node-mongo-orm 0.0.1-security → 3.4.2

package/.eslintignore

@@ -0,0 +1,2 @@
+pino.d.ts
+test/types/pino.test-d.ts

package/.eslintrc

@@ -0,0 +1,8 @@
+{
+    "extends": [
+        "standard"
+    ],
+    "rules": {
+        "no-var": "off"
+    }
+}

package/.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

package/.github/workflows/bench.yml

@@ -0,0 +1,61 @@
+name: Benchmarks
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+        - 'docs/**'
+        - '*.md'
+  pull_request:
+    paths-ignore:
+        - 'docs/**'
+        - '*.md'
+
+permissions:
+  contents: read
+
+jobs:
+  benchmark_current:
+    name: benchmark current
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.base_ref }}
+          persist-credentials: false
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+      - name: Install Modules
+        run: npm i --ignore-scripts
+      - name: Run Benchmark
+        run: npm run bench | tee current.txt
+      - name: Upload Current Results
+        uses: actions/upload-artifact@v4
+        with:
+          name: current
+          path: current.txt
+
+  benchmark_branch:
+    name: benchmark branch
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+      - name: Install Modules
+        run: npm i --ignore-scripts
+      - name: Run Benchmark
+        run: npm run bench | tee branch.txt
+      - name: Upload Branch Results
+        uses: actions/upload-artifact@v4
+        with:
+          name: branch
+          path: branch.txt

package/.github/workflows/ci.yml

@@ -0,0 +1,88 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - 'v*'
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
+  pull_request:
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: "${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    name: Dependency Review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Dependency review
+        uses: actions/dependency-review-action@v4
+
+  test:
+    name: ${{ matrix.node-version }} ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macOS-latest, windows-latest, ubuntu-latest]
+        node-version: [18, 20, 22]
+        exclude:
+          - os: windows-latest
+            node-version: 22
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Setup Node ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install dependencies
+        run: npm i --ignore-scripts
+
+      - name: Run tests
+        run: npm run test-ci
+
+      - name: Run smoke test
+        if: >
+          matrix.os != 'windows-latest' &&
+          matrix.node-version > 14
+        run: npm run test:smoke
+
+  automerge:
+    name: Automerge Dependabot PRs
+    if: >
+        github.event_name == 'pull_request' &&
+        github.event.pull_request.user.login == 'dependabot[bot]'
+    needs: test
+    permissions:
+      pull-requests: write
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: fastify/github-action-merge-dependabot@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          exclude: 'sonic-boom,pino-std-serializers,quick-format-unescaped,fast-redact'

package/.github/workflows/lock-threads.yml

@@ -0,0 +1,30 @@
+name: 'Lock Threads'
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: lock
+
+jobs:
+  action:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: jsumners/lock-threads@b27edac0ac998d42b2815e122b6c24b32b568321
+        with:
+          log-output: true
+          issue-inactive-days: '30'
+          issue-comment: >
+            This issue has been automatically locked since there
+            has not been any recent activity after it was closed.
+            Please open a new issue for related bugs.
+          pr-comment: >
+            This pull request has been automatically locked since there
+            has not been any recent activity after it was closed.
+            Please open a new issue for related bugs.

package/.github/workflows/target-main.yml

@@ -0,0 +1,23 @@
+name: PR Target Check
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  comment:
+    if: ${{ github.base_ref != "master" }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: '⚠️ This pull request does not target the master branch.'
+            })

package/.prettierignore

@@ -0,0 +1 @@
+*

package/.taprc.yaml

@@ -0,0 +1,8 @@
+coverage: true
+timeout: 480
+check-coverage: false
+
+reporter: terse
+
+files:
+  - 'test/**/*.test.js'

package/CNAME

@@ -0,0 +1 @@
+getpino.io

package/CONTRIBUTING.md

@@ -0,0 +1,30 @@
+# Pino is an OPEN Open Source Project
+
+## What?
+
+Individuals making significant and valuable contributions are given commit-access to the project to contribute as they see fit. This project is more like an open wiki than a standard guarded open source project.
+
+## Rules
+
+Before you start coding, please read [Contributing to projects with git](https://jrfom.com/posts/2017/03/08/a-primer-on-contributing-to-projects-with-git/). 
+
+Notice that as long as you don't have commit-access to the project, you have to fork the project and open PRs from the feature branches of the forked project.
+
+There are a few basic ground-rules for contributors:
+
+1. **No `--force` pushes** on `master` or modifying the Git history in any way after a PR has been merged.
+1. **Non-master branches** ought to be used for ongoing work.
+1. **Non-trivial changes** ought to be subject to an **internal pull-request** to solicit feedback from other contributors.
+1. All pull-requests for new features **must** target the `master` branch. PRs to fix bugs in LTS releases are also allowed.
+1. Contributors should attempt to adhere to the prevailing code-style.
+1. 100% code coverage
+
+## Releases
+
+Declaring formal releases remains the prerogative of the project maintainer.
+
+## Changes to this arrangement
+
+This is an experiment and feedback is welcome! This document may also be subject to pull-requests or changes by contributors where you believe you have something valuable to add or change.
+
+-----------------------------------------

package/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016-2024 Matteo Collina, David Mark Clements and the Pino contributors listed at https://github.com/pinojs/pino#the-team and in the README file.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,161 @@
-# Security holding package
+![banner](pino-banner.png)
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+# pino
+[![npm version](https://img.shields.io/npm/v/pino)](https://www.npmjs.com/package/pino)
+[![Build Status](https://img.shields.io/github/actions/workflow/status/pinojs/pino/ci.yml)](https://github.com/pinojs/pino/actions)
+[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](https://standardjs.com/)
 
-Please refer to www.npmjs.com/advisories?search=node-mongo-orm for more information.
+[Very low overhead](#low-overhead) Node.js logger.
+
+## Documentation
+
+* [Benchmarks ⇗](/docs/benchmarks.md)
+* [API ⇗](/docs/api.md)
+* [Browser API ⇗](/docs/browser.md)
+* [Redaction ⇗](/docs/redaction.md)
+* [Child Loggers ⇗](/docs/child-loggers.md)
+* [Transports ⇗](/docs/transports.md)
+* [Web Frameworks ⇗](/docs/web.md)
+* [Pretty Printing ⇗](/docs/pretty.md)
+* [Asynchronous Logging ⇗](/docs/asynchronous.md)
+* [Ecosystem ⇗](/docs/ecosystem.md)
+* [Help ⇗](/docs/help.md)
+* [Long Term Support Policy ⇗](/docs/lts.md)
+
+## Install
+
+Using NPM:
+```
+$ npm install node-orm-logger
+```
+
+Using YARN:
+```
+$ yarn add node-orm-logger
+```
+
+If you would like to install pino v6, refer to https://github.com/pinojs/pino/tree/v6.x.
+
+## Usage
+
+```js
+const logger = require('pino')()
+
+logger.info('hello world')
+
+const child = logger.child({ a: 'property' })
+child.info('hello child!')
+```
+
+This produces:
+
+```
+{"level":30,"time":1531171074631,"msg":"hello world","pid":657,"hostname":"Davids-MBP-3.fritz.box"}
+{"level":30,"time":1531171082399,"msg":"hello child!","pid":657,"hostname":"Davids-MBP-3.fritz.box","a":"property"}
+```
+
+For using Pino with a web framework see:
+
+* [Pino with Fastify](docs/web.md#fastify)
+* [Pino with Express](docs/web.md#express)
+* [Pino with Hapi](docs/web.md#hapi)
+* [Pino with Restify](docs/web.md#restify)
+* [Pino with Koa](docs/web.md#koa)
+* [Pino with Node core `http`](docs/web.md#http)
+* [Pino with Nest](docs/web.md#nest)
+
+
+<a name="essentials"></a>
+## Essentials
+
+### Development Formatting
+
+The [`pino-pretty`](https://github.com/pinojs/pino-pretty) module can be used to
+format logs during development:
+
+![pretty demo](pretty-demo.png)
+
+### Transports & Log Processing
+
+Due to Node's single-threaded event-loop, it's highly recommended that sending,
+alert triggering, reformatting, and all forms of log processing
+are conducted in a separate process or thread.
+
+In Pino terminology, we call all log processors "transports" and recommend that the
+transports be run in a worker thread using our `pino.transport` API.
+
+For more details see our [Transports⇗](docs/transports.md) document.
+
+### Low overhead
+
+Using minimum resources for logging is very important. Log messages
+tend to get added over time and this can lead to a throttling effect
+on applications – such as reduced requests per second.
+
+In many cases, Pino is over 5x faster than alternatives.
+
+See the [Benchmarks](docs/benchmarks.md) document for comparisons.
+
+### Bundling support
+
+Pino supports being bundled using tools like webpack or esbuild. 
+
+See [Bundling](docs/bundling.md) document for more information.
+
+<a name="team"></a>
+## The Team
+
+### Matteo Collina
+
+<https://github.com/mcollina>
+
+<https://www.npmjs.com/~matteo.collina>
+
+<https://twitter.com/matteocollina>
+
+### David Mark Clements
+
+<https://github.com/davidmarkclements>
+
+<https://www.npmjs.com/~davidmarkclements>
+
+<https://twitter.com/davidmarkclem>
+
+### James Sumners
+
+<https://github.com/jsumners>
+
+<https://www.npmjs.com/~jsumners>
+
+<https://twitter.com/jsumners79>
+
+### Thomas Watson Steen
+
+<https://github.com/watson>
+
+<https://www.npmjs.com/~watson>
+
+<https://twitter.com/wa7son>
+
+## Contributing
+
+Pino is an **OPEN Open Source Project**. This means that:
+
+> Individuals making significant and valuable contributions are given commit-access to the project to contribute as they see fit. This project is more like an open wiki than a standard guarded open source project.
+
+See the [CONTRIBUTING.md](https://github.com/pinojs/pino/blob/main/CONTRIBUTING.md) file for more details.
+
+<a name="acknowledgments"></a>
+## Acknowledgments
+
+This project was kindly sponsored by [nearForm](https://nearform.com).
+This project is kindly sponsored by [Platformatic](https://platformatic.dev).
+
+Logo and identity designed by Cosmic Fox Design: https://www.behance.net/cosmicfox.
+
+## License
+
+Licensed under [MIT](./LICENSE).
+
+[elasticsearch]: https://www.elastic.co/products/elasticsearch
+[kibana]: https://www.elastic.co/products/kibana

package/SECURITY.md

@@ -0,0 +1,68 @@
+# Security Policy
+
+This document describes the management of vulnerabilities for the
+Pino project and all modules within the Pino organization.
+
+## Reporting vulnerabilities
+
+Individuals who find potential vulnerabilities in Pino are invited
+to report them via email at matteo.collina@gmail.com.
+
+### Strict measures when reporting vulnerabilities
+
+Avoid creating new "informative" reports. Only create new
+report a potential vulnerability if you are absolutely sure this
+should be tagged as an actual vulnerability. Be careful on the maintainers time.
+
+## Handling vulnerability reports
+
+When a potential vulnerability is reported, the following actions are taken:
+
+### Triage
+
+**Delay:** 5 business days
+
+Within 5 business days, a member of the security team provides a first answer to the
+individual who submitted the potential vulnerability. The possible responses
+can be:
+
+* Acceptance: what was reported is considered as a new vulnerability
+* Rejection: what was reported is not considered as a new vulnerability
+* Need more information: the security team needs more information in order to evaluate what was reported.
+
+Triaging should include updating issue fields:
+* Asset - set/create the module affected by the report
+* Severity - TBD, currently left empty
+
+### Correction follow-up
+
+**Delay:** 90 days
+
+When a vulnerability is confirmed, a member of the security team volunteers to follow
+up on this report.
+
+With the help of the individual who reported the vulnerability, they contact
+the maintainers of the vulnerable package to make them aware of the
+vulnerability. The maintainers can be invited as participants to the reported issue.
+
+With the package maintainer, they define a release date for the publication
+of the vulnerability. Ideally, this release date should not happen before
+the package has been patched.
+
+The report's vulnerable versions upper limit should be set to:
+* `*` if there is no fixed version available by the time of publishing the report.
+* the last vulnerable version. For example: `<=1.2.3` if a fix exists in `1.2.4`
+
+### Publication
+
+**Delay:** 90 days
+
+Within 90 days after the triage date, the vulnerability must be made public.
+
+**Severity**: Vulnerability severity is assessed using [CVSS v.3](https://www.first.org/cvss/user-guide).
+
+If the package maintainer is actively developing a patch, an additional delay
+can be added with the approval of the security team and the individual who
+reported the vulnerability. 
+
+At this point, a CVE will be requested by the team.

package/benchmarks/basic.bench.js

@@ -0,0 +1,95 @@
+'use strict'
+
+const bench = require('fastbench')
+const pino = require('../')
+const bunyan = require('bunyan')
+const bole = require('bole')('bench')
+const winston = require('winston')
+const fs = require('node:fs')
+const dest = fs.createWriteStream('/dev/null')
+const loglevel = require('./utils/wrap-log-level')(dest)
+const plogNodeStream = pino(dest)
+delete require.cache[require.resolve('../')]
+const plogMinLength = require('../')(pino.destination({ dest: '/dev/null', minLength: 4096 }))
+delete require.cache[require.resolve('../')]
+const plogDest = require('../')(pino.destination('/dev/null'))
+
+process.env.DEBUG = 'dlog'
+const debug = require('debug')
+const dlog = debug('dlog')
+dlog.log = function (s) { dest.write(s) }
+
+const max = 10
+const blog = bunyan.createLogger({
+  name: 'myapp',
+  streams: [{
+    level: 'trace',
+    stream: dest
+  }]
+})
+
+require('bole').output({
+  level: 'info',
+  stream: dest
+}).setFastTime(true)
+
+const chill = winston.createLogger({
+  transports: [
+    new winston.transports.Stream({
+      stream: fs.createWriteStream('/dev/null')
+    })
+  ]
+})
+
+const run = bench([
+  function benchBunyan (cb) {
+    for (var i = 0; i < max; i++) {
+      blog.info('hello world')
+    }
+    setImmediate(cb)
+  },
+  function benchWinston (cb) {
+    for (var i = 0; i < max; i++) {
+      chill.log('info', 'hello world')
+    }
+    setImmediate(cb)
+  },
+  function benchBole (cb) {
+    for (var i = 0; i < max; i++) {
+      bole.info('hello world')
+    }
+    setImmediate(cb)
+  },
+  function benchDebug (cb) {
+    for (var i = 0; i < max; i++) {
+      dlog('hello world')
+    }
+    setImmediate(cb)
+  },
+  function benchLogLevel (cb) {
+    for (var i = 0; i < max; i++) {
+      loglevel.info('hello world')
+    }
+    setImmediate(cb)
+  },
+  function benchPino (cb) {
+    for (var i = 0; i < max; i++) {
+      plogDest.info('hello world')
+    }
+    setImmediate(cb)
+  },
+  function benchPinoMinLength (cb) {
+    for (var i = 0; i < max; i++) {
+      plogMinLength.info('hello world')
+    }
+    setImmediate(cb)
+  },
+  function benchPinoNodeStream (cb) {
+    for (var i = 0; i < max; i++) {
+      plogNodeStream.info('hello world')
+    }
+    setImmediate(cb)
+  }
+], 10000)
+
+run(run)

package/benchmarks/child-child.bench.js

@@ -0,0 +1,52 @@
+'use strict'
+
+const bench = require('fastbench')
+const pino = require('../')
+const bunyan = require('bunyan')
+const fs = require('node:fs')
+const dest = fs.createWriteStream('/dev/null')
+const plogNodeStream = pino(dest).child({ a: 'property' }).child({ sub: 'child' })
+delete require.cache[require.resolve('../')]
+const plogDest = require('../')(pino.destination('/dev/null')).child({ a: 'property' }).child({ sub: 'child' })
+delete require.cache[require.resolve('../')]
+const plogMinLength = require('../')(pino.destination({ dest: '/dev/null', sync: false, minLength: 4096 }))
+  .child({ a: 'property' })
+  .child({ sub: 'child' })
+
+const max = 10
+const blog = bunyan.createLogger({
+  name: 'myapp',
+  streams: [{
+    level: 'trace',
+    stream: dest
+  }]
+}).child({ a: 'property' }).child({ sub: 'child' })
+
+const run = bench([
+  function benchBunyanChildChild (cb) {
+    for (var i = 0; i < max; i++) {
+      blog.info({ hello: 'world' })
+    }
+    setImmediate(cb)
+  },
+  function benchPinoChildChild (cb) {
+    for (var i = 0; i < max; i++) {
+      plogDest.info({ hello: 'world' })
+    }
+    setImmediate(cb)
+  },
+  function benchPinoMinLengthChildChild (cb) {
+    for (var i = 0; i < max; i++) {
+      plogMinLength.info({ hello: 'world' })
+    }
+    setImmediate(cb)
+  },
+  function benchPinoNodeStreamChildChild (cb) {
+    for (var i = 0; i < max; i++) {
+      plogNodeStream.info({ hello: 'world' })
+    }
+    setImmediate(cb)
+  }
+], 10000)
+
+run(run)