snyk 1.1192.0 → 1.1193.0

package/dist/cli/95.index.js

@@ -18675,6 +18675,7 @@ function validateGraph(graph, rootNodeId, pkgs, pkgNodes) {
 }
 exports.validateGraph = validateGraph;
 function validatePackageURL(pkg) {
+    var _a;
     if (!pkg.purl) {
         return;
     }
@@ -18686,6 +18687,29 @@ function validatePackageURL(pkg) {
             case 'maven':
                 assert(pkg.name === purlPkg.namespace + ':' + purlPkg.name, `name and packageURL name do not match`);
                 break;
+            case 'composer':
+            case 'golang':
+            case 'npm':
+            case 'swift':
+                assert(pkg.name ===
+                    (purlPkg.namespace
+                        ? `${purlPkg.namespace}/${purlPkg.name}`
+                        : purlPkg.name), `name and packageURL name do not match`);
+                break;
+            // The PURL spec for Linux distros does not include the source in the name.
+            // This is why we relax the assertion here and match only on the package name:
+            // <source name>/<package name> - we omit the source name
+            // For now, make this exception only for deb to cover a support case.
+            case 'deb': {
+                const pkgName = pkg.name.split('/').pop();
+                assert(pkgName === purlPkg.name, 'name and packageURL name do not match');
+                if (((_a = purlPkg.qualifiers) === null || _a === void 0 ? void 0 : _a['upstream']) && pkg.name.includes('/')) {
+                    const pkgSrc = pkg.name.split('/')[0];
+                    const pkgUpstream = purlPkg.qualifiers['upstream'].split('@')[0];
+                    assert(pkgSrc === pkgUpstream, 'source and packageURL source do not match');
+                }
+                break;
+            }
             default:
                 assert(pkg.name === purlPkg.name, `name and packageURL name do not match`);
         }
@@ -94308,9 +94332,9 @@ var querystring = __webpack_require__(63477),
   debug = __webpack_require__(15158)('modem'),
   utils = __webpack_require__(76174),
   util = __webpack_require__(73837),
-  url = __webpack_require__(57310),
   splitca = __webpack_require__(22714),
-  isWin = __webpack_require__(22037).type() === 'Windows_NT';
+  isWin = __webpack_require__(22037).type() === 'Windows_NT',
+  stream = __webpack_require__(12781);
 
 var defaultOpts = function () {
   var host;
@@ -94376,7 +94400,7 @@ var Modem = function (options) {
 
   this.host = opts.host;
 
-  if(!this.host) {
+  if (!this.host) {
     this.socketPath = opts.socketPath;
   }
 
@@ -94394,7 +94418,7 @@ var Modem = function (options) {
   this.headers = opts.headers || {};
   this.sshOptions = Object.assign({}, options ? options.sshOptions : {}, optDefaults.sshOptions);
   //retrocompabitlity
-  if(this.sshOptions.agentForward === undefined) {
+  if (this.sshOptions.agentForward === undefined) {
     this.sshOptions.agentForward = opts.agentForward;
   }
 
@@ -94465,7 +94489,7 @@ Modem.prototype.dial = function (options, callback) {
 
   if (options.authconfig) {
     optionsf.headers['X-Registry-Auth'] = options.authconfig.key || options.authconfig.base64 ||
-      Buffer.from(JSON.stringify(options.authconfig)).toString('base64');
+      Buffer.from(JSON.stringify(options.authconfig)).toString('base64').replace(/\+/g, "-").replace(/\//g, "_");
   }
 
   if (options.registryconfig) {
@@ -94525,6 +94549,7 @@ Modem.prototype.dial = function (options, callback) {
 Modem.prototype.buildRequest = function (options, context, data, callback) {
   var self = this;
   var connectionTimeoutTimer;
+  var finished = false;
 
   var opts = self.protocol === 'ssh' ? Object.assign(options, {
     agent: ssh(Object.assign({}, self.sshOptions, {
@@ -94563,7 +94588,10 @@ Modem.prototype.buildRequest = function (options, context, data, callback) {
   if (context.hijack === true) {
     clearTimeout(connectionTimeoutTimer);
     req.on('upgrade', function (res, sock, head) {
-      return callback(null, sock);
+      if (finished === false) {
+        finished = true;
+        return callback(null, sock);
+      }
     });
   }
 
@@ -94578,8 +94606,17 @@ Modem.prototype.buildRequest = function (options, context, data, callback) {
   req.on('response', function (res) {
     clearTimeout(connectionTimeoutTimer);
     if (context.isStream === true) {
-      self.buildPayload(null, context.isStream, context.statusCodes, context.openStdin, req, res, null, callback);
+      if (finished === false) {
+        finished = true;
+        self.buildPayload(null, context.isStream, context.statusCodes, context.openStdin, req, res, null, callback);
+      }
     } else {
+      // The native 'request' method only handles aborting during the request lifecycle not the response lifecycle.
+      // We need to make the response stream abortable so that it's destroyed with an error on abort and then
+      // it triggers the request 'error' event
+      if (options.signal != null) {
+        stream.addAbortSignal(options.signal, res)
+      }
       var chunks = [];
       res.on('data', function (chunk) {
         chunks.push(chunk);
@@ -94592,14 +94629,20 @@ Modem.prototype.buildRequest = function (options, context, data, callback) {
         debug('Received: %s', result);
 
         var json = utils.parseJSON(result) || buffer;
-        self.buildPayload(null, context.isStream, context.statusCodes, false, req, res, json, callback);
+        if (finished === false) {
+          finished = true;
+          self.buildPayload(null, context.isStream, context.statusCodes, false, req, res, json, callback);
+        }
       });
     }
   });
 
   req.on('error', function (error) {
     clearTimeout(connectionTimeoutTimer);
-    self.buildPayload(error, context.isStream, context.statusCodes, false, {}, {}, null, callback);
+    if (finished === false) {
+      finished = true;
+      self.buildPayload(error, context.isStream, context.statusCodes, false, {}, {}, null, callback);
+    }
   });
 
   if (typeof data === 'string' || Buffer.isBuffer(data)) {
@@ -94656,7 +94699,7 @@ Modem.prototype.buildPayload = function (err, isStream, statusCodes, openStdin,
   }
 };
 
-Modem.prototype.demuxStream = function (stream, stdout, stderr) {
+Modem.prototype.demuxStream = function (streama, stdout, stderr) {
   var nextDataType = null;
   var nextDataLength = null;
   var buffer = Buffer.from('');
@@ -94695,18 +94738,18 @@ Modem.prototype.demuxStream = function (stream, stdout, stderr) {
     return out;
   }
 
-  stream.on('data', processData);
+  streama.on('data', processData);
 };
 
-Modem.prototype.followProgress = function (stream, onFinished, onProgress) {
+Modem.prototype.followProgress = function (streama, onFinished, onProgress) {
   var buf = '';
   var output = [];
   var finished = false;
 
-  stream.on('data', onStreamEvent);
-  stream.on('error', onStreamError);
-  stream.on('end', onStreamEnd);
-  stream.on('close', onStreamEnd);
+  streama.on('data', onStreamEvent);
+  streama.on('error', onStreamError);
+  streama.on('end', onStreamEnd);
+  streama.on('close', onStreamEnd);
 
   function onStreamEvent(data) {
     buf += data.toString();
@@ -94738,15 +94781,15 @@ Modem.prototype.followProgress = function (stream, onFinished, onProgress) {
 
   function onStreamError(err) {
     finished = true;
-    stream.removeListener('data', onStreamEvent);
-    stream.removeListener('error', onStreamError);
-    stream.removeListener('end', onStreamEnd);
-    stream.removeListener('close', onStreamEnd);
+    streama.removeListener('data', onStreamEvent);
+    streama.removeListener('error', onStreamError);
+    streama.removeListener('end', onStreamEnd);
+    streama.removeListener('close', onStreamEnd);
     onFinished(err, output);
   }
 
   function onStreamEnd() {
-    if(!finished) onFinished(null, output);
+    if (!finished) onFinished(null, output);
     finished = true;
   }
 };
@@ -94754,14 +94797,13 @@ Modem.prototype.followProgress = function (stream, onFinished, onProgress) {
 Modem.prototype.buildQuerystring = function (opts) {
   var clone = {};
 
-  // serialize map values as JSON strings, else querystring truncates.
+  // serialize map and array values as JSON strings, else querystring truncates.
+  // 't' and 'extrahosts' can be arrays but need special treatment so that they're
+  // passed as multiple qs parameters instead of JSON values.
   Object.keys(opts).map(function (key, i) {
     if (opts[key]
       && typeof opts[key] === 'object'
-      && !Array.isArray(opts[key])
-      // Ref: https://docs.docker.com/engine/api/v1.40/#operation/ImageBuild
-      // > cachefrom (string) JSON array of images used for build cache resolution.
-      || key === 'cachefrom'
+      && !['t', 'extrahosts'].includes(key)
     ) {
       clone[key] = JSON.stringify(opts[key]);
     } else {
@@ -170258,7 +170300,7 @@ module.exports = arrify;
 /* module decorator */ module = __webpack_require__.nmd(module);
 
 try {
-  process.dlopen(module, __dirname + __webpack_require__(71017).sep + __webpack_require__.p + "a8f8676967c7b025b7bbc9bf05eac2de.node");
+  process.dlopen(module, __dirname + __webpack_require__(71017).sep + __webpack_require__.p + "eb317cf9255f67c17789c294700ceae7.node");
 } catch (error) {
   throw new Error('node-loader:\n' + error);
 }
@@ -170272,7 +170314,7 @@ try {
 /* module decorator */ module = __webpack_require__.nmd(module);
 
 try {
-  process.dlopen(module, __dirname + __webpack_require__(71017).sep + __webpack_require__.p + "e229c1b0266a376aca04e7a37697b1b4.node");
+  process.dlopen(module, __dirname + __webpack_require__(71017).sep + __webpack_require__.p + "9b9a51334b4c8ed9874aa93bfe64d166.node");
 } catch (error) {
   throw new Error('node-loader:\n' + error);
 }
@@ -171338,7 +171380,7 @@ class PackageURL {
   }
 
   toString() {
-    var purl = ['pkg:', this.type, '/'];
+    var purl = ['pkg:', encodeURIComponent(this.type), '/'];
 
     if (this.type === 'pypi') {
       this._handlePyPi();
@@ -171353,11 +171395,11 @@ class PackageURL {
       purl.push('/');
     }
 
-    purl.push(encodeURIComponent(this.name).replace('%3A', ':'));
+    purl.push(encodeURIComponent(this.name).replace(/%3A/g, ':'));
 
     if (this.version) {
       purl.push('@');
-      purl.push(encodeURIComponent(this.version).replace('%3A', ':'));
+      purl.push(encodeURIComponent(this.version).replace(/%3A/g, ':'));
     }
 
     if (this.qualifiers) {
@@ -171366,7 +171408,11 @@ class PackageURL {
       let qualifiers = this.qualifiers;
       let qualifierString = [];
       Object.keys(qualifiers).sort().forEach(key => {
-        qualifierString.push(encodeURIComponent(key).replace('%3A', ':') + '=' + encodeURI(qualifiers[key]));
+        qualifierString.push(
+          encodeURIComponent(key).replace(/%3A/g, ':')
+          + '='
+          + encodeURIComponent(qualifiers[key]).replace(/%2F/g, '/')
+        );
       });
 
       purl.push(qualifierString.join('&'));
@@ -171374,14 +171420,16 @@ class PackageURL {
 
     if (this.subpath) {
       purl.push('#');
-      purl.push(encodeURI(this.subpath));
+      purl.push(encodeURIComponent(this.subpath)
+        .replace(/%3A/g, ':')
+        .replace(/%2F/g, '/'));
     }
 
     return purl.join('');
   }
 
   static fromString(purl) {
-    if (!purl || !typeof purl === 'string' || !purl.trim()) {
+    if (!purl || typeof purl !== 'string' || !purl.trim()) {
       throw new Error('A purl string argument is required.');
     }
 
@@ -171398,6 +171446,7 @@ class PackageURL {
     if (!type || !remainder) {
       throw new Error('purl is missing the required "type" component.');
     }
+    type = decodeURIComponent(type)
 
     let url = new URL(purl);
 
@@ -171412,9 +171461,9 @@ class PackageURL {
     if (subpath.indexOf('#') === 0) {
       subpath = subpath.substring(1);
     }
-    if (subpath.length === 0) {
-      subpath = null;
-    }
+    subpath = subpath.length === 0
+      ? null
+      : decodeURIComponent(subpath)
 
     if (url.username !== '' || url.password !== '') {
       throw new Error('Invalid purl: cannot contain a "user:pass@host:port"');
@@ -182328,7 +182377,7 @@ function cleanupCallback(imageFolderPath, imageName) {
         }
         fs.rmdir(imageFolderPath, (err) => {
             if (err !== null) {
-                debug(`Can't remove folder ${imageFolderPath}, got error ${err}`);
+                debug(`Can't remove folder ${imageFolderPath}, got error ${err.message}`);
             }
         });
     };
@@ -182344,44 +182393,49 @@ async function pullWithDockerBinary(docker, targetImage, saveLocation, username,
         return (pullAndSaveSuccessful = true);
     }
     catch (err) {
-        debug(`couldn't pull ${targetImage} using docker binary: ${err}`);
-        if (err.stderr &&
-            err.stderr.includes("unknown operating system or architecture")) {
-            throw new Error("Unknown operating system or architecture");
-        }
-        if (err.stderr &&
-            err.stderr.includes("operating system is not supported")) {
-            throw new Error(`Operating system is not supported`);
-        }
-        const unknownManifestConditions = [
-            "no matching manifest for",
-            "manifest unknown",
-        ];
-        if (err.stderr &&
-            unknownManifestConditions.some((value) => err.stderr.includes(value))) {
-            if (platform) {
-                throw new Error(`The image does not exist for ${platform}`);
-            }
-            throw new Error(`The image does not exist for the current platform`);
-        }
-        if (err.stderr && err.stderr.includes("invalid reference format")) {
-            throw new Error(`invalid image format`);
-        }
-        if (err.stderr.includes("unknown flag: --platform")) {
-            throw new Error('"--platform" is only supported on a Docker daemon with version later than 17.09');
-        }
-        if (err.stderr &&
-            err.stderr ===
-                '"--platform" is only supported on a Docker daemon with experimental features enabled') {
-            throw new Error(err.stderr);
-        }
+        debug(`couldn't pull ${targetImage} using docker binary: ${err.message}`);
+        handleDockerPullError(err.stderr, platform);
         return pullAndSaveSuccessful;
     }
 }
+function handleDockerPullError(err, platform) {
+    if (err && err.includes("unknown operating system or architecture")) {
+        throw new Error("Unknown operating system or architecture");
+    }
+    if (err.includes("operating system is not supported")) {
+        throw new Error(`Operating system is not supported`);
+    }
+    const unknownManifestConditions = [
+        "no matching manifest for",
+        "manifest unknown",
+    ];
+    if (unknownManifestConditions.some((value) => err.includes(value))) {
+        if (platform) {
+            throw new Error(`The image does not exist for ${platform}`);
+        }
+        throw new Error(`The image does not exist for the current platform`);
+    }
+    if (err.includes("invalid reference format")) {
+        throw new Error(`invalid image format`);
+    }
+    if (err.includes("unknown flag: --platform")) {
+        throw new Error('"--platform" is only supported on a Docker daemon with version later than 17.09');
+    }
+    if (err ===
+        '"--platform" is only supported on a Docker daemon with experimental features enabled') {
+        throw new Error(err);
+    }
+}
 async function pullFromContainerRegistry(docker, targetImage, imageSavePath, username, password) {
     const { hostname, imageName, tag } = extractImageDetails(targetImage);
     debug(`Attempting to pull: registry: ${hostname}, image: ${imageName}, tag: ${tag}`);
-    return await docker.pull(hostname, imageName, tag, imageSavePath, username, password);
+    try {
+        return await docker.pull(hostname, imageName, tag, imageSavePath, username, password);
+    }
+    catch (err) {
+        handleDockerPullError(err.message);
+        throw err;
+    }
 }
 async function pullImage(docker, targetImage, saveLocation, imageSavePath, username, password, platform) {
     if (await docker_1.Docker.binaryExists()) {
@@ -182509,7 +182563,7 @@ function isLocalImageSameArchitecture(platformOption, inspectResultArchitecture)
         platformArchitecture = platformOption.split("/")[1];
     }
     catch (error) {
-        debug(`Error parsing platform flag: '${error}'`);
+        debug(`Error parsing platform flag: '${error.message}'`);
         return false;
     }
     return platformArchitecture === inspectResultArchitecture;
@@ -182713,7 +182767,7 @@ async function detect(extractedLayers, dockerfileAnalysis) {
             osRelease = await handler(osReleaseFile);
         }
         catch (err) {
-            debug(`Malformed OS release file: ${err}`);
+            debug(`Malformed OS release file: ${err.message}`);
         }
         if (osRelease) {
             break;
@@ -182823,7 +182877,8 @@ function parseLine(text, curPkg, pkgs) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.analyzeDistroless = exports.analyze = void 0;
+exports.purl = exports.analyzeDistroless = exports.analyze = void 0;
+const packageurl_js_1 = __webpack_require__(38382);
 const types_1 = __webpack_require__(36293);
 function analyze(targetImage, aptFiles) {
     const pkgs = parseDpkgFile(aptFiles.dpkgFile);
@@ -182855,9 +182910,29 @@ function parseDpkgFile(text) {
     let curPkg = null;
     for (const line of text.split("\n")) {
         curPkg = parseDpkgLine(line, curPkg, pkgs);
+        if (curPkg) {
+            curPkg.Purl = purl(curPkg);
+        }
     }
     return pkgs;
 }
+function purl(curPkg) {
+    if (!curPkg.Name || !curPkg.Version) {
+        return undefined;
+    }
+    const qualifiers = {};
+    if (curPkg.Source && curPkg.SourceVersion) {
+        qualifiers.upstream = `${curPkg.Source}@${curPkg.SourceVersion}`;
+    }
+    else if (curPkg.Source) {
+        qualifiers.upstream = curPkg.Source;
+    }
+    return new packageurl_js_1.PackageURL("deb", "", curPkg.Name, curPkg.Version, 
+    // make sure that we pass in undefined if there are no qualifiers, because
+    // the packageurl-js library doesn't handle that properly...
+    Object.keys(qualifiers).length !== 0 ? qualifiers : undefined, undefined).toString();
+}
+exports.purl = purl;
 function parseDpkgLine(text, curPkg, pkgs) {
     const [key, value] = text.split(": ");
     switch (key) {
@@ -182866,6 +182941,7 @@ function parseDpkgLine(text, curPkg, pkgs) {
                 Name: value,
                 Version: "",
                 Source: undefined,
+                SourceVersion: undefined,
                 Provides: [],
                 Deps: {},
                 AutoInstalled: undefined,
@@ -182876,7 +182952,22 @@ function parseDpkgLine(text, curPkg, pkgs) {
             curPkg.Version = value;
             break;
         case "Source":
-            curPkg.Source = value.trim().split(" ")[0];
+            /**
+             * The value may look something like this:
+             * libgcc6 (1.3.0-b1)
+             * <name> (<version>)
+             *
+             * For example, Syft matches these values with a regex:
+             * https://github.com/anchore/syft/blob/1764e1c3f6bd66781f8350d957a1f95e4d9ad3de/syft/pkg/cataloger/deb/parse_dpkg_db.go#L169-L173
+             */
+            const parts = value.split(" ");
+            curPkg.Source = parts[0];
+            if (parts.length > 1) {
+                curPkg.SourceVersion = parts[1]
+                    .trim()
+                    .replace("(", "")
+                    .replace(")", "");
+            }
             break;
         case "Provides":
             for (let name of value.split(",")) {
@@ -183080,7 +183171,7 @@ async function analyze(targetImage, dockerfileAnalysis, imageType, imagePath, gl
         osRelease = await osReleaseDetector.detectStatically(extractedLayers, dockerfileAnalysis);
     }
     catch (err) {
-        debug(`Could not detect OS release: ${err}`);
+        debug(`Could not detect OS release: ${err.message}`);
         throw new Error("Failed to detect OS release");
     }
     const redHatRepositories = (0, static_10.getRedHatRepositoriesFromExtractedLayers)(extractedLayers);
@@ -183095,7 +183186,7 @@ async function analyze(targetImage, dockerfileAnalysis, imageType, imagePath, gl
         ]);
     }
     catch (err) {
-        debug(`Could not detect installed OS packages: ${err}`);
+        debug(`Could not detect installed OS packages: ${err.message}`);
         throw new Error("Failed to detect installed OS packages");
     }
     const binaries = (0, static_3.getBinariesHashes)(extractedLayers);
@@ -183280,6 +183371,7 @@ function buildTree(targetImage, packageFormat, depInfosList, targetOS) {
             const pkg = {
                 name: depFullName(depInfo),
                 version: depInfo.Version,
+                sourceVersion: depInfo.SourceVersion,
             };
             metaSubtree.dependencies[pkg.name] = pkg;
         }
@@ -184118,7 +184210,7 @@ async function extractArchive(dockerArchiveFilesystemPath, extractActions) {
                         layers[normalizedName] = await (0, layer_1.extractImageLayer)(stream, extractActions);
                     }
                     catch (error) {
-                        debug(`Error extracting layer content from: '${error}'`);
+                        debug(`Error extracting layer content from: '${error.message}'`);
                         reject(new Error("Error reading tar archive"));
                     }
                 }
@@ -184138,7 +184230,7 @@ async function extractArchive(dockerArchiveFilesystemPath, extractActions) {
                 resolve(getLayersContentAndArchiveManifest(manifest, imageConfig, layers));
             }
             catch (error) {
-                debug(`Error getting layers and manifest content from docker archive: ${error}`);
+                debug(`Error getting layers and manifest content from docker archive: ${error.message}`);
                 reject(new __1.InvalidArchiveError("Invalid Docker archive"));
             }
         });
@@ -184555,7 +184647,7 @@ async function extractImageLayer(layerTarStream, extractActions) {
                     }
                     catch (error) {
                         // An ExtractAction has thrown an uncaught exception, likely a bug in the code!
-                        debug(`Exception thrown while applying callbacks during image layer extraction: ${error}`);
+                        debug(`Exception thrown while applying callbacks during image layer extraction: ${error.message}`);
                         reject(error);
                     }
                 }
@@ -184681,7 +184773,7 @@ async function extractArchive(ociArchiveFilesystemPath, extractActions) {
                 resolve(getLayersContentAndArchiveManifest(mainIndexFile, manifests, indexFiles, imageConfig, layers));
             }
             catch (error) {
-                debug(`Error getting layers and manifest content from oci archive: '${error}'`);
+                debug(`Error getting layers and manifest content from oci archive: '${error.message}'`);
                 reject(new __1.InvalidArchiveError("Invalid OCI archive"));
             }
         });
@@ -185337,7 +185429,7 @@ async function goModulesToScannedProjects(filePathToContent) {
             });
         }
         catch (err) {
-            debug(`Go binary scan for file ${filePath} failed: ${err}`);
+            debug(`Go binary scan for file ${filePath} failed: ${err.message}`);
         }
     }
     return scanResults;
@@ -186161,7 +186253,7 @@ async function getRpmDbFileContent(extractedLayers) {
         return parserResponse.response;
     }
     catch (error) {
-        debug(`An error occurred while analysing RPM packages: ${error}`);
+        debug(`An error occurred while analysing RPM packages: ${error.message}`);
         return [];
     }
 }
@@ -186179,7 +186271,7 @@ async function getRpmSqliteDbFileContent(extractedLayers) {
         return results.response;
     }
     catch (error) {
-        debug(`An error occurred while analysing RPM packages: ${error}`);
+        debug(`An error occurred while analysing RPM packages: ${error.message}`);
         return [];
     }
 }
@@ -186628,6 +186720,7 @@ const fs = __webpack_require__(57147);
 const path = __webpack_require__(71017);
 const image_inspector_1 = __webpack_require__(95710);
 const dockerfile_1 = __webpack_require__(79652);
+const image_1 = __webpack_require__(92748);
 const image_save_path_1 = __webpack_require__(89313);
 const image_type_1 = __webpack_require__(38932);
 const option_utils_1 = __webpack_require__(48587);
@@ -186678,7 +186771,7 @@ async function scan(options) {
 }
 exports.scan = scan;
 async function localArchiveAnalysis(targetImage, imageType, dockerfileAnalysis, options) {
-    var _a, _b;
+    var _a, _b, _c, _d, _e, _f;
     const globToFind = {
         include: ((_a = options.globsToFind) === null || _a === void 0 ? void 0 : _a.include) || [],
         exclude: ((_b = options.globsToFind) === null || _b === void 0 ? void 0 : _b.exclude) || [],
@@ -186693,7 +186786,15 @@ async function localArchiveAnalysis(targetImage, imageType, dockerfileAnalysis,
     const imageIdentifier = options.imageNameAndTag ||
         // The target image becomes the base of the path, e.g. "archive.tar" for "/var/tmp/archive.tar"
         path.basename(archivePath);
-    return await staticModule.analyzeStatically(imageIdentifier, dockerfileAnalysis, imageType, archivePath, globToFind, options);
+    let imageName;
+    if ((((_c = options.digests) === null || _c === void 0 ? void 0 : _c.manifest) || ((_d = options.digests) === null || _d === void 0 ? void 0 : _d.index)) &&
+        options.imageNameAndTag) {
+        imageName = new image_1.ImageName(options.imageNameAndTag, {
+            manifest: (_e = options.digests) === null || _e === void 0 ? void 0 : _e.manifest,
+            index: (_f = options.digests) === null || _f === void 0 ? void 0 : _f.index,
+        });
+    }
+    return await staticModule.analyzeStatically(imageIdentifier, dockerfileAnalysis, imageType, archivePath, globToFind, options, imageName);
 }
 async function imageIdentifierAnalysis(targetImage, imageType, dockerfileAnalysis, options) {
     var _a, _b;
@@ -186850,7 +186951,7 @@ exports.streamToJson = streamToJson;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.execute = void 0;
 const childProcess = __webpack_require__(32081);
-const shescape_1 = __webpack_require__(79114);
+const shescape_1 = __webpack_require__(66710);
 function execute(command, args, options) {
     const spawnOptions = { shell: true, env: process.env };
     if (options && options.cwd) {
@@ -187934,6 +188035,7 @@ class Comparator {
       }
     }
 
+    comp = comp.trim().split(/\s+/).join(' ')
     debug('comparator', comp, options)
     this.options = options
     this.loose = !!options.loose
@@ -187996,13 +188098,6 @@ class Comparator {
       throw new TypeError('a Comparator is required')
     }
 
-    if (!options || typeof options !== 'object') {
-      options = {
-        loose: !!options,
-        includePrerelease: false,
-      }
-    }
-
     if (this.operator === '') {
       if (this.value === '') {
         return true
@@ -188015,39 +188110,50 @@ class Comparator {
       return new Range(this.value, options).test(comp.semver)
     }
 
-    const sameDirectionIncreasing =
-      (this.operator === '>=' || this.operator === '>') &&
-      (comp.operator === '>=' || comp.operator === '>')
-    const sameDirectionDecreasing =
-      (this.operator === '<=' || this.operator === '<') &&
-      (comp.operator === '<=' || comp.operator === '<')
-    const sameSemVer = this.semver.version === comp.semver.version
-    const differentDirectionsInclusive =
-      (this.operator === '>=' || this.operator === '<=') &&
-      (comp.operator === '>=' || comp.operator === '<=')
-    const oppositeDirectionsLessThan =
-      cmp(this.semver, '<', comp.semver, options) &&
-      (this.operator === '>=' || this.operator === '>') &&
-        (comp.operator === '<=' || comp.operator === '<')
-    const oppositeDirectionsGreaterThan =
-      cmp(this.semver, '>', comp.semver, options) &&
-      (this.operator === '<=' || this.operator === '<') &&
-        (comp.operator === '>=' || comp.operator === '>')
+    options = parseOptions(options)
 
-    return (
-      sameDirectionIncreasing ||
-      sameDirectionDecreasing ||
-      (sameSemVer && differentDirectionsInclusive) ||
-      oppositeDirectionsLessThan ||
-      oppositeDirectionsGreaterThan
-    )
+    // Special cases where nothing can possibly be lower
+    if (options.includePrerelease &&
+      (this.value === '<0.0.0-0' || comp.value === '<0.0.0-0')) {
+      return false
+    }
+    if (!options.includePrerelease &&
+      (this.value.startsWith('<0.0.0') || comp.value.startsWith('<0.0.0'))) {
+      return false
+    }
+
+    // Same direction increasing (> or >=)
+    if (this.operator.startsWith('>') && comp.operator.startsWith('>')) {
+      return true
+    }
+    // Same direction decreasing (< or <=)
+    if (this.operator.startsWith('<') && comp.operator.startsWith('<')) {
+      return true
+    }
+    // same SemVer and both sides are inclusive (<= or >=)
+    if (
+      (this.semver.version === comp.semver.version) &&
+      this.operator.includes('=') && comp.operator.includes('=')) {
+      return true
+    }
+    // opposite directions less than
+    if (cmp(this.semver, '<', comp.semver, options) &&
+      this.operator.startsWith('>') && comp.operator.startsWith('<')) {
+      return true
+    }
+    // opposite directions greater than
+    if (cmp(this.semver, '>', comp.semver, options) &&
+      this.operator.startsWith('<') && comp.operator.startsWith('>')) {
+      return true
+    }
+    return false
   }
 }
 
 module.exports = Comparator
 
 const parseOptions = __webpack_require__(40932)
-const { re, t } = __webpack_require__(92805)
+const { safeRe: re, t } = __webpack_require__(92805)
 const cmp = __webpack_require__(36650)
 const debug = __webpack_require__(25078)
 const SemVer = __webpack_require__(96769)
@@ -188087,9 +188193,16 @@ class Range {
     this.loose = !!options.loose
     this.includePrerelease = !!options.includePrerelease
 
-    // First, split based on boolean or ||
+    // First reduce all whitespace as much as possible so we do not have to rely
+    // on potentially slow regexes like \s*. This is then stored and used for
+    // future error messages as well.
     this.raw = range
-    this.set = range
+      .trim()
+      .split(/\s+/)
+      .join(' ')
+
+    // First, split on ||
+    this.set = this.raw
       .split('||')
       // map the range to a 2d array of comparators
       .map(r => this.parseRange(r.trim()))
@@ -188099,7 +188212,7 @@ class Range {
       .filter(c => c.length)
 
     if (!this.set.length) {
-      throw new TypeError(`Invalid SemVer Range: ${range}`)
+      throw new TypeError(`Invalid SemVer Range: ${this.raw}`)
     }
 
     // if we have any that are not the null set, throw out null sets.
@@ -188125,9 +188238,7 @@ class Range {
 
   format () {
     this.range = this.set
-      .map((comps) => {
-        return comps.join(' ').trim()
-      })
+      .map((comps) => comps.join(' ').trim())
       .join('||')
       .trim()
     return this.range
@@ -188138,12 +188249,12 @@ class Range {
   }
 
   parseRange (range) {
-    range = range.trim()
-
     // memoize range parsing for performance.
     // this is a very hot path, and fully deterministic.
-    const memoOpts = Object.keys(this.options).join(',')
-    const memoKey = `parseRange:${memoOpts}:${range}`
+    const memoOpts =
+      (this.options.includePrerelease && FLAG_INCLUDE_PRERELEASE) |
+      (this.options.loose && FLAG_LOOSE)
+    const memoKey = memoOpts + ':' + range
     const cached = cache.get(memoKey)
     if (cached) {
       return cached
@@ -188154,18 +188265,18 @@ class Range {
     const hr = loose ? re[t.HYPHENRANGELOOSE] : re[t.HYPHENRANGE]
     range = range.replace(hr, hyphenReplace(this.options.includePrerelease))
     debug('hyphen replace', range)
+
     // `> 1.2.3 < 1.2.5` => `>1.2.3 <1.2.5`
     range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace)
     debug('comparator trim', range)
 
     // `~ 1.2.3` => `~1.2.3`
     range = range.replace(re[t.TILDETRIM], tildeTrimReplace)
+    debug('tilde trim', range)
 
     // `^ 1.2.3` => `^1.2.3`
     range = range.replace(re[t.CARETTRIM], caretTrimReplace)
-
-    // normalize spaces
-    range = range.split(/\s+/).join(' ')
+    debug('caret trim', range)
 
     // At this point, the range is completely trimmed and
     // ready to be split into comparators.
@@ -188251,6 +188362,7 @@ class Range {
     return false
   }
 }
+
 module.exports = Range
 
 const LRU = __webpack_require__(68994)
@@ -188261,12 +188373,13 @@ const Comparator = __webpack_require__(60377)
 const debug = __webpack_require__(25078)
 const SemVer = __webpack_require__(96769)
 const {
-  re,
+  safeRe: re,
   t,
   comparatorTrimReplace,
   tildeTrimReplace,
   caretTrimReplace,
 } = __webpack_require__(92805)
+const { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = __webpack_require__(32094)
 
 const isNullSet = c => c.value === '<0.0.0-0'
 const isAny = c => c.value === ''
@@ -188314,10 +188427,13 @@ const isX = id => !id || id.toLowerCase() === 'x' || id === '*'
 // ~1.2.3, ~>1.2.3 --> >=1.2.3 <1.3.0-0
 // ~1.2.0, ~>1.2.0 --> >=1.2.0 <1.3.0-0
 // ~0.0.1 --> >=0.0.1 <0.1.0-0
-const replaceTildes = (comp, options) =>
-  comp.trim().split(/\s+/).map((c) => {
-    return replaceTilde(c, options)
-  }).join(' ')
+const replaceTildes = (comp, options) => {
+  return comp
+    .trim()
+    .split(/\s+/)
+    .map((c) => replaceTilde(c, options))
+    .join(' ')
+}
 
 const replaceTilde = (comp, options) => {
   const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE]
@@ -188355,10 +188471,13 @@ const replaceTilde = (comp, options) => {
 // ^1.2.0 --> >=1.2.0 <2.0.0-0
 // ^0.0.1 --> >=0.0.1 <0.0.2-0
 // ^0.1.0 --> >=0.1.0 <0.2.0-0
-const replaceCarets = (comp, options) =>
-  comp.trim().split(/\s+/).map((c) => {
-    return replaceCaret(c, options)
-  }).join(' ')
+const replaceCarets = (comp, options) => {
+  return comp
+    .trim()
+    .split(/\s+/)
+    .map((c) => replaceCaret(c, options))
+    .join(' ')
+}
 
 const replaceCaret = (comp, options) => {
   debug('caret', comp, options)
@@ -188415,9 +188534,10 @@ const replaceCaret = (comp, options) => {
 
 const replaceXRanges = (comp, options) => {
   debug('replaceXRanges', comp, options)
-  return comp.split(/\s+/).map((c) => {
-    return replaceXRange(c, options)
-  }).join(' ')
+  return comp
+    .split(/\s+/)
+    .map((c) => replaceXRange(c, options))
+    .join(' ')
 }
 
 const replaceXRange = (comp, options) => {
@@ -188500,12 +188620,15 @@ const replaceXRange = (comp, options) => {
 const replaceStars = (comp, options) => {
   debug('replaceStars', comp, options)
   // Looseness is ignored here.  star is always as loose as it gets!
-  return comp.trim().replace(re[t.STAR], '')
+  return comp
+    .trim()
+    .replace(re[t.STAR], '')
 }
 
 const replaceGTE0 = (comp, options) => {
   debug('replaceGTE0', comp, options)
-  return comp.trim()
+  return comp
+    .trim()
     .replace(re[options.includePrerelease ? t.GTE0PRE : t.GTE0], '')
 }
 
@@ -188543,7 +188666,7 @@ const hyphenReplace = incPr => ($0,
     to = `<=${to}`
   }
 
-  return (`${from} ${to}`).trim()
+  return `${from} ${to}`.trim()
 }
 
 const testSet = (set, version, options) => {
@@ -188590,7 +188713,7 @@ const testSet = (set, version, options) => {
 
 const debug = __webpack_require__(25078)
 const { MAX_LENGTH, MAX_SAFE_INTEGER } = __webpack_require__(32094)
-const { re, t } = __webpack_require__(92805)
+const { safeRe: re, t } = __webpack_require__(92805)
 
 const parseOptions = __webpack_require__(40932)
 const { compareIdentifiers } = __webpack_require__(81960)
@@ -188606,7 +188729,7 @@ class SemVer {
         version = version.version
       }
     } else if (typeof version !== 'string') {
-      throw new TypeError(`Invalid Version: ${version}`)
+      throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`)
     }
 
     if (version.length > MAX_LENGTH) {
@@ -188765,36 +188888,36 @@ class SemVer {
 
   // preminor will bump the version up to the next minor release, and immediately
   // down to pre-release. premajor and prepatch work the same way.
-  inc (release, identifier) {
+  inc (release, identifier, identifierBase) {
     switch (release) {
       case 'premajor':
         this.prerelease.length = 0
         this.patch = 0
         this.minor = 0
         this.major++
-        this.inc('pre', identifier)
+        this.inc('pre', identifier, identifierBase)
         break
       case 'preminor':
         this.prerelease.length = 0
         this.patch = 0
         this.minor++
-        this.inc('pre', identifier)
+        this.inc('pre', identifier, identifierBase)
         break
       case 'prepatch':
         // If this is already a prerelease, it will bump to the next version
         // drop any prereleases that might already exist, since they are not
         // relevant at this point.
         this.prerelease.length = 0
-        this.inc('patch', identifier)
-        this.inc('pre', identifier)
+        this.inc('patch', identifier, identifierBase)
+        this.inc('pre', identifier, identifierBase)
         break
       // If the input is a non-prerelease version, this acts the same as
       // prepatch.
       case 'prerelease':
         if (this.prerelease.length === 0) {
-          this.inc('patch', identifier)
+          this.inc('patch', identifier, identifierBase)
         }
-        this.inc('pre', identifier)
+        this.inc('pre', identifier, identifierBase)
         break
 
       case 'major':
@@ -188836,9 +188959,15 @@ class SemVer {
         break
       // This probably shouldn't be used publicly.
       // 1.0.0 'pre' would become 1.0.0-0 which is the wrong direction.
-      case 'pre':
+      case 'pre': {
+        const base = Number(identifierBase) ? 1 : 0
+
+        if (!identifier && identifierBase === false) {
+          throw new Error('invalid increment argument: identifier is empty')
+        }
+
         if (this.prerelease.length === 0) {
-          this.prerelease = [0]
+          this.prerelease = [base]
         } else {
           let i = this.prerelease.length
           while (--i >= 0) {
@@ -188849,27 +188978,36 @@ class SemVer {
           }
           if (i === -1) {
             // didn't increment anything
-            this.prerelease.push(0)
+            if (identifier === this.prerelease.join('.') && identifierBase === false) {
+              throw new Error('invalid increment argument: identifier already exists')
+            }
+            this.prerelease.push(base)
           }
         }
         if (identifier) {
           // 1.2.0-beta.1 bumps to 1.2.0-beta.2,
           // 1.2.0-beta.fooblz or 1.2.0-beta bumps to 1.2.0-beta.0
+          let prerelease = [identifier, base]
+          if (identifierBase === false) {
+            prerelease = [identifier]
+          }
           if (compareIdentifiers(this.prerelease[0], identifier) === 0) {
             if (isNaN(this.prerelease[1])) {
-              this.prerelease = [identifier, 0]
+              this.prerelease = prerelease
             }
           } else {
-            this.prerelease = [identifier, 0]
+            this.prerelease = prerelease
           }
         }
         break
-
+      }
       default:
         throw new Error(`invalid increment argument: ${release}`)
     }
-    this.format()
-    this.raw = this.version
+    this.raw = this.format()
+    if (this.build.length) {
+      this.raw += `+${this.build.join('.')}`
+    }
     return this
   }
 }
@@ -188956,7 +189094,7 @@ module.exports = cmp
 
 const SemVer = __webpack_require__(96769)
 const parse = __webpack_require__(763)
-const { re, t } = __webpack_require__(92805)
+const { safeRe: re, t } = __webpack_require__(92805)
 
 const coerce = (version, options) => {
   if (version instanceof SemVer) {
@@ -189050,27 +189188,69 @@ module.exports = compare
 /***/ ((module, __unused_webpack_exports, __webpack_require__) => {
 
 const parse = __webpack_require__(763)
-const eq = __webpack_require__(17771)
 
 const diff = (version1, version2) => {
-  if (eq(version1, version2)) {
+  const v1 = parse(version1, null, true)
+  const v2 = parse(version2, null, true)
+  const comparison = v1.compare(v2)
+
+  if (comparison === 0) {
     return null
-  } else {
-    const v1 = parse(version1)
-    const v2 = parse(version2)
-    const hasPre = v1.prerelease.length || v2.prerelease.length
-    const prefix = hasPre ? 'pre' : ''
-    const defaultResult = hasPre ? 'prerelease' : ''
-    for (const key in v1) {
-      if (key === 'major' || key === 'minor' || key === 'patch') {
-        if (v1[key] !== v2[key]) {
-          return prefix + key
-        }
-      }
+  }
+
+  const v1Higher = comparison > 0
+  const highVersion = v1Higher ? v1 : v2
+  const lowVersion = v1Higher ? v2 : v1
+  const highHasPre = !!highVersion.prerelease.length
+  const lowHasPre = !!lowVersion.prerelease.length
+
+  if (lowHasPre && !highHasPre) {
+    // Going from prerelease -> no prerelease requires some special casing
+
+    // If the low version has only a major, then it will always be a major
+    // Some examples:
+    // 1.0.0-1 -> 1.0.0
+    // 1.0.0-1 -> 1.1.1
+    // 1.0.0-1 -> 2.0.0
+    if (!lowVersion.patch && !lowVersion.minor) {
+      return 'major'
     }
-    return defaultResult // may be undefined
+
+    // Otherwise it can be determined by checking the high version
+
+    if (highVersion.patch) {
+      // anything higher than a patch bump would result in the wrong version
+      return 'patch'
+    }
+
+    if (highVersion.minor) {
+      // anything higher than a minor bump would result in the wrong version
+      return 'minor'
+    }
+
+    // bumping major/minor/patch all have same result
+    return 'major'
   }
+
+  // add the `pre` prefix if we are going to a prerelease version
+  const prefix = highHasPre ? 'pre' : ''
+
+  if (v1.major !== v2.major) {
+    return prefix + 'major'
+  }
+
+  if (v1.minor !== v2.minor) {
+    return prefix + 'minor'
+  }
+
+  if (v1.patch !== v2.patch) {
+    return prefix + 'patch'
+  }
+
+  // high and low are preleases
+  return 'prerelease'
 }
+
 module.exports = diff
 
 
@@ -189111,8 +189291,9 @@ module.exports = gte
 
 const SemVer = __webpack_require__(96769)
 
-const inc = (version, release, options, identifier) => {
+const inc = (version, release, options, identifier, identifierBase) => {
   if (typeof (options) === 'string') {
+    identifierBase = identifier
     identifier = options
     options = undefined
   }
@@ -189121,7 +189302,7 @@ const inc = (version, release, options, identifier) => {
     return new SemVer(
       version instanceof SemVer ? version.version : version,
       options
-    ).inc(release, identifier).version
+    ).inc(release, identifier, identifierBase).version
   } catch (er) {
     return null
   }
@@ -189184,35 +189365,18 @@ module.exports = neq
 /***/ 763:
 /***/ ((module, __unused_webpack_exports, __webpack_require__) => {
 
-const { MAX_LENGTH } = __webpack_require__(32094)
-const { re, t } = __webpack_require__(92805)
 const SemVer = __webpack_require__(96769)
-
-const parseOptions = __webpack_require__(40932)
-const parse = (version, options) => {
-  options = parseOptions(options)
-
+const parse = (version, options, throwErrors = false) => {
   if (version instanceof SemVer) {
     return version
   }
-
-  if (typeof version !== 'string') {
-    return null
-  }
-
-  if (version.length > MAX_LENGTH) {
-    return null
-  }
-
-  const r = options.loose ? re[t.LOOSE] : re[t.FULL]
-  if (!r.test(version)) {
-    return null
-  }
-
   try {
     return new SemVer(version, options)
   } catch (er) {
-    return null
+    if (!throwErrors) {
+      return null
+    }
+    throw er
   }
 }
 
@@ -189392,6 +189556,7 @@ module.exports = {
   src: internalRe.src,
   tokens: internalRe.t,
   SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
+  RELEASE_TYPES: constants.RELEASE_TYPES,
   compareIdentifiers: identifiers.compareIdentifiers,
   rcompareIdentifiers: identifiers.rcompareIdentifiers,
 }
@@ -189413,11 +189578,29 @@ const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER ||
 // Max safe segment length for coercion.
 const MAX_SAFE_COMPONENT_LENGTH = 16
 
+// Max safe length for a build identifier. The max length minus 6 characters for
+// the shortest version with a build 0.0.0+BUILD.
+const MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6
+
+const RELEASE_TYPES = [
+  'major',
+  'premajor',
+  'minor',
+  'preminor',
+  'patch',
+  'prepatch',
+  'prerelease',
+]
+
 module.exports = {
-  SEMVER_SPEC_VERSION,
   MAX_LENGTH,
-  MAX_SAFE_INTEGER,
   MAX_SAFE_COMPONENT_LENGTH,
+  MAX_SAFE_BUILD_LENGTH,
+  MAX_SAFE_INTEGER,
+  RELEASE_TYPES,
+  SEMVER_SPEC_VERSION,
+  FLAG_INCLUDE_PRERELEASE: 0b001,
+  FLAG_LOOSE: 0b010,
 }
 
 
@@ -189472,16 +189655,20 @@ module.exports = {
 /***/ 40932:
 /***/ ((module) => {
 
-// parse out just the options we care about so we always get a consistent
-// obj with keys in a consistent order.
-const opts = ['includePrerelease', 'loose', 'rtl']
-const parseOptions = options =>
-  !options ? {}
-  : typeof options !== 'object' ? { loose: true }
-  : opts.filter(k => options[k]).reduce((o, k) => {
-    o[k] = true
-    return o
-  }, {})
+// parse out just the options we care about
+const looseOption = Object.freeze({ loose: true })
+const emptyOpts = Object.freeze({ })
+const parseOptions = options => {
+  if (!options) {
+    return emptyOpts
+  }
+
+  if (typeof options !== 'object') {
+    return looseOption
+  }
+
+  return options
+}
 module.exports = parseOptions
 
 
@@ -189490,22 +189677,52 @@ module.exports = parseOptions
 /***/ 92805:
 /***/ ((module, exports, __webpack_require__) => {
 
-const { MAX_SAFE_COMPONENT_LENGTH } = __webpack_require__(32094)
+const {
+  MAX_SAFE_COMPONENT_LENGTH,
+  MAX_SAFE_BUILD_LENGTH,
+  MAX_LENGTH,
+} = __webpack_require__(32094)
 const debug = __webpack_require__(25078)
 exports = module.exports = {}
 
 // The actual regexps go on exports.re
 const re = exports.re = []
+const safeRe = exports.safeRe = []
 const src = exports.src = []
 const t = exports.t = {}
 let R = 0
 
+const LETTERDASHNUMBER = '[a-zA-Z0-9-]'
+
+// Replace some greedy regex tokens to prevent regex dos issues. These regex are
+// used internally via the safeRe object since all inputs in this library get
+// normalized first to trim and collapse all extra whitespace. The original
+// regexes are exported for userland consumption and lower level usage. A
+// future breaking change could export the safer regex only with a note that
+// all input should have extra whitespace removed.
+const safeRegexReplacements = [
+  ['\\s', 1],
+  ['\\d', MAX_LENGTH],
+  [LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH],
+]
+
+const makeSafeRegex = (value) => {
+  for (const [token, max] of safeRegexReplacements) {
+    value = value
+      .split(`${token}*`).join(`${token}{0,${max}}`)
+      .split(`${token}+`).join(`${token}{1,${max}}`)
+  }
+  return value
+}
+
 const createToken = (name, value, isGlobal) => {
+  const safe = makeSafeRegex(value)
   const index = R++
   debug(name, index, value)
   t[name] = index
   src[index] = value
   re[index] = new RegExp(value, isGlobal ? 'g' : undefined)
+  safeRe[index] = new RegExp(safe, isGlobal ? 'g' : undefined)
 }
 
 // The following Regular Expressions can be used for tokenizing,
@@ -189515,13 +189732,13 @@ const createToken = (name, value, isGlobal) => {
 // A single `0`, or a non-zero digit followed by zero or more digits.
 
 createToken('NUMERICIDENTIFIER', '0|[1-9]\\d*')
-createToken('NUMERICIDENTIFIERLOOSE', '[0-9]+')
+createToken('NUMERICIDENTIFIERLOOSE', '\\d+')
 
 // ## Non-numeric Identifier
 // Zero or more digits, followed by a letter or hyphen, and then zero or
 // more letters, digits, or hyphens.
 
-createToken('NONNUMERICIDENTIFIER', '\\d*[a-zA-Z-][a-zA-Z0-9-]*')
+createToken('NONNUMERICIDENTIFIER', `\\d*[a-zA-Z-]${LETTERDASHNUMBER}*`)
 
 // ## Main Version
 // Three dot-separated numeric identifiers.
@@ -189556,7 +189773,7 @@ createToken('PRERELEASELOOSE', `(?:-?(${src[t.PRERELEASEIDENTIFIERLOOSE]
 // ## Build Metadata Identifier
 // Any combination of digits, letters, or hyphens.
 
-createToken('BUILDIDENTIFIER', '[0-9A-Za-z-]+')
+createToken('BUILDIDENTIFIER', `${LETTERDASHNUMBER}+`)
 
 // ## Build Metadata
 // Plus sign, followed by one or more period-separated build metadata
@@ -189694,7 +189911,7 @@ const Range = __webpack_require__(4142)
 const intersects = (r1, r2, options) => {
   r1 = new Range(r1, options)
   r2 = new Range(r2, options)
-  return r1.intersects(r2)
+  return r1.intersects(r2, options)
 }
 module.exports = intersects
 
@@ -190057,6 +190274,9 @@ const subset = (sub, dom, options = {}) => {
   return true
 }
 
+const minimumVersionWithPreRelease = [new Comparator('>=0.0.0-0')]
+const minimumVersion = [new Comparator('>=0.0.0')]
+
 const simpleSubset = (sub, dom, options) => {
   if (sub === dom) {
     return true
@@ -190066,9 +190286,9 @@ const simpleSubset = (sub, dom, options) => {
     if (dom.length === 1 && dom[0].semver === ANY) {
       return true
     } else if (options.includePrerelease) {
-      sub = [new Comparator('>=0.0.0-0')]
+      sub = minimumVersionWithPreRelease
     } else {
-      sub = [new Comparator('>=0.0.0')]
+      sub = minimumVersion
     }
   }
 
@@ -190076,7 +190296,7 @@ const simpleSubset = (sub, dom, options) => {
     if (options.includePrerelease) {
       return true
     } else {
-      dom = [new Comparator('>=0.0.0')]
+      dom = minimumVersion
     }
   }
 
@@ -191053,6 +191273,138 @@ module.exports.tmpNameSync = tmpNameSync;
 module.exports.setGracefulCleanup = setGracefulCleanup;
 
 
+/***/ }),
+
+/***/ 81918:
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+const isWindows = process.platform === 'win32' ||
+    process.env.OSTYPE === 'cygwin' ||
+    process.env.OSTYPE === 'msys'
+
+const path = __webpack_require__(71017)
+const COLON = isWindows ? ';' : ':'
+const isexe = __webpack_require__(31959)
+
+const getNotFoundError = (cmd) =>
+  Object.assign(new Error(`not found: ${cmd}`), { code: 'ENOENT' })
+
+const getPathInfo = (cmd, opt) => {
+  const colon = opt.colon || COLON
+
+  // If it has a slash, then we don't bother searching the pathenv.
+  // just check the file itself, and that's it.
+  const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? ['']
+    : (
+      [
+        // windows always checks the cwd first
+        ...(isWindows ? [process.cwd()] : []),
+        ...(opt.path || process.env.PATH ||
+          /* istanbul ignore next: very unusual */ '').split(colon),
+      ]
+    )
+  const pathExtExe = isWindows
+    ? opt.pathExt || process.env.PATHEXT || '.EXE;.CMD;.BAT;.COM'
+    : ''
+  const pathExt = isWindows ? pathExtExe.split(colon) : ['']
+
+  if (isWindows) {
+    if (cmd.indexOf('.') !== -1 && pathExt[0] !== '')
+      pathExt.unshift('')
+  }
+
+  return {
+    pathEnv,
+    pathExt,
+    pathExtExe,
+  }
+}
+
+const which = (cmd, opt, cb) => {
+  if (typeof opt === 'function') {
+    cb = opt
+    opt = {}
+  }
+  if (!opt)
+    opt = {}
+
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  const step = i => new Promise((resolve, reject) => {
+    if (i === pathEnv.length)
+      return opt.all && found.length ? resolve(found)
+        : reject(getNotFoundError(cmd))
+
+    const ppRaw = pathEnv[i]
+    const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw
+
+    const pCmd = path.join(pathPart, cmd)
+    const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd
+      : pCmd
+
+    resolve(subStep(p, i, 0))
+  })
+
+  const subStep = (p, i, ii) => new Promise((resolve, reject) => {
+    if (ii === pathExt.length)
+      return resolve(step(i + 1))
+    const ext = pathExt[ii]
+    isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
+      if (!er && is) {
+        if (opt.all)
+          found.push(p + ext)
+        else
+          return resolve(p + ext)
+      }
+      return resolve(subStep(p, i, ii + 1))
+    })
+  })
+
+  return cb ? step(0).then(res => cb(null, res), cb) : step(0)
+}
+
+const whichSync = (cmd, opt) => {
+  opt = opt || {}
+
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (let i = 0; i < pathEnv.length; i ++) {
+    const ppRaw = pathEnv[i]
+    const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw
+
+    const pCmd = path.join(pathPart, cmd)
+    const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd
+      : pCmd
+
+    for (let j = 0; j < pathExt.length; j ++) {
+      const cur = p + pathExt[j]
+      try {
+        const is = isexe.sync(cur, { pathExt: pathExtExe })
+        if (is) {
+          if (opt.all)
+            found.push(cur)
+          else
+            return cur
+        }
+      } catch (ex) {}
+    }
+  }
+
+  if (opt.all && found.length)
+    return found
+
+  if (opt.nothrow)
+    return null
+
+  throw getNotFoundError(cmd)
+}
+
+module.exports = which
+which.sync = whichSync
+
+
 /***/ }),
 
 /***/ 26520:
@@ -263964,6 +264316,7 @@ class Client extends EventEmitter {
     const DEBUG_HANDLER = (!debug ? undefined : (p, display, msg) => {
       debug(`Debug output from server: ${JSON.stringify(msg)}`);
     });
+    let serverSigAlgs;
     const proto = this._protocol = new Protocol({
       ident: this.config.ident,
       offer: (allOfferDefaults ? undefined : algorithms),
@@ -264015,6 +264368,17 @@ class Client extends EventEmitter {
           if (name === 'ssh-userauth')
             tryNextAuth();
         },
+        EXT_INFO: (p, exts) => {
+          if (serverSigAlgs === undefined) {
+            for (const ext of exts) {
+              if (ext.name === 'server-sig-algs') {
+                serverSigAlgs = ext.algs;
+                return;
+              }
+            }
+            serverSigAlgs = null;
+          }
+        },
         USERAUTH_BANNER: (p, msg) => {
           this.emit('banner', msg);
         },
@@ -264027,6 +264391,51 @@ class Client extends EventEmitter {
           this.emit('ready');
         },
         USERAUTH_FAILURE: (p, authMethods, partialSuccess) => {
+          // For key-based authentication, check if we should retry the current
+          // key with a different algorithm first
+          if (curAuth.keyAlgos) {
+            const oldKeyAlgo = curAuth.keyAlgos[0][0];
+            if (debug)
+              debug(`Client: ${curAuth.type} (${oldKeyAlgo}) auth failed`);
+            curAuth.keyAlgos.shift();
+            if (curAuth.keyAlgos.length) {
+              const [keyAlgo, hashAlgo] = curAuth.keyAlgos[0];
+              switch (curAuth.type) {
+                case 'agent':
+                  proto.authPK(
+                    curAuth.username,
+                    curAuth.agentCtx.currentKey(),
+                    keyAlgo
+                  );
+                  return;
+                case 'publickey':
+                  proto.authPK(curAuth.username, curAuth.key, keyAlgo);
+                  return;
+                case 'hostbased':
+                  proto.authHostbased(curAuth.username,
+                                      curAuth.key,
+                                      curAuth.localHostname,
+                                      curAuth.localUsername,
+                                      keyAlgo,
+                                      (buf, cb) => {
+                    const signature = curAuth.key.sign(buf, hashAlgo);
+                    if (signature instanceof Error) {
+                      signature.message =
+                        `Error while signing with key: ${signature.message}`;
+                      signature.level = 'client-authentication';
+                      this.emit('error', signature);
+                      return tryNextAuth();
+                    }
+
+                    cb(signature);
+                  });
+                  return;
+              }
+            } else {
+              curAuth.keyAlgos = undefined;
+            }
+          }
+
           if (curAuth.type === 'agent') {
             const pos = curAuth.agentCtx.pos();
             debug && debug(`Client: Agent key #${pos + 1} failed`);
@@ -264053,10 +264462,15 @@ class Client extends EventEmitter {
           }
         },
         USERAUTH_PK_OK: (p) => {
+          let keyAlgo;
+          let hashAlgo;
+          if (curAuth.keyAlgos)
+            [keyAlgo, hashAlgo] = curAuth.keyAlgos[0];
           if (curAuth.type === 'agent') {
             const key = curAuth.agentCtx.currentKey();
-            proto.authPK(curAuth.username, key, (buf, cb) => {
-              curAuth.agentCtx.sign(key, buf, {}, (err, signed) => {
+            proto.authPK(curAuth.username, key, keyAlgo, (buf, cb) => {
+              const opts = { hash: hashAlgo };
+              curAuth.agentCtx.sign(key, buf, opts, (err, signed) => {
                 if (err) {
                   err.level = 'agent';
                   this.emit('error', err);
@@ -264068,8 +264482,8 @@ class Client extends EventEmitter {
               });
             });
           } else if (curAuth.type === 'publickey') {
-            proto.authPK(curAuth.username, curAuth.key, (buf, cb) => {
-              const signature = curAuth.key.sign(buf);
+            proto.authPK(curAuth.username, curAuth.key, keyAlgo, (buf, cb) => {
+              const signature = curAuth.key.sign(buf, hashAlgo);
               if (signature instanceof Error) {
                 signature.message =
                   `Error signing data with key: ${signature.message}`;
@@ -264604,16 +265018,42 @@ class Client extends EventEmitter {
           case 'password':
             proto.authPassword(username, curAuth.password);
             break;
-          case 'publickey':
-            proto.authPK(username, curAuth.key);
+          case 'publickey': {
+            let keyAlgo;
+            curAuth.keyAlgos = getKeyAlgos(this, curAuth.key, serverSigAlgs);
+            if (curAuth.keyAlgos) {
+              if (curAuth.keyAlgos.length) {
+                keyAlgo = curAuth.keyAlgos[0][0];
+              } else {
+                return skipAuth(
+                  'Skipping key authentication (no mutual hash algorithm)'
+                );
+              }
+            }
+            proto.authPK(username, curAuth.key, keyAlgo);
             break;
-          case 'hostbased':
+          }
+          case 'hostbased': {
+            let keyAlgo;
+            let hashAlgo;
+            curAuth.keyAlgos = getKeyAlgos(this, curAuth.key, serverSigAlgs);
+            if (curAuth.keyAlgos) {
+              if (curAuth.keyAlgos.length) {
+                [keyAlgo, hashAlgo] = curAuth.keyAlgos[0];
+              } else {
+                return skipAuth(
+                  'Skipping hostbased authentication (no mutual hash algorithm)'
+                );
+              }
+            }
+
             proto.authHostbased(username,
                                 curAuth.key,
                                 curAuth.localHostname,
                                 curAuth.localUsername,
+                                keyAlgo,
                                 (buf, cb) => {
-              const signature = curAuth.key.sign(buf);
+              const signature = curAuth.key.sign(buf, hashAlgo);
               if (signature instanceof Error) {
                 signature.message =
                   `Error while signing with key: ${signature.message}`;
@@ -264625,6 +265065,7 @@ class Client extends EventEmitter {
               cb(signature);
             });
             break;
+          }
           case 'agent':
             curAuth.agentCtx.init((err) => {
               if (err) {
@@ -264669,8 +265110,21 @@ class Client extends EventEmitter {
           tryNextAuth();
         } else {
           const pos = curAuth.agentCtx.pos();
+          let keyAlgo;
+          curAuth.keyAlgos = getKeyAlgos(this, key, serverSigAlgs);
+          if (curAuth.keyAlgos) {
+            if (curAuth.keyAlgos.length) {
+              keyAlgo = curAuth.keyAlgos[0][0];
+            } else {
+              debug && debug(
+                `Agent: Skipping key #${pos + 1} (no mutual hash algorithm)`
+              );
+              tryNextAgentKey();
+              return;
+            }
+          }
           debug && debug(`Agent: Trying key #${pos + 1}`);
-          proto.authPK(curAuth.username, key);
+          proto.authPK(curAuth.username, key, keyAlgo);
         }
       }
     };
@@ -264701,7 +265155,6 @@ class Client extends EventEmitter {
           localAddress: this.config.localAddress,
           localPort: this.config.localPort
         });
-        sock.setNoDelay(true);
         sock.setMaxListeners(0);
         sock.setTimeout(typeof cfg.timeout === 'number' ? cfg.timeout : 0);
       };
@@ -265181,6 +265634,13 @@ class Client extends EventEmitter {
 
     return this;
   }
+
+  setNoDelay(noDelay) {
+    if (this._sock && typeof this._sock.setNoDelay === 'function')
+      this._sock.setNoDelay(noDelay);
+
+    return this;
+  }
 }
 
 function openChannel(self, type, opts, cb) {
@@ -265678,6 +266138,27 @@ function hostKeysProve(client, keys_, cb) {
   );
 }
 
+function getKeyAlgos(client, key, serverSigAlgs) {
+  switch (key.type) {
+    case 'ssh-rsa':
+      if (client._protocol._compatFlags & COMPAT.IMPLY_RSA_SHA2_SIGALGS) {
+        if (!Array.isArray(serverSigAlgs))
+          serverSigAlgs = ['rsa-sha2-256', 'rsa-sha2-512'];
+        else
+          serverSigAlgs = ['rsa-sha2-256', 'rsa-sha2-512', ...serverSigAlgs];
+      }
+      if (Array.isArray(serverSigAlgs)) {
+        if (serverSigAlgs.indexOf('rsa-sha2-256') !== -1)
+          return [['rsa-sha2-256', 'sha256']];
+        if (serverSigAlgs.indexOf('rsa-sha2-512') !== -1)
+          return [['rsa-sha2-512', 'sha512']];
+        if (serverSigAlgs.indexOf('ssh-rsa') === -1)
+          return [];
+      }
+      return [['ssh-rsa', 'sha1']];
+  }
+}
+
 module.exports = Client;
 
 
@@ -265814,6 +266295,7 @@ module.exports = {
   Server: __webpack_require__(37465),
   utils: {
     parseKey,
+    ...__webpack_require__(88970),
     sftp: {
       flagsToString,
       OPEN_MODE,
@@ -265824,6 +266306,596 @@ module.exports = {
 };
 
 
+/***/ }),
+
+/***/ 88970:
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+"use strict";
+
+
+const {
+  createCipheriv,
+  generateKeyPair: generateKeyPair_,
+  generateKeyPairSync: generateKeyPairSync_,
+  getCurves,
+  randomBytes,
+} = __webpack_require__(6113);
+
+const { Ber } = __webpack_require__(90476);
+const bcrypt_pbkdf = __webpack_require__(62703).pbkdf;
+
+const { CIPHER_INFO } = __webpack_require__(83877);
+
+const SALT_LEN = 16;
+const DEFAULT_ROUNDS = 16;
+
+const curves = getCurves();
+const ciphers = new Map(Object.entries(CIPHER_INFO));
+
+function makeArgs(type, opts) {
+  if (typeof type !== 'string')
+    throw new TypeError('Key type must be a string');
+
+  const publicKeyEncoding = { type: 'spki', format: 'der' };
+  const privateKeyEncoding = { type: 'pkcs8', format: 'der' };
+
+  switch (type.toLowerCase()) {
+    case 'rsa': {
+      if (typeof opts !== 'object' || opts === null)
+        throw new TypeError('Missing options object for RSA key');
+      const modulusLength = opts.bits;
+      if (!Number.isInteger(modulusLength))
+        throw new TypeError('RSA bits must be an integer');
+      if (modulusLength <= 0 || modulusLength > 16384)
+        throw new RangeError('RSA bits must be non-zero and <= 16384');
+      return ['rsa', { modulusLength, publicKeyEncoding, privateKeyEncoding }];
+    }
+    case 'ecdsa': {
+      if (typeof opts !== 'object' || opts === null)
+        throw new TypeError('Missing options object for ECDSA key');
+      if (!Number.isInteger(opts.bits))
+        throw new TypeError('ECDSA bits must be an integer');
+      let namedCurve;
+      switch (opts.bits) {
+        case 256:
+          namedCurve = 'prime256v1';
+          break;
+        case 384:
+          namedCurve = 'secp384r1';
+          break;
+        case 521:
+          namedCurve = 'secp521r1';
+          break;
+        default:
+          throw new Error('ECDSA bits must be 256, 384, or 521');
+      }
+      if (!curves.includes(namedCurve))
+        throw new Error('Unsupported ECDSA bits value');
+      return ['ec', { namedCurve, publicKeyEncoding, privateKeyEncoding }];
+    }
+    case 'ed25519':
+      return ['ed25519', { publicKeyEncoding, privateKeyEncoding }];
+    default:
+      throw new Error(`Unsupported key type: ${type}`);
+  }
+}
+
+function parseDERs(keyType, pub, priv) {
+  switch (keyType) {
+    case 'rsa': {
+      // Note: we don't need to parse the public key since the PKCS8 private key
+      // already includes the public key parameters
+
+      // Parse private key
+      let reader = new Ber.Reader(priv);
+      reader.readSequence();
+
+      // - Version
+      if (reader.readInt() !== 0)
+        throw new Error('Unsupported version in RSA private key');
+
+      // - Algorithm
+      reader.readSequence();
+      if (reader.readOID() !== '1.2.840.113549.1.1.1')
+        throw new Error('Bad RSA private OID');
+      // - Algorithm parameters (RSA has none)
+      if (reader.readByte() !== Ber.Null)
+        throw new Error('Malformed RSA private key (expected null)');
+      if (reader.readByte() !== 0x00) {
+        throw new Error(
+          'Malformed RSA private key (expected zero-length null)'
+        );
+      }
+
+      reader = new Ber.Reader(reader.readString(Ber.OctetString, true));
+      reader.readSequence();
+      if (reader.readInt() !== 0)
+        throw new Error('Unsupported version in RSA private key');
+      const n = reader.readString(Ber.Integer, true);
+      const e = reader.readString(Ber.Integer, true);
+      const d = reader.readString(Ber.Integer, true);
+      const p = reader.readString(Ber.Integer, true);
+      const q = reader.readString(Ber.Integer, true);
+      reader.readString(Ber.Integer, true); // dmp1
+      reader.readString(Ber.Integer, true); // dmq1
+      const iqmp = reader.readString(Ber.Integer, true);
+
+      /*
+        OpenSSH RSA private key:
+          string  "ssh-rsa"
+          string  n -- public
+          string  e -- public
+          string  d -- private
+          string  iqmp -- private
+          string  p -- private
+          string  q -- private
+      */
+      const keyName = Buffer.from('ssh-rsa');
+      const privBuf = Buffer.allocUnsafe(
+        4 + keyName.length
+        + 4 + n.length
+        + 4 + e.length
+        + 4 + d.length
+        + 4 + iqmp.length
+        + 4 + p.length
+        + 4 + q.length
+      );
+      let pos = 0;
+
+      privBuf.writeUInt32BE(keyName.length, pos += 0);
+      privBuf.set(keyName, pos += 4);
+      privBuf.writeUInt32BE(n.length, pos += keyName.length);
+      privBuf.set(n, pos += 4);
+      privBuf.writeUInt32BE(e.length, pos += n.length);
+      privBuf.set(e, pos += 4);
+      privBuf.writeUInt32BE(d.length, pos += e.length);
+      privBuf.set(d, pos += 4);
+      privBuf.writeUInt32BE(iqmp.length, pos += d.length);
+      privBuf.set(iqmp, pos += 4);
+      privBuf.writeUInt32BE(p.length, pos += iqmp.length);
+      privBuf.set(p, pos += 4);
+      privBuf.writeUInt32BE(q.length, pos += p.length);
+      privBuf.set(q, pos += 4);
+
+      /*
+        OpenSSH RSA public key:
+          string  "ssh-rsa"
+          string  e -- public
+          string  n -- public
+      */
+      const pubBuf = Buffer.allocUnsafe(
+        4 + keyName.length
+        + 4 + e.length
+        + 4 + n.length
+      );
+      pos = 0;
+
+      pubBuf.writeUInt32BE(keyName.length, pos += 0);
+      pubBuf.set(keyName, pos += 4);
+      pubBuf.writeUInt32BE(e.length, pos += keyName.length);
+      pubBuf.set(e, pos += 4);
+      pubBuf.writeUInt32BE(n.length, pos += e.length);
+      pubBuf.set(n, pos += 4);
+
+      return { sshName: keyName.toString(), priv: privBuf, pub: pubBuf };
+    }
+    case 'ec': {
+      // Parse public key
+      let reader = new Ber.Reader(pub);
+      reader.readSequence();
+
+      reader.readSequence();
+      if (reader.readOID() !== '1.2.840.10045.2.1')
+        throw new Error('Bad ECDSA public OID');
+      // Skip curve OID, we'll get it from the private key
+      reader.readOID();
+      let pubBin = reader.readString(Ber.BitString, true);
+      {
+        // Remove leading zero bytes
+        let i = 0;
+        for (; i < pubBin.length && pubBin[i] === 0x00; ++i);
+        if (i > 0)
+          pubBin = pubBin.slice(i);
+      }
+
+      // Parse private key
+      reader = new Ber.Reader(priv);
+      reader.readSequence();
+
+      // - Version
+      if (reader.readInt() !== 0)
+        throw new Error('Unsupported version in ECDSA private key');
+
+      reader.readSequence();
+      if (reader.readOID() !== '1.2.840.10045.2.1')
+        throw new Error('Bad ECDSA private OID');
+      const curveOID = reader.readOID();
+      let sshCurveName;
+      switch (curveOID) {
+        case '1.2.840.10045.3.1.7':
+          // prime256v1/secp256r1
+          sshCurveName = 'nistp256';
+          break;
+        case '1.3.132.0.34':
+          // secp384r1
+          sshCurveName = 'nistp384';
+          break;
+        case '1.3.132.0.35':
+          // secp521r1
+          sshCurveName = 'nistp521';
+          break;
+        default:
+          throw new Error('Unsupported curve in ECDSA private key');
+      }
+
+      reader = new Ber.Reader(reader.readString(Ber.OctetString, true));
+      reader.readSequence();
+
+      // - Version
+      if (reader.readInt() !== 1)
+        throw new Error('Unsupported version in ECDSA private key');
+
+      // Add leading zero byte to prevent negative bignum in private key
+      const privBin = Buffer.concat([
+        Buffer.from([0x00]),
+        reader.readString(Ber.OctetString, true)
+      ]);
+
+      /*
+        OpenSSH ECDSA private key:
+          string  "ecdsa-sha2-<sshCurveName>"
+          string  curve name
+          string  Q -- public
+          string  d -- private
+      */
+      const keyName = Buffer.from(`ecdsa-sha2-${sshCurveName}`);
+      sshCurveName = Buffer.from(sshCurveName);
+      const privBuf = Buffer.allocUnsafe(
+        4 + keyName.length
+        + 4 + sshCurveName.length
+        + 4 + pubBin.length
+        + 4 + privBin.length
+      );
+      let pos = 0;
+
+      privBuf.writeUInt32BE(keyName.length, pos += 0);
+      privBuf.set(keyName, pos += 4);
+      privBuf.writeUInt32BE(sshCurveName.length, pos += keyName.length);
+      privBuf.set(sshCurveName, pos += 4);
+      privBuf.writeUInt32BE(pubBin.length, pos += sshCurveName.length);
+      privBuf.set(pubBin, pos += 4);
+      privBuf.writeUInt32BE(privBin.length, pos += pubBin.length);
+      privBuf.set(privBin, pos += 4);
+
+      /*
+        OpenSSH ECDSA public key:
+          string  "ecdsa-sha2-<sshCurveName>"
+          string  curve name
+          string  Q -- public
+      */
+      const pubBuf = Buffer.allocUnsafe(
+        4 + keyName.length
+        + 4 + sshCurveName.length
+        + 4 + pubBin.length
+      );
+      pos = 0;
+
+      pubBuf.writeUInt32BE(keyName.length, pos += 0);
+      pubBuf.set(keyName, pos += 4);
+      pubBuf.writeUInt32BE(sshCurveName.length, pos += keyName.length);
+      pubBuf.set(sshCurveName, pos += 4);
+      pubBuf.writeUInt32BE(pubBin.length, pos += sshCurveName.length);
+      pubBuf.set(pubBin, pos += 4);
+
+      return { sshName: keyName.toString(), priv: privBuf, pub: pubBuf };
+    }
+    case 'ed25519': {
+      // Parse public key
+      let reader = new Ber.Reader(pub);
+      reader.readSequence();
+
+      // - Algorithm
+      reader.readSequence();
+      if (reader.readOID() !== '1.3.101.112')
+        throw new Error('Bad ED25519 public OID');
+      // - Attributes (absent for ED25519)
+
+      let pubBin = reader.readString(Ber.BitString, true);
+      {
+        // Remove leading zero bytes
+        let i = 0;
+        for (; i < pubBin.length && pubBin[i] === 0x00; ++i);
+        if (i > 0)
+          pubBin = pubBin.slice(i);
+      }
+
+      // Parse private key
+      reader = new Ber.Reader(priv);
+      reader.readSequence();
+
+      // - Version
+      if (reader.readInt() !== 0)
+        throw new Error('Unsupported version in ED25519 private key');
+
+      // - Algorithm
+      reader.readSequence();
+      if (reader.readOID() !== '1.3.101.112')
+        throw new Error('Bad ED25519 private OID');
+      // - Attributes (absent)
+
+      reader = new Ber.Reader(reader.readString(Ber.OctetString, true));
+      const privBin = reader.readString(Ber.OctetString, true);
+
+      /*
+        OpenSSH ed25519 private key:
+          string  "ssh-ed25519"
+          string  public key
+          string  private key + public key
+      */
+      const keyName = Buffer.from('ssh-ed25519');
+      const privBuf = Buffer.allocUnsafe(
+        4 + keyName.length
+        + 4 + pubBin.length
+        + 4 + (privBin.length + pubBin.length)
+      );
+      let pos = 0;
+
+      privBuf.writeUInt32BE(keyName.length, pos += 0);
+      privBuf.set(keyName, pos += 4);
+      privBuf.writeUInt32BE(pubBin.length, pos += keyName.length);
+      privBuf.set(pubBin, pos += 4);
+      privBuf.writeUInt32BE(
+        privBin.length + pubBin.length,
+        pos += pubBin.length
+      );
+      privBuf.set(privBin, pos += 4);
+      privBuf.set(pubBin, pos += privBin.length);
+
+      /*
+        OpenSSH ed25519 public key:
+          string  "ssh-ed25519"
+          string  public key
+      */
+      const pubBuf = Buffer.allocUnsafe(
+        4 + keyName.length
+        + 4 + pubBin.length
+      );
+      pos = 0;
+
+      pubBuf.writeUInt32BE(keyName.length, pos += 0);
+      pubBuf.set(keyName, pos += 4);
+      pubBuf.writeUInt32BE(pubBin.length, pos += keyName.length);
+      pubBuf.set(pubBin, pos += 4);
+
+      return { sshName: keyName.toString(), priv: privBuf, pub: pubBuf };
+    }
+  }
+}
+
+function convertKeys(keyType, pub, priv, opts) {
+  let format = 'new';
+  let encrypted;
+  let comment = '';
+  if (typeof opts === 'object' && opts !== null) {
+    if (typeof opts.comment === 'string' && opts.comment)
+      comment = opts.comment;
+    if (typeof opts.format === 'string' && opts.format)
+      format = opts.format;
+    if (opts.passphrase) {
+      let passphrase;
+      if (typeof opts.passphrase === 'string')
+        passphrase = Buffer.from(opts.passphrase);
+      else if (Buffer.isBuffer(opts.passphrase))
+        passphrase = opts.passphrase;
+      else
+        throw new Error('Invalid passphrase');
+
+      if (opts.cipher === undefined)
+        throw new Error('Missing cipher name');
+      const cipher = ciphers.get(opts.cipher);
+      if (cipher === undefined)
+        throw new Error('Invalid cipher name');
+
+      if (format === 'new') {
+        let rounds = DEFAULT_ROUNDS;
+        if (opts.rounds !== undefined) {
+          if (!Number.isInteger(opts.rounds))
+            throw new TypeError('rounds must be an integer');
+          if (opts.rounds > 0)
+            rounds = opts.rounds;
+        }
+
+        const gen = Buffer.allocUnsafe(cipher.keyLen + cipher.ivLen);
+        const salt = randomBytes(SALT_LEN);
+        const r = bcrypt_pbkdf(
+          passphrase,
+          passphrase.length,
+          salt,
+          salt.length,
+          gen,
+          gen.length,
+          rounds
+        );
+        if (r !== 0)
+          return new Error('Failed to generate information to encrypt key');
+
+        /*
+          string salt
+          uint32 rounds
+        */
+        const kdfOptions = Buffer.allocUnsafe(4 + salt.length + 4);
+        {
+          let pos = 0;
+          kdfOptions.writeUInt32BE(salt.length, pos += 0);
+          kdfOptions.set(salt, pos += 4);
+          kdfOptions.writeUInt32BE(rounds, pos += salt.length);
+        }
+
+        encrypted = {
+          cipher,
+          cipherName: opts.cipher,
+          kdfName: 'bcrypt',
+          kdfOptions,
+          key: gen.slice(0, cipher.keyLen),
+          iv: gen.slice(cipher.keyLen),
+        };
+      }
+    }
+  }
+
+  switch (format) {
+    case 'new': {
+      let privateB64 = '-----BEGIN OPENSSH PRIVATE KEY-----\n';
+      let publicB64;
+      /*
+        byte[]  "openssh-key-v1\0"
+        string  ciphername
+        string  kdfname
+        string  kdfoptions
+        uint32  number of keys N
+        string  publickey1
+        string  encrypted, padded list of private keys
+          uint32  checkint
+          uint32  checkint
+          byte[]  privatekey1
+          string  comment1
+          byte  1
+          byte  2
+          byte  3
+          ...
+          byte  padlen % 255
+      */
+      const cipherName = Buffer.from(encrypted ? encrypted.cipherName : 'none');
+      const kdfName = Buffer.from(encrypted ? encrypted.kdfName : 'none');
+      const kdfOptions = (encrypted ? encrypted.kdfOptions : Buffer.alloc(0));
+      const blockLen = (encrypted ? encrypted.cipher.blockLen : 8);
+
+      const parsed = parseDERs(keyType, pub, priv);
+
+      const checkInt = randomBytes(4);
+      const commentBin = Buffer.from(comment);
+      const privBlobLen = (4 + 4 + parsed.priv.length + 4 + commentBin.length);
+      let padding = [];
+      for (let i = 1; ((privBlobLen + padding.length) % blockLen); ++i)
+        padding.push(i & 0xFF);
+      padding = Buffer.from(padding);
+
+      let privBlob = Buffer.allocUnsafe(privBlobLen + padding.length);
+      let extra;
+      {
+        let pos = 0;
+        privBlob.set(checkInt, pos += 0);
+        privBlob.set(checkInt, pos += 4);
+        privBlob.set(parsed.priv, pos += 4);
+        privBlob.writeUInt32BE(commentBin.length, pos += parsed.priv.length);
+        privBlob.set(commentBin, pos += 4);
+        privBlob.set(padding, pos += commentBin.length);
+      }
+
+      if (encrypted) {
+        const options = { authTagLength: encrypted.cipher.authLen };
+        const cipher = createCipheriv(
+          encrypted.cipher.sslName,
+          encrypted.key,
+          encrypted.iv,
+          options
+        );
+        cipher.setAutoPadding(false);
+        privBlob = Buffer.concat([ cipher.update(privBlob), cipher.final() ]);
+        if (encrypted.cipher.authLen > 0)
+          extra = cipher.getAuthTag();
+        else
+          extra = Buffer.alloc(0);
+        encrypted.key.fill(0);
+        encrypted.iv.fill(0);
+      } else {
+        extra = Buffer.alloc(0);
+      }
+
+      const magicBytes = Buffer.from('openssh-key-v1\0');
+      const privBin = Buffer.allocUnsafe(
+        magicBytes.length
+          + 4 + cipherName.length
+          + 4 + kdfName.length
+          + 4 + kdfOptions.length
+          + 4
+          + 4 + parsed.pub.length
+          + 4 + privBlob.length
+          + extra.length
+      );
+      {
+        let pos = 0;
+        privBin.set(magicBytes, pos += 0);
+        privBin.writeUInt32BE(cipherName.length, pos += magicBytes.length);
+        privBin.set(cipherName, pos += 4);
+        privBin.writeUInt32BE(kdfName.length, pos += cipherName.length);
+        privBin.set(kdfName, pos += 4);
+        privBin.writeUInt32BE(kdfOptions.length, pos += kdfName.length);
+        privBin.set(kdfOptions, pos += 4);
+        privBin.writeUInt32BE(1, pos += kdfOptions.length);
+        privBin.writeUInt32BE(parsed.pub.length, pos += 4);
+        privBin.set(parsed.pub, pos += 4);
+        privBin.writeUInt32BE(privBlob.length, pos += parsed.pub.length);
+        privBin.set(privBlob, pos += 4);
+        privBin.set(extra, pos += privBlob.length);
+      }
+
+      {
+        const b64 = privBin.base64Slice(0, privBin.length);
+        let formatted = b64.replace(/.{64}/g, '$&\n');
+        if (b64.length & 63)
+          formatted += '\n';
+        privateB64 += formatted;
+      }
+
+      {
+        const b64 = parsed.pub.base64Slice(0, parsed.pub.length);
+        publicB64 = `${parsed.sshName} ${b64}${comment ? ` ${comment}` : ''}`;
+      }
+
+      privateB64 += '-----END OPENSSH PRIVATE KEY-----\n';
+      return {
+        private: privateB64,
+        public: publicB64,
+      };
+    }
+    default:
+      throw new Error('Invalid output key format');
+  }
+}
+
+function noop() {}
+
+module.exports = {
+  generateKeyPair: (keyType, opts, cb) => {
+    if (typeof opts === 'function') {
+      cb = opts;
+      opts = undefined;
+    }
+    if (typeof cb !== 'function')
+      cb = noop;
+    const args = makeArgs(keyType, opts);
+    generateKeyPair_(...args, (err, pub, priv) => {
+      if (err)
+        return cb(err);
+      let ret;
+      try {
+        ret = convertKeys(args[0], pub, priv, opts);
+      } catch (ex) {
+        return cb(ex);
+      }
+      cb(null, ret);
+    });
+  },
+  generateKeyPairSync: (keyType, opts) => {
+    const args = makeArgs(keyType, opts);
+    const { publicKey: pub, privateKey: priv } = generateKeyPairSync_(...args);
+    return convertKeys(args[0], pub, priv, opts);
+  }
+};
+
+
 /***/ }),
 
 /***/ 53603:
@@ -265876,12 +266948,14 @@ const { bindingAvailable, NullCipher, NullDecipher } = __webpack_require__(83877
 const {
   COMPAT_CHECKS,
   DISCONNECT_REASON,
+  eddsaSupported,
   MESSAGE,
   SIGNALS,
   TERMINAL_MODE,
 } = __webpack_require__(3190);
 const {
-  DEFAULT_KEXINIT,
+  DEFAULT_KEXINIT_CLIENT,
+  DEFAULT_KEXINIT_SERVER,
   KexInit,
   kexinit,
   onKEXPayload,
@@ -265970,8 +267044,13 @@ class Protocol {
     let onHandshakeComplete = config.onHandshakeComplete;
     if (typeof onHandshakeComplete !== 'function')
       onHandshakeComplete = noop;
+    let firstHandshake;
     this._onHandshakeComplete = (...args) => {
       this._debug && this._debug('Handshake completed');
+      if (firstHandshake === undefined)
+        firstHandshake = true;
+      else
+        firstHandshake = false;
 
       // Process packets queued during a rekey where necessary
       const oldQueue = this._queue;
@@ -265997,6 +267076,9 @@ class Protocol {
         this._debug && this._debug('... finished draining outbound queue');
       }
 
+      if (firstHandshake && this._server && this._kex.remoteExtInfoEnabled)
+        sendExtInfo(this);
+
       onHandshakeComplete(...args);
     };
     this._queue = undefined;
@@ -266037,10 +267119,13 @@ class Protocol {
     }
 
     let offer = config.offer;
-    if (typeof offer !== 'object' || offer === null)
-      offer = DEFAULT_KEXINIT;
-    else if (offer.constructor !== KexInit)
+    if (typeof offer !== 'object' || offer === null) {
+      offer = (this._server ? DEFAULT_KEXINIT_SERVER : DEFAULT_KEXINIT_CLIENT);
+    } else if (offer.constructor !== KexInit) {
+      if (!this._server)
+        offer.kex = offer.kex.concat(['ext-info-c']);
       offer = new KexInit(offer);
+    }
     this._kex = undefined;
     this._kexinit = undefined;
     this._offer = offer;
@@ -266440,7 +267525,7 @@ class Protocol {
 
     sendPacket(this, this._packetRW.write.finalize(packet));
   }
-  authPK(username, pubKey, cbSign) {
+  authPK(username, pubKey, keyAlgo, cbSign) {
     if (this._server)
       throw new Error('Client-only method called in server mode');
 
@@ -266451,8 +267536,15 @@ class Protocol {
     const keyType = pubKey.type;
     pubKey = pubKey.getPublicSSH();
 
+    if (typeof keyAlgo === 'function') {
+      cbSign = keyAlgo;
+      keyAlgo = undefined;
+    }
+    if (!keyAlgo)
+      keyAlgo = keyType;
+
     const userLen = Buffer.byteLength(username);
-    const algoLen = Buffer.byteLength(keyType);
+    const algoLen = Buffer.byteLength(keyAlgo);
     const pubKeyLen = pubKey.length;
     const sessionID = this._kex.sessionID;
     const sesLen = sessionID.length;
@@ -266486,7 +267578,7 @@ class Protocol {
     packet[p += 9] = (cbSign ? 1 : 0);
 
     writeUInt32BE(packet, algoLen, ++p);
-    packet.utf8Write(keyType, p += 4, algoLen);
+    packet.utf8Write(keyAlgo, p += 4, algoLen);
 
     writeUInt32BE(packet, pubKeyLen, p += algoLen);
     packet.set(pubKey, p += 4);
@@ -266529,7 +267621,7 @@ class Protocol {
       packet[p += 9] = 1;
 
       writeUInt32BE(packet, algoLen, ++p);
-      packet.utf8Write(keyType, p += 4, algoLen);
+      packet.utf8Write(keyAlgo, p += 4, algoLen);
 
       writeUInt32BE(packet, pubKeyLen, p += algoLen);
       packet.set(pubKey, p += 4);
@@ -266537,7 +267629,7 @@ class Protocol {
       writeUInt32BE(packet, 4 + algoLen + 4 + sigLen, p += pubKeyLen);
 
       writeUInt32BE(packet, algoLen, p += 4);
-      packet.utf8Write(keyType, p += 4, algoLen);
+      packet.utf8Write(keyAlgo, p += 4, algoLen);
 
       writeUInt32BE(packet, sigLen, p += algoLen);
       packet.set(signature, p += 4);
@@ -266552,7 +267644,7 @@ class Protocol {
       sendPacket(this, this._packetRW.write.finalize(packet));
     });
   }
-  authHostbased(username, pubKey, hostname, userlocal, cbSign) {
+  authHostbased(username, pubKey, hostname, userlocal, keyAlgo, cbSign) {
     // TODO: Make DRY by sharing similar code with authPK()
     if (this._server)
       throw new Error('Client-only method called in server mode');
@@ -266564,8 +267656,15 @@ class Protocol {
     const keyType = pubKey.type;
     pubKey = pubKey.getPublicSSH();
 
+    if (typeof keyAlgo === 'function') {
+      cbSign = keyAlgo;
+      keyAlgo = undefined;
+    }
+    if (!keyAlgo)
+      keyAlgo = keyType;
+
     const userLen = Buffer.byteLength(username);
-    const algoLen = Buffer.byteLength(keyType);
+    const algoLen = Buffer.byteLength(keyAlgo);
     const pubKeyLen = pubKey.length;
     const sessionID = this._kex.sessionID;
     const sesLen = sessionID.length;
@@ -266592,7 +267691,7 @@ class Protocol {
     data.utf8Write('hostbased', p += 4, 9);
 
     writeUInt32BE(data, algoLen, p += 9);
-    data.utf8Write(keyType, p += 4, algoLen);
+    data.utf8Write(keyAlgo, p += 4, algoLen);
 
     writeUInt32BE(data, pubKeyLen, p += algoLen);
     data.set(pubKey, p += 4);
@@ -266619,7 +267718,7 @@ class Protocol {
 
       writeUInt32BE(packet, 4 + algoLen + 4 + sigLen, p += reqDataLen);
       writeUInt32BE(packet, algoLen, p += 4);
-      packet.utf8Write(keyType, p += 4, algoLen);
+      packet.utf8Write(keyAlgo, p += 4, algoLen);
       writeUInt32BE(packet, sigLen, p += algoLen);
       packet.set(signature, p += 4);
 
@@ -267906,6 +269005,31 @@ function modesToBytes(modes) {
   return bytes;
 }
 
+function sendExtInfo(proto) {
+  let serverSigAlgs =
+    'ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521'
+      + 'rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss';
+  if (eddsaSupported)
+    serverSigAlgs = `ssh-ed25519,${serverSigAlgs}`;
+  const algsLen = Buffer.byteLength(serverSigAlgs);
+
+  let p = proto._packetRW.write.allocStart;
+  const packet = proto._packetRW.write.alloc(1 + 4 + 4 + 15 + 4 + algsLen);
+
+  packet[p] = MESSAGE.EXT_INFO;
+
+  writeUInt32BE(packet, 1, ++p);
+
+  writeUInt32BE(packet, 15, p += 4);
+  packet.utf8Write('server-sig-algs', p += 4, 15);
+
+  writeUInt32BE(packet, algsLen, p += 15);
+  packet.utf8Write(serverSigAlgs, p += 4, algsLen);
+
+  proto._debug && proto._debug('Outbound: Sending EXT_INFO');
+  sendPacket(proto, proto._packetRW.write.finalize(packet));
+}
+
 module.exports = Protocol;
 
 
@@ -269505,7 +270629,17 @@ class SFTP extends EventEmitter {
     writeUInt32BE(buf, pathLen, p += 20);
     buf.utf8Write(path, p += 4, pathLen);
 
-    this._requests[reqid] = { cb };
+    this._requests[reqid] = {
+      cb: (err, names) => {
+        if (typeof cb !== 'function')
+          return;
+        if (err)
+          return cb(err);
+        if (!names || !names.length)
+          return cb(new Error('Response missing expanded path'));
+        cb(undefined, names[0].filename);
+      }
+    };
 
     const isBuffered = sendOrBuffer(this, buf);
     if (this._debug) {
@@ -269598,6 +270732,146 @@ class SFTP extends EventEmitter {
       this._debug(`SFTP: Outbound: ${status} copy-data`);
     }
   }
+  ext_home_dir(username, cb) {
+    if (this.server)
+      throw new Error('Client-only method called in server mode');
+
+    const ext = this._extensions['home-directory'];
+    if (ext !== '1')
+      throw new Error('Server does not support this extended request');
+
+    if (typeof username !== 'string')
+      throw new TypeError('username is not a string');
+
+    /*
+      uint32    id
+      string    "home-directory"
+      string    username
+    */
+    let p = 0;
+    const usernameLen = Buffer.byteLength(username);
+    const buf = Buffer.allocUnsafe(
+      4 + 1
+      + 4
+      + 4 + 14
+      + 4 + usernameLen
+    );
+
+    writeUInt32BE(buf, buf.length - 4, p);
+    p += 4;
+
+    buf[p] = REQUEST.EXTENDED;
+    ++p;
+
+    const reqid = this._writeReqid = (this._writeReqid + 1) & MAX_REQID;
+    writeUInt32BE(buf, reqid, p);
+    p += 4;
+
+    writeUInt32BE(buf, 14, p);
+    p += 4;
+    buf.utf8Write('home-directory', p, 14);
+    p += 14;
+
+    writeUInt32BE(buf, usernameLen, p);
+    p += 4;
+    buf.utf8Write(username, p, usernameLen);
+    p += usernameLen;
+
+    this._requests[reqid] = {
+      cb: (err, names) => {
+        if (typeof cb !== 'function')
+          return;
+        if (err)
+          return cb(err);
+        if (!names || !names.length)
+          return cb(new Error('Response missing home directory'));
+        cb(undefined, names[0].filename);
+      }
+    };
+
+    const isBuffered = sendOrBuffer(this, buf);
+    if (this._debug) {
+      const status = (isBuffered ? 'Buffered' : 'Sending');
+      this._debug(`SFTP: Outbound: ${status} home-directory`);
+    }
+  }
+  ext_users_groups(uids, gids, cb) {
+    if (this.server)
+      throw new Error('Client-only method called in server mode');
+
+    const ext = this._extensions['users-groups-by-id@openssh.com'];
+    if (ext !== '1')
+      throw new Error('Server does not support this extended request');
+
+    if (!Array.isArray(uids))
+      throw new TypeError('uids is not an array');
+    for (const val of uids) {
+      if (!Number.isInteger(val) || val < 0 || val > (2 ** 32 - 1))
+        throw new Error('uid values must all be 32-bit unsigned integers');
+    }
+    if (!Array.isArray(gids))
+      throw new TypeError('gids is not an array');
+    for (const val of gids) {
+      if (!Number.isInteger(val) || val < 0 || val > (2 ** 32 - 1))
+        throw new Error('gid values must all be 32-bit unsigned integers');
+    }
+
+    /*
+      uint32    id
+      string    "users-groups-by-id@openssh.com"
+      string    uids
+        uint32    uid1
+        ...
+      string    gids
+        uint32    gid1
+        ...
+    */
+    let p = 0;
+    const buf = Buffer.allocUnsafe(
+      4 + 1
+      + 4
+      + 4 + 30
+      + 4 + (4 * uids.length)
+      + 4 + (4 * gids.length)
+    );
+
+    writeUInt32BE(buf, buf.length - 4, p);
+    p += 4;
+
+    buf[p] = REQUEST.EXTENDED;
+    ++p;
+
+    const reqid = this._writeReqid = (this._writeReqid + 1) & MAX_REQID;
+    writeUInt32BE(buf, reqid, p);
+    p += 4;
+
+    writeUInt32BE(buf, 30, p);
+    p += 4;
+    buf.utf8Write('users-groups-by-id@openssh.com', p, 30);
+    p += 30;
+
+    writeUInt32BE(buf, 4 * uids.length, p);
+    p += 4;
+    for (const val of uids) {
+      writeUInt32BE(buf, val, p);
+      p += 4;
+    }
+
+    writeUInt32BE(buf, 4 * gids.length, p);
+    p += 4;
+    for (const val of gids) {
+      writeUInt32BE(buf, val, p);
+      p += 4;
+    }
+
+    this._requests[reqid] = { extended: 'users-groups-by-id@openssh.com', cb };
+
+    const isBuffered = sendOrBuffer(this, buf);
+    if (this._debug) {
+      const status = (isBuffered ? 'Buffered' : 'Sending');
+      this._debug(`SFTP: Outbound: ${status} users-groups-by-id@openssh.com`);
+    }
+  }
   // ===========================================================================
   // Server-specific ===========================================================
   // ===========================================================================
@@ -270845,6 +272119,44 @@ const CLIENT_HANDLERS = {
               req.cb(undefined, limits);
             return;
           }
+          case 'users-groups-by-id@openssh.com': {
+            /*
+              string    usernames
+                string    username1
+                ...
+              string    groupnames
+                string    groupname1
+                ...
+            */
+            const usernameCount = bufferParser.readUInt32BE();
+            if (usernameCount === undefined)
+              break;
+            const usernames = new Array(usernameCount);
+            for (let i = 0; i < usernames.length; ++i)
+              usernames[i] = bufferParser.readString(true);
+
+            const groupnameCount = bufferParser.readUInt32BE();
+            if (groupnameCount === undefined)
+              break;
+            const groupnames = new Array(groupnameCount);
+            for (let i = 0; i < groupnames.length; ++i)
+              groupnames[i] = bufferParser.readString(true);
+            if (groupnames.length > 0
+                && groupnames[groupnames.length - 1] === undefined) {
+              break;
+            }
+
+            if (sftp._debug) {
+              sftp._debug(
+                'SFTP: Inbound: Received EXTENDED_REPLY '
+                  + `(id:${reqID}, ${req.extended})`
+              );
+            }
+            bufferParser.clear();
+            if (typeof req.cb === 'function')
+              req.cb(undefined, usernames, groupnames);
+            return;
+          }
           default:
             // Unknown extended request
             sftp._debug && sftp._debug(
@@ -271948,6 +273260,7 @@ const COMPAT = {
   OLD_EXIT: 1 << 1,
   DYN_RPORT_BUG: 1 << 2,
   BUG_DHGEX_LARGE: 1 << 3,
+  IMPLY_RSA_SHA2_SIGALGS: 1 << 4,
 };
 
 module.exports = {
@@ -271959,6 +273272,7 @@ module.exports = {
     DEBUG: 4,
     SERVICE_REQUEST: 5,
     SERVICE_ACCEPT: 6,
+    EXT_INFO: 7, // RFC 8308
 
     // Transport layer protocol -- algorithm negotiation (20-29)
     KEXINIT: 20,
@@ -272116,9 +273430,10 @@ module.exports = {
   COMPAT,
   COMPAT_CHECKS: [
     [ 'Cisco-1.25', COMPAT.BAD_DHGEX ],
-    [ /^Cisco-1\./, COMPAT.BUG_DHGEX_LARGE ],
+    [ /^Cisco-1[.]/, COMPAT.BUG_DHGEX_LARGE ],
     [ /^[0-9.]+$/, COMPAT.OLD_EXIT ], // old SSH.com implementations
-    [ /^OpenSSH_5\.\d+/, COMPAT.DYN_RPORT_BUG ],
+    [ /^OpenSSH_5[.][0-9]+/, COMPAT.DYN_RPORT_BUG ],
+    [ /^OpenSSH_7[.]4/, COMPAT.IMPLY_RSA_SHA2_SIGALGS ],
   ],
 
   // KEX proposal-related
@@ -273977,6 +275292,48 @@ module.exports = {
     const handler = self._handlers.SERVICE_ACCEPT;
     handler && handler(self, name);
   },
+  [MESSAGE.EXT_INFO]: (self, payload) => {
+    /*
+      byte       SSH_MSG_EXT_INFO
+      uint32     nr-extensions
+      repeat the following 2 fields "nr-extensions" times:
+        string   extension-name
+        string   extension-value (binary)
+    */
+    bufferParser.init(payload, 1);
+    const numExts = bufferParser.readUInt32BE();
+    let exts;
+    if (numExts !== undefined) {
+      exts = [];
+      for (let i = 0; i < numExts; ++i) {
+        const name = bufferParser.readString(true);
+        const data = bufferParser.readString();
+        if (data !== undefined) {
+          switch (name) {
+            case 'server-sig-algs': {
+              const algs = data.latin1Slice(0, data.length).split(',');
+              exts.push({ name, algs });
+              continue;
+            }
+            default:
+              continue;
+          }
+        }
+        // Malformed
+        exts = undefined;
+        break;
+      }
+    }
+    bufferParser.clear();
+
+    if (exts === undefined)
+      return doFatalError(self, 'Inbound: Malformed EXT_INFO packet');
+
+    self._debug && self._debug('Inbound: Received EXT_INFO');
+
+    const handler = self._handlers.EXT_INFO;
+    handler && handler(self, exts);
+  },
 
   // User auth protocol -- generic =============================================
   [MESSAGE.USERAUTH_REQUEST]: (self, payload) => {
@@ -274026,7 +275383,21 @@ module.exports = {
         const hasSig = bufferParser.readBool();
         if (hasSig !== undefined) {
           const keyAlgo = bufferParser.readString(true);
+          let realKeyAlgo = keyAlgo;
           const key = bufferParser.readString();
+
+          let hashAlgo;
+          switch (keyAlgo) {
+            case 'rsa-sha2-256':
+              realKeyAlgo = 'ssh-rsa';
+              hashAlgo = 'sha256';
+              break;
+            case 'rsa-sha2-512':
+              realKeyAlgo = 'ssh-rsa';
+              hashAlgo = 'sha512';
+              break;
+          }
+
           if (hasSig) {
             const blobEnd = bufferParser.pos();
             let signature = bufferParser.readString();
@@ -274037,7 +275408,7 @@ module.exports = {
                 signature = bufferSlice(signature, 4 + keyAlgo.length + 4);
               }
 
-              signature = sigSSHToASN1(signature, keyAlgo);
+              signature = sigSSHToASN1(signature, realKeyAlgo);
               if (signature) {
                 const sessionID = self._kex.sessionID;
                 const blob = Buffer.allocUnsafe(4 + sessionID.length + blobEnd);
@@ -274048,15 +275419,16 @@ module.exports = {
                   4 + sessionID.length
                 );
                 methodData = {
-                  keyAlgo,
+                  keyAlgo: realKeyAlgo,
                   key,
                   signature,
                   blob,
+                  hashAlgo,
                 };
               }
             }
           } else {
-            methodData = { keyAlgo, key };
+            methodData = { keyAlgo: realKeyAlgo, key, hashAlgo };
             methodDesc = 'publickey -- check';
           }
         }
@@ -274072,10 +275444,23 @@ module.exports = {
           string    signature
         */
         const keyAlgo = bufferParser.readString(true);
+        let realKeyAlgo = keyAlgo;
         const key = bufferParser.readString();
         const localHostname = bufferParser.readString(true);
         const localUsername = bufferParser.readString(true);
 
+        let hashAlgo;
+        switch (keyAlgo) {
+          case 'rsa-sha2-256':
+            realKeyAlgo = 'ssh-rsa';
+            hashAlgo = 'sha256';
+            break;
+          case 'rsa-sha2-512':
+            realKeyAlgo = 'ssh-rsa';
+            hashAlgo = 'sha512';
+            break;
+        }
+
         const blobEnd = bufferParser.pos();
         let signature = bufferParser.readString();
         if (signature !== undefined) {
@@ -274085,7 +275470,7 @@ module.exports = {
             signature = bufferSlice(signature, 4 + keyAlgo.length + 4);
           }
 
-          signature = sigSSHToASN1(signature, keyAlgo);
+          signature = sigSSHToASN1(signature, realKeyAlgo);
           if (signature !== undefined) {
             const sessionID = self._kex.sessionID;
             const blob = Buffer.allocUnsafe(4 + sessionID.length + blobEnd);
@@ -274096,12 +275481,13 @@ module.exports = {
               4 + sessionID.length
             );
             methodData = {
-              keyAlgo,
+              keyAlgo: realKeyAlgo,
               key,
               signature,
               blob,
               localHostname,
               localUsername,
+              hashAlgo
             };
           }
         }
@@ -275275,12 +276661,15 @@ function handleKexInit(self, payload) {
   // Key exchange method =======================================================
   debug && debug(`Handshake: (local) KEX method: ${localKex}`);
   debug && debug(`Handshake: (remote) KEX method: ${remote.kex}`);
+  let remoteExtInfoEnabled;
   if (self._server) {
     serverList = localKex;
     clientList = remote.kex;
+    remoteExtInfoEnabled = (clientList.indexOf('ext-info-c') !== -1);
   } else {
     serverList = remote.kex;
     clientList = localKex;
+    remoteExtInfoEnabled = (serverList.indexOf('ext-info-s') !== -1);
   }
   // Check for agreeable key exchange algorithm
   for (i = 0;
@@ -275532,6 +276921,7 @@ function handleKexInit(self, payload) {
   }
 
   self._kex = createKeyExchange(init, self, payload);
+  self._kex.remoteExtInfoEnabled = remoteExtInfoEnabled;
   self._kex.start();
 }
 
@@ -275563,6 +276953,7 @@ const createKeyExchange = (() => {
 
       this.sessionID = (protocol._kex ? protocol._kex.sessionID : undefined);
       this.negotiated = negotiated;
+      this.remoteExtInfoEnabled = false;
       this._step = 1;
       this._public = null;
       this._dh = null;
@@ -275580,7 +276971,7 @@ const createKeyExchange = (() => {
       this._dhData = undefined;
       this._sig = undefined;
     }
-    finish() {
+    finish(scOnly) {
       if (this._finished)
         return false;
       this._finished = true;
@@ -275831,9 +277222,26 @@ const createKeyExchange = (() => {
           this._protocol._packetRW.write.finalize(packet, true)
         );
       }
-      trySendNEWKEYS(this);
 
-      const completeHandshake = () => {
+      if (isServer || !scOnly)
+        trySendNEWKEYS(this);
+
+      let hsCipherConfig;
+      let hsWrite;
+      const completeHandshake = (partial) => {
+        if (hsCipherConfig) {
+          trySendNEWKEYS(this);
+          hsCipherConfig.outbound.seqno = this._protocol._cipher.outSeqno;
+          this._protocol._cipher.free();
+          this._protocol._cipher = createCipher(hsCipherConfig);
+          this._protocol._packetRW.write = hsWrite;
+          hsCipherConfig = undefined;
+          hsWrite = undefined;
+          this._protocol._onHandshakeComplete(negotiated);
+
+          return false;
+        }
+
         if (!this.sessionID)
           this.sessionID = exchangeHash;
 
@@ -275916,9 +277324,8 @@ const createKeyExchange = (() => {
             macKey: (isServer ? scMacKey : csMacKey),
           },
         };
-        this._protocol._cipher && this._protocol._cipher.free();
-        this._protocol._decipher && this._protocol._decipher.free();
-        this._protocol._cipher = createCipher(config);
+        this._protocol._decipher.free();
+        hsCipherConfig = config;
         this._protocol._decipher = createDecipher(config);
 
         const rw = {
@@ -275985,7 +277392,8 @@ const createKeyExchange = (() => {
         }
         this._protocol._packetRW.read.cleanup();
         this._protocol._packetRW.write.cleanup();
-        this._protocol._packetRW = rw;
+        this._protocol._packetRW.read = rw.read;
+        hsWrite = rw.write;
 
         // Cleanup/reset various state
         this._public = null;
@@ -275998,13 +277406,16 @@ const createKeyExchange = (() => {
         this._dhData = undefined;
         this._sig = undefined;
 
-        this._protocol._onHandshakeComplete(negotiated);
-
+        if (!partial)
+          return completeHandshake();
         return false;
       };
+
+      if (isServer || scOnly)
+        this.finish = completeHandshake;
+
       if (!isServer)
-        return completeHandshake();
-      this.finish = completeHandshake;
+        return completeHandshake(scOnly);
     }
 
     start() {
@@ -276265,12 +277676,8 @@ const createKeyExchange = (() => {
           );
           this._receivedNEWKEYS = true;
           ++this._step;
-          if (this._protocol._server || this._hostVerified)
-            return this.finish();
 
-          // Signal to current decipher that we need to change to a new decipher
-          // for the next packet
-          return false;
+          return this.finish(!this._protocol._server && !this._hostVerified);
         default:
           return doFatalError(
             this._protocol,
@@ -276431,7 +277838,7 @@ const createKeyExchange = (() => {
     parse(payload) {
       const type = payload[0];
       switch (this._step) {
-        case 1:
+        case 1: {
           if (this._protocol._server) {
             if (type !== MESSAGE.KEXDH_GEX_REQUEST) {
               return doFatalError(
@@ -276506,6 +277913,7 @@ const createKeyExchange = (() => {
 
           ++this._step;
           break;
+        }
         case 2:
           if (this._protocol._server) {
             if (type !== MESSAGE.KEXDH_GEX_INIT) {
@@ -276862,7 +278270,23 @@ module.exports = {
   KexInit,
   kexinit,
   onKEXPayload,
-  DEFAULT_KEXINIT: new KexInit({
+  DEFAULT_KEXINIT_CLIENT: new KexInit({
+    kex: DEFAULT_KEX.concat(['ext-info-c']),
+    serverHostKey: DEFAULT_SERVER_HOST_KEY,
+    cs: {
+      cipher: DEFAULT_CIPHER,
+      mac: DEFAULT_MAC,
+      compress: DEFAULT_COMPRESSION,
+      lang: [],
+    },
+    sc: {
+      cipher: DEFAULT_CIPHER,
+      mac: DEFAULT_MAC,
+      compress: DEFAULT_COMPRESSION,
+      lang: [],
+    },
+  }),
+  DEFAULT_KEXINIT_SERVER: new KexInit({
     kex: DEFAULT_KEX,
     serverHostKey: DEFAULT_SERVER_HOST_KEY,
     cs: {
@@ -277404,7 +278828,7 @@ OpenSSH_Private.prototype = BaseKey;
       switch (kdfName) {
         case 'none':
           return new Error('Malformed OpenSSH private key');
-        case 'bcrypt':
+        case 'bcrypt': {
           /*
             string salt
             uint32 rounds
@@ -277426,6 +278850,7 @@ OpenSSH_Private.prototype = BaseKey;
           cipherKey = bufferSlice(gen, 0, encInfo.keyLen);
           cipherIV = bufferSlice(gen, encInfo.keyLen, gen.length);
           break;
+        }
       }
     } else if (kdfName !== 'none') {
       return new Error('Malformed OpenSSH private key');
@@ -277465,6 +278890,7 @@ OpenSSH_Private.prototype = BaseKey;
                                             cipherKey,
                                             cipherIV,
                                             options);
+          decipher.setAutoPadding(false);
           if (encInfo.authLen > 0) {
             if (data.length - data._pos < encInfo.authLen)
               return new Error('Malformed OpenSSH private key');
@@ -277824,7 +279250,7 @@ OpenSSH_Old_Private.prototype = BaseKey;
         }
         algo = 'sha1';
         break;
-      case 'EC':
+      case 'EC': {
         let ecSSLName;
         let ecPriv;
         let ecOID;
@@ -277873,6 +279299,7 @@ OpenSSH_Old_Private.prototype = BaseKey;
         pubPEM = genOpenSSLECDSAPub(ecOID, pubBlob);
         pubSSH = genOpenSSHECDSAPub(ecOID, pubBlob);
         break;
+      }
     }
 
     return new OpenSSH_Old_Private(type, '', privPEM, pubPEM, pubSSH, algo,
@@ -277948,9 +279375,7 @@ PPK_Private.prototype = BaseKey;
       if (cipherKey.length > encInfo.keyLen)
         cipherKey = bufferSlice(cipherKey, 0, encInfo.keyLen);
       try {
-        const decipher = createDecipheriv(encInfo.sslName,
-                                        cipherKey,
-                                        PPK_IV);
+        const decipher = createDecipheriv(encInfo.sslName, cipherKey, PPK_IV);
         decipher.setAutoPadding(false);
         privBlob = combineBuffers(decipher.update(privBlob),
                                   decipher.final());
@@ -279269,6 +280694,7 @@ class PKAuthContext extends AuthContext {
     super(protocol, username, service, method, cb);
 
     this.key = { algo: pkInfo.keyAlgo, data: pkInfo.key };
+    this.hashAlgo = pkInfo.hashAlgo;
     this.signature = pkInfo.signature;
     this.blob = pkInfo.blob;
   }
@@ -279288,6 +280714,7 @@ class HostbasedAuthContext extends AuthContext {
     super(protocol, username, service, method, cb);
 
     this.key = { algo: pkInfo.keyAlgo, data: pkInfo.key };
+    this.hashAlgo = pkInfo.hashAlgo;
     this.signature = pkInfo.signature;
     this.blob = pkInfo.blob;
     this.localHostname = pkInfo.localHostname;
@@ -280449,6 +281876,13 @@ class Client extends EventEmitter {
         this.once('rekey', cb);
     }
   }
+
+  setNoDelay(noDelay) {
+    if (this._sock && typeof this._sock.setNoDelay === 'function')
+      this._sock.setNoDelay(noDelay);
+
+    return this;
+  }
 }
 
 
@@ -297353,6 +298787,1375 @@ exports.quote = quote;
 exports.quoteAll = quoteAll;
 
 
+/***/ }),
+
+/***/ 66710:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+
+var os = __webpack_require__(22037);
+var process = __webpack_require__(77282);
+var fs = __webpack_require__(57147);
+var path = __webpack_require__(71017);
+var which = __webpack_require__(81918);
+var util = __webpack_require__(73837);
+
+function _interopNamespaceDefault(e) {
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var fs__namespace = /*#__PURE__*/_interopNamespaceDefault(fs);
+var path__namespace = /*#__PURE__*/_interopNamespaceDefault(path);
+
+/**
+ * @overview Provides functionality related to working with executables.
+ * @license MPL-2.0
+ */
+
+/**
+ * Resolves the location of an executable given an arbitrary valid string
+ * representation of that executable.
+ *
+ * To obtain the location of the executable this function (if necessary):
+ * - Expands the provided string to a absolute path.
+ * - Follows symbolic links.
+ *
+ * @param {object} args The arguments for this function.
+ * @param {string} args.executable A string representation of the executable.
+ * @param {object} deps The dependencies for this function.
+ * @param {Function} deps.exists A function to check if a file exists.
+ * @param {Function} deps.readlink A function to resolve (sym)links.
+ * @param {Function} deps.which A function to perform a `which(1)`-like lookup.
+ * @returns {string} The full path to the binary of the executable.
+ * @throws {Error} If the `deps` aren't provided.
+ */
+function resolveExecutable({ executable }, { exists, readlink, which }) {
+  if (readlink === undefined || which === undefined) {
+    throw new Error();
+  }
+
+  try {
+    executable = which(executable);
+  } catch (_) {
+    // For backwards compatibility return the executable even if its location
+    // cannot be obtained
+    return executable;
+  }
+
+  if (!exists(executable)) {
+    // For backwards compatibility return the executable even if there exists no
+    // file at the specified path
+    return executable;
+  }
+
+  try {
+    executable = readlink(executable);
+  } catch (_) {
+    // An error will be thrown if the executable is not a (sym)link, this is not
+    // a problem so the error is ignored
+  }
+
+  return executable;
+}
+
+/**
+ * @overview Provides reflection functionality.
+ * @license MPL-2.0
+ */
+
+/**
+ * The error message for incorrect parameter types.
+ *
+ * @constant
+ * @type {string}
+ */
+const typeError =
+  "Shescape requires strings or values that can be converted into a string using .toString()";
+
+/**
+ * The `typeof` value of functions.
+ *
+ * @constant
+ * @type {string}
+ */
+const typeofFunction = "function";
+
+/**
+ * The `typeof` value of strings.
+ *
+ * @constant
+ * @type {string}
+ */
+const typeofString = "string";
+
+/**
+ * Checks if a value can be converted into a string and converts it if possible.
+ *
+ * @param {any} value The value of interest.
+ * @returns {string|null} The `.toString()` if it's a string, otherwise `null`.
+ */
+function maybeToString(value) {
+  if (value === undefined || value === null) {
+    return null;
+  }
+
+  if (typeof value.toString !== typeofFunction) {
+    return null;
+  }
+
+  const maybeStr = value.toString();
+  if (isString(maybeStr)) {
+    return maybeStr;
+  } else {
+    return null;
+  }
+}
+
+/**
+ * Convert a value into a string if that is possible.
+ *
+ * @param {any} value The value to convert into a string.
+ * @returns {string} The `value` as a string.
+ * @throws {TypeError} The `value` is not stringable.
+ */
+function checkedToString(value) {
+  if (isString(value)) {
+    return value;
+  }
+
+  const maybeStr = maybeToString(value);
+  if (maybeStr === null) {
+    throw new TypeError(typeError);
+  }
+
+  return maybeStr;
+}
+
+/**
+ * Checks if a value is a string.
+ *
+ * @param {any} value The value of interest.
+ * @returns {boolean} `true` if `value` is a string, `false` otherwise.
+ */
+function isString(value) {
+  return typeof value === typeofString;
+}
+
+/**
+ * Converts the provided value into an array if it is not already an array and
+ * returns the array.
+ *
+ * @param {Array | any} value The value to convert to an array if necessary.
+ * @returns {Array} An array containing `value` or `value` itself.
+ */
+function toArrayIfNecessary(value) {
+  return Array.isArray(value) ? value : [value];
+}
+
+/**
+ * @overview Provides functionality for parsing shescape options.
+ * @license MPL-2.0
+ */
+
+
+/**
+ * Parses options provided to shescape.
+ *
+ * @param {object} args The arguments for this function.
+ * @param {object} args.options The options for escaping.
+ * @param {boolean} [args.options.flagProtection] Is flag protection enabled.
+ * @param {boolean} [args.options.interpolation] Is interpolation enabled.
+ * @param {boolean | string} [args.options.shell] The shell to escape for.
+ * @param {object} args.process The `process` values.
+ * @param {object} args.process.env The environment variables.
+ * @param {object} deps The dependencies for this function.
+ * @param {Function} deps.getDefaultShell Function to get the default shell.
+ * @param {Function} deps.getShellName Function to get the name of a shell.
+ * @returns {object} The parsed arguments.
+ */
+function parseOptions(
+  { options: { flagProtection, interpolation, shell }, process: { env } },
+  { getDefaultShell, getShellName },
+) {
+  flagProtection = flagProtection ? true : false;
+  interpolation = interpolation ? true : false;
+  shell = isString(shell) ? shell : getDefaultShell({ env });
+
+  const shellName = getShellName({ shell }, { resolveExecutable });
+  return { flagProtection, interpolation, shellName };
+}
+
+/**
+ * @overview Provides functionality for the Bourne-again shell (Bash).
+ * @license MPL-2.0
+ */
+
+/**
+ * Escape an argument for use in Bash when interpolation is active.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForInterpolation$5(arg) {
+  return arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r(?!\n)/gu, "")
+    .replace(/\\/gu, "\\\\")
+    .replace(/\r?\n/gu, " ")
+    .replace(/(?<=^|\s)([#~])/gu, "\\$1")
+    .replace(/(["$&'()*;<>?`{|])/gu, "\\$1")
+    .replace(/(?<=[:=])(~)(?=[\s+\-/0:=]|$)/gu, "\\$1")
+    .replace(/([\t ])/gu, "\\$1");
+}
+
+/**
+ * Escape an argument for use in Bash when the argument is not being quoted (but
+ * interpolation is inactive).
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForNoInterpolation$5(arg) {
+  return arg.replace(/[\0\u0008\u001B\u009B]/gu, "").replace(/\r(?!\n)/gu, "");
+}
+
+/**
+ * Returns a function to escape arguments for use in Bash for the given use
+ * case.
+ *
+ * @param {object} options The options for escaping arguments.
+ * @param {boolean} options.interpolation Is interpolation enabled.
+ * @returns {Function} A function to escape arguments.
+ */
+function getEscapeFunction$7(options) {
+  if (options.interpolation) {
+    return escapeArgForInterpolation$5;
+  } else {
+    return escapeArgForNoInterpolation$5;
+  }
+}
+
+/**
+ * Escape an argument for use in Bash when the argument is being quoted.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForQuoted$5(arg) {
+  return arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r(?!\n)/gu, "")
+    .replace(/'/gu, "'\\''");
+}
+
+/**
+ * Quotes an argument for use in Bash.
+ *
+ * @param {string} arg The argument to quote.
+ * @returns {string} The quoted argument.
+ */
+function quoteArg$5(arg) {
+  return `'${arg}'`;
+}
+
+/**
+ * Returns a pair of functions to escape and quote arguments for use in Bash.
+ *
+ * @returns {Function[]} A function pair to escape & quote arguments.
+ */
+function getQuoteFunction$7() {
+  return [escapeArgForQuoted$5, quoteArg$5];
+}
+
+/**
+ * Remove any prefix from the provided argument that might be interpreted as a
+ * flag on Unix systems for Bash.
+ *
+ * @param {string} arg The argument to update.
+ * @returns {string} The updated argument.
+ */
+function stripFlagPrefix$5(arg) {
+  return arg.replace(/^-+/gu, "");
+}
+
+/**
+ * Returns a function to protect against flag injection for Bash.
+ *
+ * @returns {Function} A function to protect against flag injection.
+ */
+function getFlagProtectionFunction$7() {
+  return stripFlagPrefix$5;
+}
+
+/**
+ * @overview Provides functionality for the C shell (csh).
+ * @license MPL-2.0
+ */
+
+
+/**
+ * Escape an argument for use in csh when interpolation is active.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForInterpolation$4(arg) {
+  const textEncoder = new util.TextEncoder();
+  return arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r?\n|\r/gu, " ")
+    .replace(/\\/gu, "\\\\")
+    .replace(/(?<=^|\s)(~)/gu, "\\$1")
+    .replace(/(["#$&'()*;<>?[`{|])/gu, "\\$1")
+    .replace(/([\t ])/gu, "\\$1")
+    .split("")
+    .map(
+      // Due to a bug in C shell version 20110502-7, when a character whose
+      // utf-8 encoding includes the bytes 0xA0 (160 in decimal) appears in
+      // an argument after an escaped character, it will hang and endlessly
+      // consume memory unless the character is escaped with quotes.
+      // ref: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=995013
+      (char) => (textEncoder.encode(char).includes(160) ? `'${char}'` : char),
+    )
+    .join("")
+    .replace(/!(?!$)/gu, "\\!");
+}
+
+/**
+ * Escape an argument for use in csh when the argument is not being quoted (but
+ * interpolation is inactive).
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForNoInterpolation$4(arg) {
+  return arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r?\n|\r/gu, " ")
+    .replace(/\\!$/gu, "\\\\!")
+    .replace(/!(?!$)/gu, "\\!");
+}
+
+/**
+ * Returns a function to escape arguments for use in csh for the given use case.
+ *
+ * @param {object} options The options for escaping arguments.
+ * @param {boolean} options.interpolation Is interpolation enabled.
+ * @returns {Function} A function to escape arguments.
+ */
+function getEscapeFunction$6(options) {
+  if (options.interpolation) {
+    return escapeArgForInterpolation$4;
+  } else {
+    return escapeArgForNoInterpolation$4;
+  }
+}
+
+/**
+ * Escape an argument for use in csh when the argument is being quoted.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForQuoted$4(arg) {
+  return arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r?\n|\r/gu, " ")
+    .replace(/\\!$/gu, "\\\\!")
+    .replace(/'/gu, "'\\''")
+    .replace(/!(?!$)/gu, "\\!");
+}
+
+/**
+ * Quotes an argument for use in csh.
+ *
+ * @param {string} arg The argument to quote.
+ * @returns {string} The quoted argument.
+ */
+function quoteArg$4(arg) {
+  return `'${arg}'`;
+}
+
+/**
+ * Returns a pair of functions to escape and quote arguments for use in csh.
+ *
+ * @returns {Function[]} A function pair to escape & quote arguments.
+ */
+function getQuoteFunction$6() {
+  return [escapeArgForQuoted$4, quoteArg$4];
+}
+
+/**
+ * Remove any prefix from the provided argument that might be interpreted as a
+ * flag on Unix systems for csh.
+ *
+ * @param {string} arg The argument to update.
+ * @returns {string} The updated argument.
+ */
+function stripFlagPrefix$4(arg) {
+  return arg.replace(/^-+/gu, "");
+}
+
+/**
+ * Returns a function to protect against flag injection for csh.
+ *
+ * @returns {Function} A function to protect against flag injection.
+ */
+function getFlagProtectionFunction$6() {
+  return stripFlagPrefix$4;
+}
+
+/**
+ * @overview Provides functionality for the Debian Almquist shell (Dash).
+ * @license MPL-2.0
+ */
+
+/**
+ * Escape an argument for use in Dash when interpolation is active.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForInterpolation$3(arg) {
+  return arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r(?!\n)/gu, "")
+    .replace(/\\/gu, "\\\\")
+    .replace(/\r?\n/gu, " ")
+    .replace(/(?<=^|\s)([#~])/gu, "\\$1")
+    .replace(/(["$&'()*;<>?`|])/gu, "\\$1")
+    .replace(/([\t\n ])/gu, "\\$1");
+}
+
+/**
+ * Escape an argument for use in Dash when the argument is not being quoted (but
+ * interpolation is inactive).
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForNoInterpolation$3(arg) {
+  return arg.replace(/[\0\u0008\u001B\u009B]/gu, "").replace(/\r(?!\n)/gu, "");
+}
+
+/**
+ * Returns a function to escape arguments for use in Dash for the given use
+ * case.
+ *
+ * @param {object} options The options for escaping arguments.
+ * @param {boolean} options.interpolation Is interpolation enabled.
+ * @returns {Function} A function to escape arguments.
+ */
+function getEscapeFunction$5(options) {
+  if (options.interpolation) {
+    return escapeArgForInterpolation$3;
+  } else {
+    return escapeArgForNoInterpolation$3;
+  }
+}
+
+/**
+ * Escape an argument for use in Dash when the argument is being quoted.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForQuoted$3(arg) {
+  return arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r(?!\n)/gu, "")
+    .replace(/'/gu, "'\\''");
+}
+
+/**
+ * Quotes an argument for use in Dash.
+ *
+ * @param {string} arg The argument to quote.
+ * @returns {string} The quoted argument.
+ */
+function quoteArg$3(arg) {
+  return `'${arg}'`;
+}
+
+/**
+ * Returns a pair of functions to escape and quote arguments for use in Dash.
+ *
+ * @returns {Function[]} A function pair to escape & quote arguments.
+ */
+function getQuoteFunction$5() {
+  return [escapeArgForQuoted$3, quoteArg$3];
+}
+
+/**
+ * Remove any prefix from the provided argument that might be interpreted as a
+ * flag on Unix systems for Dash.
+ *
+ * @param {string} arg The argument to update.
+ * @returns {string} The updated argument.
+ */
+function stripFlagPrefix$3(arg) {
+  return arg.replace(/^-+/gu, "");
+}
+
+/**
+ * Returns a function to protect against flag injection for Dash.
+ *
+ * @returns {Function} A function to protect against flag injection.
+ */
+function getFlagProtectionFunction$5() {
+  return stripFlagPrefix$3;
+}
+
+/**
+ * @overview Provides functionality for the Z shell (Zsh).
+ * @license MPL-2.0
+ */
+
+/**
+ * Escape an argument for use in Zsh when interpolation is active.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForInterpolation$2(arg) {
+  return arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r(?!\n)/gu, "")
+    .replace(/\\/gu, "\\\\")
+    .replace(/\r?\n/gu, " ")
+    .replace(/(?<=^|\s)([#=~])/gu, "\\$1")
+    .replace(/(["$&'()*;<>?[\]`{|}])/gu, "\\$1")
+    .replace(/([\t ])/gu, "\\$1");
+}
+
+/**
+ * Escape an argument for use in Zsh when the argument is not being quoted (but
+ * interpolation is inactive).
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForNoInterpolation$2(arg) {
+  return arg.replace(/[\0\u0008\u001B\u009B]/gu, "").replace(/\r(?!\n)/gu, "");
+}
+
+/**
+ * Returns a function to escape arguments for use in Zsh for the given use case.
+ *
+ * @param {object} options The options for escaping arguments.
+ * @param {boolean} options.interpolation Is interpolation enabled.
+ * @returns {Function} A function to escape arguments.
+ */
+function getEscapeFunction$4(options) {
+  if (options.interpolation) {
+    return escapeArgForInterpolation$2;
+  } else {
+    return escapeArgForNoInterpolation$2;
+  }
+}
+
+/**
+ * Escape an argument for use in Zsh when the argument is being quoted.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForQuoted$2(arg) {
+  return arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r(?!\n)/gu, "")
+    .replace(/'/gu, "'\\''");
+}
+
+/**
+ * Quotes an argument for use in Zsh.
+ *
+ * @param {string} arg The argument to quote.
+ * @returns {string} The quoted argument.
+ */
+function quoteArg$2(arg) {
+  return `'${arg}'`;
+}
+
+/**
+ * Returns a pair of functions to escape and quote arguments for use in Zsh.
+ *
+ * @returns {Function[]} A function pair to escape & quote arguments.
+ */
+function getQuoteFunction$4() {
+  return [escapeArgForQuoted$2, quoteArg$2];
+}
+
+/**
+ * Remove any prefix from the provided argument that might be interpreted as a
+ * flag on Unix systems for Zsh.
+ *
+ * @param {string} arg The argument to update.
+ * @returns {string} The updated argument.
+ */
+function stripFlagPrefix$2(arg) {
+  return arg.replace(/^-+/gu, "");
+}
+
+/**
+ * Returns a function to protect against flag injection for Zsh.
+ *
+ * @returns {Function} A function to protect against flag injection.
+ */
+function getFlagProtectionFunction$4() {
+  return stripFlagPrefix$2;
+}
+
+/**
+ * @overview Provides functionality for Unix systems.
+ * @license MPL-2.0
+ */
+
+
+/**
+ * The name of the Bourne-again shell (Bash) binary.
+ *
+ * @constant
+ * @type {string}
+ */
+const binBash = "bash";
+
+/**
+ * The name of the C shell (csh) binary.
+ *
+ * @constant
+ * @type {string}
+ */
+const binCsh = "csh";
+
+/**
+ * The name of the Debian Almquist shell (Dash) binary.
+ *
+ * @constant
+ * @type {string}
+ */
+const binDash = "dash";
+
+/**
+ * The name of the Z shell (Zsh) binary.
+ *
+ * @constant
+ * @type {string}
+ */
+const binZsh = "zsh";
+
+/**
+ * Returns the default shell for Unix systems.
+ *
+ * For more information, see `options.shell` in:
+ * https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback.
+ *
+ * @returns {string} The default shell.
+ */
+function getDefaultShell$1() {
+  return "/bin/sh";
+}
+
+/**
+ * Returns a function to escape arguments for use in a particular shell.
+ *
+ * @param {string} shellName The name of a Unix shell.
+ * @param {object} options The options for escaping arguments.
+ * @param {boolean} options.interpolation Is interpolation enabled.
+ * @returns {Function | undefined} A function to escape arguments.
+ */
+function getEscapeFunction$3(shellName, options) {
+  switch (shellName) {
+    case binBash:
+      return getEscapeFunction$7(options);
+    case binCsh:
+      return getEscapeFunction$6(options);
+    case binDash:
+      return getEscapeFunction$5(options);
+    case binZsh:
+      return getEscapeFunction$4(options);
+  }
+}
+
+/**
+ * Returns a pair of functions to escape and quote arguments for use in a
+ * particular shell.
+ *
+ * @param {string} shellName The name of a Unix shell.
+ * @returns {Function[] | undefined} A function pair to escape & quote arguments.
+ */
+function getQuoteFunction$3(shellName) {
+  switch (shellName) {
+    case binBash:
+      return getQuoteFunction$7();
+    case binCsh:
+      return getQuoteFunction$6();
+    case binDash:
+      return getQuoteFunction$5();
+    case binZsh:
+      return getQuoteFunction$4();
+  }
+}
+
+/**
+ * Returns a function to protect against flag injection.
+ *
+ * @param {string} shellName The name of a Unix shell.
+ * @returns {Function | undefined} A function to protect against flag injection.
+ */
+function getFlagProtectionFunction$3(shellName) {
+  switch (shellName) {
+    case binBash:
+      return getFlagProtectionFunction$7();
+    case binCsh:
+      return getFlagProtectionFunction$6();
+    case binDash:
+      return getFlagProtectionFunction$5();
+    case binZsh:
+      return getFlagProtectionFunction$4();
+  }
+}
+
+/**
+ * Determines the name of the shell identified by a file path or file name.
+ *
+ * @param {object} args The arguments for this function.
+ * @param {string} args.shell The name or path of the shell.
+ * @param {object} deps The dependencies for this function.
+ * @param {Function} deps.resolveExecutable Resolve the path to an executable.
+ * @returns {string} The shell name.
+ */
+function getShellName$1({ shell }, { resolveExecutable }) {
+  shell = resolveExecutable(
+    { executable: shell },
+    { exists: fs__namespace.existsSync, readlink: fs__namespace.readlinkSync, which: which.sync },
+  );
+
+  const shellName = path__namespace.basename(shell);
+  if (getEscapeFunction$3(shellName, {}) === undefined) {
+    return binBash;
+  }
+
+  return shellName;
+}
+
+var unix = /*#__PURE__*/Object.freeze({
+  __proto__: null,
+  getDefaultShell: getDefaultShell$1,
+  getEscapeFunction: getEscapeFunction$3,
+  getFlagProtectionFunction: getFlagProtectionFunction$3,
+  getQuoteFunction: getQuoteFunction$3,
+  getShellName: getShellName$1
+});
+
+/**
+ * @overview Provides functionality for the Windows Command Prompt.
+ * @license MPL-2.0
+ */
+
+/**
+ * Escape an argument for use in CMD when interpolation is active.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForInterpolation$1(arg) {
+  let shouldEscapeSpecialChar = true;
+  return arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r?\n|\r/gu, " ")
+    .replace(/(?<!\\)(\\*)"/gu, '$1$1\\"')
+    .split("")
+    .map(
+      // Due to the way CMD determines if it is inside a quoted section, and the
+      // way we escape double quotes, whether or not special character need to
+      // be escaped depends on the number of double quotes that proceed it. So,
+      // we flip a flag for every double quote we encounter and escape special
+      // characters conditionally on that flag.
+      (char) => {
+        if (char === '"') {
+          shouldEscapeSpecialChar = !shouldEscapeSpecialChar;
+        } else if (shouldEscapeSpecialChar && /[%&<>^|]/u.test(char)) {
+          return `^${char}`;
+        }
+
+        return char;
+      },
+    )
+    .join("");
+}
+
+/**
+ * Escape an argument for use in CMD when the argument is not being quoted (but
+ * interpolation is inactive).
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForNoInterpolation$1(arg) {
+  return arg.replace(/[\0\u0008\u001B\u009B]/gu, "").replace(/\r?\n|\r/gu, " ");
+}
+
+/**
+ * Returns a function to escape arguments for use in CMD for the given use case.
+ *
+ * @param {object} options The options for escaping arguments.
+ * @param {boolean} options.interpolation Is interpolation enabled.
+ * @returns {Function} A function to escape arguments.
+ */
+function getEscapeFunction$2(options) {
+  if (options.interpolation) {
+    return escapeArgForInterpolation$1;
+  } else {
+    return escapeArgForNoInterpolation$1;
+  }
+}
+
+/**
+ * Escape an argument for use in CMD when the argument is being quoted.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForQuoted$1(arg) {
+  return escapeArgForInterpolation$1(arg).replace(
+    /(?<!\\)(\\*)([\t ])/gu,
+    "$1$1$2",
+  );
+}
+
+/**
+ * Quotes an argument for use in CMD.
+ *
+ * @param {string} arg The argument to quote.
+ * @returns {string} The quoted argument.
+ */
+function quoteArg$1(arg) {
+  return arg.replace(/([\t ]+)/gu, '"$1"');
+}
+
+/**
+ * Returns a pair of functions to escape and quote arguments for use in CMD.
+ *
+ * @returns {Function[]} A function pair to escape & quote arguments.
+ */
+function getQuoteFunction$2() {
+  return [escapeArgForQuoted$1, quoteArg$1];
+}
+
+/**
+ * Remove any prefix from the provided argument that might be interpreted as a
+ * flag on Windows systems for CMD.
+ *
+ * @param {string} arg The argument to update.
+ * @returns {string} The updated argument.
+ */
+function stripFlagPrefix$1(arg) {
+  return arg.replace(/^(?:-+|\/+)/gu, "");
+}
+
+/**
+ * Returns a function to protect against flag injection for CMD.
+ *
+ * @returns {Function} A function to protect against flag injection.
+ */
+function getFlagProtectionFunction$2() {
+  return stripFlagPrefix$1;
+}
+
+/**
+ * @overview Provides functionality for Windows PowerShell.
+ * @license MPL-2.0
+ */
+
+/**
+ * Escape an argument for use in PowerShell when interpolation is active.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForInterpolation(arg) {
+  arg = arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/`/gu, "``")
+    .replace(/\r(?!\n)/gu, "")
+    .replace(/\r?\n/gu, " ")
+    .replace(/(?<=^|[\s\u0085])([*1-6]?)(>)/gu, "$1`$2")
+    .replace(/(?<=^|[\s\u0085])([#\-:<@\]])/gu, "`$1")
+    .replace(/([$&'(),;{|}‘’‚‛“”„])/gu, "`$1");
+
+  if (/[\s\u0085]/u.test(arg.replace(/^[\s\u0085]+/gu, ""))) {
+    arg = arg
+      .replace(/(?<!\\)(\\*)"/gu, '$1$1`"`"')
+      .replace(/(?<!\\)(\\+)$/gu, "$1$1");
+  } else {
+    arg = arg.replace(/(?<!\\)(\\*)"/gu, '$1$1\\`"');
+  }
+
+  arg = arg.replace(/([\s\u0085])/gu, "`$1");
+
+  return arg;
+}
+
+/**
+ * Escape an argument for use in PowerShell when the argument is not being
+ * quoted (but interpolation is inactive).
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForNoInterpolation(arg) {
+  return arg.replace(/[\0\u0008\u001B\u009B]/gu, "").replace(/\r(?!\n)/gu, "");
+}
+
+/**
+ * Returns a function to escape arguments for use in PowerShell for the given
+ * use case.
+ *
+ * @param {object} options The options for escaping arguments.
+ * @param {boolean} options.interpolation Is interpolation enabled.
+ * @returns {Function} A function to escape arguments.
+ */
+function getEscapeFunction$1(options) {
+  if (options.interpolation) {
+    return escapeArgForInterpolation;
+  } else {
+    return escapeArgForNoInterpolation;
+  }
+}
+
+/**
+ * Escape an argument for use in PowerShell when the argument is being quoted.
+ *
+ * @param {string} arg The argument to escape.
+ * @returns {string} The escaped argument.
+ */
+function escapeArgForQuoted(arg) {
+  arg = arg
+    .replace(/[\0\u0008\u001B\u009B]/gu, "")
+    .replace(/\r(?!\n)/gu, "")
+    .replace(/(['‘’‚‛])/gu, "$1$1");
+
+  if (/[\s\u0085]/u.test(arg)) {
+    arg = arg
+      .replace(/(?<!\\)(\\*)"/gu, '$1$1""')
+      .replace(/(?<!\\)(\\+)$/gu, "$1$1");
+  } else {
+    arg = arg.replace(/(?<!\\)(\\*)"/gu, '$1$1\\"');
+  }
+
+  return arg;
+}
+
+/**
+ * Quotes an argument for use in PowerShell.
+ *
+ * @param {string} arg The argument to quote and escape.
+ * @returns {string} The quoted and escaped argument.
+ */
+function quoteArg(arg) {
+  return `'${arg}'`;
+}
+
+/**
+ * Returns a pair of functions to escape and quote arguments for use in
+ * PowerShell.
+ *
+ * @returns {Function[]} A function pair to escape & quote arguments.
+ */
+function getQuoteFunction$1() {
+  return [escapeArgForQuoted, quoteArg];
+}
+
+/**
+ * Remove any prefix from the provided argument that might be interpreted as a
+ * flag on Windows systems for PowerShell.
+ *
+ * @param {string} arg The argument to update.
+ * @returns {string} The updated argument.
+ */
+function stripFlagPrefix(arg) {
+  return arg.replace(/^(?:`?-+|\/+)/gu, "");
+}
+
+/**
+ * Returns a function to protect against flag injection for PowerShell.
+ *
+ * @returns {Function} A function to protect against flag injection.
+ */
+function getFlagProtectionFunction$1() {
+  return stripFlagPrefix;
+}
+
+/**
+ * @overview Provides functionality for Windows systems.
+ * @license MPL-2.0
+ */
+
+
+/**
+ * The name of the Windows Command Prompt binary.
+ *
+ * @constant
+ * @type {string}
+ */
+const binCmd = "cmd.exe";
+
+/**
+ * The name of the Windows PowerShell binary.
+ *
+ * @constant
+ * @type {string}
+ */
+const binPowerShell = "powershell.exe";
+
+/**
+ * Returns the default shell for Windows systems.
+ *
+ * For more information, see:
+ * https://nodejs.org/api/child_process.html#default-windows-shell.
+ *
+ * @param {object} args The arguments for this function.
+ * @param {object} args.env The environment variables.
+ * @param {string} [args.env.ComSpec] The %COMSPEC% value.
+ * @returns {string} The default shell.
+ */
+function getDefaultShell({ env: { ComSpec } }) {
+  if (ComSpec !== undefined) {
+    return ComSpec;
+  }
+
+  return binCmd;
+}
+
+/**
+ * Returns a function to escape arguments for use in a particular shell.
+ *
+ * @param {string} shellName The name of a Windows shell.
+ * @param {object} options The options for escaping arguments.
+ * @param {boolean} options.interpolation Is interpolation enabled.
+ * @returns {Function | undefined} A function to escape arguments.
+ */
+function getEscapeFunction(shellName, options) {
+  switch (shellName) {
+    case binCmd:
+      return getEscapeFunction$2(options);
+    case binPowerShell:
+      return getEscapeFunction$1(options);
+  }
+}
+
+/**
+ * Returns a pair of functions to escape and quote arguments for use in a
+ * particular shell.
+ *
+ * @param {string} shellName The name of a Windows shell.
+ * @returns {Function[] | undefined} A function pair to escape & quote arguments.
+ */
+function getQuoteFunction(shellName) {
+  switch (shellName) {
+    case binCmd:
+      return getQuoteFunction$2();
+    case binPowerShell:
+      return getQuoteFunction$1();
+  }
+}
+
+/**
+ * Returns a function to protect against flag injection.
+ *
+ * @param {string} shellName The name of a Windows shell.
+ * @returns {Function | undefined} A function to protect against flag injection.
+ */
+function getFlagProtectionFunction(shellName) {
+  switch (shellName) {
+    case binCmd:
+      return getFlagProtectionFunction$2();
+    case binPowerShell:
+      return getFlagProtectionFunction$1();
+  }
+}
+
+/**
+ * Determines the name of the shell identified by a file path or file name.
+ *
+ * @param {object} args The arguments for this function.
+ * @param {string} args.shell The name or path of the shell.
+ * @param {object} deps The dependencies for this function.
+ * @param {Function} deps.resolveExecutable Resolve the path to an executable.
+ * @returns {string} The shell name.
+ */
+function getShellName({ shell }, { resolveExecutable }) {
+  shell = resolveExecutable(
+    { executable: shell },
+    { exists: fs__namespace.existsSync, readlink: fs__namespace.readlinkSync, which: which.sync },
+  );
+
+  const shellName = path__namespace.win32.basename(shell);
+  if (getEscapeFunction(shellName, {}) === undefined) {
+    return binCmd;
+  }
+
+  return shellName;
+}
+
+var win = /*#__PURE__*/Object.freeze({
+  __proto__: null,
+  getDefaultShell: getDefaultShell,
+  getEscapeFunction: getEscapeFunction,
+  getFlagProtectionFunction: getFlagProtectionFunction,
+  getQuoteFunction: getQuoteFunction,
+  getShellName: getShellName
+});
+
+/**
+ * @overview Provides functionality related to getting the platform module for
+ * the current system.
+ * @license MPL-2.0
+ */
+
+
+/**
+ * The string identifying the OS type Cygwin.
+ *
+ * @constant
+ * @type {string}
+ */
+const cygwin = "cygwin";
+
+/**
+ * The string identifying the OS type MSYS.
+ *
+ * @constant
+ * @type {string}
+ */
+const msys = "msys";
+
+/**
+ * The string identifying Windows platforms.
+ *
+ * @constant
+ * @type {string}
+ */
+const win32 = "win32";
+
+/**
+ * Checks if the current system is a Windows system.
+ *
+ * @param {object} args The arguments for this function.
+ * @param {Object<string, string>} args.env The environment variables.
+ * @param {string} args.platform The `os.platform()` value.
+ * @returns {boolean} `true` if the system is Windows, `false` otherwise.
+ */
+function isWindow({ env, platform }) {
+  return env.OSTYPE === cygwin || env.OSTYPE === msys || platform === win32;
+}
+
+/**
+ * Returns all helper functions for a specific system.
+ *
+ * @param {object} args The arguments for this function.
+ * @param {Object<string, string>} args.env The environment variables.
+ * @param {string} args.platform The `os.platform()` value.
+ * @returns {object} The helper functions for the current system.
+ */
+function getHelpersByPlatform({ env, platform }) {
+  if (isWindow({ env, platform })) {
+    return win;
+  }
+
+  return unix;
+}
+
+/**
+ * A simple shell escape library. Use it to escape user-controlled inputs to
+ * shell commands to prevent shell injection.
+ *
+ * @overview Entrypoint for the library.
+ * @module shescape
+ * @version 1.7.2
+ * @license MPL-2.0
+ */
+
+
+/**
+ * Get the helper functions for the current platform.
+ *
+ * @returns {object} The helper functions for the current platform.
+ */
+function getPlatformHelpers() {
+  const platform = os.platform();
+  const helpers = getHelpersByPlatform({ env: process.env, platform });
+  return helpers;
+}
+
+/**
+ * Take a single value, the argument, and escape any dangerous characters.
+ *
+ * Non-string inputs will be converted to strings using a `toString()` method.
+ *
+ * NOTE: when the `interpolation` option is set to `true`, whitespace is escaped
+ * to prevent argument splitting except for cmd.exe (which does not support it).
+ *
+ * @example
+ * import { spawn } from "node:child_process";
+ * spawn(
+ *   "echo",
+ *   ["Hello", shescape.escape(userInput)],
+ *   null // `options.shell` MUST be falsy
+ * );
+ * @param {string} arg The argument to escape.
+ * @param {object} [options] The escape options.
+ * @param {boolean} [options.flagProtection=false] Is flag protection enabled.
+ * @param {boolean} [options.interpolation=false] Is interpolation enabled.
+ * @param {boolean | string} [options.shell] The shell to escape for.
+ * @returns {string} The escaped argument.
+ * @throws {TypeError} The argument is not stringable.
+ * @since 0.1.0
+ */
+function escape(arg, options = {}) {
+  const helpers = getPlatformHelpers();
+  const { flagProtection, interpolation, shellName } = parseOptions(
+    { options, process },
+    helpers,
+  );
+  const argAsString = checkedToString(arg);
+  const escape = helpers.getEscapeFunction(shellName, { interpolation });
+  const escapedArg = escape(argAsString);
+  if (flagProtection) {
+    const flagProtect = helpers.getFlagProtectionFunction(shellName);
+    return flagProtect(escapedArg);
+  } else {
+    return escapedArg;
+  }
+}
+
+/**
+ * Take a array of values, the arguments, and escape any dangerous characters in
+ * every argument.
+ *
+ * Non-array inputs will be converted to one-value arrays and non-string values
+ * will be converted to strings using a `toString()` method.
+ *
+ * @example
+ * import { spawn } from "node:child_process";
+ * spawn(
+ *   "echo",
+ *   shescape.escapeAll(["Hello", userInput]),
+ *   null // `options.shell` MUST be falsy
+ * );
+ * @param {string[]} args The arguments to escape.
+ * @param {object} [options] The escape options.
+ * @param {boolean} [options.flagProtection=false] Is flag protection enabled.
+ * @param {boolean} [options.interpolation=false] Is interpolation enabled.
+ * @param {boolean | string} [options.shell] The shell to escape for.
+ * @returns {string[]} The escaped arguments.
+ * @throws {TypeError} One of the arguments is not stringable.
+ * @since 1.1.0
+ */
+function escapeAll(args, options = {}) {
+  args = toArrayIfNecessary(args);
+  return args.map((arg) => escape(arg, options));
+}
+
+/**
+ * Take a single value, the argument, put shell-specific quotes around it and
+ * escape any dangerous characters.
+ *
+ * Non-string inputs will be converted to strings using a `toString()` method.
+ *
+ * @example
+ * import { spawn } from "node:child_process";
+ * const spawnOptions = { shell: true }; // `options.shell` SHOULD be truthy
+ * const shescapeOptions = { ...spawnOptions };
+ * spawn(
+ *   "echo",
+ *   ["Hello", shescape.quote(userInput, shescapeOptions)],
+ *   spawnOptions
+ * );
+ * @example
+ * import { exec } from "node:child_process";
+ * const execOptions = null || { };
+ * const shescapeOptions = { ...execOptions };
+ * exec(
+ *   `echo Hello ${shescape.quote(userInput, shescapeOptions)}`,
+ *   execOptions
+ * );
+ * @param {string} arg The argument to quote and escape.
+ * @param {object} [options] The escape and quote options.
+ * @param {boolean} [options.flagProtection=false] Is flag protection enabled.
+ * @param {boolean | string} [options.shell] The shell to escape for.
+ * @returns {string} The quoted and escaped argument.
+ * @throws {TypeError} The argument is not stringable.
+ * @since 0.3.0
+ */
+function quote(arg, options = {}) {
+  const helpers = getPlatformHelpers();
+  const { flagProtection, shellName } = parseOptions(
+    { options, process },
+    helpers,
+  );
+  const argAsString = checkedToString(arg);
+  const [escape, quote] = helpers.getQuoteFunction(shellName);
+  const escapedArg = escape(argAsString);
+  if (flagProtection) {
+    const flagProtect = helpers.getFlagProtectionFunction(shellName);
+    return quote(flagProtect(escapedArg));
+  } else {
+    return quote(escapedArg);
+  }
+}
+
+/**
+ * Take an array of values, the arguments, put shell-specific quotes around
+ * every argument and escape any dangerous characters in every argument.
+ *
+ * Non-array inputs will be converted to one-value arrays and non-string values
+ * will be converted to strings using a `toString()` method.
+ *
+ * @example
+ * import { spawn } from "node:child_process";
+ * const spawnOptions = { shell: true }; // `options.shell` SHOULD be truthy
+ * const shescapeOptions = { ...spawnOptions };
+ * spawn(
+ *   "echo",
+ *   shescape.quoteAll(["Hello", userInput], shescapeOptions),
+ *   spawnOptions
+ * );
+ * @param {string[]} args The arguments to quote and escape.
+ * @param {object} [options] The escape and quote options.
+ * @param {boolean} [options.flagProtection=false] Is flag protection enabled.
+ * @param {boolean | string} [options.shell] The shell to escape for.
+ * @returns {string[]} The quoted and escaped arguments.
+ * @throws {TypeError} One of the arguments is not stringable.
+ * @since 0.4.0
+ */
+function quoteAll(args, options = {}) {
+  args = toArrayIfNecessary(args);
+  return args.map((arg) => quote(arg, options));
+}
+
+exports.escape = escape;
+exports.escapeAll = escapeAll;
+exports.quote = quote;
+exports.quoteAll = quoteAll;
+
+
 /***/ }),
 
 /***/ 53966:
@@ -304142,7 +306945,7 @@ module.exports = JSON.parse('[{"name":"AppVeyor","constant":"APPVEYOR","env":"AP
 /***/ ((module) => {
 
 "use strict";
-module.exports = {"i8":"1.11.0"};
+module.exports = {"i8":"1.14.0"};
 
 /***/ })