projen-pipelines 0.3.21 → 0.3.23

package/node_modules/semver/classes/range.js

@@ -98,6 +98,9 @@ class Range {
   }
 
   parseRange (range) {
+    // strip build metadata so it can't bleed into the version
+    range = range.replace(BUILDSTRIPRE, '')
+
     // memoize range parsing for performance.
     // this is a very hot path, and fully deterministic.
     const memoOpts =
@@ -223,6 +226,7 @@ const debug = require('../internal/debug')
 const SemVer = require('./semver')
 const {
   safeRe: re,
+  src,
   t,
   comparatorTrimReplace,
   tildeTrimReplace,
@@ -230,6 +234,9 @@ const {
 } = require('../internal/re')
 const { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = require('../internal/constants')
 
+// unbounded global build-metadata stripper used by parseRange
+const BUILDSTRIPRE = new RegExp(src[t.BUILD], 'g')
+
 const isNullSet = c => c.value === '<0.0.0-0'
 const isAny = c => c.value === ''
 
@@ -270,6 +277,11 @@ const parseComparator = (comp, options) => {
 
 const isX = id => !id || id.toLowerCase() === 'x' || id === '*'
 
+const invalidXRangeOrder = (M, m, p) => (
+  (isX(M) && !isX(m)) ||
+  (isX(m) && p && !isX(p))
+)
+
 // ~, ~> --> * (any, kinda silly)
 // ~2, ~2.x, ~2.x.x, ~>2, ~>2.x ~>2.x.x --> >=2.0.0 <3.0.0-0
 // ~2.0, ~2.0.x, ~>2.0, ~>2.0.x --> >=2.0.0 <2.1.0-0
@@ -287,6 +299,10 @@ const replaceTildes = (comp, options) => {
 
 const replaceTilde = (comp, options) => {
   const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE]
+  // if we're including prereleases in the match, then the lower bound is
+  // -0, the lowest possible prerelease value, just like x-ranges and carets.
+  // this keeps `~1.2` equivalent to the `1.2.x` x-range it's documented as.
+  const z = options.includePrerelease ? '-0' : ''
   return comp.replace(r, (_, M, m, p, pr) => {
     debug('tilde', comp, _, M, m, p, pr)
     let ret
@@ -294,10 +310,10 @@ const replaceTilde = (comp, options) => {
     if (isX(M)) {
       ret = ''
     } else if (isX(m)) {
-      ret = `>=${M}.0.0 <${+M + 1}.0.0-0`
+      ret = `>=${M}.0.0${z} <${+M + 1}.0.0-0`
     } else if (isX(p)) {
       // ~1.2 == >=1.2.0 <1.3.0-0
-      ret = `>=${M}.${m}.0 <${M}.${+m + 1}.0-0`
+      ret = `>=${M}.${m}.0${z} <${M}.${+m + 1}.0-0`
     } else if (pr) {
       debug('replaceTilde pr', pr)
       ret = `>=${M}.${m}.${p}-${pr
@@ -366,10 +382,10 @@ const replaceCaret = (comp, options) => {
       if (M === '0') {
         if (m === '0') {
           ret = `>=${M}.${m}.${p
-          }${z} <${M}.${m}.${+p + 1}-0`
+          } <${M}.${m}.${+p + 1}-0`
         } else {
           ret = `>=${M}.${m}.${p
-          }${z} <${M}.${+m + 1}.0-0`
+          } <${M}.${+m + 1}.0-0`
         }
       } else {
         ret = `>=${M}.${m}.${p
@@ -395,6 +411,10 @@ const replaceXRange = (comp, options) => {
   const r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE]
   return comp.replace(r, (ret, gtlt, M, m, p, pr) => {
     debug('xRange', comp, ret, gtlt, M, m, p, pr)
+    if (invalidXRangeOrder(M, m, p)) {
+      return comp
+    }
+
     const xM = isX(M)
     const xm = xM || isX(m)
     const xp = xm || isX(p)

package/node_modules/semver/classes/semver.js

@@ -6,6 +6,22 @@ const { safeRe: re, t } = require('../internal/re')
 
 const parseOptions = require('../internal/parse-options')
 const { compareIdentifiers } = require('../internal/identifiers')
+
+const isPrereleaseIdentifier = (prerelease, identifier) => {
+  const identifiers = identifier.split('.')
+  if (identifiers.length > prerelease.length) {
+    return false
+  }
+
+  for (let i = 0; i < identifiers.length; i++) {
+    if (compareIdentifiers(prerelease[i], identifiers[i]) !== 0) {
+      return false
+    }
+  }
+
+  return true
+}
+
 class SemVer {
   constructor (version, options) {
     options = parseOptions(options)
@@ -309,8 +325,9 @@ class SemVer {
           if (identifierBase === false) {
             prerelease = [identifier]
           }
-          if (compareIdentifiers(this.prerelease[0], identifier) === 0) {
-            if (isNaN(this.prerelease[1])) {
+          if (isPrereleaseIdentifier(this.prerelease, identifier)) {
+            const prereleaseBase = this.prerelease[identifier.split('.').length]
+            if (isNaN(prereleaseBase)) {
               this.prerelease = prerelease
             }
           } else {

package/node_modules/semver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "semver",
-  "version": "7.8.0",
+  "version": "7.8.5",
   "description": "The semantic version parser used by npm.",
   "main": "index.js",
   "scripts": {
@@ -14,7 +14,7 @@
     "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^6.0.0",
+    "@npmcli/eslint-config": "^7.0.0",
     "@npmcli/template-oss": "5.0.0",
     "benchmark": "^2.1.4",
     "tap": "^16.0.0"

package/node_modules/semver/ranges/subset.js

@@ -174,7 +174,7 @@ const simpleSubset = (sub, dom, options) => {
         if (higher === c && higher !== gt) {
           return false
         }
-      } else if (gt.operator === '>=' && !satisfies(gt.semver, String(c), options)) {
+      } else if (gt.operator === '>=' && !c.test(gt.semver)) {
         return false
       }
     }
@@ -192,7 +192,7 @@ const simpleSubset = (sub, dom, options) => {
         if (lower === c && lower !== lt) {
           return false
         }
-      } else if (lt.operator === '<=' && !satisfies(lt.semver, String(c), options)) {
+      } else if (lt.operator === '<=' && !c.test(lt.semver)) {
         return false
       }
     }

package/node_modules/strnum/CHANGELOG.md

@@ -1,4 +1,18 @@
 
+**2.4.2 / 2026-08-14**
+- fix: trimZeros to avoid quadratic complexity
+
+**2.4.1 / 2026-06-18**
+- deps: update anynum to 1.0.1
+
+**2.4.0 / 2026-06-09**
+- support unicode numerals using 'anynum'
+
+**2.3.0 / 2026-05-07**
+- support octal and binary, test with @byspec/numbers
+- test with @byspec/numbers
+
+
 **2.2.3 / 2026-04-07**
 - remove unnecessary files from npm package
 

package/node_modules/strnum/README.md

@@ -1,6 +1,10 @@
 # strnum
 Parse string into Number based on configuration
 
+[![strnum downloads](https://img.shields.io/npm/dw/strnum.svg)](https://npm-compare.com/strnum) 
+[![strnum version](https://img.shields.io/npm/v/strnum.svg)](https://www.npmjs.com/package/strnum)
+[![strnum license](https://img.shields.io/npm/l/strnum.svg)](https://github.com/NaturalIntelligence/strnum)
+
 ## Users
 
 <a href="https://github.com/aws-amplify" target="_blank"><img src="https://avatars.githubusercontent.com/u/41077760?s=100&v=4"></a>
@@ -86,6 +90,10 @@ toNumber("1.0e-2"); //0.01)
 
 toNumber("+1212121212"); // 1212121212
 toNumber("+1212121212", { skipLike: /\+[0-9]{10}/} )); //"+1212121212"
+
+toNumber("１e１000", { unicode: true, infinity: "original" }); //"１e１000"
+toNumber("１000", { unicode: true }); //1000
+toNumber("１000", { unicode: false }); //"１000"
 ```
 
 Supported Options
@@ -95,6 +103,7 @@ leadingZeros: true, //when number with leading zeros like 08 should be parsed. 0
 eNotation: true,    //when number with eNotation or number parsed in eNotation should be considered
 skipLike: /regex/   //when string should not be parsed when it matches the specified regular expression
 infinity: "original", // "null", "infinity" (Infinity type), "string" ("Infinity" (the string literal))
+unicode: false, //when number with unicode numerals should be parsed
 ```
 
 

package/node_modules/strnum/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strnum",
-  "version": "2.3.0",
+  "version": "2.4.2",
   "description": "Parse String to Number based on configuration",
   "type": "module",
   "main": "strnum.js",
@@ -11,7 +11,8 @@
     "string",
     "number",
     "parse",
-    "convert"
+    "convert",
+    "unicode"
   ],
   "repository": {
     "type": "git",
@@ -28,5 +29,8 @@
   "devDependencies": {
     "@byspec/numbers": "^0.1.1",
     "jasmine": "^5.6.0"
+  },
+  "dependencies": {
+    "anynum": "^1.0.1"
   }
-}
+}

package/node_modules/strnum/strnum.js

@@ -3,6 +3,8 @@ const binRegex = /^0b[01]+$/;
 const octRegex = /^0o[0-7]+$/;
 const numRegex = /^([\-\+])?(0*)([0-9]*(\.[0-9]*)?)$/;
 
+import anynum from "anynum";
+
 const consider = {
     hex: true,
     binary: false,
@@ -12,6 +14,7 @@ const consider = {
     eNotation: true,
     //skipLike: /regex/,
     infinity: "original", // "null", "infinity" (Infinity type), "string" ("Infinity" (the string literal))
+    unicode: false,
 };
 
 export default function toNumber(str, options = {}) {
@@ -23,7 +26,12 @@ export default function toNumber(str, options = {}) {
     if (trimmedStr.length === 0) return str;
     else if (options.skipLike !== undefined && options.skipLike.test(trimmedStr)) return str;
     else if (trimmedStr === "0") return 0;
-    else if (options.hex && hexRegex.test(trimmedStr)) {
+
+    if (options.unicode) {
+        trimmedStr = anynum(trimmedStr);
+        if (trimmedStr === "0") return 0; // re-check after normalization
+    }
+    if (options.hex && hexRegex.test(trimmedStr)) {
         return parse_int(trimmedStr, 16);
     } else if (options.binary && binRegex.test(trimmedStr)) {
         return parse_int(trimmedStr, 2);
@@ -120,7 +128,11 @@ function resolveEnotation(str, trimmedStr, options) {
  */
 function trimZeros(numStr) {
     if (numStr && numStr.indexOf(".") !== -1) {//float
-        numStr = numStr.replace(/0+$/, ""); //remove ending zeros
+        //remove ending zeros without the O(n^2) backtracking that /0+$/ hits
+        //when the string doesn't end in 0 but has a long internal zero-run
+        let end = numStr.length;
+        while (end > 0 && numStr.charCodeAt(end - 1) === 48 /* '0' */) end--;
+        numStr = numStr.slice(0, end);
         if (numStr === ".") numStr = "0";
         else if (numStr[0] === ".") numStr = "0" + numStr;
         else if (numStr[numStr.length - 1] === ".") numStr = numStr.substring(0, numStr.length - 1);

package/node_modules/xml-naming/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Natural Intelligence
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/xml-naming/README.md

@@ -1,4 +1,7 @@
 # xml-naming
+[![xml-naming downloads](https://img.shields.io/npm/dw/xml-naming.svg)](https://npm-compare.com/xml-naming) 
+[![xml-naming version](https://img.shields.io/npm/v/xml-naming.svg)](https://www.npmjs.com/package/xml-naming)
+[![xml-naming license](https://img.shields.io/npm/l/xml-naming.svg)](https://github.com/NaturalIntelligence/xml-naming)
 
 Validates XML name productions as defined in the [XML 1.0](https://www.w3.org/TR/xml/) and [XML 1.1](https://www.w3.org/TR/xml11/) specifications.
 
@@ -71,6 +74,88 @@ name('\uD800\uDC00', { xmlVersion: '1.1' })  // true
 
 ---
 
+### ASCII-only fast path
+
+All validators, `validate`, `validateAll`, and `sanitize` also accept `{ asciiOnly: true }`.
+When set, matching is restricted to the ASCII subset of the NameStartChar/NameChar
+productions and skips unicode-aware regex matching entirely — no `\u00C0-\uFFFD`-style
+ranges, and (for XML 1.1) no `/u` regex flag. Unicode-aware regexes are measurably slower
+than plain ASCII matching in JS engines, so this is a real performance win when you know
+your input is ASCII-only, which is the common case for HTML/SVG ids and most XML tags.
+
+**This is opt-in and defaults to `false`** for backward compatibility: turning it on
+changes behavior, since it rejects legitimate non-ASCII XML names that would otherwise be
+valid. Only enable it when you control the input and know it's ASCII (e.g. internal
+identifiers, machine-generated names), not for validating arbitrary user- or
+externally-supplied XML/SVG content.
+
+```js
+import { name, sanitize } from 'xml-naming';
+
+name('café', { asciiOnly: true })   // false — 'é' is not ASCII, even though it's
+name('café')                        //  true    a valid XML 1.0/1.1 NameChar
+
+sanitize('café', 'name', { asciiOnly: true })  // 'caf_' — non-ASCII replaced too
+sanitize('café', 'name')                       // 'café' — left untouched by default
+```
+
+---
+
+### Memoized validator (`createValidator`)
+
+Real documents tend to reuse a small vocabulary of tag/attribute names across many
+siblings (`id`, `class`, `href`, ... repeated across hundreds of elements). Calling the
+plain boolean validators re-runs the regex on every call, even for names seen before.
+
+`createValidator(production, opts)` returns a memoized validator function: `xmlVersion`
+and `asciiOnly` are fixed at creation time (so the regex is resolved once, not per call),
+and repeated inputs after the first are served from an internal cache instead of
+re-matching the regex.
+
+```js
+import { createValidator } from 'xml-naming';
+
+const isQName = createValidator('qName', { xmlVersion: '1.0' });
+
+isQName('sku');   // false → regex test (cache miss), result cached
+isQName('sku');   // false → cache hit, no regex run
+```
+
+Use one instance per document/parse (or reuse across a session — your choice), rather
+than creating one per call:
+
+```js
+// e.g. inside a parser, once per parse call:
+const isValidTag = createValidator('qName', { asciiOnly: true });
+
+for (const tagName of tagNames) {
+  if (!isValidTag(tagName)) throw new Error(`Invalid tag name: ${tagName}`);
+}
+```
+
+Because the validator is a plain function, this loop already gets short-circuit
+behaviour (via `break`/`throw` on first failure) and zero extra allocation on the happy
+path — no separate "bulk" API is needed for that.
+
+**Cache bound:** the internal cache is capped by `maxCacheSize` (default `2048`). Once
+the cap is reached, new distinct strings are still validated correctly, they're just no
+longer cached — existing cached entries keep being served. This keeps memory bounded
+even against high-cardinality or adversarial input (e.g. externally-supplied names that
+never repeat), without the cost of a full LRU or the perf cliff of reset-and-refill.
+
+Call `.reset()` on the returned function to clear the cache manually, e.g. between
+unrelated parse calls if you're reusing one validator instance across a long-running
+process:
+
+```js
+isQName.reset();
+```
+
+The cache is private to each `createValidator()` instance — there's no shared/global
+cache, so unrelated callers never interfere with each other.
+
+---
+
 ### Diagnostic validation
 
 ```js
@@ -169,21 +254,34 @@ sanitize('my element', 'name', { replacement: '-' })  // 'my-element'
 
 `opts`:
 - `xmlVersion`: `'1.0'` (default) | `'1.1'`
+- `asciiOnly`: boolean (default `false`) — ASCII-only fast path, see above
+
+### `createValidator(production, opts?)` → memoized `(str) => boolean`, with `.reset()`
+
+`opts`:
+- `xmlVersion`: `'1.0'` (default) | `'1.1'`
+- `asciiOnly`: boolean (default `false`)
+- `maxCacheSize`: number (default `2048`) — cache stops accepting new entries once reached; existing entries keep serving hits
 
 ### `validate(str, production, opts?)` → `ValidationResult`
 
 `production`: `'name'` | `'ncName'` | `'qName'` | `'nmToken'` | `'nmTokens'`
 
+`opts`: same as boolean validators (`xmlVersion`, `asciiOnly`)
+
 ### `validateAll(strings[], production, opts?)` → `ValidationResult[]`
 
+`opts`: same as `validate`
+
 ### `sanitize(str, production?, opts?)` → `string`
 
 `opts`:
 - `xmlVersion`: `'1.0'` | `'1.1'`
 - `replacement`: string (default `'_'`)
+- `asciiOnly`: boolean (default `false`) — also replaces non-ASCII characters, not just XML-illegal ones
 
 ---
 
 ## License
 
-MIT
+MIT

package/node_modules/xml-naming/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xml-naming",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Validates XML name productions — Name, NCName, QName, NMToken, NMTokens — for XML 1.0 and 1.1",
   "type": "module",
   "main": "./src/index.js",
@@ -16,9 +16,11 @@
     "README.md"
   ],
   "scripts": {
-    "test": "jasmine specs/*spec.js"
+    "test": "jasmine specs/*spec.js",
+    "perf": "node specs/perf.js"
   },
   "keywords": [
+    "fast",
     "xml",
     "xml-name",
     "ncname",

package/node_modules/xml-naming/src/index.d.ts

@@ -1,6 +1,15 @@
 export interface ValidationOptions {
   /** XML specification version to validate against. Defaults to '1.0'. */
   xmlVersion?: '1.0' | '1.1';
+  /**
+   * Restrict matching to the ASCII subset of the NameStartChar/NameChar
+   * productions and skip unicode-aware regex matching entirely. Faster,
+   * especially for XML 1.1 (which otherwise requires the `/u` regex flag),
+   * but rejects legitimate non-ASCII XML names. Off by default for
+   * backward compatibility — opt in only when inputs are known to be ASCII.
+   * Defaults to false.
+   */
+  asciiOnly?: boolean;
 }
 
 export interface SanitizeOptions extends ValidationOptions {
@@ -55,6 +64,31 @@ export function nmToken(str: string, opts?: ValidationOptions): boolean;
  */
 export function nmTokens(str: string, opts?: ValidationOptions): boolean;
 
+export interface CreateValidatorOptions extends ValidationOptions {
+  /**
+   * Max number of distinct strings to cache. Once reached, new strings are
+   * still validated correctly but are no longer cached; existing cached
+   * entries keep being served. Defaults to 2048.
+   */
+  maxCacheSize?: number;
+}
+
+export interface MemoizedValidator {
+  (str: string): boolean;
+  /** Clears the internal cache. */
+  reset(): void;
+}
+
+/**
+ * Returns a memoized boolean validator function for a single production.
+ * `opts` (xmlVersion, asciiOnly) are fixed at creation time. Repeated calls
+ * with the same string after the first are served from an internal cache
+ * instead of re-running the regex — useful when validating a small, reused
+ * vocabulary of names (e.g. tag/attribute names across many siblings in a
+ * document) many times.
+ */
+export function createValidator(production: Production, opts?: CreateValidatorOptions): MemoizedValidator;
+
 /**
  * Validates a string against a named XML production and returns a detailed result.
  */