pxnpm 5.0.0 → 6.0.1

package/dist/node_modules/ssri/lib/index.js

@@ -1,9 +1,10 @@
 'use strict'
 
 const crypto = require('crypto')
-const MiniPass = require('minipass')
+const { Minipass } = require('minipass')
 
-const SPEC_ALGORITHMS = ['sha256', 'sha384', 'sha512']
+const SPEC_ALGORITHMS = ['sha512', 'sha384', 'sha256']
+const DEFAULT_ALGORITHMS = ['sha512']
 
 // TODO: this should really be a hardcoded list of algorithms we support,
 // rather than [a-z0-9].
@@ -12,72 +13,64 @@ const SRI_REGEX = /^([a-z0-9]+)-([^?]+)([?\S*]*)$/
 const STRICT_SRI_REGEX = /^([a-z0-9]+)-([A-Za-z0-9+/=]{44,88})(\?[\x21-\x7E]*)?$/
 const VCHAR_REGEX = /^[\x21-\x7E]+$/
 
-const defaultOpts = {
-  algorithms: ['sha512'],
-  error: false,
-  options: [],
-  pickAlgorithm: getPrioritizedHash,
-  sep: ' ',
-  single: false,
-  strict: false,
-}
-
-const ssriOpts = (opts = {}) => ({ ...defaultOpts, ...opts })
+const getOptString = options => options?.length ? `?${options.join('?')}` : ''
 
-const getOptString = options => !options || !options.length
-  ? ''
-  : `?${options.join('?')}`
+class IntegrityStream extends Minipass {
+  #emittedIntegrity
+  #emittedSize
+  #emittedVerified
 
-const _onEnd = Symbol('_onEnd')
-const _getOptions = Symbol('_getOptions')
-const _emittedSize = Symbol('_emittedSize')
-const _emittedIntegrity = Symbol('_emittedIntegrity')
-const _emittedVerified = Symbol('_emittedVerified')
-
-class IntegrityStream extends MiniPass {
   constructor (opts) {
     super()
     this.size = 0
     this.opts = opts
 
     // may be overridden later, but set now for class consistency
-    this[_getOptions]()
+    this.#getOptions()
 
     // options used for calculating stream.  can't be changed.
-    const { algorithms = defaultOpts.algorithms } = opts
-    this.algorithms = Array.from(
-      new Set(algorithms.concat(this.algorithm ? [this.algorithm] : []))
-    )
+    if (opts?.algorithms) {
+      this.algorithms = [...opts.algorithms]
+    } else {
+      this.algorithms = [...DEFAULT_ALGORITHMS]
+    }
+    if (this.algorithm !== null && !this.algorithms.includes(this.algorithm)) {
+      this.algorithms.push(this.algorithm)
+    }
+
     this.hashes = this.algorithms.map(crypto.createHash)
   }
 
-  [_getOptions] () {
-    const {
-      integrity,
-      size,
-      options,
-    } = { ...defaultOpts, ...this.opts }
-
+  #getOptions () {
     // For verification
-    this.sri = integrity ? parse(integrity, this.opts) : null
-    this.expectedSize = size
-    this.goodSri = this.sri ? !!Object.keys(this.sri).length : false
-    this.algorithm = this.goodSri ? this.sri.pickAlgorithm(this.opts) : null
+    this.sri = this.opts?.integrity ? parse(this.opts?.integrity, this.opts) : null
+    this.expectedSize = this.opts?.size
+
+    if (!this.sri) {
+      this.algorithm = null
+    } else if (this.sri.isHash) {
+      this.goodSri = true
+      this.algorithm = this.sri.algorithm
+    } else {
+      this.goodSri = !this.sri.isEmpty()
+      this.algorithm = this.sri.pickAlgorithm(this.opts)
+    }
+
     this.digests = this.goodSri ? this.sri[this.algorithm] : null
-    this.optString = getOptString(options)
+    this.optString = getOptString(this.opts?.options)
   }
 
   on (ev, handler) {
-    if (ev === 'size' && this[_emittedSize]) {
-      return handler(this[_emittedSize])
+    if (ev === 'size' && this.#emittedSize) {
+      return handler(this.#emittedSize)
     }
 
-    if (ev === 'integrity' && this[_emittedIntegrity]) {
-      return handler(this[_emittedIntegrity])
+    if (ev === 'integrity' && this.#emittedIntegrity) {
+      return handler(this.#emittedIntegrity)
     }
 
-    if (ev === 'verified' && this[_emittedVerified]) {
-      return handler(this[_emittedVerified])
+    if (ev === 'verified' && this.#emittedVerified) {
+      return handler(this.#emittedVerified)
     }
 
     return super.on(ev, handler)
@@ -85,7 +78,7 @@ class IntegrityStream extends MiniPass {
 
   emit (ev, data) {
     if (ev === 'end') {
-      this[_onEnd]()
+      this.#onEnd()
     }
     return super.emit(ev, data)
   }
@@ -96,9 +89,9 @@ class IntegrityStream extends MiniPass {
     return super.write(data)
   }
 
-  [_onEnd] () {
+  #onEnd () {
     if (!this.goodSri) {
-      this[_getOptions]()
+      this.#getOptions()
     }
     const newSri = parse(this.hashes.map((h, i) => {
       return `${this.algorithms[i]}-${h.digest('base64')}${this.optString}`
@@ -123,12 +116,12 @@ class IntegrityStream extends MiniPass {
       err.sri = this.sri
       this.emit('error', err)
     } else {
-      this[_emittedSize] = this.size
+      this.#emittedSize = this.size
       this.emit('size', this.size)
-      this[_emittedIntegrity] = newSri
+      this.#emittedIntegrity = newSri
       this.emit('integrity', newSri)
       if (match) {
-        this[_emittedVerified] = match
+        this.#emittedVerified = match
         this.emit('verified', match)
       }
     }
@@ -141,8 +134,7 @@ class Hash {
   }
 
   constructor (hash, opts) {
-    opts = ssriOpts(opts)
-    const strict = !!opts.strict
+    const strict = opts?.strict
     this.source = hash.trim()
 
     // set default values so that we make V8 happy to
@@ -161,7 +153,7 @@ class Hash {
     if (!match) {
       return
     }
-    if (strict && !SPEC_ALGORITHMS.some(a => a === match[1])) {
+    if (strict && !SPEC_ALGORITHMS.includes(match[1])) {
       return
     }
     this.algorithm = match[1]
@@ -181,15 +173,37 @@ class Hash {
     return this.toString()
   }
 
+  match (integrity, opts) {
+    const other = parse(integrity, opts)
+    if (!other) {
+      return false
+    }
+    if (other.isIntegrity) {
+      const algo = other.pickAlgorithm(opts, [this.algorithm])
+
+      if (!algo) {
+        return false
+      }
+
+      const foundHash = other[algo].find(hash => hash.digest === this.digest)
+
+      if (foundHash) {
+        return foundHash
+      }
+
+      return false
+    }
+    return other.digest === this.digest ? other : false
+  }
+
   toString (opts) {
-    opts = ssriOpts(opts)
-    if (opts.strict) {
+    if (opts?.strict) {
       // Strict mode enforces the standard as close to the foot of the
       // letter as it can.
       if (!(
         // The spec has very restricted productions for algorithms.
         // https://www.w3.org/TR/CSP2/#source-list-syntax
-        SPEC_ALGORITHMS.some(x => x === this.algorithm) &&
+        SPEC_ALGORITHMS.includes(this.algorithm) &&
         // Usually, if someone insists on using a "different" base64, we
         // leave it as-is, since there's multiple standards, and the
         // specified is not a URL-safe variant.
@@ -203,13 +217,43 @@ class Hash {
         return ''
       }
     }
-    const options = this.options && this.options.length
-      ? `?${this.options.join('?')}`
-      : ''
-    return `${this.algorithm}-${this.digest}${options}`
+    return `${this.algorithm}-${this.digest}${getOptString(this.options)}`
   }
 }
 
+function integrityHashToString (toString, sep, opts, hashes) {
+  const toStringIsNotEmpty = toString !== ''
+
+  let shouldAddFirstSep = false
+  let complement = ''
+
+  const lastIndex = hashes.length - 1
+
+  for (let i = 0; i < lastIndex; i++) {
+    const hashString = Hash.prototype.toString.call(hashes[i], opts)
+
+    if (hashString) {
+      shouldAddFirstSep = true
+
+      complement += hashString
+      complement += sep
+    }
+  }
+
+  const finalHashString = Hash.prototype.toString.call(hashes[lastIndex], opts)
+
+  if (finalHashString) {
+    shouldAddFirstSep = true
+    complement += finalHashString
+  }
+
+  if (toStringIsNotEmpty && shouldAddFirstSep) {
+    return toString + sep + complement
+  }
+
+  return toString + complement
+}
+
 class Integrity {
   get isIntegrity () {
     return true
@@ -224,21 +268,28 @@ class Integrity {
   }
 
   toString (opts) {
-    opts = ssriOpts(opts)
-    let sep = opts.sep || ' '
-    if (opts.strict) {
+    let sep = opts?.sep || ' '
+    let toString = ''
+
+    if (opts?.strict) {
       // Entries must be separated by whitespace, according to spec.
       sep = sep.replace(/\S+/g, ' ')
+
+      for (const hash of SPEC_ALGORITHMS) {
+        if (this[hash]) {
+          toString = integrityHashToString(toString, sep, opts, this[hash])
+        }
+      }
+    } else {
+      for (const hash of Object.keys(this)) {
+        toString = integrityHashToString(toString, sep, opts, this[hash])
+      }
     }
-    return Object.keys(this).map(k => {
-      return this[k].map(hash => {
-        return Hash.prototype.toString.call(hash, opts)
-      }).filter(x => x.length).join(sep)
-    }).filter(x => x.length).join(sep)
+
+    return toString
   }
 
   concat (integrity, opts) {
-    opts = ssriOpts(opts)
     const other = typeof integrity === 'string'
       ? integrity
       : stringify(integrity, opts)
@@ -252,7 +303,6 @@ class Integrity {
   // add additional hashes to an integrity value, but prevent
   // *changing* an existing integrity hash.
   merge (integrity, opts) {
-    opts = ssriOpts(opts)
     const other = parse(integrity, opts)
     for (const algo in other) {
       if (this[algo]) {
@@ -268,10 +318,13 @@ class Integrity {
   }
 
   match (integrity, opts) {
-    opts = ssriOpts(opts)
     const other = parse(integrity, opts)
-    const algo = other.pickAlgorithm(opts)
+    if (!other) {
+      return false
+    }
+    const algo = other.pickAlgorithm(opts, Object.keys(this))
     return (
+      !!algo &&
       this[algo] &&
       other[algo] &&
       this[algo].find(hash =>
@@ -282,13 +335,22 @@ class Integrity {
     ) || false
   }
 
-  pickAlgorithm (opts) {
-    opts = ssriOpts(opts)
-    const pickAlgorithm = opts.pickAlgorithm
-    const keys = Object.keys(this)
-    return keys.reduce((acc, algo) => {
-      return pickAlgorithm(acc, algo) || acc
+  // Pick the highest priority algorithm present, optionally also limited to a
+  // set of hashes found in another integrity.  When limiting it may return
+  // nothing.
+  pickAlgorithm (opts, hashes) {
+    const pickAlgorithm = opts?.pickAlgorithm || getPrioritizedHash
+    const keys = Object.keys(this).filter(k => {
+      if (hashes?.length) {
+        return hashes.includes(k)
+      }
+      return true
     })
+    if (keys.length) {
+      return keys.reduce((acc, algo) => pickAlgorithm(acc, algo) || acc)
+    }
+    // no intersection between this and hashes,
+    return null
   }
 }
 
@@ -297,7 +359,6 @@ function parse (sri, opts) {
   if (!sri) {
     return null
   }
-  opts = ssriOpts(opts)
   if (typeof sri === 'string') {
     return _parse(sri, opts)
   } else if (sri.algorithm && sri.digest) {
@@ -312,7 +373,7 @@ function parse (sri, opts) {
 function _parse (integrity, opts) {
   // 3.4.3. Parse metadata
   // https://w3c.github.io/webappsec-subresource-integrity/#parse-metadata
-  if (opts.single) {
+  if (opts?.single) {
     return new Hash(integrity, opts)
   }
   const hashes = integrity.trim().split(/\s+/).reduce((acc, string) => {
@@ -331,7 +392,6 @@ function _parse (integrity, opts) {
 
 module.exports.stringify = stringify
 function stringify (obj, opts) {
-  opts = ssriOpts(opts)
   if (obj.algorithm && obj.digest) {
     return Hash.prototype.toString.call(obj, opts)
   } else if (typeof obj === 'string') {
@@ -343,8 +403,7 @@ function stringify (obj, opts) {
 
 module.exports.fromHex = fromHex
 function fromHex (hexDigest, algorithm, opts) {
-  opts = ssriOpts(opts)
-  const optString = getOptString(opts.options)
+  const optString = getOptString(opts?.options)
   return parse(
     `${algorithm}-${
       Buffer.from(hexDigest, 'hex').toString('base64')
@@ -354,9 +413,8 @@ function fromHex (hexDigest, algorithm, opts) {
 
 module.exports.fromData = fromData
 function fromData (data, opts) {
-  opts = ssriOpts(opts)
-  const algorithms = opts.algorithms
-  const optString = getOptString(opts.options)
+  const algorithms = opts?.algorithms || [...DEFAULT_ALGORITHMS]
+  const optString = getOptString(opts?.options)
   return algorithms.reduce((acc, algo) => {
     const digest = crypto.createHash(algo).update(data).digest('base64')
     const hash = new Hash(
@@ -379,7 +437,6 @@ function fromData (data, opts) {
 
 module.exports.fromStream = fromStream
 function fromStream (stream, opts) {
-  opts = ssriOpts(opts)
   const istream = integrityStream(opts)
   return new Promise((resolve, reject) => {
     stream.pipe(istream)
@@ -390,16 +447,15 @@ function fromStream (stream, opts) {
       sri = s
     })
     istream.on('end', () => resolve(sri))
-    istream.on('data', () => {})
+    istream.resume()
   })
 }
 
 module.exports.checkData = checkData
 function checkData (data, sri, opts) {
-  opts = ssriOpts(opts)
   sri = parse(sri, opts)
   if (!sri || !Object.keys(sri).length) {
-    if (opts.error) {
+    if (opts?.error) {
       throw Object.assign(
         new Error('No valid integrity hashes to check against'), {
           code: 'EINTEGRITY',
@@ -413,7 +469,8 @@ function checkData (data, sri, opts) {
   const digest = crypto.createHash(algorithm).update(data).digest('base64')
   const newSri = parse({ algorithm, digest })
   const match = newSri.match(sri, opts)
-  if (match || !opts.error) {
+  opts = opts || {}
+  if (match || !(opts.error)) {
     return match
   } else if (typeof opts.size === 'number' && (data.length !== opts.size)) {
     /* eslint-disable-next-line max-len */
@@ -437,7 +494,7 @@ function checkData (data, sri, opts) {
 
 module.exports.checkStream = checkStream
 function checkStream (stream, sri, opts) {
-  opts = ssriOpts(opts)
+  opts = opts || Object.create(null)
   opts.integrity = sri
   sri = parse(sri, opts)
   if (!sri || !Object.keys(sri).length) {
@@ -457,20 +514,19 @@ function checkStream (stream, sri, opts) {
       verified = s
     })
     checker.on('end', () => resolve(verified))
-    checker.on('data', () => {})
+    checker.resume()
   })
 }
 
 module.exports.integrityStream = integrityStream
-function integrityStream (opts = {}) {
+function integrityStream (opts = Object.create(null)) {
   return new IntegrityStream(opts)
 }
 
 module.exports.create = createIntegrity
 function createIntegrity (opts) {
-  opts = ssriOpts(opts)
-  const algorithms = opts.algorithms
-  const optString = getOptString(opts.options)
+  const algorithms = opts?.algorithms || [...DEFAULT_ALGORITHMS]
+  const optString = getOptString(opts?.options)
 
   const hashes = algorithms.map(crypto.createHash)
 
@@ -479,7 +535,7 @@ function createIntegrity (opts) {
       hashes.forEach(h => h.update(chunk, enc))
       return this
     },
-    digest: function (enc) {
+    digest: function () {
       const integrity = algorithms.reduce((acc, algo) => {
         const digest = hashes.shift().digest('base64')
         const hash = new Hash(
@@ -504,7 +560,7 @@ function createIntegrity (opts) {
   }
 }
 
-const NODE_HASHES = new Set(crypto.getHashes())
+const NODE_HASHES = crypto.getHashes()
 
 // This is a Best Effort™ at a reasonable priority for hash algos
 const DEFAULT_PRIORITY = [
@@ -514,7 +570,7 @@ const DEFAULT_PRIORITY = [
   'sha3',
   'sha3-256', 'sha3-384', 'sha3-512',
   'sha3_256', 'sha3_384', 'sha3_512',
-].filter(algo => NODE_HASHES.has(algo))
+].filter(algo => NODE_HASHES.includes(algo))
 
 function getPrioritizedHash (algo1, algo2) {
   /* eslint-disable-next-line max-len */

package/dist/node_modules/ssri/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ssri",
-  "version": "9.0.1",
+  "version": "10.0.6",
   "description": "Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.",
   "main": "lib/index.js",
   "files": [
@@ -10,24 +10,25 @@
   "scripts": {
     "prerelease": "npm t",
     "postrelease": "npm publish",
-    "prepublishOnly": "git push origin --follow-tags",
     "posttest": "npm run lint",
     "test": "tap",
     "coverage": "tap",
-    "lint": "eslint \"**/*.js\"",
+    "lint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
     "postlint": "template-oss-check",
     "template-oss-apply": "template-oss-apply --force",
     "lintfix": "npm run lint -- --fix",
-    "preversion": "npm test",
-    "postversion": "npm publish",
     "snap": "tap"
   },
   "tap": {
-    "check-coverage": true
+    "check-coverage": true,
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/npm/ssri.git"
+    "url": "git+https://github.com/npm/ssri.git"
   },
   "keywords": [
     "w3c",
@@ -46,18 +47,19 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "dependencies": {
-    "minipass": "^3.1.1"
+    "minipass": "^7.0.3"
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.5.0",
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.22.0",
     "tap": "^16.0.1"
   },
   "engines": {
-    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.5.0"
+    "version": "4.22.0",
+    "publish": "true"
   }
 }

package/dist/node_modules/string-width/index.js

@@ -1,13 +1,17 @@
-'use strict';
-const stripAnsi = require('strip-ansi');
-const isFullwidthCodePoint = require('is-fullwidth-code-point');
-const emojiRegex = require('emoji-regex');
+import stripAnsi from 'strip-ansi';
+import eastAsianWidth from 'eastasianwidth';
+import emojiRegex from 'emoji-regex';
 
-const stringWidth = string => {
+export default function stringWidth(string, options = {}) {
 	if (typeof string !== 'string' || string.length === 0) {
 		return 0;
 	}
 
+	options = {
+		ambiguousIsNarrow: true,
+		...options
+	};
+
 	string = stripAnsi(string);
 
 	if (string.length === 0) {
@@ -16,32 +20,35 @@ const stringWidth = string => {
 
 	string = string.replace(emojiRegex(), '  ');
 
+	const ambiguousCharacterWidth = options.ambiguousIsNarrow ? 1 : 2;
 	let width = 0;
 
-	for (let i = 0; i < string.length; i++) {
-		const code = string.codePointAt(i);
+	for (const character of string) {
+		const codePoint = character.codePointAt(0);
 
 		// Ignore control characters
-		if (code <= 0x1F || (code >= 0x7F && code <= 0x9F)) {
+		if (codePoint <= 0x1F || (codePoint >= 0x7F && codePoint <= 0x9F)) {
 			continue;
 		}
 
 		// Ignore combining characters
-		if (code >= 0x300 && code <= 0x36F) {
+		if (codePoint >= 0x300 && codePoint <= 0x36F) {
 			continue;
 		}
 
-		// Surrogates
-		if (code > 0xFFFF) {
-			i++;
+		const code = eastAsianWidth.eastAsianWidth(character);
+		switch (code) {
+			case 'F':
+			case 'W':
+				width += 2;
+				break;
+			case 'A':
+				width += ambiguousCharacterWidth;
+				break;
+			default:
+				width += 1;
 		}
-
-		width += isFullwidthCodePoint(code) ? 2 : 1;
 	}
 
 	return width;
-};
-
-module.exports = stringWidth;
-// TODO: remove this in the next major version
-module.exports.default = stringWidth;
+}

package/dist/node_modules/string-width/license

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

package/dist/node_modules/string-width/package.json

@@ -1,16 +1,19 @@
 {
 	"name": "string-width",
-	"version": "4.2.3",
+	"version": "5.1.2",
 	"description": "Get the visual width of a string - the number of columns required to display it",
 	"license": "MIT",
 	"repository": "sindresorhus/string-width",
+	"funding": "https://github.com/sponsors/sindresorhus",
 	"author": {
 		"name": "Sindre Sorhus",
 		"email": "sindresorhus@gmail.com",
-		"url": "sindresorhus.com"
+		"url": "https://sindresorhus.com"
 	},
+	"type": "module",
+	"exports": "./index.js",
 	"engines": {
-		"node": ">=8"
+		"node": ">=12"
 	},
 	"scripts": {
 		"test": "xo && ava && tsd"
@@ -44,13 +47,13 @@
 		"fixed-width"
 	],
 	"dependencies": {
-		"emoji-regex": "^8.0.0",
-		"is-fullwidth-code-point": "^3.0.0",
-		"strip-ansi": "^6.0.1"
+		"eastasianwidth": "^0.2.0",
+		"emoji-regex": "^9.2.2",
+		"strip-ansi": "^7.0.1"
 	},
 	"devDependencies": {
-		"ava": "^1.4.1",
-		"tsd": "^0.7.1",
-		"xo": "^0.24.0"
+		"ava": "^3.15.0",
+		"tsd": "^0.14.0",
+		"xo": "^0.38.2"
 	}
 }