pema 0.14.0 → 0.14.2

package/lib/private/coerce/bigint.js

@@ -1,10 +1,27 @@
 import is from "@rcompat/is";
 export default function coerce_bigint(x) {
-    // normalize from string to number; other types unaffected
-    const n = is.numeric(x) ? Number(x) : x;
-    // normalize from number to bigint; other types unaffected
-    if (is.int(n))
-        return BigInt(n);
+    if (is.numeric(x)) {
+        // Retain non-finite rejection and bound exponent expansion. This number
+        // is only an eligibility check, never the source of the bigint value.
+        if (!is.finite(Number(x)))
+            return x;
+        const [coefficient, exponent = "0"] = x.trim().toLowerCase().split("e");
+        const [whole, fraction = ""] = coefficient.split(".");
+        const digits = whole + fraction;
+        if (/^[+-]?0+$/.test(digits))
+            return 0n;
+        const shift = Number(exponent) - fraction.length;
+        if (shift >= 0)
+            return BigInt(digits) * 10n ** BigInt(shift);
+        // A decimal shift may discard only zeroes, never a fractional value.
+        const end = digits.length + shift;
+        if (end <= 0 || /[1-9]/.test(digits.slice(end)))
+            return x;
+        return BigInt(digits.slice(0, end));
+    }
+    // Number inputs have already acquired JavaScript's precision semantics.
+    if (is.int(x))
+        return BigInt(x);
     // bigint or invalid
     return x;
 }

package/lib/private/validator/email.js

@@ -1,5 +1,7 @@
 import regex from "#validator/regex";
-const re = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+// Choose the first dot after the domain's first character. Keeping dots out
+// of the preceding repetition avoids quadratic backtracking on hostile input.
+const re = /^[^\s@]+@[^\s@][^\s@.]*\.[^\s@]+$/u;
 export default function email(options) {
     return regex(re, options ?? (x => `"${x}" is not a valid email`));
 }

package/package.json

@@ -48,5 +48,5 @@
     "test": "proby"
   },
   "type": "module",
-  "version": "0.14.0"
+  "version": "0.14.2"
 }