nanos-lint 2.4.0 → 2.5.0

package/dist/cli.js

@@ -1,2 +1,2 @@
-import { i as runCLI, n as createProgram, r as isDirectExecution, t as collectIgnorePatterns } from "./cli-kmHD4epr.js";
+import { i as runCLI, n as createProgram, r as isDirectExecution, t as collectIgnorePatterns } from "./cli-BVXk8XmH.js";
 export { collectIgnorePatterns, createProgram, isDirectExecution, runCLI };

package/dist/index.d.ts

@@ -86,6 +86,15 @@ export declare function getDefaultTemplatePath(): string;
 export declare function stripJsonComments(text: string): string;
 export declare function parseJsonc<T = unknown>(text: string): T;
 export declare function loadConfigFile(filePath: string): LuaRCConfig;
+/**
+ * Removes trailing `/` characters from a path-like string.
+ *
+ * Implemented with a scan instead of a `\/+$` regular expression: on inputs made
+ * of many slashes that do not end in a slash, a backtracking engine retries the
+ * repetition at every offset, which is quadratic in the input length
+ * (CodeQL: js/polynomial-redos).
+ */
+export declare function stripTrailingSlashes(value: string): string;
 export interface MergeConfigOptions {
   cliIgnore?: string[];
 }
@@ -117,6 +126,20 @@ export declare function initWorkspace(workspacePath: string, options?: InitWorks
 //#region src/luals.d.ts
 export declare const FALLBACK_LUALS_VERSION = "3.19.1";
 export declare const DEFAULT_LUALS_VERSION = "latest";
+/**
+ * Validates a LuaLS version/tag and rebuilds it from the allow-list above.
+ *
+ * Version strings originate from untrusted sources: the GitHub releases API
+ * response and user supplied `--luals-version` arguments. They are interpolated
+ * into cache directory paths, download URLs, and the path of the binary that is
+ * eventually executed, so they must be constrained to a single safe path
+ * segment. Rebuilding the value character by character guarantees the returned
+ * string only ever contains allow-listed characters (CodeQL: js/command-line-injection).
+ *
+ * @returns the normalized version (a single leading `v` is dropped), or `null`
+ *          when the input cannot be used as a version tag.
+ */
+export declare function sanitizeLuaLSVersion(raw: string): string | null;
 /**
  * Escapes single quotes for safe PowerShell single-quoted string interpolation.
  */
@@ -127,6 +150,8 @@ export declare function escapePowerShellSingleQuote(str: string): string;
 export declare function resolveLatestLuaLSVersion(): Promise<string>;
 /**
  * Resolves a version string ("latest" -> actual tag).
+ *
+ * @throws when an explicitly requested version is not a valid tag.
  */
 export declare function resolveLuaLSVersion(version?: string): Promise<string>;
 export interface PlatformInfo {

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/config.ts","../src/luals.ts","../src/reporter.ts"],"mappings":";;YAEY;YACA;iBAEK;EACf;IACE;IACA;;EAEF;IACE;IACA;;;iBAIa;EACf,OAAO;EACP,UAAU;EACV;EACA;EACA;;YAGU,mBAAmB,eAAe;iBAE7B;EACf;EACA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe;EACf;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;;iBAGE;EACf;EACA;IACE;IACA;KACC;;EAEH;IACE;IACA;IACA;KACC;;EAEH;IACE;KACC;;EAEH;IACE;IACA;IACA;IACA,WAAW;IACX,mBAAmB;KAClB;;GAEF;;;;;;wBAOa,cAAc;;;;;;wBCnEd;wBAWA;wBAKA;;;;wBAQA,kBAAkB;wBAKlB,WAAW,aAAa,eAAe;wBAavC,eAAe,mBAAmB;iBAQjC;EACf;;;;;;;wBAQc,aACd,MAAM,aACN,WAAU,aACV,yBACA,UAAU,qBACT;iBAsGc;EACf;;;;;;wBAOc,uBACd,uBACA,2BACA,UAAU;EACP;EAAoB;;iBA2ER;EACf;;;;;wBAMc,cAAc,uBAAuB,UAAU;;;qBCtQlD;qBACA;;;;wBAKG,4BAA4B;;;;wBAOtB,6BAA6B;;;;wBA4B7B,oBAAoB,mBAAmB;iBAO5C;EACf;EACA;EACA;EACA;;wBAGc,gBAAgB,mBAA2C;wBAiD3D,YAAY;iBASX;EACf;;;;;wBAMc,cAAc;wBAoBR,wBACpB,kBACA,oBACA,UAAU,kBACT;iBAqKc;EACf;;wBAGoB,mBACpB,kBACA,UAAU,sBACT;wBA0DmB,cACpB,oBACA,oBACA,SAAS,eACR,QAAQ;;;;wBA+HK,kBAAkB,oBAAoB;;;;;;;wBCpftC;wBAUA,UAAU;;;;;;;;;;;;wBA6BV,oBACd,kBACA;wBAgBc,UAAU,eAAe,kBAAkB;wBAI3C,qBACd,uBACA,gBACA,kBACA;wBAqBc,aACd,QAAQ,aACR,cACA;wBAiFc,wBAAwB,QAAQ,aAAa;wBAsC7C,aACd,QAAQ,aACR,uCACA,cACA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types.ts","../src/config.ts","../src/luals.ts","../src/reporter.ts"],"mappings":";;YAEY;YACA;iBAEK;EACf;IACE;IACA;;EAEF;IACE;IACA;;;iBAIa;EACf,OAAO;EACP,UAAU;EACV;EACA;EACA;;YAGU,mBAAmB,eAAe;iBAE7B;EACf;EACA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe;EACf;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;;iBAGE;EACf;EACA;IACE;IACA;KACC;;EAEH;IACE;IACA;IACA;KACC;;EAEH;IACE;KACC;;EAEH;IACE;IACA;IACA;IACA,WAAW;IACX,mBAAmB;KAClB;;GAEF;;;;;;wBAOa,cAAc;;;;;;wBCnEd;wBAWA;wBAKA;;;;wBAQA,kBAAkB;wBAKlB,WAAW,aAAa,eAAe;wBAavC,eAAe,mBAAmB;;;;;;;;;wBAgBlC,qBAAqB;iBAQpB;EACf;;;;;;;wBAQc,aACd,MAAM,aACN,WAAU,aACV,yBACA,UAAU,qBACT;iBAsGc;EACf;;;;;;wBAOc,uBACd,uBACA,2BACA,UAAU;EACP;EAAoB;;iBA6ER;EACf;;;;;wBAMc,cAAc,uBAAuB,UAAU;;;qBCxRlD;qBACA;;;;;;;;;;;;;;wBA0BG,qBAAqB;;;;wBAkCrB,4BAA4B;;;;wBAOtB,6BAA6B;;;;;;wBAgC7B,oBAAoB,mBAAmB;iBAa5C;EACf;EACA;EACA;EACA;;wBAGc,gBAAgB,mBAA2C;wBAiD3D,YAAY;iBASX;EACf;;;;;wBAMc,cAAc;wBAoBR,wBACpB,kBACA,oBACA,UAAU,kBACT;iBAqKc;EACf;;wBAGoB,mBACpB,kBACA,UAAU,sBACT;wBA0DmB,cACpB,oBACA,oBACA,SAAS,eACR,QAAQ;;;;wBA+HK,kBAAkB,oBAAoB;;;;;;;wBCrjBtC;wBAUA,UAAU;;;;;;;;;;;;wBA6BV,oBACd,kBACA;wBAgBc,UAAU,eAAe,kBAAkB;wBAI3C,qBACd,uBACA,gBACA,kBACA;wBAqBc,aACd,QAAQ,aACR,cACA;wBAiFc,wBAAwB,QAAQ,aAAa;wBAsC7C,aACd,QAAQ,aACR,uCACA,cACA"}

package/dist/index.js

@@ -1,2 +1,2 @@
-import { A as mergeConfigs, C as resolveLuaLSVersion, D as getPackageRoot, E as getDefinitionsDir, M as resolveWorkspaceConfig, N as stripJsonComments, O as initWorkspace, P as fileUriToPath, S as resolveLuaLSBinary, T as getDefaultTemplatePath, _ as escapePowerShellSingleQuote, a as formatGitHubAnnotations, b as isBinaryValid, c as formatReport, d as pluralize, f as shouldEnableColor, g as downloadAndExtractLuaLS, h as countCheckedFiles, i as runCLI, j as parseJsonc, k as loadConfigFile, l as formatSeverityBadge, m as FALLBACK_LUALS_VERSION, n as createProgram, o as formatPretty, p as DEFAULT_LUALS_VERSION, r as isDirectExecution, s as formatProblemSummary, t as collectIgnorePatterns, u as getColors, v as getCacheDir, w as runLuaLSCheck, x as resolveLatestLuaLSVersion, y as getPlatformInfo } from "./cli-kmHD4epr.js";
-export { DEFAULT_LUALS_VERSION, FALLBACK_LUALS_VERSION, collectIgnorePatterns, countCheckedFiles, createProgram, downloadAndExtractLuaLS, escapePowerShellSingleQuote, fileUriToPath, formatGitHubAnnotations, formatPretty, formatProblemSummary, formatReport, formatSeverityBadge, getCacheDir, getColors, getDefaultTemplatePath, getDefinitionsDir, getPackageRoot, getPlatformInfo, initWorkspace, isBinaryValid, isDirectExecution, loadConfigFile, mergeConfigs, parseJsonc, pluralize, resolveLatestLuaLSVersion, resolveLuaLSBinary, resolveLuaLSVersion, resolveWorkspaceConfig, runCLI, runLuaLSCheck, shouldEnableColor, stripJsonComments };
+import { A as loadConfigFile, C as resolveLuaLSVersion, D as getDefinitionsDir, E as getDefaultTemplatePath, F as stripTrailingSlashes, I as fileUriToPath, M as parseJsonc, N as resolveWorkspaceConfig, O as getPackageRoot, P as stripJsonComments, S as resolveLuaLSBinary, T as sanitizeLuaLSVersion, _ as escapePowerShellSingleQuote, a as formatGitHubAnnotations, b as isBinaryValid, c as formatReport, d as pluralize, f as shouldEnableColor, g as downloadAndExtractLuaLS, h as countCheckedFiles, i as runCLI, j as mergeConfigs, k as initWorkspace, l as formatSeverityBadge, m as FALLBACK_LUALS_VERSION, n as createProgram, o as formatPretty, p as DEFAULT_LUALS_VERSION, r as isDirectExecution, s as formatProblemSummary, t as collectIgnorePatterns, u as getColors, v as getCacheDir, w as runLuaLSCheck, x as resolveLatestLuaLSVersion, y as getPlatformInfo } from "./cli-BVXk8XmH.js";
+export { DEFAULT_LUALS_VERSION, FALLBACK_LUALS_VERSION, collectIgnorePatterns, countCheckedFiles, createProgram, downloadAndExtractLuaLS, escapePowerShellSingleQuote, fileUriToPath, formatGitHubAnnotations, formatPretty, formatProblemSummary, formatReport, formatSeverityBadge, getCacheDir, getColors, getDefaultTemplatePath, getDefinitionsDir, getPackageRoot, getPlatformInfo, initWorkspace, isBinaryValid, isDirectExecution, loadConfigFile, mergeConfigs, parseJsonc, pluralize, resolveLatestLuaLSVersion, resolveLuaLSBinary, resolveLuaLSVersion, resolveWorkspaceConfig, runCLI, runLuaLSCheck, sanitizeLuaLSVersion, shouldEnableColor, stripJsonComments, stripTrailingSlashes };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nanos-lint",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Linter and type-checker for nanos world Lua scripts powered by LuaLS",
   "keywords": [
     "nanos-world",