projen 0.99.71 → 0.99.73

package/node_modules/rechoir/package.json

@@ -1,88 +0,0 @@
-{
-  "name": "rechoir",
-  "description": "Require any supported file as a node module.",
-  "version": "0.6.2",
-  "homepage": "https://github.com/tkellen/node-rechoir",
-  "author": {
-    "name": "Tyler Kellen",
-    "url": "http://goingslowly.com/"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git://github.com/tkellen/node-rechoir.git"
-  },
-  "bugs": {
-    "url": "https://github.com/tkellen/node-rechoir/issues"
-  },
-  "licenses": [
-    {
-      "type": "MIT",
-      "url": "https://github.com/tkellen/node-rechoir/blob/master/LICENSE"
-    }
-  ],
-  "main": "index.js",
-  "engines": {
-    "node": ">= 0.10"
-  },
-  "scripts": {
-    "test": "mocha -R spec test/index.js"
-  },
-  "dependencies": {
-    "resolve": "^1.1.6"
-  },
-  "devDependencies": {
-    "babel": "^5.4.3",
-    "chai": "^2.3.0",
-    "coco": "^0.9.1",
-    "coffee-script": "^1.9.2",
-    "earlgrey": "0.0.9",
-    "iced-coffee-script": "^1.8.0-d",
-    "interpret": "^0.6.1",
-    "json5": "^0.4.0",
-    "livescript": "^1.4.0",
-    "mocha": "^2.2.5",
-    "node-jsx": "^0.13.3",
-    "require-csv": "0.0.1",
-    "require-ini": "0.0.1",
-    "require-uncached": "^1.0.2",
-    "require-xml": "0.0.1",
-    "require-yaml": "0.0.1",
-    "rimraf": "^2.3.4",
-    "semver": "^4.3.4",
-    "sinon": "^1.14.1",
-    "toml-require": "^1.0.1",
-    "typescript-register": "^1.1.0"
-  },
-  "keywords": [
-    "require",
-    "cjsx",
-    "co",
-    "coco",
-    "coffee-script",
-    "coffee",
-    "coffee.md",
-    "csv",
-    "earlgrey",
-    "es",
-    "es6",
-    "iced",
-    "iced.md",
-    "iced-coffee-script",
-    "ini",
-    "js",
-    "json",
-    "json5",
-    "jsx",
-    "react",
-    "litcoffee",
-    "liticed",
-    "ls",
-    "livescript",
-    "toml",
-    "ts",
-    "typescript",
-    "xml",
-    "yaml",
-    "yml"
-  ]
-}

package/node_modules/resolve/.editorconfig

@@ -1,37 +0,0 @@
-root = true
-
-[*]
-indent_style = space
-indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
-max_line_length = 200
-
-[*.js]
-block_comment_start = /*
-block_comment = *
-block_comment_end = */
-
-[*.yml]
-indent_size = 1
-
-[package.json]
-indent_style = tab
-
-[lib/core.json]
-indent_style = tab
-
-[CHANGELOG.md]
-indent_style = space
-indent_size = 2
-
-[{*.json,Makefile}]
-max_line_length = off
-
-[test/{dotdot,resolver,module_dir,multirepo,node_path,pathfilter,precedence}/**/*]
-indent_style = off
-indent_size = off
-max_line_length = off
-insert_final_newline = off

package/node_modules/resolve/.eslintrc

@@ -1,65 +0,0 @@
-{
-    "root": true,
-
-    "extends": "@ljharb",
-
-    "rules": {
-        "indent": [2, 4],
-        "strict": 0,
-        "complexity": 0,
-        "consistent-return": 0,
-        "curly": 0,
-        "dot-notation": [2, { "allowKeywords": true }],
-        "func-name-matching": 0,
-        "func-style": 0,
-        "global-require": 1,
-        "id-length": [2, { "min": 1, "max": 40 }],
-        "max-lines": [2, 360],
-        "max-lines-per-function": 0,
-        "max-nested-callbacks": 0,
-        "max-params": 0,
-        "max-statements-per-line": [2, { "max": 2 }],
-        "max-statements": 0,
-        "no-magic-numbers": 0,
-        "no-shadow": 0,
-        "no-use-before-define": 0,
-        "sort-keys": 0,
-    },
-    "overrides": [
-        {
-            "files": "bin/**",
-            "rules": {
-                "no-process-exit": "off",
-            },
-        },
-        {
-            "files": "example/**",
-            "rules": {
-                "no-console": 0,
-            },
-        },
-        {
-            "files": "test/resolver/nested_symlinks/mylib/*.js",
-            "rules": {
-                "no-throw-literal": 0,
-            },
-        },
-        {
-            "files": "test/**",
-            "parserOptions": {
-                "ecmaVersion": 5,
-                "allowReserved": false,
-            },
-            "rules": {
-                "dot-notation": [2, { "allowPattern": "throws" }],
-                "max-lines": 0,
-                "max-lines-per-function": 0,
-                "no-unused-vars": [2, { "vars": "all", "args": "none" }],
-            },
-        },
-    ],
-
-    "ignorePatterns": [
-        "./test/resolver/malformed_package_json/package.json",
-    ],
-}

package/node_modules/resolve/.github/FUNDING.yml

@@ -1,12 +0,0 @@
-# These are supported funding model platforms
-
-github: [ljharb]
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: npm/resolve
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

package/node_modules/resolve/.github/INCIDENT_RESPONSE_PROCESS.md

@@ -1,119 +0,0 @@
-# Incident Response Process for **resolve**
-
-## Reporting a Vulnerability
-
-We take the security of **resolve** very seriously. If you believe you’ve found a security vulnerability, please inform us responsibly through coordinated disclosure.
-
-### How to Report
-
-> **Do not** report security vulnerabilities through public GitHub issues, discussions, or social media.
-
-Instead, please use one of these secure channels:
-
-1. **GitHub Security Advisories**
-   Use the **Report a vulnerability** button in the Security tab of the [browserify/resolve repository](https://github.com/browserify/resolve).
-
-2. **Email**
-   Follow the posted [Security Policy](https://github.com/browserify/resolve/security/policy).
-
-### What to Include
-
-**Required Information:**
-- Brief description of the vulnerability type
-- Affected version(s) and components
-- Steps to reproduce the issue
-- Impact assessment (what an attacker could achieve)
-- Confirm the issue is not present in test files (in other words, only via the official entry points in `exports`)
-
-**Helpful Additional Details:**
-- Full paths of affected source files
-- Specific commit or branch where the issue exists
-- Required configuration to reproduce
-- Proof-of-concept code (if available)
-- Suggested mitigation or fix
-
-## Our Response Process
-
-**Timeline Commitments:**
-- **Initial acknowledgment**: Within 24 hours
-- **Detailed response**: Within 3 business days
-- **Status updates**: Every 7 days until resolved
-- **Resolution target**: 90 days for most issues
-
-**What We’ll Do:**
-1. Acknowledge your report and assign a tracking ID
-2. Assess the vulnerability and determine severity
-3. Develop and test a fix
-4. Coordinate disclosure timeline with you
-5. Release a security update and publish an advisory and CVE
-6. Credit you in our security advisory (if desired)
-
-## Disclosure Policy
-
-- **Coordinated disclosure**: We’ll work with you on timing
-- **Typical timeline**: 90 days from report to public disclosure
-- **Early disclosure**: If actively exploited
-- **Delayed disclosure**: For complex issues
-
-## Scope
-
-**In Scope:**
-- **resolve** package (all supported versions)
-- Official examples and documentation
-- Core resolution APIs
-- Dependencies with direct security implications
-
-**Out of Scope:**
-- Third-party wrappers or extensions
-- Bundler-specific integrations
-- Social engineering or physical attacks
-- Theoretical vulnerabilities without practical exploitation
-- Issues in non-production files
-
-## Security Measures
-
-**Our Commitments:**
-- Regular vulnerability scanning via `npm audit`
-- Automated security checks in CI/CD (GitHub Actions)
-- Secure coding practices and mandatory code review
-- Prompt patch releases for critical issues
-
-**User Responsibilities:**
-- Keep **resolve** updated
-- Monitor dependency vulnerabilities
-- Follow secure configuration guidelines for module resolution
-
-## Legal Safe Harbor
-
-**We will NOT:**
-- Initiate legal action
-- Contact law enforcement
-- Suspend or terminate your access
-
-**You must:**
-- Only test against your own installations
-- Not access, modify, or delete user data
-- Not degrade service availability
-- Not publicly disclose before coordinated disclosure
-- Act in good faith
-
-## Recognition
-
-- **Advisory Credits**: Credit in GitHub Security Advisories (unless anonymous)
-
-## Security Updates
-
-**Stay Informed:**
-- Subscribe to npm updates for **resolve**
-- Enable GitHub Security Advisory notifications
-
-**Update Process:**
-- Patch releases (e.g., 1.22.10 → 1.22.11)
-- Out-of-band releases for critical issues
-- Advisories via GitHub Security Advisories
-
-## Contact Information
-
-- **Security reports**: Security tab of [browserify/resolve](https://github.com/browserify/resolve/security)
-- **General inquiries**: GitHub Discussions or Issues
-

package/node_modules/resolve/.github/THREAT_MODEL.md

@@ -1,74 +0,0 @@
-## Threat Model for resolve (module path resolution library)
-
-### 1. Library Overview
-
-- **Library Name:** resolve
-- **Brief Description:** Implements Node.js `require.resolve()` algorithm for synchronous and asynchronous file path resolution. Used to locate modules and files in Node.js projects.
-- **Key Public APIs/Functions:** `resolve.sync()` / `resolve/sync`, `resolve()` / `resolve/async`
-
-### 2. Define Scope
-
-This threat model focuses on the core path resolution algorithm, including filesystem interaction, option handling, and cache management.
-
-### 3. Conceptual System Diagram
-
-```
-Caller Application → resolve(id, options) → Resolution Algorithm → File System
-                           │
-                           └→ Options Handling
-                           └→ Cache System
-```
-
-**Trust Boundaries:**
-- **Input module IDs:** May come from untrusted sources (user input, configuration)
-- **Filesystem access:** The library interacts with the filesystem to resolve paths
-- **Options:** Provided by the caller
-- **Cache:** Used to improve performance, but could be a vector for tampering or information disclosure if not handled securely
-
-### 4. Identify Assets
-
-- **Integrity of resolution output:** Ensure correct and safe file path matching.
-- **Confidentiality of configuration:** Prevent sensitive path information from being leaked.
-- **Availability/performance for host application:** Prevent crashes or resource exhaustion.
-- **Security of host application:** Prevent path traversal or unintended filesystem access.
-- **Reputation of library:** Maintain trust by avoiding supply chain attacks and vulnerabilities[1][3][4].
-
-### 5. Identify Threats
-
-| Component / API / Interaction                       | S  | T  | R  | I  | D  | E  |
-|-----------------------------------------------------|----|----|----|----|----|----|
-| Public API Call (`resolve/async`, `resolve/sync`)   | ✓  | ✓  | –  | ✓  | –  | –  |
-| Filesystem Access                                   | –  | ✓  | –  | ✓  | ✓  | –  |
-| Options Handling                                    | ✓  | ✓  | –  | ✓  | –  | –  |
-| Cache System                                        | –  | ✓  | –  | ✓  | –  | –  |
-
-**Key Threats:**
-- **Spoofing:** Malicious module IDs mimicking legitimate packages, or spoofing configuration options[1].
-- **Tampering:** Caller-provided paths altering resolution order, or cache tampering leading to incorrect results[1][4].
-- **Information Disclosure:** Error messages revealing filesystem structure or sensitive paths[1].
-- **Denial of Service:** Recursive or excessive resolution exhausting filesystem handles or causing application crashes[1].
-- **Path Traversal:** Malicious input allowing access to files outside the intended directory[4].
-
-### 6. Mitigation/Countermeasures
-
-| Threat Identified                          | Proposed Mitigation |
-|--------------------------------------------|---------------------|
-| Spoofing (malicious module IDs/config)     | Sanitize input IDs; validate against known patterns; restrict `basedir` to app-controlled paths[1][4]. |
-| Tampering (path traversal, cache)          | Validate input IDs for directory escapes; secure cache reads/writes; restrict cache to trusted sources[1][4]. |
-| Information Disclosure (error messages)    | Generic "not found" errors without internal paths; avoid exposing sensitive configuration in errors[1]. |
-| Denial of Service (resource exhaustion)    | Limit recursive resolution depth; implement timeout; monitor for excessive filesystem operations[1]. |
-
-### 7. Risk Ranking
-
-- **High:** Path traversal via malicious IDs (if not properly mitigated)
-- **Medium:** Cache tampering or spoofing (if cache is not secured)
-- **Low:** Information disclosure in errors (if error handling is generic)
-
-### 8. Next Steps & Review
-
-1. **Implement input sanitization for module IDs and configuration.**
-2. **Add resolution depth limiting and timeout.**
-3. **Audit cache handling for race conditions and tampering.**
-4. **Regularly review dependencies for vulnerabilities.**
-5. **Keep documentation and threat model up to date.**
-6. **Monitor for new threats as the ecosystem and library evolve[1][3].**

package/node_modules/resolve/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2012 James Halliday
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/node_modules/resolve/SECURITY.md

@@ -1,11 +0,0 @@
-# Security
-
-Please file a private vulnerability via GitHub, email [@ljharb](https://github.com/ljharb), or see https://tidelift.com/security if you have a potential security vulnerability to report.
-
-## Incident Response
-
-See our [Incident Response Process](.github/INCIDENT_RESPONSE_PROCESS.md).
-
-## Threat Model
-
-See [THREAT_MODEL.md](./THREAT_MODEL.md).

package/node_modules/resolve/async.js

@@ -1,3 +0,0 @@
-'use strict';
-
-module.exports = require('./lib/async');

package/node_modules/resolve/bin/resolve

@@ -1,50 +0,0 @@
-#!/usr/bin/env node
-
-'use strict';
-
-var path = require('path');
-var fs = require('fs');
-
-if (
-    String(process.env.npm_lifecycle_script).slice(0, 8) !== 'resolve '
-    && (
-        !process.argv
-        || process.argv.length < 2
-        || (process.argv[1] !== __filename && fs.statSync(process.argv[1]).ino !== fs.statSync(__filename).ino)
-        || (process.env.npm_lifecycle_event !== 'npx' && process.env._ && fs.realpathSync(path.resolve(process.env._)) !== __filename)
-    )
-) {
-    console.error('Error: `resolve` must be run directly as an executable');
-    process.exit(1);
-}
-
-var supportsPreserveSymlinkFlag = require('supports-preserve-symlinks-flag');
-
-var preserveSymlinks = false;
-for (var i = 2; i < process.argv.length; i += 1) {
-    if (process.argv[i].slice(0, 2) === '--') {
-        if (supportsPreserveSymlinkFlag && process.argv[i] === '--preserve-symlinks') {
-            preserveSymlinks = true;
-        } else if (process.argv[i].length > 2) {
-            console.error('Unknown argument ' + process.argv[i].replace(/[=].*$/, ''));
-            process.exit(2);
-        }
-        process.argv.splice(i, 1);
-        i -= 1;
-        if (process.argv[i] === '--') { break; } // eslint-disable-line no-restricted-syntax
-    }
-}
-
-if (process.argv.length < 3) {
-    console.error('Error: `resolve` expects a specifier');
-    process.exit(2);
-}
-
-var resolve = require('../');
-
-var result = resolve.sync(process.argv[2], {
-    basedir: process.cwd(),
-    preserveSymlinks: preserveSymlinks
-});
-
-console.log(result);

package/node_modules/resolve/example/async.js

@@ -1,5 +0,0 @@
-var resolve = require('../');
-resolve('tap', { basedir: __dirname }, function (err, res) {
-    if (err) console.error(err);
-    else console.log(res);
-});

package/node_modules/resolve/example/sync.js

@@ -1,3 +0,0 @@
-var resolve = require('../');
-var res = resolve.sync('tap', { basedir: __dirname });
-console.log(res);

package/node_modules/resolve/index.js

@@ -1,6 +0,0 @@
-var async = require('./lib/async');
-async.core = require('./lib/core');
-async.isCore = require('./lib/is-core');
-async.sync = require('./lib/sync');
-
-module.exports = async;