projen-pipelines 0.3.25 → 0.3.27

package/.jsii

@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "constructs": "^10.5.1",
-    "projen": ">=0.103.5 <1.0.0"
+    "projen": ">=0.104.5 <1.0.0"
   },
   "dependencyClosure": {
     "constructs": {
@@ -59,6 +59,7 @@
         "projen.java": {},
         "projen.javascript": {},
         "projen.javascript.biome_config": {},
+        "projen.polaris": {},
         "projen.python": {},
         "projen.python.uvConfig": {},
         "projen.release": {},
@@ -93,7 +94,7 @@
     "stability": "stable"
   },
   "homepage": "https://github.com/open-constructs/projen-pipelines.git",
-  "jsiiVersion": "5.9.53 (build 16812ce)",
+  "jsiiVersion": "5.9.56 (build 0265a5f)",
   "keywords": [
     "aws",
     "cdk",
@@ -9019,6 +9020,6 @@
       "symbolId": "src/versioning/types:VersioningStrategyComponents"
     }
   },
-  "version": "0.3.25",
-  "fingerprint": "oVyKVWPabyNBeXanBrkDhRyTOs1jvC2j4dtII33Q1kY="
+  "version": "0.3.27",
+  "fingerprint": "EFDENJHgiq5zJsOqju3opJ7b0/mlp1behRQOJrdKw6I="
 }

package/lib/assign-approver/base.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const projen_1 = require("projen");
 class AssignApprover extends projen_1.Component {
     baseOptions;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.AssignApprover", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.AssignApprover", version: "0.3.27" };
     constructor(scope, baseOptions) {
         super(scope);
         this.baseOptions = baseOptions;

package/lib/assign-approver/github.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const workflows_model_1 = require("projen/lib/github/workflows-model");
 const base_1 = require("./base");
 class GitHubAssignApprover extends base_1.AssignApprover {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GitHubAssignApprover", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GitHubAssignApprover", version: "0.3.27" };
     workflow;
     options;
     constructor(scope, options) {

package/lib/awscdk/base.js

@@ -67,7 +67,7 @@ var CdkDiffType;
 class CDKPipeline extends projen_1.Component {
     app;
     baseOptions;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CDKPipeline", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CDKPipeline", version: "0.3.27" };
     stackPrefix;
     branchName;
     /** Prefix for workflow files, concurrency groups, and artifact names to prevent collisions in monorepos. */

package/lib/awscdk/bash.js

@@ -6,7 +6,7 @@ const projen_1 = require("projen");
 const base_1 = require("./base");
 const engine_1 = require("../engine");
 class BashCDKPipeline extends base_1.CDKPipeline {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.BashCDKPipeline", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.BashCDKPipeline", version: "0.3.27" };
     constructor(app, options) {
         super(app, options);
         const readme = new projen_1.TextFile(this, 'pipeline.md', { lines: [] });

package/lib/awscdk/github.js

@@ -18,7 +18,7 @@ const WORKFLOW_DIR = '.github/workflows';
  */
 class GithubCDKPipeline extends base_1.CDKPipeline {
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GithubCDKPipeline", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GithubCDKPipeline", version: "0.3.27" };
     /** Indicates if versioned artifacts are needed based on manual approval requirements. */
     needsVersionedArtifacts;
     /** The GitHub workflow associated with the pipeline. */

package/lib/awscdk/gitlab.js

@@ -13,7 +13,7 @@ const github_summary_step_1 = require("../steps/github-summary.step");
  */
 class GitlabCDKPipeline extends base_1.CDKPipeline {
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GitlabCDKPipeline", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GitlabCDKPipeline", version: "0.3.27" };
     /** Indicates if versioned artifacts are required. Currently set to false  */
     needsVersionedArtifacts;
     /** The Docker image used for pipeline jobs. Defaults to a specified image or a default value. */

package/lib/drift/base.js

@@ -6,7 +6,7 @@ const projen_1 = require("projen");
 const javascript_1 = require("projen/lib/javascript");
 const steps_1 = require("../steps");
 class DriftDetectionWorkflow extends projen_1.Component {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.DriftDetectionWorkflow", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.DriftDetectionWorkflow", version: "0.3.27" };
     name;
     schedule;
     stages;

package/lib/drift/bash.js

@@ -6,7 +6,7 @@ const projen_1 = require("projen");
 const base_1 = require("./base");
 const step_1 = require("./step");
 class BashDriftDetectionWorkflow extends base_1.DriftDetectionWorkflow {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.BashDriftDetectionWorkflow", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.BashDriftDetectionWorkflow", version: "0.3.27" };
     scriptPath;
     constructor(project, options) {
         super(project, options);

package/lib/drift/github.js

@@ -6,7 +6,7 @@ const workflows_model_1 = require("projen/lib/github/workflows-model");
 const base_1 = require("./base");
 const step_1 = require("./step");
 class GitHubDriftDetectionWorkflow extends base_1.DriftDetectionWorkflow {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GitHubDriftDetectionWorkflow", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GitHubDriftDetectionWorkflow", version: "0.3.27" };
     permissions;
     createIssues;
     workflow;

package/lib/drift/gitlab.js

@@ -6,7 +6,7 @@ const projen_1 = require("projen");
 const base_1 = require("./base");
 const step_1 = require("./step");
 class GitLabDriftDetectionWorkflow extends base_1.DriftDetectionWorkflow {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GitLabDriftDetectionWorkflow", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GitLabDriftDetectionWorkflow", version: "0.3.27" };
     runnerTags;
     image;
     config;

package/lib/drift/step.js

@@ -4,7 +4,7 @@ exports.DriftDetectionStep = void 0;
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const steps_1 = require("../steps");
 class DriftDetectionStep extends steps_1.StepSequence {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.DriftDetectionStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.DriftDetectionStep", version: "0.3.27" };
     static generateCommand(props) {
         const args = [
             'detect-drift',

package/lib/steps/amplify-deploy.step.js

@@ -8,7 +8,7 @@ const step_1 = require("./step");
  */
 class AmplifyDeployStep extends step_1.PipelineStep {
     config;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.AmplifyDeployStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.AmplifyDeployStep", version: "0.3.27" };
     branchName;
     region;
     constructor(project, config) {

package/lib/steps/artifact-steps.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const step_1 = require("./step");
 class DownloadArtifactStep extends step_1.PipelineStep {
     config;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.DownloadArtifactStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.DownloadArtifactStep", version: "0.3.27" };
     constructor(project, config) {
         super(project);
         this.config = config;
@@ -37,7 +37,7 @@ class DownloadArtifactStep extends step_1.PipelineStep {
 exports.DownloadArtifactStep = DownloadArtifactStep;
 class UploadArtifactStep extends step_1.PipelineStep {
     config;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.UploadArtifactStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.UploadArtifactStep", version: "0.3.27" };
     constructor(project, config) {
         super(project);
         this.config = config;

package/lib/steps/aws-assume-role.step.js

@@ -9,7 +9,7 @@ const step_1 = require("./step");
  */
 class AwsAssumeRoleStep extends step_1.PipelineStep {
     config;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.AwsAssumeRoleStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.AwsAssumeRoleStep", version: "0.3.27" };
     constructor(project, config) {
         super(project);
         this.config = config;

package/lib/steps/github-summary.step.js

@@ -14,7 +14,7 @@ const step_1 = require("./step");
  */
 class CdkOutputsSummaryStep extends step_1.PipelineStep {
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CdkOutputsSummaryStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CdkOutputsSummaryStep", version: "0.3.27" };
     constructor(project, options) {
         super(project);
         this.options = options;

package/lib/steps/package-manager-setup.step.js

@@ -12,7 +12,7 @@ const step_1 = require("./step");
  */
 class PnpmSetupStep extends step_1.PipelineStep {
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.PnpmSetupStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.PnpmSetupStep", version: "0.3.27" };
     constructor(project, options = {}) {
         super(project);
         this.options = options;
@@ -53,7 +53,7 @@ exports.PnpmSetupStep = PnpmSetupStep;
  * which is required for Yarn Berry (v2+) to work correctly.
  */
 class CorepackSetupStep extends step_1.PipelineStep {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CorepackSetupStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CorepackSetupStep", version: "0.3.27" };
     constructor(project) {
         super(project);
     }

package/lib/steps/registries.js

@@ -13,7 +13,7 @@ const step_1 = require("./step");
  */
 class GithubPackagesLoginStep extends step_1.PipelineStep {
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GithubPackagesLoginStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.GithubPackagesLoginStep", version: "0.3.27" };
     constructor(project, options) {
         super(project);
         this.options = options;
@@ -38,7 +38,7 @@ exports.GithubPackagesLoginStep = GithubPackagesLoginStep;
  */
 class NpmSecretStep extends step_1.PipelineStep {
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.NpmSecretStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.NpmSecretStep", version: "0.3.27" };
     constructor(project, options) {
         super(project);
         this.options = options;
@@ -63,7 +63,7 @@ exports.NpmSecretStep = NpmSecretStep;
  */
 class CodeArtifactLoginStep extends step_1.StepSequence {
     options;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CodeArtifactLoginStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CodeArtifactLoginStep", version: "0.3.27" };
     constructor(project, options) {
         super(project, [
             new aws_assume_role_step_1.AwsAssumeRoleStep(project, { roleArn: options.role, sessionName: 'CodeArtifact' }),

package/lib/steps/step.js

@@ -8,7 +8,7 @@ const engines_1 = require("../engines");
  */
 class PipelineStep {
     project;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.PipelineStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.PipelineStep", version: "0.3.27" };
     /**
      * Initializes a new instance of a PipelineStep with a reference to a projen project.
      * @param project - The projen project reference.
@@ -41,7 +41,7 @@ exports.PipelineStep = PipelineStep;
  * Concrete implementation of PipelineStep that executes simple commands.
  */
 class SimpleCommandStep extends PipelineStep {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.SimpleCommandStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.SimpleCommandStep", version: "0.3.27" };
     commands;
     env;
     /**
@@ -89,7 +89,7 @@ class SimpleCommandStep extends PipelineStep {
 }
 exports.SimpleCommandStep = SimpleCommandStep;
 class ProjenScriptStep extends SimpleCommandStep {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.ProjenScriptStep", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.ProjenScriptStep", version: "0.3.27" };
     constructor(project, scriptName, args) {
         super(project, [`${project.projenCommand} ${scriptName}${args ? ` ${args}` : ''}`]);
     }
@@ -97,7 +97,7 @@ class ProjenScriptStep extends SimpleCommandStep {
 exports.ProjenScriptStep = ProjenScriptStep;
 // Add class that is a sequence of pipleine steps but is a pipeline step in itself
 class StepSequence extends PipelineStep {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.StepSequence", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.StepSequence", version: "0.3.27" };
     steps;
     /**
      * Constructs a sequence of pipeline steps.

package/lib/versioning/computation.js

@@ -8,7 +8,7 @@ const version_info_1 = require("./version-info");
  */
 class VersionComputationStrategy {
     strategy;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersionComputationStrategy", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersionComputationStrategy", version: "0.3.27" };
     constructor(strategy) {
         this.strategy = strategy;
     }
@@ -40,7 +40,7 @@ exports.VersionComputationStrategy = VersionComputationStrategy;
  * Composite version computation that combines multiple strategies
  */
 class CompositeComputation extends VersionComputationStrategy {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CompositeComputation", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CompositeComputation", version: "0.3.27" };
     constructor(strategy) {
         super(strategy);
     }
@@ -92,7 +92,7 @@ exports.CompositeComputation = CompositeComputation;
  * Main version computer that handles strategy selection
  */
 class VersionComputer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersionComputer", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersionComputer", version: "0.3.27" };
     strategy;
     constructor(strategy) {
         this.strategy = this.createStrategy(strategy);

package/lib/versioning/config.js

@@ -8,7 +8,7 @@ const strategy_1 = require("./strategy");
  * Main versioning configuration class with factory methods
  */
 class VersioningConfigurations {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersioningConfigurations", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersioningConfigurations", version: "0.3.27" };
     /**
      * Standard configuration with commit count strategy
      */
@@ -49,7 +49,7 @@ exports.VersioningConfigurations = VersioningConfigurations;
  * Utility functions for versioning configuration
  */
 class VersioningConfigUtils {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersioningConfigUtils", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersioningConfigUtils", version: "0.3.27" };
     /**
      * Resolve configuration for a specific stage
      */

package/lib/versioning/outputs.js

@@ -7,7 +7,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
  */
 class OutputConfigBase {
     type;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.OutputConfigBase", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.OutputConfigBase", version: "0.3.27" };
     constructor(type) {
         this.type = type;
     }
@@ -18,7 +18,7 @@ exports.OutputConfigBase = OutputConfigBase;
  */
 class CloudFormationOutput extends OutputConfigBase {
     config;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CloudFormationOutput", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.CloudFormationOutput", version: "0.3.27" };
     static TYPE = 'cloudformation';
     /**
      * Enable CloudFormation outputs with default configuration
@@ -55,7 +55,7 @@ exports.CloudFormationOutput = CloudFormationOutput;
  */
 class ParameterStoreOutput extends OutputConfigBase {
     config;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.ParameterStoreOutput", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.ParameterStoreOutput", version: "0.3.27" };
     static TYPE = 'parameterStore';
     /**
      * Enable Parameter Store outputs with parameter name
@@ -103,7 +103,7 @@ exports.ParameterStoreOutput = ParameterStoreOutput;
  * Output format types
  */
 class OutputFormat {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.OutputFormat", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.OutputFormat", version: "0.3.27" };
     static PLAIN = 'plain';
     static STRUCTURED = 'structured';
     constructor() { }
@@ -113,7 +113,7 @@ exports.OutputFormat = OutputFormat;
  * Factory class for output configurations
  */
 class VersioningOutputs {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersioningOutputs", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersioningOutputs", version: "0.3.27" };
     /**
      * Create output configuration with CloudFormation and SSM Parameter Store
      */

package/lib/versioning/setup.js

@@ -8,7 +8,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 class VersioningSetup {
     project;
     config;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersioningSetup", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersioningSetup", version: "0.3.27" };
     constructor(project, config) {
         this.project = project;
         this.config = config;

package/lib/versioning/strategy.js

@@ -8,7 +8,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 class VersioningStrategy {
     format;
     components;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersioningStrategy", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersioningStrategy", version: "0.3.27" };
     /**
      * Create a composite strategy with custom format and components
      */

package/lib/versioning/version-info.js

@@ -6,7 +6,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
  * Represents complete version information for a deployment
  */
 class VersionInfo {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersionInfo", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersionInfo", version: "0.3.27" };
     /**
      * Create a VersionInfo instance from raw data
      */
@@ -185,7 +185,7 @@ exports.VersionInfo = VersionInfo;
  * Builder class for creating VersionInfo instances
  */
 class VersionInfoBuilder {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersionInfoBuilder", version: "0.3.25" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "projen-pipelines.VersionInfoBuilder", version: "0.3.27" };
     props = {};
     /**
      * Set the version string

package/node_modules/dotgitignore/node_modules/brace-expansion/index.js

@@ -23,6 +23,26 @@ var EXPANSION_MAX = 100000
 // characters) so legitimate input is unaffected.
 var EXPANSION_MAX_LENGTH = 4000000
 
+// `expand` recurses once per level of brace *nesting* - both when expanding a
+// set's comma members and when re-wrapping a set whose body is a single part.
+// The CVE-2026-14257 fix made the *tail* iterative (recursion on `m.post`, one
+// level per chained group), which left nesting depth unbounded: about 3,100
+// levels of `{{{...a,b...}}}` - only ~6KB of input - exhausted the native stack
+// and crashed the process. `EXPANSION_MAX_DEPTH` bounds how deep the parser
+// will follow nesting. It sits far above any realistic pattern and well below
+// the depth at which the stack runs out.
+var EXPANSION_MAX_DEPTH = 1000
+
+// Bash keeps a quirk where a brace group followed by a comma set still expands
+// (`{a},b}`). The parser implements it by rewriting the string and restarting
+// the scan, absorbing one `}` per pass. `n` trailing braces therefore cost `n`
+// full passes over a string that itself grows by one `escClose` sentinel each
+// time - quadratic in `n`, with a ~26x constant from the sentinel's length.
+// 128KB of `'{a}' + '}'.repeat(n) + ',z}'` blocked the event loop for 27
+// seconds to produce two results. `EXPANSION_MAX_REWRITES` bounds how many
+// times the scan may restart. Real `{a},b}` input needs a handful.
+var EXPANSION_MAX_REWRITES = 1000
+
 function numeric(str) {
   return parseInt(str, 10) == str
     ? parseInt(str, 10)
@@ -46,34 +66,54 @@ function unescapeBraces(str) {
 }
 
 
+// Like `target.push(...items)` but doesn't overflow the stack
+function pushAll(target, items) {
+  for (var i = 0; i < items.length; i++) {
+    target.push(items[i]);
+  }
+}
+
 // Basically just str.split(","), but handling cases
 // where we have nested braced sections, which should be
 // treated as individual members, like {a,{b,c},d}
 function parseCommaParts(str) {
-  if (!str)
-    return [''];
-
   var parts = [];
-  var m = balanced('{', '}', str);
 
-  if (!m)
-    return str.split(',');
+  // Walk the brace groups iteratively. Recursing on `post` once per group let a
+  // chain of them exhaust the stack - the parsing-side counterpart to
+  // the `expand` overflow fixed for CVE-2026-14257, and not something `max` or
+  // `maxLength` can bound, since it happens before expansion.
+  //
+  // The part the next chunk continues
+  var carry = '';
 
-  var pre = m.pre;
-  var body = m.body;
-  var post = m.post;
-  var p = pre.split(',');
+  for (;;) {
+    var m = balanced('{', '}', str);
 
-  p[p.length-1] += '{' + body + '}';
-  var postParts = parseCommaParts(post);
-  if (post.length) {
-    p[p.length-1] += postParts.shift();
-    p.push.apply(p, postParts);
-  }
+    if (!m) {
+      var tail = str.split(',');
+      tail[0] = carry + tail[0];
+      pushAll(parts, tail);
+      return parts;
+    }
 
-  parts.push.apply(parts, p);
+    var pre = m.pre;
+    var body = m.body;
+    var post = m.post;
+    var p = pre.split(',');
 
-  return parts;
+    p[0] = carry + p[0];
+    p[p.length-1] += '{' + body + '}';
+
+    if (!post.length) {
+      pushAll(parts, p);
+      return parts;
+    }
+
+    carry = p.pop();
+    pushAll(parts, p);
+    str = post;
+  }
 }
 
 function expandTop(str, options) {
@@ -83,6 +123,8 @@ function expandTop(str, options) {
   options = options || {};
   var max = options.max == null ? EXPANSION_MAX : options.max;
   var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH : options.maxLength;
+  var maxDepth = options.maxDepth == null ? EXPANSION_MAX_DEPTH : options.maxDepth;
+  var maxRewrites = options.maxRewrites == null ? EXPANSION_MAX_REWRITES : options.maxRewrites;
 
   // I don't know why Bash 4.3 does this, but it does.
   // Anything starting with {} will have the first two bytes preserved
@@ -94,7 +136,7 @@ function expandTop(str, options) {
     str = '\\{\\}' + str.substr(2);
   }
 
-  return expand(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
+  return expand(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces);
 }
 
 function identity(e) {
@@ -218,8 +260,18 @@ function expand(
   str,
   max,
   maxLength,
+  maxDepth,
+  depth,
+  maxRewrites,
   isTop
 ) {
+  // Too deeply nested to keep following: treat the rest as literal, the same
+  // way a group that cannot expand is already handled. Truncating rather than
+  // throwing keeps expansion total, matching `max` and `maxLength`.
+  if (depth > maxDepth) {
+    return [str];
+  }
+
   // Consume the string's top-level brace groups left to right, threading a
   // running set of combined prefixes (`acc`). Expanding the tail iteratively -
   // rather than recursing on `m.post` once per group - keeps the native stack
@@ -240,6 +292,9 @@ function expand(
   // `accBase[a]` records how much of `acc[a]` predates the current run;
   // `combine` treats an expansion as empty when it adds nothing past that.
   var accBase = [0]
+  // How many times the `{a},b}` rewrite below has restarted the scan. Each pass
+  // re-reads the whole string, so leaving this unbounded is quadratic.
+  var rewrites = 0
   var dropEmpties = false
   var firstGroup = true
   var nextBase
@@ -271,7 +326,8 @@ function expand(
     var isOptions = m.body.indexOf(',') >= 0;
     if (!isSequence && !isOptions) {
       // {a},b}
-      if (m.post.match(/,(?!,).*\}/)) {
+      if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) {
+        rewrites++;
         str = m.pre + '{' + m.body + escClose + m.post;
         // The rewritten string is expanded as if it were a fresh top-level one,
         // so start a new empty-drop run: anchor the baseline at what `acc`
@@ -310,7 +366,7 @@ function expand(
       var n = parseCommaParts(m.body);
       if (n.length === 1 && n[0] !== undefined) {
         // x{{a,b}}y ==> x{a}y x{b}y
-        n = expand(n[0], max, maxLength, false).map(embrace);
+        n = expand(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace);
         //XXX is this necessary? Can't seem to hit it in tests.
         /* c8 ignore start */
         if (n.length === 1) {
@@ -349,7 +405,7 @@ function expand(
       values = []
       var valuesLength = 0
       outer: for (var j = 0; j < n.length; j++) {
-        var expanded = expand(n[j], max, maxLength, false)
+        var expanded = expand(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false)
         for (var k = 0; k < expanded.length; k++) {
           var v = expanded[k]
           if (dropsEmpties && !v) continue

package/node_modules/dotgitignore/node_modules/brace-expansion/package.json

@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "1.1.18",
+  "version": "1.1.21",
   "repository": {
     "type": "git",
     "url": "git://github.com/juliangruber/brace-expansion.git"

package/node_modules/handlebars/bin/handlebars

@@ -65,7 +65,7 @@ var argv = parseArgs({
   },
   'r': {
     'type': 'string',
-    'description': 'Template root. Base value that will be stripped from template names.',
+    'description': 'Template root. Base value that will be stripped from template names; it does not restrict filesystem access.',
     'alias': 'root'
   },
   'p': {