projen-pipelines 0.3.21 → 0.3.23

package/node_modules/fast-xml-parser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fast-xml-parser",
-  "version": "5.8.0",
+  "version": "5.11.0",
   "description": "Validate XML, Parse XML, Build XML without C/C++ based libraries",
   "main": "./lib/fxp.cjs",
   "type": "module",
@@ -27,9 +27,7 @@
     "lint": "eslint src/**/*.js spec/**/*.js benchmark/**/*.js",
     "bundle": "webpack --config webpack.cjs.config.js",
     "prettier": "prettier --write src/**/*.js",
-    "checkReadiness": "publish-please --dry-run",
-    "publish-please": "publish-please",
-    "prepublishOnly": "publish-please guard"
+    "preversion": "npm test"
   },
   "bin": {
     "fxparser": "src/cli/cli.js"
@@ -74,7 +72,6 @@
     "eslint": "^8.3.0",
     "jasmine": "^5.6.0",
     "prettier": "^3.5.1",
-    "publish-please": "^5.5.2",
     "typescript": "5",
     "webpack": "^5.64.4",
     "webpack-cli": "^4.9.1"
@@ -86,10 +83,11 @@
     }
   ],
   "dependencies": {
-    "@nodable/entities": "^2.1.0",
+    "@nodable/entities": "^3.0.0",
     "fast-xml-builder": "^1.2.0",
-    "path-expression-matcher": "^1.5.0",
-    "strnum": "^2.3.0",
-    "xml-naming": "^0.1.0"
+    "is-unsafe": "^2.0.0",
+    "path-expression-matcher": "^1.6.2",
+    "strnum": "^2.4.2",
+    "xml-naming": "^0.3.0"
   }
-}
+}

package/node_modules/fast-xml-parser/src/fxp.d.ts

@@ -503,7 +503,9 @@ export type strnumOptions = {
   hex: boolean;
   leadingZeros: boolean,
   skipLike?: RegExp,
-  eNotation?: boolean
+  eNotation?: boolean,
+  infinity?: string,
+  unicode?: boolean
 }
 
 export type validationOptions = {
@@ -747,4 +749,6 @@ export class XMLBuilder {
 export interface XMLMetaData {
   /** The index, if available, of the character where the XML node began in the input stream. */
   startIndex?: number;
+  /** The index, if available, of the character where the XML node ended in the input stream. */
+  endIndex?: number;
 }

package/node_modules/fast-xml-parser/src/xmlparser/DocTypeReader.js

@@ -23,8 +23,23 @@ export default class DocTypeReader {
             i = i + 9;
             let angleBracketsCount = 1;
             let hasBody = false, comment = false;
+            let quoteChar = null; // tracks an open SYSTEM/PUBLIC literal before the '[' body
             let exp = "";
             for (; i < xmlData.length; i++) {
+                // Inside a quoted external-identifier literal — XML allows '<'
+                // and '>' as plain data here, so they must not be interpreted
+                // as DOCTYPE structure until the matching quote closes.
+                if (quoteChar !== null) {
+                    if (xmlData[i] === quoteChar) quoteChar = null;
+                    exp += xmlData[i];
+                    continue;
+                }
+                if (!hasBody && !comment && (xmlData[i] === '"' || xmlData[i] === "'")) {
+                    quoteChar = xmlData[i];
+                    exp += xmlData[i];
+                    continue;
+                }
+
                 if (xmlData[i] === '<' && !comment) { //Determine the tag type
                     if (hasBody && hasSeq(xmlData, "!ENTITY", i)) {
                         i += 7;
@@ -79,7 +94,7 @@ export default class DocTypeReader {
                     exp += xmlData[i];
                 }
             }
-            if (angleBracketsCount !== 0) {
+            if (quoteChar !== null || angleBracketsCount !== 0) {
                 throw new Error(`Unclosed DOCTYPE`);
             }
         } else {

package/node_modules/fast-xml-parser/src/xmlparser/OptionsBuilder.js

@@ -25,7 +25,8 @@ export const defaultOptions = {
   numberParseOptions: {
     hex: true,
     leadingZeros: true,
-    eNotation: true
+    eNotation: true,
+    unicode: false
   },
   tagValueProcessor: function (tagName, val) {
     return val;

package/node_modules/fast-xml-parser/src/xmlparser/OrderedObjParser.js

@@ -8,7 +8,9 @@ import toNumber from "strnum";
 import getIgnoreAttributesFn from "../ignoreAttributes.js";
 import { Expression, Matcher } from 'path-expression-matcher';
 import { ExpressionSet } from 'path-expression-matcher';
-import { EntityDecoder, XML, CURRENCY, COMMON_HTML } from '@nodable/entities';
+import { EntityDecoder, XML, CURRENCY, COMMON_HTML, ENTITY_ACTION } from '@nodable/entities';
+import { isUnsafe, HTML as HTML_CONTEXT, XML as XML_CONTEXT } from "is-unsafe"
+
 
 // const regx =
 //   '<((!\\[CDATA\\[([\\s\\S]*?)(]]>))|((NAME:)?(NAME))([^>]*)>|((\\/)(NAME)\\s*>))([^<]*)'
@@ -85,6 +87,7 @@ export default class OrderedObjParser {
     this.ignoreAttributesFn = getIgnoreAttributesFn(this.options.ignoreAttributes)
     this.entityExpansionCount = 0;
     this.currentExpandedLength = 0;
+    this.doctypefound = false;
     let namedEntities = { ...XML };
     if (this.options.entityDecoder) {
       this.entityDecoder = this.options.entityDecoder
@@ -98,7 +101,12 @@ export default class OrderedObjParser {
           maxTotalExpansions: this.options.processEntities.maxTotalExpansions,
           maxExpandedLength: this.options.processEntities.maxExpandedLength,
           applyLimitsTo: this.options.processEntities.appliesTo,
-        }
+        },
+        // onExternalEntity: (name, value) => isUnsafe(value) ? 'block' : 'allow',
+        onInputEntity: (name, value) =>
+          //TODO: VALID_CONTEXTS.HTML should be set only if this.options.htmlEntities
+          isUnsafe(value, [HTML_CONTEXT, XML_CONTEXT]) ? ENTITY_ACTION.BLOCK : ENTITY_ACTION.ALLOW,
+
         //postCheck: resolved => resolved
       });
     }
@@ -287,6 +295,7 @@ const parseXml = function (xmlData) {
   // Reset entity expansion counters for this document
   this.entityExpansionCount = 0;
   this.currentExpandedLength = 0;
+  this.doctypefound = false;
   const options = this.options;
   const docTypeReader = new DocTypeReader(options.processEntities);
   const xmlLen = xmlData.length;
@@ -327,7 +336,12 @@ const parseXml = function (xmlData) {
         this.matcher.pop();
         this.isCurrentNodeStopNode = false; // Reset flag when closing tag
 
-        currentNode = this.tagsNodeStack.pop();//avoid recursion, set the parent tag scope
+        //a closing tag with no matching opening tag leaves the stack empty
+        currentNode = this.tagsNodeStack.pop() || xmlObj;//avoid recursion, set the parent tag scope
+
+        if (options.captureMetaData && currentNode) {
+          currentNode.addEndIndex(closeIndex + 1);
+        }
         textData = "";
         i = closeIndex;
       } else if (c1 === 63) { //'?'
@@ -353,6 +367,11 @@ const parseXml = function (xmlData) {
             childNode[":@"] = attsMap
           }
           this.addChild(currentNode, childNode, this.readonlyMatcher, i);
+
+          if (options.captureMetaData) {
+            // closeIndex points at '?' of the closing '?>'
+            currentNode.addEndIndex(tagData.closeIndex + 2);
+          }
         }
 
 
@@ -371,6 +390,8 @@ const parseXml = function (xmlData) {
         i = endIndex;
       } else if (c1 === 33
         && xmlData.charCodeAt(i + 2) === 68) { //'!D'
+        if (this.doctypefound) throw new Error("Multiple DOCTYPE declarations found.");
+        this.doctypefound = true;
         const result = docTypeReader.readDocType(xmlData, i);
         this.entityDecoder.addInputEntities(result.entities);
         i = result.i;
@@ -515,6 +536,10 @@ const parseXml = function (xmlData) {
           this.isCurrentNodeStopNode = false; // Reset flag
 
           this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
+
+          if (options.captureMetaData) {
+            currentNode.addEndIndex(i + 1);
+          }
         } else {
           //selfClosing tag
           if (isSelfClosing) {
@@ -525,6 +550,10 @@ const parseXml = function (xmlData) {
               childNode[":@"] = prefixedAttrs;
             }
             this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
+
+            if (options.captureMetaData) {
+              currentNode.addEndIndex(closeIndex + 1);
+            }
             this.matcher.pop(); // Pop self-closing tag
             this.isCurrentNodeStopNode = false; // Reset flag
           }
@@ -534,6 +563,10 @@ const parseXml = function (xmlData) {
               childNode[":@"] = prefixedAttrs;
             }
             this.addChild(currentNode, childNode, this.readonlyMatcher, startIndex);
+
+            if (options.captureMetaData) {
+              currentNode.addEndIndex(result.closeIndex + 1);
+            }
             this.matcher.pop(); // Pop unpaired tag
             this.isCurrentNodeStopNode = false; // Reset flag
             i = result.closeIndex;

package/node_modules/fast-xml-parser/src/xmlparser/xmlNode.js

@@ -27,12 +27,26 @@ export default class XmlNode {
       this.child.push({ [node.tagname]: node.child });
     }
     // if requested, add the startIndex
+    this.addStartIndex(startIndex);
+  }
+
+  addStartIndex(startIndex) {
     if (startIndex !== undefined) {
       // Note: for now we just overwrite the metadata. If we had more complex metadata,
       // we might need to do an object append here:  metadata = { ...metadata, startIndex }
       this.child[this.child.length - 1][METADATA_SYMBOL] = { startIndex };
     }
   }
+
+  addEndIndex(endIndex) {
+    const lastChild = this.child[this.child.length - 1];
+    // endIndex is write-once: when updateTag drops a node, the last child is a
+    // previously completed sibling whose endIndex must not be overwritten
+    if (lastChild !== undefined && lastChild[METADATA_SYMBOL] !== undefined
+      && lastChild[METADATA_SYMBOL].endIndex === undefined) {
+      lastChild[METADATA_SYMBOL].endIndex = endIndex;
+    }
+  }
   /** symbol used for metadata */
   static getMetaDataSymbol() {
     return METADATA_SYMBOL;

package/node_modules/get-pkg-repo/node_modules/yargs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yargs",
-  "version": "16.2.0",
+  "version": "16.2.2",
   "description": "yargs the modern, pirate-themed, successor to optimist.",
   "main": "./index.cjs",
   "exports": {
@@ -18,9 +18,9 @@
     },
     "./yargs": [
       {
-        "require": "./yargs"
+        "require": "./yargs.cjs"
       },
-      "./yargs"
+      "./yargs.cjs"
     ]
   },
   "type": "module",
@@ -38,6 +38,7 @@
     "helpers/*",
     "index.mjs",
     "yargs",
+    "yargs.cjs",
     "build",
     "locales",
     "LICENSE",
@@ -54,34 +55,35 @@
     "yargs-parser": "^20.2.2"
   },
   "devDependencies": {
-    "@types/chai": "^4.2.11",
-    "@types/mocha": "^8.0.0",
-    "@types/node": "^14.11.2",
-    "@wessberg/rollup-plugin-ts": "^1.3.2",
-    "c8": "^7.0.0",
-    "chai": "^4.2.0",
-    "chalk": "^4.0.0",
-    "coveralls": "^3.0.9",
-    "cpr": "^3.0.1",
-    "cross-env": "^7.0.2",
-    "cross-spawn": "^7.0.0",
-    "gts": "^3.0.0",
+    "@types/babel__traverse": "7.0.16",
+    "@types/chai": "4.2.14",
+    "@types/mocha": "8.0.4",
+    "@types/node": "14.14.0",
+    "@wessberg/rollup-plugin-ts": "1.3.8",
+    "chai": "4.2.0",
+    "chalk": "4.1.0",
+    "coveralls": "3.1.0",
+    "cpr": "3.0.1",
+    "cross-env": "7.0.2",
+    "cross-spawn": "7.0.3",
+    "gts": "3.0.3",
     "hashish": "0.0.4",
-    "mocha": "^8.0.0",
-    "rimraf": "^3.0.2",
-    "rollup": "^2.23.0",
-    "rollup-plugin-cleanup": "^3.1.1",
+    "mocha": "8.2.1",
+    "rimraf": "3.0.2",
+    "prettier": "2.2.1",
+    "rollup": "2.34.1",
+    "rollup-plugin-cleanup": "3.2.1",
     "standardx": "^5.0.0",
-    "typescript": "^4.0.2",
-    "which": "^2.0.0",
-    "yargs-test-extends": "^1.0.1"
+    "typescript": "4.1.2",
+    "which": "2.0.2",
+    "yargs-test-extends": "1.0.1"
   },
   "scripts": {
     "fix": "gts fix && npm run fix:js",
     "fix:js": "standardx --fix '**/*.mjs' && standardx --fix '**/*.cjs' && standardx --fix './*.mjs' && standardx --fix './*.cjs'",
     "posttest": "npm run check",
-    "test": "c8 mocha ./test/*.cjs --require ./test/before.cjs --timeout=12000 --check-leaks",
-    "test:esm": "c8 mocha ./test/esm/*.mjs --check-leaks",
+    "test": "mocha ./test/*.cjs --require ./test/before.cjs --timeout=12000 --check-leaks",
+    "test:esm": "mocha ./test/esm/*.mjs --check-leaks",
     "coverage": "c8 report --check-coverage",
     "prepare": "npm run compile",
     "pretest": "npm run compile -- -p tsconfig.test.json && cross-env NODE_ENV=test npm run build:cjs",
@@ -89,8 +91,7 @@
     "postcompile": "npm run build:cjs",
     "build:cjs": "rollup -c rollup.config.cjs",
     "postbuild:cjs": "rimraf ./build/index.cjs.d.ts",
-    "check": "gts lint && npm run check:js",
-    "check:js": "standardx '**/*.mjs' && standardx '**/*.cjs' && standardx './*.mjs' && standardx './*.cjs'",
+    "check": "gts lint",
     "clean": "gts clean"
   },
   "repository": {

package/node_modules/get-pkg-repo/node_modules/yargs/yargs

@@ -1,9 +1,5 @@
-// TODO: consolidate on using a helpers file at some point in the future, which
-// is the approach currently used to export Parser and applyExtends for ESM:
-const {applyExtends, cjsPlatformShim, Parser, Yargs, processArgv} = require('./build/index.cjs')
-Yargs.applyExtends = (config, cwd, mergeExtends) => {
-  return applyExtends(config, cwd, mergeExtends, cjsPlatformShim)
-}
-Yargs.hideBin = processArgv.hideBin
-Yargs.Parser = Parser
-module.exports = Yargs
+// This file gets hit in node versions below node 12.17.0
+// when require('yargs/yargs') from CommonJS
+// because conditional exports not fully supported and treats as filename.
+
+module.exports = require('./yargs.cjs');

package/node_modules/get-pkg-repo/node_modules/yargs/yargs.cjs

@@ -0,0 +1,15 @@
+// TODO: consolidate on using a helpers file at some point in the future, which
+// is the approach currently used to export Parser and applyExtends for ESM:
+const {
+  applyExtends,
+  cjsPlatformShim,
+  Parser,
+  Yargs,
+  processArgv,
+} = require('./build/index.cjs');
+Yargs.applyExtends = (config, cwd, mergeExtends) => {
+  return applyExtends(config, cwd, mergeExtends, cjsPlatformShim);
+};
+Yargs.hideBin = processArgv.hideBin;
+Yargs.Parser = Parser;
+module.exports = Yargs;

package/node_modules/hasown/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v2.0.4](https://github.com/inspect-js/hasOwn/compare/v2.0.3...v2.0.4) - 2026-05-28
+
+### Commits
+
+- [types] drop the dead key-narrowing overload [`fdab00e`](https://github.com/inspect-js/hasOwn/commit/fdab00e2703e65411424e19bf86a7e72a8f10da9)
+- [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint` [`91f6247`](https://github.com/inspect-js/hasOwn/commit/91f624768dd0f7db0d019b89d4d86bd66e20ec30)
+
 ## [v2.0.3](https://github.com/inspect-js/hasOwn/compare/v2.0.2...v2.0.3) - 2026-04-17
 
 ### Commits

package/node_modules/hasown/index.d.ts

@@ -1,4 +1,3 @@
-declare function hasOwn<O, K extends PropertyKey>(o: O, p: K): p is K & keyof O;
 declare function hasOwn<O, K extends PropertyKey, V = unknown>(o: O, p: K): o is O & Record<K, V>;
 
 export = hasOwn;

package/node_modules/hasown/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "hasown",
-	"version": "2.0.3",
+	"version": "2.0.4",
 	"description": "A robust, ES3 compatible, \"has own property\" predicate.",
 	"main": "index.js",
 	"exports": {
@@ -52,13 +52,12 @@
 	},
 	"devDependencies": {
 		"@arethetypeswrong/cli": "^0.18.2",
-		"@ljharb/eslint-config": "^22.2.2",
+		"@ljharb/eslint-config": "^22.2.3",
 		"@ljharb/tsconfig": "^0.3.2",
 		"@types/function-bind": "^1.1.10",
 		"@types/tape": "^5.8.1",
-		"auto-changelog": "^2.5.0",
-		"encoding": "^0.1.13",
-		"eslint": "^10.2.0",
+		"auto-changelog": "^2.5.1",
+		"eslint": "^10.4.0",
 		"evalmd": "^0.0.19",
 		"in-publish": "^2.0.1",
 		"jiti": "^0.0.0",

package/node_modules/is-unsafe/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Natural Intelligence
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.