032fe14205732ff10e533534c987fffd2220c74404c6ea9884159eeccb4692b6050e213c52ec8431a657ba446545da7ba1f5917e2b86}

@@ -758,7 +758,7 @@
   "dist-tags": {
     "latest": "5.2.1"
   },
-  "_rev": "4161-50ecb3bf25a05ad6",
+  "_rev": "4285-b8a958312de78ff8",
   "_id": "safe-buffer",
   "readme": "# safe-buffer [![travis][travis-image]][travis-url] [![npm][npm-image]][npm-url] [![downloads][downloads-image]][downloads-url] [![javascript style guide][standard-image]][standard-url]\n\n[travis-image]: https://img.shields.io/travis/feross/safe-buffer/master.svg\n[travis-url]: https://travis-ci.org/feross/safe-buffer\n[npm-image]: https://img.shields.io/npm/v/safe-buffer.svg\n[npm-url]: https://npmjs.org/package/safe-buffer\n[downloads-image]: https://img.shields.io/npm/dm/safe-buffer.svg\n[downloads-url]: https://npmjs.org/package/safe-buffer\n[standard-image]: https://img.shields.io/badge/code_style-standard-brightgreen.svg\n[standard-url]: https://standardjs.com\n\n#### Safer Node.js Buffer API\n\n**Use the new Node.js Buffer APIs (`Buffer.from`, `Buffer.alloc`,\n`Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`) in all versions of Node.js.**\n\n**Uses the built-in implementation when available.**\n\n## install\n\n```\nnpm install safe-buffer\n```\n\n## usage\n\nThe goal of this package is to provide a safe replacement for the node.js `Buffer`.\n\nIt's a drop-in replacement for `Buffer`. You can use it by adding one `require` line to\nthe top of your node.js modules:\n\n```js\nvar Buffer = require('safe-buffer').Buffer\n\n// Existing buffer code will continue to work without issues:\n\nnew Buffer('hey', 'utf8')\nnew Buffer([1, 2, 3], 'utf8')\nnew Buffer(obj)\nnew Buffer(16) // create an uninitialized buffer (potentially unsafe)\n\n// But you can use these new explicit APIs to make clear what you want:\n\nBuffer.from('hey', 'utf8') // convert from many types to a Buffer\nBuffer.alloc(16) // create a zero-filled buffer (safe)\nBuffer.allocUnsafe(16) // create an uninitialized buffer (potentially unsafe)\n```\n\n## api\n\n### Class Method: Buffer.from(array)\n<!-- YAML\nadded: v3.0.0\n-->\n\n* `array` {Array}\n\nAllocates a new `Buffer` using an `array` of octets.\n\n```js\nconst buf = Buffer.from([0x62,0x75,0x66,0x66,0x65,0x72]);\n  // creates a new Buffer containing ASCII bytes\n  // ['b','u','f','f','e','r']\n```\n\nA `TypeError` will be thrown if `array` is not an `Array`.\n\n### Class Method: Buffer.from(arrayBuffer[, byteOffset[, length]])\n<!-- YAML\nadded: v5.10.0\n-->\n\n* `arrayBuffer` {ArrayBuffer} The `.buffer` property of a `TypedArray` or\n  a `new ArrayBuffer()`\n* `byteOffset` {Number} Default: `0`\n* `length` {Number} Default: `arrayBuffer.length - byteOffset`\n\nWhen passed a reference to the `.buffer` property of a `TypedArray` instance,\nthe newly created `Buffer` will share the same allocated memory as the\nTypedArray.\n\n```js\nconst arr = new Uint16Array(2);\narr[0] = 5000;\narr[1] = 4000;\n\nconst buf = Buffer.from(arr.buffer); // shares the memory with arr;\n\nconsole.log(buf);\n  // Prints: <Buffer 88 13 a0 0f>\n\n// changing the TypedArray changes the Buffer also\narr[1] = 6000;\n\nconsole.log(buf);\n  // Prints: <Buffer 88 13 70 17>\n```\n\nThe optional `byteOffset` and `length` arguments specify a memory range within\nthe `arrayBuffer` that will be shared by the `Buffer`.\n\n```js\nconst ab = new ArrayBuffer(10);\nconst buf = Buffer.from(ab, 0, 2);\nconsole.log(buf.length);\n  // Prints: 2\n```\n\nA `TypeError` will be thrown if `arrayBuffer` is not an `ArrayBuffer`.\n\n### Class Method: Buffer.from(buffer)\n<!-- YAML\nadded: v3.0.0\n-->\n\n* `buffer` {Buffer}\n\nCopies the passed `buffer` data onto a new `Buffer` instance.\n\n```js\nconst buf1 = Buffer.from('buffer');\nconst buf2 = Buffer.from(buf1);\n\nbuf1[0] = 0x61;\nconsole.log(buf1.toString());\n  // 'auffer'\nconsole.log(buf2.toString());\n  // 'buffer' (copy is not changed)\n```\n\nA `TypeError` will be thrown if `buffer` is not a `Buffer`.\n\n### Class Method: Buffer.from(str[, encoding])\n<!-- YAML\nadded: v5.10.0\n-->\n\n* `str` {String} String to encode.\n* `encoding` {String} Encoding to use, Default: `'utf8'`\n\nCreates a new `Buffer` containing the given JavaScript string `str`. If\nprovided, the `encoding` parameter identifies the character encoding.\nIf not provided, `encoding` defaults to `'utf8'`.\n\n```js\nconst buf1 = Buffer.from('this is a tést');\nconsole.log(buf1.toString());\n  // prints: this is a tést\nconsole.log(buf1.toString('ascii'));\n  // prints: this is a tC)st\n\nconst buf2 = Buffer.from('7468697320697320612074c3a97374', 'hex');\nconsole.log(buf2.toString());\n  // prints: this is a tést\n```\n\nA `TypeError` will be thrown if `str` is not a string.\n\n### Class Method: Buffer.alloc(size[, fill[, encoding]])\n<!-- YAML\nadded: v5.10.0\n-->\n\n* `size` {Number}\n* `fill` {Value} Default: `undefined`\n* `encoding` {String} Default: `utf8`\n\nAllocates a new `Buffer` of `size` bytes. If `fill` is `undefined`, the\n`Buffer` will be *zero-filled*.\n\n```js\nconst buf = Buffer.alloc(5);\nconsole.log(buf);\n  // <Buffer 00 00 00 00 00>\n```\n\nThe `size` must be less than or equal to the value of\n`require('buffer').kMaxLength` (on 64-bit architectures, `kMaxLength` is\n`(2^31)-1`). Otherwise, a [`RangeError`][] is thrown. A zero-length Buffer will\nbe created if a `size` less than or equal to 0 is specified.\n\nIf `fill` is specified, the allocated `Buffer` will be initialized by calling\n`buf.fill(fill)`. See [`buf.fill()`][] for more information.\n\n```js\nconst buf = Buffer.alloc(5, 'a');\nconsole.log(buf);\n  // <Buffer 61 61 61 61 61>\n```\n\nIf both `fill` and `encoding` are specified, the allocated `Buffer` will be\ninitialized by calling `buf.fill(fill, encoding)`. For example:\n\n```js\nconst buf = Buffer.alloc(11, 'aGVsbG8gd29ybGQ=', 'base64');\nconsole.log(buf);\n  // <Buffer 68 65 6c 6c 6f 20 77 6f 72 6c 64>\n```\n\nCalling `Buffer.alloc(size)` can be significantly slower than the alternative\n`Buffer.allocUnsafe(size)` but ensures that the newly created `Buffer` instance\ncontents will *never contain sensitive data*.\n\nA `TypeError` will be thrown if `size` is not a number.\n\n### Class Method: Buffer.allocUnsafe(size)\n<!-- YAML\nadded: v5.10.0\n-->\n\n* `size` {Number}\n\nAllocates a new *non-zero-filled* `Buffer` of `size` bytes.  The `size` must\nbe less than or equal to the value of `require('buffer').kMaxLength` (on 64-bit\narchitectures, `kMaxLength` is `(2^31)-1`). Otherwise, a [`RangeError`][] is\nthrown. A zero-length Buffer will be created if a `size` less than or equal to\n0 is specified.\n\nThe underlying memory for `Buffer` instances created in this way is *not\ninitialized*. The contents of the newly created `Buffer` are unknown and\n*may contain sensitive data*. Use [`buf.fill(0)`][] to initialize such\n`Buffer` instances to zeroes.\n\n```js\nconst buf = Buffer.allocUnsafe(5);\nconsole.log(buf);\n  // <Buffer 78 e0 82 02 01>\n  // (octets will be different, every time)\nbuf.fill(0);\nconsole.log(buf);\n  // <Buffer 00 00 00 00 00>\n```\n\nA `TypeError` will be thrown if `size` is not a number.\n\nNote that the `Buffer` module pre-allocates an internal `Buffer` instance of\nsize `Buffer.poolSize` that is used as a pool for the fast allocation of new\n`Buffer` instances created using `Buffer.allocUnsafe(size)` (and the deprecated\n`new Buffer(size)` constructor) only when `size` is less than or equal to\n`Buffer.poolSize >> 1` (floor of `Buffer.poolSize` divided by two). The default\nvalue of `Buffer.poolSize` is `8192` but can be modified.\n\nUse of this pre-allocated internal memory pool is a key difference between\ncalling `Buffer.alloc(size, fill)` vs. `Buffer.allocUnsafe(size).fill(fill)`.\nSpecifically, `Buffer.alloc(size, fill)` will *never* use the internal Buffer\npool, while `Buffer.allocUnsafe(size).fill(fill)` *will* use the internal\nBuffer pool if `size` is less than or equal to half `Buffer.poolSize`. The\ndifference is subtle but can be important when an application requires the\nadditional performance that `Buffer.allocUnsafe(size)` provides.\n\n### Class Method: Buffer.allocUnsafeSlow(size)\n<!-- YAML\nadded: v5.10.0\n-->\n\n* `size` {Number}\n\nAllocates a new *non-zero-filled* and non-pooled `Buffer` of `size` bytes.  The\n`size` must be less than or equal to the value of\n`require('buffer').kMaxLength` (on 64-bit architectures, `kMaxLength` is\n`(2^31)-1`). Otherwise, a [`RangeError`][] is thrown. A zero-length Buffer will\nbe created if a `size` less than or equal to 0 is specified.\n\nThe underlying memory for `Buffer` instances created in this way is *not\ninitialized*. The contents of the newly created `Buffer` are unknown and\n*may contain sensitive data*. Use [`buf.fill(0)`][] to initialize such\n`Buffer` instances to zeroes.\n\nWhen using `Buffer.allocUnsafe()` to allocate new `Buffer` instances,\nallocations under 4KB are, by default, sliced from a single pre-allocated\n`Buffer`. This allows applications to avoid the garbage collection overhead of\ncreating many individually allocated Buffers. This approach improves both\nperformance and memory usage by eliminating the need to track and cleanup as\nmany `Persistent` objects.\n\nHowever, in the case where a developer may need to retain a small chunk of\nmemory from a pool for an indeterminate amount of time, it may be appropriate\nto create an un-pooled Buffer instance using `Buffer.allocUnsafeSlow()` then\ncopy out the relevant bits.\n\n```js\n// need to keep around a few small chunks of memory\nconst store = [];\n\nsocket.on('readable', () => {\n  const data = socket.read();\n  // allocate for retained data\n  const sb = Buffer.allocUnsafeSlow(10);\n  // copy the data into the new allocation\n  data.copy(sb, 0, 0, 10);\n  store.push(sb);\n});\n```\n\nUse of `Buffer.allocUnsafeSlow()` should be used only as a last resort *after*\na developer has observed undue memory retention in their applications.\n\nA `TypeError` will be thrown if `size` is not a number.\n\n### All the Rest\n\nThe rest of the `Buffer` API is exactly the same as in node.js.\n[See the docs](https://nodejs.org/api/buffer.html).\n\n\n## Related links\n\n- [Node.js issue: Buffer(number) is unsafe](https://github.com/nodejs/node/issues/4660)\n- [Node.js Enhancement Proposal: Buffer.from/Buffer.alloc/Buffer.zalloc/Buffer() soft-deprecate](https://github.com/nodejs/node-eps/pull/4)\n\n## Why is `Buffer` unsafe?\n\nToday, the node.js `Buffer` constructor is overloaded to handle many different argument\ntypes like `String`, `Array`, `Object`, `TypedArrayView` (`Uint8Array`, etc.),\n`ArrayBuffer`, and also `Number`.\n\nThe API is optimized for convenience: you can throw any type at it, and it will try to do\nwhat you want.\n\nBecause the Buffer constructor is so powerful, you often see code like this:\n\n```js\n// Convert UTF-8 strings to hex\nfunction toHex (str) {\n  return new Buffer(str).toString('hex')\n}\n```\n\n***But what happens if `toHex` is called with a `Number` argument?***\n\n### Remote Memory Disclosure\n\nIf an attacker can make your program call the `Buffer` constructor with a `Number`\nargument, then they can make it allocate uninitialized memory from the node.js process.\nThis could potentially disclose TLS private keys, user data, or database passwords.\n\nWhen the `Buffer` constructor is passed a `Number` argument, it returns an\n**UNINITIALIZED** block of memory of the specified `size`. When you create a `Buffer` like\nthis, you **MUST** overwrite the contents before returning it to the user.\n\nFrom the [node.js docs](https://nodejs.org/api/buffer.html#buffer_new_buffer_size):\n\n> `new Buffer(size)`\n>\n> - `size` Number\n>\n> The underlying memory for `Buffer` instances created in this way is not initialized.\n> **The contents of a newly created `Buffer` are unknown and could contain sensitive\n> data.** Use `buf.fill(0)` to initialize a Buffer to zeroes.\n\n(Emphasis our own.)\n\nWhenever the programmer intended to create an uninitialized `Buffer` you often see code\nlike this:\n\n```js\nvar buf = new Buffer(16)\n\n// Immediately overwrite the uninitialized buffer with data from another buffer\nfor (var i = 0; i < buf.length; i++) {\n  buf[i] = otherBuf[i]\n}\n```\n\n\n### Would this ever be a problem in real code?\n\nYes. It's surprisingly common to forget to check the type of your variables in a\ndynamically-typed language like JavaScript.\n\nUsually the consequences of assuming the wrong type is that your program crashes with an\nuncaught exception. But the failure mode for forgetting to check the type of arguments to\nthe `Buffer` constructor is more catastrophic.\n\nHere's an example of a vulnerable service that takes a JSON payload and converts it to\nhex:\n\n```js\n// Take a JSON payload {str: \"some string\"} and convert it to hex\nvar server = http.createServer(function (req, res) {\n  var data = ''\n  req.setEncoding('utf8')\n  req.on('data', function (chunk) {\n    data += chunk\n  })\n  req.on('end', function () {\n    var body = JSON.parse(data)\n    res.end(new Buffer(body.str).toString('hex'))\n  })\n})\n\nserver.listen(8080)\n```\n\nIn this example, an http client just has to send:\n\n```json\n{\n  \"str\": 1000\n}\n```\n\nand it will get back 1,000 bytes of uninitialized memory from the server.\n\nThis is a very serious bug. It's similar in severity to the\n[the Heartbleed bug](http://heartbleed.com/) that allowed disclosure of OpenSSL process\nmemory by remote attackers.\n\n\n### Which real-world packages were vulnerable?\n\n#### [`bittorrent-dht`](https://www.npmjs.com/package/bittorrent-dht)\n\n[Mathias Buus](https://github.com/mafintosh) and I\n([Feross Aboukhadijeh](http://feross.org/)) found this issue in one of our own packages,\n[`bittorrent-dht`](https://www.npmjs.com/package/bittorrent-dht). The bug would allow\nanyone on the internet to send a series of messages to a user of `bittorrent-dht` and get\nthem to reveal 20 bytes at a time of uninitialized memory from the node.js process.\n\nHere's\n[the commit](https://github.com/feross/bittorrent-dht/commit/6c7da04025d5633699800a99ec3fbadf70ad35b8)\nthat fixed it. We released a new fixed version, created a\n[Node Security Project disclosure](https://nodesecurity.io/advisories/68), and deprecated all\nvulnerable versions on npm so users will get a warning to upgrade to a newer version.\n\n#### [`ws`](https://www.npmjs.com/package/ws)\n\nThat got us wondering if there were other vulnerable packages. Sure enough, within a short\nperiod of time, we found the same issue in [`ws`](https://www.npmjs.com/package/ws), the\nmost popular WebSocket implementation in node.js.\n\nIf certain APIs were called with `Number` parameters instead of `String` or `Buffer` as\nexpected, then uninitialized server memory would be disclosed to the remote peer.\n\nThese were the vulnerable methods:\n\n```js\nsocket.send(number)\nsocket.ping(number)\nsocket.pong(number)\n```\n\nHere's a vulnerable socket server with some echo functionality:\n\n```js\nserver.on('connection', function (socket) {\n  socket.on('message', function (message) {\n    message = JSON.parse(message)\n    if (message.type === 'echo') {\n      socket.send(message.data) // send back the user's message\n    }\n  })\n})\n```\n\n`socket.send(number)` called on the server, will disclose server memory.\n\nHere's [the release](https://github.com/websockets/ws/releases/tag/1.0.1) where the issue\nwas fixed, with a more detailed explanation. Props to\n[Arnout Kazemier](https://github.com/3rd-Eden) for the quick fix. Here's the\n[Node Security Project disclosure](https://nodesecurity.io/advisories/67).\n\n\n### What's the solution?\n\nIt's important that node.js offers a fast way to get memory otherwise performance-critical\napplications would needlessly get a lot slower.\n\nBut we need a better way to *signal our intent* as programmers. **When we want\nuninitialized memory, we should request it explicitly.**\n\nSensitive functionality should not be packed into a developer-friendly API that loosely\naccepts many different types. This type of API encourages the lazy practice of passing\nvariables in without checking the type very carefully.\n\n#### A new API: `Buffer.allocUnsafe(number)`\n\nThe functionality of creating buffers with uninitialized memory should be part of another\nAPI. We propose `Buffer.allocUnsafe(number)`. This way, it's not part of an API that\nfrequently gets user input of all sorts of different types passed into it.\n\n```js\nvar buf = Buffer.allocUnsafe(16) // careful, uninitialized memory!\n\n// Immediately overwrite the uninitialized buffer with data from another buffer\nfor (var i = 0; i < buf.length; i++) {\n  buf[i] = otherBuf[i]\n}\n```\n\n\n### How do we fix node.js core?\n\nWe sent [a PR to node.js core](https://github.com/nodejs/node/pull/4514) (merged as\n`semver-major`) which defends against one case:\n\n```js\nvar str = 16\nnew Buffer(str, 'utf8')\n```\n\nIn this situation, it's implied that the programmer intended the first argument to be a\nstring, since they passed an encoding as a second argument. Today, node.js will allocate\nuninitialized memory in the case of `new Buffer(number, encoding)`, which is probably not\nwhat the programmer intended.\n\nBut this is only a partial solution, since if the programmer does `new Buffer(variable)`\n(without an `encoding` parameter) there's no way to know what they intended. If `variable`\nis sometimes a number, then uninitialized memory will sometimes be returned.\n\n### What's the real long-term fix?\n\nWe could deprecate and remove `new Buffer(number)` and use `Buffer.allocUnsafe(number)` when\nwe need uninitialized memory. But that would break 1000s of packages.\n\n~~We believe the best solution is to:~~\n\n~~1. Change `new Buffer(number)` to return safe, zeroed-out memory~~\n\n~~2. Create a new API for creating uninitialized Buffers. We propose: `Buffer.allocUnsafe(number)`~~\n\n#### Update\n\nWe now support adding three new APIs:\n\n- `Buffer.from(value)` - convert from any type to a buffer\n- `Buffer.alloc(size)` - create a zero-filled buffer\n- `Buffer.allocUnsafe(size)` - create an uninitialized buffer with given size\n\nThis solves the core problem that affected `ws` and `bittorrent-dht` which is\n`Buffer(variable)` getting tricked into taking a number argument.\n\nThis way, existing code continues working and the impact on the npm ecosystem will be\nminimal. Over time, npm maintainers can migrate performance-critical code to use\n`Buffer.allocUnsafe(number)` instead of `new Buffer(number)`.\n\n\n### Conclusion\n\nWe think there's a serious design issue with the `Buffer` API as it exists today. It\npromotes insecure software by putting high-risk functionality into a convenient API\nwith friendly \"developer ergonomics\".\n\nThis wasn't merely a theoretical exercise because we found the issue in some of the\nmost popular npm packages.\n\nFortunately, there's an easy fix that can be applied today. Use `safe-buffer` in place of\n`buffer`.\n\n```js\nvar Buffer = require('safe-buffer').Buffer\n```\n\nEventually, we hope that node.js core can switch to this new, safer behavior. We believe\nthe impact on the ecosystem would be minimal since it's not a breaking change.\nWell-maintained, popular packages would be updated to use `Buffer.alloc` quickly, while\nolder, insecure packages would magically become safe from this attack vector.\n\n\n## links\n\n- [Node.js PR: buffer: throw if both length and enc are passed](https://github.com/nodejs/node/pull/4514)\n- [Node Security Project disclosure for `ws`](https://nodesecurity.io/advisories/67)\n- [Node Security Project disclosure for`bittorrent-dht`](https://nodesecurity.io/advisories/68)\n\n\n## credit\n\nThe original issues in `bittorrent-dht`\n([disclosure](https://nodesecurity.io/advisories/68)) and\n`ws` ([disclosure](https://nodesecurity.io/advisories/67)) were discovered by\n[Mathias Buus](https://github.com/mafintosh) and\n[Feross Aboukhadijeh](http://feross.org/).\n\nThanks to [Adam Baldwin](https://github.com/evilpacket) for helping disclose these issues\nand for his work running the [Node Security Project](https://nodesecurity.io/).\n\nThanks to [John Hiesey](https://github.com/jhiesey) for proofreading this README and\nauditing the code.\n\n\n## license\n\nMIT. Copyright (C) [Feross Aboukhadijeh](http://feross.org)",
   "_attachments": {}