snyk 1.1292.0 → 1.1292.2

package/dist/cli/293.index.js

@@ -18171,9 +18171,9 @@ const registry_call_1 = __webpack_require__(15271);
 /**
  * Root V2 endpoint, useful to check V2 support and validating credentials.
  */
-async function checkSupport(registryBase, username, password, options = {}) {
+async function checkSupport(registryBase, username, password, options = {}, callChainObserver = { visitedUrls: [] }) {
     const result = await (0, registry_call_1.registryV2Call)(registryBase, "/", // full url path should be "/v2/" as per spec
-    contentTypes.JSON, username, password, options);
+    contentTypes.JSON, callChainObserver, username, password, options);
     // always return thruthy object, even for ECR
     return result || {};
 }
@@ -18209,12 +18209,12 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.downloadLayer = void 0;
 const registry_call_1 = __webpack_require__(15271);
 const contentTypes = __webpack_require__(42625);
-async function downloadLayer(output, registryBase, repo, digest, username, password, options = {}) {
+async function downloadLayer(output, registryBase, repo, digest, username, password, options = {}, callChainObserver = { visitedUrls: [] }) {
     var _a;
     const accept = `${(_a = options.acceptLayer) !== null && _a !== void 0 ? _a : contentTypes.LAYER}`;
     const endpoint = `/${repo}/blobs/${digest}`;
     options = Object.assign({ json: false, encoding: null, snykInternalOutputStream: output }, options);
-    const layerResponse = await (0, registry_call_1.registryV2Call)(registryBase, endpoint, accept, username, password, options);
+    const layerResponse = await (0, registry_call_1.registryV2Call)(registryBase, endpoint, accept, callChainObserver, username, password, options);
     return layerResponse;
 }
 exports.downloadLayer = downloadLayer;
@@ -18287,9 +18287,9 @@ exports.getImageConfig = void 0;
 const registry_call_1 = __webpack_require__(15271);
 const contentTypes = __webpack_require__(42625);
 const needle_1 = __webpack_require__(48360);
-async function getImageConfig(registryBase, repo, digest, username, password, options = {}) {
+async function getImageConfig(registryBase, repo, digest, username, password, options = {}, callChainObserver = { visitedUrls: [] }) {
     const endpoint = `/${repo}/blobs/${digest}`;
-    const configResponse = await (0, registry_call_1.registryV2Call)(registryBase, endpoint, contentTypes.IMAGE_CONFIG, username, password, options);
+    const configResponse = await (0, registry_call_1.registryV2Call)(registryBase, endpoint, contentTypes.IMAGE_CONFIG, callChainObserver, username, password, options);
     return (0, needle_1.parseResponseBody)(configResponse);
 }
 exports.getImageConfig = getImageConfig;
@@ -18305,8 +18305,8 @@ exports.getImageConfig = getImageConfig;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getImageSize = void 0;
 const get_manifest_1 = __webpack_require__(32603);
-async function getImageSize(registryBase, repo, tag, username, password, options = {}) {
-    const manifest = await (0, get_manifest_1.getManifest)(registryBase, repo, tag, username, password, options);
+async function getImageSize(registryBase, repo, tag, username, password, options = {}, callChainObserver = { visitedUrls: [] }) {
+    const manifest = await (0, get_manifest_1.getManifest)(registryBase, repo, tag, username, password, options, undefined, callChainObserver);
     const layers = manifest.layers || [];
     return layers.reduce((size, layerConfig) => size + layerConfig.size, 0);
 }
@@ -18325,12 +18325,12 @@ exports.getLayer = void 0;
 const registry_call_1 = __webpack_require__(15271);
 const contentTypes = __webpack_require__(42625);
 /** @deprecated use downloadLayer instead. */
-async function getLayer(registryBase, repo, digest, username, password, options = {}) {
+async function getLayer(registryBase, repo, digest, username, password, options = {}, callChainObserver = { visitedUrls: [] }) {
     var _a;
     const accept = `${(_a = options.acceptLayer) !== null && _a !== void 0 ? _a : contentTypes.LAYER}`;
     const endpoint = `/${repo}/blobs/${digest}`;
     options = Object.assign({ json: false, encoding: null }, options);
-    const layerResponse = await (0, registry_call_1.registryV2Call)(registryBase, endpoint, accept, username, password, options);
+    const layerResponse = await (0, registry_call_1.registryV2Call)(registryBase, endpoint, accept, callChainObserver, username, password, options);
     // When the content type is wrongly set to text instead of binary, response body is returned as string instead of a buffer
     // This forces a buffer response.
     if (!(layerResponse.body instanceof Buffer)) {
@@ -18368,7 +18368,7 @@ const digestRegex = /^sha256:[a-f0-9]{64}$/i;
  *                 Defaults to linux/amd64. In case the requested manifest platform is not found an error is thrown.
  * @returns
  */
-async function getManifest(registryBase, repo, imageReference, username, password, options = {}, platform) {
+async function getManifest(registryBase, repo, imageReference, username, password, options = {}, platform, callChainObserver = { visitedUrls: [] }) {
     var _a;
     const accept = (_a = options.acceptManifest) !== null && _a !== void 0 ? _a : `${contentTypes.MANIFEST_V2}, ${contentTypes.MANIFEST_LIST_V2}`;
     const endpoint = `/${repo}/manifests/${imageReference}`;
@@ -18379,7 +18379,7 @@ async function getManifest(registryBase, repo, imageReference, username, passwor
     catch (err) {
         throw new needle_1.NeedleWrapperException(err.message, 400);
     }
-    let manifestResponse = await (0, registry_call_1.registryV2Call)(registryBase, endpoint, accept, username, password, options);
+    let manifestResponse = await (0, registry_call_1.registryV2Call)(registryBase, endpoint, accept, callChainObserver, username, password, options);
     const contentType = manifestResponse.headers["content-type"];
     let indexDigest;
     let manifestDigest;
@@ -18389,7 +18389,7 @@ async function getManifest(registryBase, repo, imageReference, username, passwor
         manifestDigest = getManifestDigestByPlatform(manifestResponse, platform);
         // need to call again with actual manifest (and not a list of manifest-lists)
         const endpoint = `/${repo}/manifests/${manifestDigest}`;
-        manifestResponse = await (0, registry_call_1.registryV2Call)(registryBase, endpoint, accept, username, password, options);
+        manifestResponse = await (0, registry_call_1.registryV2Call)(registryBase, endpoint, accept, callChainObserver !== null && callChainObserver !== void 0 ? callChainObserver : { visitedUrls: [] }, username, password, options);
     }
     const dockerContentDigest = manifestResponse.headers["Docker-Content-Digest"];
     switch (true) {
@@ -18433,15 +18433,19 @@ function getManifestDigestByPlatform(manifestResponse, platform) {
     };
     const platformFilter = platform ? platform : defaultPlatform;
     const manifestList = (0, needle_1.parseResponseBody)(manifestResponse);
-    const manifestPlatform = getManifestByOsAndArch(manifestList.manifests, platformFilter.os, platformFilter.architecture);
+    const manifestPlatform = getManifestByOsAndArch(manifestList.manifests, platformFilter.os, platformFilter.architecture, platformFilter.variant);
     if (manifestPlatform) {
         return manifestPlatform.digest;
     }
     throw new Error(`no supported manifest found for platform: ${JSON.stringify(platformFilter)}`);
 }
-function getManifestByOsAndArch(platformManifest, os, architecture) {
-    return platformManifest.find(manifest => manifest.platform.os === os &&
-        manifest.platform.architecture === architecture);
+function getManifestByOsAndArch(platformManifest, os, architecture, variant) {
+    return platformManifest.find(manifest => {
+        var _a, _b, _c;
+        return ((_a = manifest.platform) === null || _a === void 0 ? void 0 : _a.os) === os &&
+            ((_b = manifest.platform) === null || _b === void 0 ? void 0 : _b.architecture) === architecture &&
+            ((_c = manifest.platform) === null || _c === void 0 ? void 0 : _c.variant) === variant;
+    });
 }
 //# sourceMappingURL=get-manifest.js.map
 
@@ -18456,9 +18460,10 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getRepos = void 0;
 const contentTypes = __webpack_require__(42625);
 const registry_call_1 = __webpack_require__(15271);
-async function getRepos(registryBase, username, password, pageSize = 100, maxPages = Number.MAX_SAFE_INTEGER, options = {}) {
+async function getRepos(registryBase, username, password, pageSize = 100, maxPages = Number.MAX_SAFE_INTEGER, options = {}, callChainObserver = { visitedUrls: [] }) {
     const endpoint = "/_catalog";
-    return await (0, registry_call_1.paginatedV2Call)(registryBase, contentTypes.JSON, username, password, endpoint, "repositories", pageSize, maxPages, options);
+    const result = await (0, registry_call_1.paginatedV2Call)(registryBase, contentTypes.JSON, username, password, endpoint, "repositories", pageSize, maxPages, options, callChainObserver);
+    return result;
 }
 exports.getRepos = getRepos;
 //# sourceMappingURL=get-repos.js.map
@@ -18474,9 +18479,9 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getTags = void 0;
 const registry_call_1 = __webpack_require__(15271);
 const contentTypes = __webpack_require__(42625);
-async function getTags(registryBase, repo, username, password, pageSize = 1000, maxPages = Number.MAX_SAFE_INTEGER, options = {}) {
+async function getTags(registryBase, repo, username, password, pageSize = 1000, maxPages = Number.MAX_SAFE_INTEGER, options = {}, callChainObserver = { visitedUrls: [] }) {
     const endpoint = `/${repo}/tags/list`;
-    return await (0, registry_call_1.paginatedV2Call)(registryBase, contentTypes.JSON, username, password, endpoint, "tags", pageSize, maxPages, options);
+    return await (0, registry_call_1.paginatedV2Call)(registryBase, contentTypes.JSON, username, password, endpoint, "tags", pageSize, maxPages, options, callChainObserver);
 }
 exports.getTags = getTags;
 //# sourceMappingURL=get-tags.js.map
@@ -18526,8 +18531,9 @@ exports.contentTypes = contentTypes;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.NeedleWrapperException = exports.parseResponseBody = exports.needleWrapper = void 0;
+exports.checkAllowedHosts = exports.NeedleWrapperException = exports.parseResponseBody = exports.needleWrapper = void 0;
 const fs = __webpack_require__(57147);
+const net = __webpack_require__(41808);
 const needle = __webpack_require__(64484);
 const stream_1 = __webpack_require__(12781);
 // TODO: this is a temporary code that allows setting needle default timeout (alias for
@@ -18547,9 +18553,16 @@ if (process.env.DOCKER_REGISTRY_V2_CLIENT_NEEDLE_OPEN_TIMEOUT) {
  * and returns a response that matches what the response it used to get from `request` library
  * @param options request options
  */
-async function needleWrapper(options, maxRetries) {
+async function needleWrapper(options, maxRetries, callChainObserver = { visitedUrls: [] }) {
     var _a, _b;
     let uri = options.uri;
+    const allowedHostResult = checkAllowedHosts(uri, {
+        allowedHosts: options.allowedHosts,
+        disallowDangerousHosts: options.disallowDangerousHosts,
+    });
+    if (!allowedHostResult.allowed) {
+        throw new Error(`Refusing to connect to disallowed host ${uri} with reason ${allowedHostResult.denyReason}`);
+    }
     // append query parameters
     if (options.qs) {
         for (const key in options.qs) {
@@ -18561,6 +18574,7 @@ async function needleWrapper(options, maxRetries) {
             uri = uri.replace("&", "?");
         }
     }
+    callChainObserver.visitedUrls.push(uri);
     let response;
     let lastError;
     let retries = maxRetries !== null && maxRetries !== void 0 ? maxRetries : 0;
@@ -18663,6 +18677,52 @@ async function stream(readable, writeable) {
         (0, stream_1.pipeline)(readable, writeable, err => err ? reject(err) : resolve(response));
     });
 }
+function checkAllowedHosts(uri, options) {
+    let host;
+    try {
+        host = new URL(uri).hostname;
+    }
+    catch (err) {
+        throw new Error(`Failed to parse host from uri: ${uri}`);
+    }
+    if (options.allowedHosts && !options.allowedHosts.includes(host)) {
+        return {
+            allowed: false,
+            denyReason: "host disallowed by allowed hosts filter",
+        };
+    }
+    if (options.disallowDangerousHosts) {
+        // Disallow IPv4 addresses
+        if (net.isIPv4(host)) {
+            return {
+                allowed: false,
+                denyReason: "host disallowed by IPv4 address filter",
+            };
+        }
+        if (/^\[.*\]$/.test(host) && net.isIPv6(host.slice(1, -1))) {
+            return {
+                allowed: false,
+                denyReason: "host disallowed by IPv6 address filter",
+            };
+        }
+        // Disallow hosts in the cluster.local subdomain
+        if (/cluster\.local$/.test(host)) {
+            return {
+                allowed: false,
+                denyReason: "host disallowed by cluster.local subdomains filter",
+            };
+        }
+        // Disallow hosts without a TLD+1
+        if (!host.includes(".")) {
+            return {
+                allowed: false,
+                denyReason: "host disallowed by require TLD+1 filter",
+            };
+        }
+    }
+    return { allowed: true };
+}
+exports.checkAllowedHosts = checkAllowedHosts;
 //# sourceMappingURL=needle.js.map
 
 /***/ }),
@@ -18680,10 +18740,11 @@ const needle_1 = __webpack_require__(48360);
 const BEARER_REALM = "Bearer realm";
 const MAX_RETRIES = 1;
 const MAX_REDIRECTS = 5;
-async function registryV2Call(registryBase, endpoint, accept, username, password, reqOptions = {}) {
+async function registryV2Call(registryBase, endpoint, accept, callChainObserver, username, password, reqOptions = {}) {
     const reqConfig = buildUnauthenticatedV2RequestConfig(registryBase, endpoint, accept, reqOptions);
     try {
-        return await (0, needle_1.needleWrapper)(reqConfig, MAX_RETRIES);
+        callChainObserver.visitedUrls.push();
+        return await (0, needle_1.needleWrapper)(reqConfig, MAX_RETRIES, callChainObserver);
     }
     catch (err) {
         if (err.statusCode === 401) {
@@ -18695,17 +18756,17 @@ async function registryV2Call(registryBase, endpoint, accept, username, password
             }
             const authConfig = await setAuthConfig(registryBase, err, reqConfig, username, password, reqOptions);
             try {
-                return await (0, needle_1.needleWrapper)(authConfig, MAX_RETRIES);
+                return await (0, needle_1.needleWrapper)(authConfig, MAX_RETRIES, callChainObserver);
             }
             catch (err) {
                 if (isRedirectStatus(err.statusCode)) {
-                    return await handleRedirect(err, reqConfig);
+                    return await handleRedirect(err, reqConfig, callChainObserver);
                 }
                 throw err;
             }
         }
         if (isRedirectStatus(err.statusCode)) {
-            return await handleRedirect(err, reqConfig);
+            return await handleRedirect(err, reqConfig, callChainObserver);
         }
         throw err;
     }
@@ -18721,10 +18782,10 @@ exports.registryV2Call = registryV2Call;
  * Once it's no longer necessary, it is advised that this function is removed.
  *
  */
-async function registryCall(uri, username, password, reqOptions = {}) {
+async function registryCall(uri, username, password, reqOptions = {}, callChainObserver = { visitedUrls: [] }) {
     const reqConfig = applyRequestOptions({ uri: `https://${uri}` }, reqOptions);
     try {
-        return await (0, needle_1.needleWrapper)(reqConfig, MAX_RETRIES);
+        return await (0, needle_1.needleWrapper)(reqConfig, MAX_RETRIES, callChainObserver);
     }
     catch (err) {
         if (err.statusCode === 401) {
@@ -18736,28 +18797,28 @@ async function registryCall(uri, username, password, reqOptions = {}) {
             }
             const authConfig = await setAuthConfig("", err, reqConfig, username, password, reqOptions);
             try {
-                return await (0, needle_1.needleWrapper)(authConfig, MAX_RETRIES);
+                return await (0, needle_1.needleWrapper)(authConfig, MAX_RETRIES, callChainObserver);
             }
             catch (err) {
                 if (isRedirectStatus(err.statusCode)) {
-                    return await handleRedirect(err, reqConfig);
+                    return await handleRedirect(err, reqConfig, callChainObserver);
                 }
                 throw err;
             }
         }
         if (isRedirectStatus(err.statusCode)) {
-            return await handleRedirect(err, reqConfig);
+            return await handleRedirect(err, reqConfig, callChainObserver);
         }
         throw err;
     }
 }
 exports.registryCall = registryCall;
-async function paginatedV2Call(registryBase, accept, username, password, endpoint, key, pageSize = 1000, maxPages = Number.MAX_SAFE_INTEGER, reqOptions = {}) {
+async function paginatedV2Call(registryBase, accept, username, password, endpoint, key, pageSize = 1000, maxPages = Number.MAX_SAFE_INTEGER, reqOptions = {}, callChainObserver = { visitedUrls: [] }) {
     const result = [];
     let pageEndpoint = `${endpoint}?n=${pageSize}`;
     let pageCount = 0;
     while (pageCount < maxPages) {
-        const response = await registryV2Call(registryBase, pageEndpoint, accept, username, password, reqOptions);
+        const response = await registryV2Call(registryBase, pageEndpoint, accept, callChainObserver, username, password, reqOptions);
         const body = (0, needle_1.parseResponseBody)(response);
         if (body && body[key]) {
             result.push(...body[key]);
@@ -18840,10 +18901,10 @@ async function setAuthConfig(registryBase, err, reqConfig, username, password, r
     }
 }
 // Handle redirect while following up to MAX_REDIRECTS
-async function handleRedirect(err, config) {
-    return handleRedirectRec(err, config, MAX_REDIRECTS);
+async function handleRedirect(err, config, callChainObserver) {
+    return handleRedirectRec(err, config, MAX_REDIRECTS, callChainObserver);
 }
-async function handleRedirectRec(err, config, maxRedirects = 0) {
+async function handleRedirectRec(err, config, maxRedirects = 0, callChainObserver) {
     if (maxRedirects === 0) {
         throw err;
     }
@@ -18863,11 +18924,11 @@ async function handleRedirectRec(err, config, maxRedirects = 0) {
     const redirectUrl = assertFullUrl(location, config.uri);
     config.uri = redirectUrl;
     try {
-        return await (0, needle_1.needleWrapper)(config, MAX_RETRIES);
+        return await (0, needle_1.needleWrapper)(config, MAX_RETRIES, callChainObserver);
     }
     catch (err) {
         if (isRedirectStatus(err.statusCode)) {
-            return await handleRedirectRec(err, config, maxRedirects - 1);
+            return await handleRedirectRec(err, config, maxRedirects - 1, callChainObserver);
         }
         throw err;
     }
@@ -18971,7 +19032,7 @@ class ValidationError extends Error {
 exports.ValidationError = ValidationError;
 function validateRepoOrImageRef(input) {
     const invalidCharacters = ["&", ";", " ", '"'];
-    if (input.trim().length === 0) {
+    if (!input || input.trim().length === 0) {
         throw new ValidationError(exports.REPO_IMAGE_REF_BLANK_ERROR);
     }
     if (invalidCharacters.some(c => input.includes(c))) {
@@ -33908,7 +33969,7 @@ class DockerPull {
     async pull(registryBase, repo, tag, opt) {
         var _a, _b;
         const loadImage = (opt === null || opt === void 0 ? void 0 : opt.loadImage) === undefined ? true : opt.loadImage;
-        const manifest = await registryClient.getManifest(registryBase, repo, tag, opt === null || opt === void 0 ? void 0 : opt.username, opt === null || opt === void 0 ? void 0 : opt.password, opt === null || opt === void 0 ? void 0 : opt.reqOptions);
+        const manifest = await registryClient.getManifest(registryBase, repo, tag, opt === null || opt === void 0 ? void 0 : opt.username, opt === null || opt === void 0 ? void 0 : opt.password, opt === null || opt === void 0 ? void 0 : opt.reqOptions, opt === null || opt === void 0 ? void 0 : opt.platform);
         const indexDigest = (_a = manifest.indexDigest) !== null && _a !== void 0 ? _a : undefined;
         const manifestDigest = (_b = manifest.manifestDigest) !== null && _b !== void 0 ? _b : undefined;
         if (manifest.schemaVersion !== 2) {
@@ -34241,11 +34302,10 @@ exports.dirSync = dirSync;
 
 const tar = __webpack_require__(5464)
 const pump = __webpack_require__(74286)
-const mkdirp = __webpack_require__(42986)
 const fs = __webpack_require__(57147)
 const path = __webpack_require__(71017)
 
-const win32 = process.platform === 'win32'
+const win32 = (global.Bare?.platform || process.platform) === 'win32'
 
 exports.pack = function pack (cwd, opts) {
   if (!cwd) cwd = '.'
@@ -34286,6 +34346,7 @@ exports.pack = function pack (cwd, opts) {
   }
 
   function onstat (err, filename, stat) {
+    if (pack.destroyed) return
     if (err) return pack.destroy(err)
     if (!filename) {
       if (opts.finalize !== false) pack.finalize()
@@ -34539,7 +34600,7 @@ exports.extract = function extract (cwd, opts) {
     xfs.stat(name, function (err) {
       if (!err) return cb(null)
       if (err.code !== 'ENOENT') return cb(err)
-      mkdirp(name, { fs: opts.fs, mode: opts.mode }, function (err, made) {
+      xfs.mkdir(name, { mode: opts.mode, recursive: true }, function (err, made) {
         if (err) return cb(err)
         chperm(name, opts, cb)
       })
@@ -35086,7 +35147,7 @@ exports.decodePax = function decodePax (buf) {
   while (buf.length) {
     let i = 0
     while (i < buf.length && buf[i] !== 32) i++
-    const len = parseInt(buf.subarray(0, i).toString(), 10)
+    const len = parseInt(b4a.toString(buf.subarray(0, i)), 10)
     if (!len) return result
 
     const b = b4a.toString(buf.subarray(i + 1, len - 1))
@@ -35356,7 +35417,7 @@ function decodeOct (val, offset, length) {
     const end = clamp(indexOf(val, 32, offset, val.length), val.length, val.length)
     while (offset < end && val[offset] === 0) offset++
     if (end === offset) return 0
-    return parseInt(val.subarray(offset, end).toString(), 8)
+    return parseInt(b4a.toString(val.subarray(offset, end)), 8)
   }
 }
 
@@ -179316,111 +179377,6 @@ module.exports = (fromStream, toStream) => {
 };
 
 
-/***/ }),
-
-/***/ 42986:
-/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
-
-var path = __webpack_require__(71017);
-var fs = __webpack_require__(57147);
-var _0777 = parseInt('0777', 8);
-
-module.exports = mkdirP.mkdirp = mkdirP.mkdirP = mkdirP;
-
-function mkdirP (p, opts, f, made) {
-    if (typeof opts === 'function') {
-        f = opts;
-        opts = {};
-    }
-    else if (!opts || typeof opts !== 'object') {
-        opts = { mode: opts };
-    }
-    
-    var mode = opts.mode;
-    var xfs = opts.fs || fs;
-    
-    if (mode === undefined) {
-        mode = _0777 & (~process.umask());
-    }
-    if (!made) made = null;
-    
-    var cb = f || function () {};
-    p = path.resolve(p);
-    
-    xfs.mkdir(p, mode, function (er) {
-        if (!er) {
-            made = made || p;
-            return cb(null, made);
-        }
-        switch (er.code) {
-            case 'ENOENT':
-                mkdirP(path.dirname(p), opts, function (er, made) {
-                    if (er) cb(er, made);
-                    else mkdirP(p, opts, cb, made);
-                });
-                break;
-
-            // In the case of any other error, just see if there's a dir
-            // there already.  If so, then hooray!  If not, then something
-            // is borked.
-            default:
-                xfs.stat(p, function (er2, stat) {
-                    // if the stat fails, then that's super weird.
-                    // let the original error be the failure reason.
-                    if (er2 || !stat.isDirectory()) cb(er, made)
-                    else cb(null, made);
-                });
-                break;
-        }
-    });
-}
-
-mkdirP.sync = function sync (p, opts, made) {
-    if (!opts || typeof opts !== 'object') {
-        opts = { mode: opts };
-    }
-    
-    var mode = opts.mode;
-    var xfs = opts.fs || fs;
-    
-    if (mode === undefined) {
-        mode = _0777 & (~process.umask());
-    }
-    if (!made) made = null;
-
-    p = path.resolve(p);
-
-    try {
-        xfs.mkdirSync(p, mode);
-        made = made || p;
-    }
-    catch (err0) {
-        switch (err0.code) {
-            case 'ENOENT' :
-                made = sync(path.dirname(p), opts, made);
-                sync(p, opts, made);
-                break;
-
-            // In the case of any other error, just see if there's a dir
-            // there already.  If so, then hooray!  If not, then something
-            // is borked.
-            default:
-                var stat;
-                try {
-                    stat = xfs.statSync(p);
-                }
-                catch (err1) {
-                    throw err0;
-                }
-                if (!stat.isDirectory()) throw err0;
-                break;
-        }
-    }
-
-    return made;
-};
-
-
 /***/ }),
 
 /***/ 23424:
@@ -192556,19 +192512,19 @@ exports.parsePomProperties = parsePomProperties;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.groupFilesByDirectory = exports.cleanupAppNodeModules = exports.persistAppNodeModules = void 0;
+exports.groupFilesByDirectory = exports.cleanupAppNodeModules = exports.persistNodeModules = void 0;
 const Debug = __webpack_require__(15158);
 const promises_1 = __webpack_require__(73292);
 const path = __webpack_require__(71017);
 const debug = Debug("snyk");
-async function createTempAppDir(appParentDir) {
+async function createTempProjectDir(projectDir) {
     const tmpDir = await (0, promises_1.mkdtemp)("snyk");
-    const appRootDir = appParentDir.includes("node_modules")
-        ? appParentDir.substring(0, appParentDir.indexOf("node_modules"))
-        : appParentDir;
-    const tempAppRootDirPath = path.join(tmpDir, appRootDir);
-    await (0, promises_1.mkdir)(tempAppRootDirPath, { recursive: true });
-    return [tmpDir, tempAppRootDirPath];
+    const tempProjectRoot = path.join(tmpDir, projectDir);
+    await (0, promises_1.mkdir)(tempProjectRoot, { recursive: true });
+    return {
+        tmpDir,
+        tempProjectRoot,
+    };
 }
 const manifestName = "package.json";
 async function fileExists(path) {
@@ -192576,44 +192532,39 @@ async function fileExists(path) {
         .then(() => true)
         .catch(() => false);
 }
-async function createAppSyntheticManifest(tempRootManifestDir) {
+async function createSyntheticManifest(tempRootManifestDir) {
     const tempRootManifestPath = path.join(tempRootManifestDir, manifestName);
     debug(`Creating an empty synthetic manifest file: ${tempRootManifestPath}`);
     await (0, promises_1.writeFile)(tempRootManifestPath, "{}", "utf-8");
 }
-async function copyAppModulesManifestFiles(appDirs, tempAppRootDirPath, fileNamesGroupedByDirectory, filePathToContent) {
-    for (const dependencyPath of appDirs) {
-        const filesInDirectory = fileNamesGroupedByDirectory[dependencyPath];
-        if (filesInDirectory.length === 0) {
-            continue;
-        }
-        const manifestPath = path.join(dependencyPath, "package.json");
-        const manifestContent = filePathToContent[manifestPath];
-        await createFile(path.join(tempAppRootDirPath, manifestPath), manifestContent);
+async function saveOnDisk(tempDir, modules, filePathToContent) {
+    for (const module of modules) {
+        const manifestContent = filePathToContent[module];
+        await createFile(path.join(tempDir, module), manifestContent);
     }
 }
-async function persistAppNodeModules(filePathToContent, fileNamesGroupedByDirectory) {
-    const appDirs = Object.keys(fileNamesGroupedByDirectory);
-    let tmpDir = "";
-    let tempAppRootDirPath = "";
-    if (appDirs.length === 0) {
+async function persistNodeModules(project, filePathToContent, fileNamesGroupedByDirectory) {
+    const modules = fileNamesGroupedByDirectory.get(project);
+    const tmpDir = "";
+    const tempProjectRoot = "";
+    if (!modules || modules.size === 0) {
         debug(`Empty application directory tree.`);
         return {
             tempDir: tmpDir,
-            tempApplicationPath: tempAppRootDirPath,
+            tempProjectPath: tempProjectRoot,
         };
     }
     try {
-        [tmpDir, tempAppRootDirPath] = await createTempAppDir(appDirs.sort()[0]);
-        await copyAppModulesManifestFiles(appDirs, tmpDir, fileNamesGroupedByDirectory, filePathToContent);
+        const { tmpDir, tempProjectRoot } = await createTempProjectDir(project);
+        await saveOnDisk(tmpDir, modules, filePathToContent);
         const result = {
             tempDir: tmpDir,
-            tempApplicationPath: tempAppRootDirPath,
-            manifestPath: path.join(tempAppRootDirPath.substring(tmpDir.length), manifestName),
+            tempProjectPath: tempProjectRoot,
+            manifestPath: path.join(tempProjectRoot.substring(tmpDir.length), manifestName),
         };
-        const manifestFileExists = await fileExists(path.join(tempAppRootDirPath, manifestName));
+        const manifestFileExists = await fileExists(path.join(tempProjectRoot, manifestName));
         if (!manifestFileExists) {
-            await createAppSyntheticManifest(tempAppRootDirPath);
+            await createSyntheticManifest(tempProjectRoot);
             delete result.manifestPath;
         }
         return result;
@@ -192622,26 +192573,28 @@ async function persistAppNodeModules(filePathToContent, fileNamesGroupedByDirect
         debug(`Failed to copy the application manifest files locally: ${error.message}`);
         return {
             tempDir: tmpDir,
-            tempApplicationPath: tempAppRootDirPath,
+            tempProjectPath: tempProjectRoot,
         };
     }
 }
-exports.persistAppNodeModules = persistAppNodeModules;
+exports.persistNodeModules = persistNodeModules;
 async function createFile(filePath, fileContent) {
     await (0, promises_1.mkdir)(path.dirname(filePath), { recursive: true });
     await (0, promises_1.writeFile)(filePath, fileContent, "utf-8");
 }
 function groupFilesByDirectory(filePathToContent) {
-    const fileNamesGrouped = {};
+    var _a;
+    const filesByDir = new Map();
     for (const filePath of Object.keys(filePathToContent)) {
-        const directory = path.dirname(filePath);
-        const fileName = path.basename(filePath);
-        if (!fileNamesGrouped[directory]) {
-            fileNamesGrouped[directory] = [];
+        const directory = filePath.includes("node_modules")
+            ? filePath.split("/node_modules")[0]
+            : path.dirname(filePath);
+        if (!filesByDir.has(directory)) {
+            filesByDir.set(directory, new Set());
         }
-        fileNamesGrouped[directory].push(fileName);
+        (_a = filesByDir.get(directory)) === null || _a === void 0 ? void 0 : _a.add(filePath);
     }
-    return fileNamesGrouped;
+    return filesByDir;
 }
 exports.groupFilesByDirectory = groupFilesByDirectory;
 async function cleanupAppNodeModules(appRootDir) {
@@ -192672,6 +192625,7 @@ const resolveDeps = __webpack_require__(40068);
 const debug = Debug("snyk");
 const node_modules_utils_1 = __webpack_require__(89252);
 async function nodeFilesToScannedProjects(filePathToContent) {
+    const scanResults = [];
     /**
      * TODO: Add support for Yarn workspaces!
      * https://github.com/snyk/nodejs-lockfile-parser/blob/af8ba81930e950156b539281ecf41c1bc63dacf4/test/lib/yarn-workflows.test.ts#L7-L17
@@ -192685,46 +192639,57 @@ async function nodeFilesToScannedProjects(filePathToContent) {
         return [];
     }
     const fileNamesGroupedByDirectory = (0, node_modules_utils_1.groupFilesByDirectory)(filePathToContent);
-    const manifestFilePairs = findManifestLockPairsInSameDirectory(fileNamesGroupedByDirectory);
-    return manifestFilePairs.length === 0
-        ? depGraphFromNodeModules(filePathToContent, fileNamesGroupedByDirectory)
-        : depGraphFromManifestFiles(filePathToContent, manifestFilePairs);
+    const [manifestFilePairs, nodeProjects] = findProjectsAndManifests(fileNamesGroupedByDirectory);
+    if (manifestFilePairs.length !== 0) {
+        scanResults.push(...(await depGraphFromManifestFiles(filePathToContent, manifestFilePairs)));
+    }
+    if (nodeProjects.length !== 0) {
+        scanResults.push(...(await depGraphFromNodeModules(filePathToContent, nodeProjects, fileNamesGroupedByDirectory)));
+    }
+    return scanResults;
 }
 exports.nodeFilesToScannedProjects = nodeFilesToScannedProjects;
-async function depGraphFromNodeModules(filePathToContent, fileNamesGroupedByDirectory) {
-    const { tempDir, tempApplicationPath, manifestPath } = await (0, node_modules_utils_1.persistAppNodeModules)(filePathToContent, fileNamesGroupedByDirectory);
-    if (!tempApplicationPath) {
-        return [];
-    }
+async function depGraphFromNodeModules(filePathToContent, nodeProjects, fileNamesGroupedByDirectory) {
     const scanResults = [];
-    try {
-        const pkgTree = await resolveDeps(tempApplicationPath, {
-            dev: false,
-            noFromArrays: true,
-        });
-        const depGraph = await dep_graph_1.legacy.depTreeToGraph(pkgTree, pkgTree.type || "npm");
-        scanResults.push({
-            facts: [
-                {
-                    type: "depGraph",
-                    data: depGraph,
-                },
-                {
-                    type: "testedFiles",
-                    data: Object.keys(filePathToContent),
+    for (const project of nodeProjects) {
+        const { tempDir, tempProjectPath, manifestPath } = await (0, node_modules_utils_1.persistNodeModules)(project, filePathToContent, fileNamesGroupedByDirectory);
+        if (!tempProjectPath) {
+            await (0, node_modules_utils_1.cleanupAppNodeModules)(tempDir);
+            continue;
+        }
+        try {
+            const pkgTree = await resolveDeps(tempProjectPath, {
+                dev: false,
+                noFromArrays: true,
+            });
+            const depGraph = await dep_graph_1.legacy.depTreeToGraph(pkgTree, pkgTree.type || "npm");
+            scanResults.push({
+                facts: [
+                    {
+                        type: "depGraph",
+                        data: depGraph,
+                    },
+                    {
+                        type: "testedFiles",
+                        data: manifestPath
+                            ? manifestPath
+                            : path.join(project, "node_modules"),
+                    },
+                ],
+                identity: {
+                    type: depGraph.pkgManager.name,
+                    targetFile: manifestPath
+                        ? manifestPath
+                        : path.join(project, "node_modules"),
                 },
-            ],
-            identity: {
-                type: depGraph.pkgManager.name,
-                targetFile: manifestPath,
-            },
-        });
-    }
-    catch (error) {
-        debug(`An error occurred while analysing node_modules dir: ${error.message}`);
-    }
-    finally {
-        await (0, node_modules_utils_1.cleanupAppNodeModules)(tempDir);
+            });
+        }
+        catch (error) {
+            debug(`An error occurred while analysing node_modules dir: ${error.message}`);
+        }
+        finally {
+            await (0, node_modules_utils_1.cleanupAppNodeModules)(tempDir);
+        }
     }
     return scanResults;
 }
@@ -192734,7 +192699,14 @@ async function depGraphFromManifestFiles(filePathToContent, manifestFilePairs) {
     const shouldBeStrictForManifestAndLockfileOutOfSync = false;
     for (const pathPair of manifestFilePairs) {
         // TODO: initially generate as DepGraph
-        const parserResult = await lockFileParser.buildDepTree(filePathToContent[pathPair.manifest], filePathToContent[pathPair.lock], shouldIncludeDevDependencies, pathPair.lockType, shouldBeStrictForManifestAndLockfileOutOfSync);
+        let parserResult;
+        try {
+            parserResult = await lockFileParser.buildDepTree(filePathToContent[pathPair.manifest], filePathToContent[pathPair.lock], shouldIncludeDevDependencies, pathPair.lockType, shouldBeStrictForManifestAndLockfileOutOfSync);
+        }
+        catch (err) {
+            debug(`An error occurred while analysing a pair of manifest and lock files: ${err.message}`);
+            continue;
+        }
         const strippedLabelsParserResult = stripUndefinedLabels(parserResult);
         const depGraph = await dep_graph_1.legacy.depTreeToGraph(strippedLabelsParserResult, pathPair.lockType);
         const depGraphFact = {
@@ -192755,38 +192727,41 @@ async function depGraphFromManifestFiles(filePathToContent, manifestFilePairs) {
     }
     return scanResults;
 }
-function findManifestLockPairsInSameDirectory(fileNamesGroupedByDirectory) {
+function findProjectsAndManifests(fileNamesGroupedByDirectory) {
     const manifestLockPathPairs = [];
-    for (const directoryPath of Object.keys(fileNamesGroupedByDirectory)) {
-        if (directoryPath.includes("node_modules")) {
-            continue;
-        }
-        const filesInDirectory = fileNamesGroupedByDirectory[directoryPath];
-        if (filesInDirectory.length !== 2) {
-            // either a missing file or too many files, ignore
+    const nodeProjects = [];
+    for (const directoryPath of fileNamesGroupedByDirectory.keys()) {
+        const filesInDirectory = fileNamesGroupedByDirectory.get(directoryPath);
+        if (!filesInDirectory || filesInDirectory.size < 1) {
+            // missing manifest files
             continue;
         }
-        const hasPackageJson = filesInDirectory.includes("package.json");
-        const hasPackageLockJson = filesInDirectory.includes("package-lock.json");
-        const hasYarnLock = filesInDirectory.includes("yarn.lock");
-        if (hasPackageJson && hasPackageLockJson) {
-            manifestLockPathPairs.push({
-                manifest: path.join(directoryPath, "package.json"),
-                lock: path.join(directoryPath, "package-lock.json"),
-                lockType: lockFileParser.LockfileType.npm,
-            });
+        const expectedManifest = path.join(directoryPath, "package.json");
+        const expectedNpmLockFile = path.join(directoryPath, "package-lock.json");
+        const expectedYarnLockFile = path.join(directoryPath, "yarn.lock");
+        const hasManifestFileOnly = filesInDirectory.has(expectedManifest) &&
+            !(filesInDirectory.has(expectedNpmLockFile) ||
+                filesInDirectory.has(expectedYarnLockFile));
+        const hasNoManifestFile = !filesInDirectory.has(expectedManifest);
+        if (hasManifestFileOnly && filesInDirectory.size === 1) {
             continue;
         }
-        if (hasPackageJson && hasYarnLock) {
-            manifestLockPathPairs.push({
-                manifest: path.join(directoryPath, "package.json"),
-                lock: path.join(directoryPath, "yarn.lock"),
-                lockType: lockFileParser.LockfileType.yarn,
-            });
+        if (hasManifestFileOnly || hasNoManifestFile) {
+            nodeProjects.push(directoryPath);
             continue;
         }
+        manifestLockPathPairs.push({
+            manifest: expectedManifest,
+            // TODO: correlate filtering action with expected lockfile types
+            lock: filesInDirectory.has(expectedNpmLockFile)
+                ? expectedNpmLockFile
+                : expectedYarnLockFile,
+            lockType: filesInDirectory.has(expectedNpmLockFile)
+                ? lockFileParser.LockfileType.npm
+                : lockFileParser.LockfileType.yarn,
+        });
     }
-    return manifestLockPathPairs;
+    return [manifestLockPathPairs, nodeProjects];
 }
 function stripUndefinedLabels(parserResult) {
     const optionalLabels = parserResult.labels;
@@ -192923,6 +192898,7 @@ const Debug = __webpack_require__(15158);
 const event_loop_spinner_1 = __webpack_require__(77158);
 const path = __webpack_require__(71017);
 const semver = __webpack_require__(41009);
+const common_1 = __webpack_require__(60409);
 const metadata_parser_1 = __webpack_require__(97176);
 const requirements_parser_1 = __webpack_require__(13157);
 const debug = Debug("snyk");
@@ -193007,7 +192983,7 @@ async function pipFilesToScannedProjects(filePathToContent) {
     // pre-sort each package name by version, descending
     for (const name of Object.keys(metadataItems)) {
         metadataItems[name].sort((v1, v2) => {
-            return semver.rcompare(v1.version, v2.version);
+            return (0, common_1.compareVersions)(v1.version, v2.version);
         });
     }
     for (const requirementsFile of Object.keys(requirements)) {
@@ -193188,11 +193164,11 @@ function handleDockerPullError(err, platform) {
         throw new Error(err);
     }
 }
-async function pullFromContainerRegistry(docker, targetImage, imageSavePath, username, password) {
+async function pullFromContainerRegistry(docker, targetImage, imageSavePath, username, password, platform) {
     const { hostname, imageName, tag } = extractImageDetails(targetImage);
     debug(`Attempting to pull: registry: ${hostname}, image: ${imageName}, tag: ${tag}`);
     try {
-        return await docker.pull(hostname, imageName, tag, imageSavePath, username, password);
+        return await docker.pull(hostname, imageName, tag, imageSavePath, username, password, platform);
     }
     catch (err) {
         handleDockerPullError(err.message);
@@ -193206,7 +193182,7 @@ async function pullImage(docker, targetImage, saveLocation, imageSavePath, usern
             return new image_1.ImageName(targetImage);
         }
     }
-    const { indexDigest, manifestDigest } = await pullFromContainerRegistry(docker, targetImage, imageSavePath, username, password);
+    const { indexDigest, manifestDigest } = await pullFromContainerRegistry(docker, targetImage, imageSavePath, username, password, platform);
     const imageName = new image_1.ImageName(targetImage, {
         manifest: manifestDigest,
         index: indexDigest,
@@ -194532,12 +194508,26 @@ class Docker {
             return false;
         }
     }
-    async pull(registry, repo, tag, imageSavePath, username, password) {
+    async pull(registry, repo, tag, imageSavePath, username, password, platform) {
         const dockerPull = new snyk_docker_pull_1.DockerPull();
+        const platformTokens = platform ? platform.split("/") : undefined;
+        let os = "linux";
+        let architecture = "amd64";
+        let variant;
+        if (platformTokens) {
+            const platformTokensLen = platformTokens.length;
+            if (platformTokensLen <= 1) {
+                throw Error("Invalid platform string. Please provide a platform name that follows os/arch[/variant] format.");
+            }
+            os = platformTokens[0];
+            architecture = platformTokens[1];
+            variant = platformTokens[2];
+        }
         const opt = {
             username,
             password,
             loadImage: false,
+            platform: platformTokens ? { os, architecture, variant } : undefined,
             imageSavePath,
             reqOptions: {
                 acceptManifest: [
@@ -196985,16 +196975,12 @@ exports.getJarFileContentAction = {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getNodeAppFileContentAction = void 0;
 const path_1 = __webpack_require__(71017);
-const path = __webpack_require__(71017);
 const stream_utils_1 = __webpack_require__(54540);
-const ignoredPaths = ["/usr", "/bin", "/opt", "C:\\"];
 const nodeAppFiles = ["package.json", "package-lock.json", "yarn.lock"];
 const deletedAppFiles = nodeAppFiles.map((file) => ".wh." + file);
 function filePathMatches(filePath) {
     const fileName = (0, path_1.basename)(filePath);
-    const dirName = path.dirname(filePath);
-    return (!ignoredPaths.some((ignorePath) => dirName.includes(ignorePath)) &&
-        (nodeAppFiles.includes(fileName) || deletedAppFiles.includes(fileName)));
+    return nodeAppFiles.includes(fileName) || deletedAppFiles.includes(fileName);
 }
 exports.getNodeAppFileContentAction = {
     actionName: "node-app-files",
@@ -197328,7 +197314,7 @@ exports.parseAnalysisResults = parseAnalysisResults;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.specifierValidRange = void 0;
+exports.compareVersions = exports.VERSION_EXTRACTION_REGEX = exports.specifierValidRange = void 0;
 function specifierValidRange(specifier, version) {
     specifier =
         specifier === "==" || specifier === "===" || specifier === "~="
@@ -197345,6 +197331,40 @@ function specifierValidRange(specifier, version) {
     return versionPartsLength === 2 ? "^" : "~";
 }
 exports.specifierValidRange = specifierValidRange;
+// This regex is used to extract the "semver" part from the version string.
+// See the tests for a better understanding (Also the reason why this is exported)
+exports.VERSION_EXTRACTION_REGEX = /(?<VERSION>(\d+\.)*\d+).*/;
+function compareArrays(v1, v2) {
+    const max = v1.length > v2.length ? v1.length : v2.length;
+    for (let i = 0; i < max; i++) {
+        if ((v1[i] || 0) < (v2[i] || 0)) {
+            return 1;
+        }
+        if ((v1[i] || 0) > (v2[i] || 0)) {
+            return -1;
+        }
+    }
+    return 0;
+}
+/**
+ * This function was taken from a different semver library and slightly modified.
+ * If passed to Array.prototype.sort, versions will be sorted in descending order.
+ */
+function compareVersions(version1, version2) {
+    const v1Match = exports.VERSION_EXTRACTION_REGEX.exec(version1);
+    const v2Match = exports.VERSION_EXTRACTION_REGEX.exec(version2);
+    if (v1Match === null || v2Match === null) {
+        return 0;
+    }
+    const v1 = v1Match
+        .groups.VERSION.split(".")
+        .map((part) => Number.parseInt(part, 10));
+    const v2 = v2Match
+        .groups.VERSION.split(".")
+        .map((part) => Number.parseInt(part, 10));
+    return compareArrays(v1, v2);
+}
+exports.compareVersions = compareVersions;
 //# sourceMappingURL=common.js.map
 
 /***/ }),
@@ -202854,481 +202874,6 @@ const forEachStep = (self, fn, node, thisp) => {
 module.exports = LRUCache
 
 
-/***/ }),
-
-/***/ 15305:
-/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
-
-"use strict";
-
-
-const util = __webpack_require__(73837);
-const braces = __webpack_require__(86744);
-const picomatch = __webpack_require__(59444);
-const utils = __webpack_require__(28702);
-const isEmptyString = val => val === '' || val === './';
-
-/**
- * Returns an array of strings that match one or more glob patterns.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm(list, patterns[, options]);
- *
- * console.log(mm(['a.js', 'a.txt'], ['*.js']));
- * //=> [ 'a.js' ]
- * ```
- * @param {String|Array<string>} `list` List of strings to match.
- * @param {String|Array<string>} `patterns` One or more glob patterns to use for matching.
- * @param {Object} `options` See available [options](#options)
- * @return {Array} Returns an array of matches
- * @summary false
- * @api public
- */
-
-const micromatch = (list, patterns, options) => {
-  patterns = [].concat(patterns);
-  list = [].concat(list);
-
-  let omit = new Set();
-  let keep = new Set();
-  let items = new Set();
-  let negatives = 0;
-
-  let onResult = state => {
-    items.add(state.output);
-    if (options && options.onResult) {
-      options.onResult(state);
-    }
-  };
-
-  for (let i = 0; i < patterns.length; i++) {
-    let isMatch = picomatch(String(patterns[i]), { ...options, onResult }, true);
-    let negated = isMatch.state.negated || isMatch.state.negatedExtglob;
-    if (negated) negatives++;
-
-    for (let item of list) {
-      let matched = isMatch(item, true);
-
-      let match = negated ? !matched.isMatch : matched.isMatch;
-      if (!match) continue;
-
-      if (negated) {
-        omit.add(matched.output);
-      } else {
-        omit.delete(matched.output);
-        keep.add(matched.output);
-      }
-    }
-  }
-
-  let result = negatives === patterns.length ? [...items] : [...keep];
-  let matches = result.filter(item => !omit.has(item));
-
-  if (options && matches.length === 0) {
-    if (options.failglob === true) {
-      throw new Error(`No matches found for "${patterns.join(', ')}"`);
-    }
-
-    if (options.nonull === true || options.nullglob === true) {
-      return options.unescape ? patterns.map(p => p.replace(/\\/g, '')) : patterns;
-    }
-  }
-
-  return matches;
-};
-
-/**
- * Backwards compatibility
- */
-
-micromatch.match = micromatch;
-
-/**
- * Returns a matcher function from the given glob `pattern` and `options`.
- * The returned function takes a string to match as its only argument and returns
- * true if the string is a match.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.matcher(pattern[, options]);
- *
- * const isMatch = mm.matcher('*.!(*a)');
- * console.log(isMatch('a.a')); //=> false
- * console.log(isMatch('a.b')); //=> true
- * ```
- * @param {String} `pattern` Glob pattern
- * @param {Object} `options`
- * @return {Function} Returns a matcher function.
- * @api public
- */
-
-micromatch.matcher = (pattern, options) => picomatch(pattern, options);
-
-/**
- * Returns true if **any** of the given glob `patterns` match the specified `string`.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.isMatch(string, patterns[, options]);
- *
- * console.log(mm.isMatch('a.a', ['b.*', '*.a'])); //=> true
- * console.log(mm.isMatch('a.a', 'b.*')); //=> false
- * ```
- * @param {String} `str` The string to test.
- * @param {String|Array} `patterns` One or more glob patterns to use for matching.
- * @param {Object} `[options]` See available [options](#options).
- * @return {Boolean} Returns true if any patterns match `str`
- * @api public
- */
-
-micromatch.isMatch = (str, patterns, options) => picomatch(patterns, options)(str);
-
-/**
- * Backwards compatibility
- */
-
-micromatch.any = micromatch.isMatch;
-
-/**
- * Returns a list of strings that _**do not match any**_ of the given `patterns`.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.not(list, patterns[, options]);
- *
- * console.log(mm.not(['a.a', 'b.b', 'c.c'], '*.a'));
- * //=> ['b.b', 'c.c']
- * ```
- * @param {Array} `list` Array of strings to match.
- * @param {String|Array} `patterns` One or more glob pattern to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Array} Returns an array of strings that **do not match** the given patterns.
- * @api public
- */
-
-micromatch.not = (list, patterns, options = {}) => {
-  patterns = [].concat(patterns).map(String);
-  let result = new Set();
-  let items = [];
-
-  let onResult = state => {
-    if (options.onResult) options.onResult(state);
-    items.push(state.output);
-  };
-
-  let matches = new Set(micromatch(list, patterns, { ...options, onResult }));
-
-  for (let item of items) {
-    if (!matches.has(item)) {
-      result.add(item);
-    }
-  }
-  return [...result];
-};
-
-/**
- * Returns true if the given `string` contains the given pattern. Similar
- * to [.isMatch](#isMatch) but the pattern can match any part of the string.
- *
- * ```js
- * var mm = require('micromatch');
- * // mm.contains(string, pattern[, options]);
- *
- * console.log(mm.contains('aa/bb/cc', '*b'));
- * //=> true
- * console.log(mm.contains('aa/bb/cc', '*d'));
- * //=> false
- * ```
- * @param {String} `str` The string to match.
- * @param {String|Array} `patterns` Glob pattern to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Boolean} Returns true if any of the patterns matches any part of `str`.
- * @api public
- */
-
-micromatch.contains = (str, pattern, options) => {
-  if (typeof str !== 'string') {
-    throw new TypeError(`Expected a string: "${util.inspect(str)}"`);
-  }
-
-  if (Array.isArray(pattern)) {
-    return pattern.some(p => micromatch.contains(str, p, options));
-  }
-
-  if (typeof pattern === 'string') {
-    if (isEmptyString(str) || isEmptyString(pattern)) {
-      return false;
-    }
-
-    if (str.includes(pattern) || (str.startsWith('./') && str.slice(2).includes(pattern))) {
-      return true;
-    }
-  }
-
-  return micromatch.isMatch(str, pattern, { ...options, contains: true });
-};
-
-/**
- * Filter the keys of the given object with the given `glob` pattern
- * and `options`. Does not attempt to match nested keys. If you need this feature,
- * use [glob-object][] instead.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.matchKeys(object, patterns[, options]);
- *
- * const obj = { aa: 'a', ab: 'b', ac: 'c' };
- * console.log(mm.matchKeys(obj, '*b'));
- * //=> { ab: 'b' }
- * ```
- * @param {Object} `object` The object with keys to filter.
- * @param {String|Array} `patterns` One or more glob patterns to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Object} Returns an object with only keys that match the given patterns.
- * @api public
- */
-
-micromatch.matchKeys = (obj, patterns, options) => {
-  if (!utils.isObject(obj)) {
-    throw new TypeError('Expected the first argument to be an object');
-  }
-  let keys = micromatch(Object.keys(obj), patterns, options);
-  let res = {};
-  for (let key of keys) res[key] = obj[key];
-  return res;
-};
-
-/**
- * Returns true if some of the strings in the given `list` match any of the given glob `patterns`.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.some(list, patterns[, options]);
- *
- * console.log(mm.some(['foo.js', 'bar.js'], ['*.js', '!foo.js']));
- * // true
- * console.log(mm.some(['foo.js'], ['*.js', '!foo.js']));
- * // false
- * ```
- * @param {String|Array} `list` The string or array of strings to test. Returns as soon as the first match is found.
- * @param {String|Array} `patterns` One or more glob patterns to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Boolean} Returns true if any `patterns` matches any of the strings in `list`
- * @api public
- */
-
-micromatch.some = (list, patterns, options) => {
-  let items = [].concat(list);
-
-  for (let pattern of [].concat(patterns)) {
-    let isMatch = picomatch(String(pattern), options);
-    if (items.some(item => isMatch(item))) {
-      return true;
-    }
-  }
-  return false;
-};
-
-/**
- * Returns true if every string in the given `list` matches
- * any of the given glob `patterns`.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.every(list, patterns[, options]);
- *
- * console.log(mm.every('foo.js', ['foo.js']));
- * // true
- * console.log(mm.every(['foo.js', 'bar.js'], ['*.js']));
- * // true
- * console.log(mm.every(['foo.js', 'bar.js'], ['*.js', '!foo.js']));
- * // false
- * console.log(mm.every(['foo.js'], ['*.js', '!foo.js']));
- * // false
- * ```
- * @param {String|Array} `list` The string or array of strings to test.
- * @param {String|Array} `patterns` One or more glob patterns to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Boolean} Returns true if all `patterns` matches all of the strings in `list`
- * @api public
- */
-
-micromatch.every = (list, patterns, options) => {
-  let items = [].concat(list);
-
-  for (let pattern of [].concat(patterns)) {
-    let isMatch = picomatch(String(pattern), options);
-    if (!items.every(item => isMatch(item))) {
-      return false;
-    }
-  }
-  return true;
-};
-
-/**
- * Returns true if **all** of the given `patterns` match
- * the specified string.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.all(string, patterns[, options]);
- *
- * console.log(mm.all('foo.js', ['foo.js']));
- * // true
- *
- * console.log(mm.all('foo.js', ['*.js', '!foo.js']));
- * // false
- *
- * console.log(mm.all('foo.js', ['*.js', 'foo.js']));
- * // true
- *
- * console.log(mm.all('foo.js', ['*.js', 'f*', '*o*', '*o.js']));
- * // true
- * ```
- * @param {String|Array} `str` The string to test.
- * @param {String|Array} `patterns` One or more glob patterns to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Boolean} Returns true if any patterns match `str`
- * @api public
- */
-
-micromatch.all = (str, patterns, options) => {
-  if (typeof str !== 'string') {
-    throw new TypeError(`Expected a string: "${util.inspect(str)}"`);
-  }
-
-  return [].concat(patterns).every(p => picomatch(p, options)(str));
-};
-
-/**
- * Returns an array of matches captured by `pattern` in `string, or `null` if the pattern did not match.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.capture(pattern, string[, options]);
- *
- * console.log(mm.capture('test/*.js', 'test/foo.js'));
- * //=> ['foo']
- * console.log(mm.capture('test/*.js', 'foo/bar.css'));
- * //=> null
- * ```
- * @param {String} `glob` Glob pattern to use for matching.
- * @param {String} `input` String to match
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Array|null} Returns an array of captures if the input matches the glob pattern, otherwise `null`.
- * @api public
- */
-
-micromatch.capture = (glob, input, options) => {
-  let posix = utils.isWindows(options);
-  let regex = picomatch.makeRe(String(glob), { ...options, capture: true });
-  let match = regex.exec(posix ? utils.toPosixSlashes(input) : input);
-
-  if (match) {
-    return match.slice(1).map(v => v === void 0 ? '' : v);
-  }
-};
-
-/**
- * Create a regular expression from the given glob `pattern`.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.makeRe(pattern[, options]);
- *
- * console.log(mm.makeRe('*.js'));
- * //=> /^(?:(\.[\\\/])?(?!\.)(?=.)[^\/]*?\.js)$/
- * ```
- * @param {String} `pattern` A glob pattern to convert to regex.
- * @param {Object} `options`
- * @return {RegExp} Returns a regex created from the given pattern.
- * @api public
- */
-
-micromatch.makeRe = (...args) => picomatch.makeRe(...args);
-
-/**
- * Scan a glob pattern to separate the pattern into segments. Used
- * by the [split](#split) method.
- *
- * ```js
- * const mm = require('micromatch');
- * const state = mm.scan(pattern[, options]);
- * ```
- * @param {String} `pattern`
- * @param {Object} `options`
- * @return {Object} Returns an object with
- * @api public
- */
-
-micromatch.scan = (...args) => picomatch.scan(...args);
-
-/**
- * Parse a glob pattern to create the source string for a regular
- * expression.
- *
- * ```js
- * const mm = require('micromatch');
- * const state = mm.parse(pattern[, options]);
- * ```
- * @param {String} `glob`
- * @param {Object} `options`
- * @return {Object} Returns an object with useful properties and output to be used as regex source string.
- * @api public
- */
-
-micromatch.parse = (patterns, options) => {
-  let res = [];
-  for (let pattern of [].concat(patterns || [])) {
-    for (let str of braces(String(pattern), options)) {
-      res.push(picomatch.parse(str, options));
-    }
-  }
-  return res;
-};
-
-/**
- * Process the given brace `pattern`.
- *
- * ```js
- * const { braces } = require('micromatch');
- * console.log(braces('foo/{a,b,c}/bar'));
- * //=> [ 'foo/(a|b|c)/bar' ]
- *
- * console.log(braces('foo/{a,b,c}/bar', { expand: true }));
- * //=> [ 'foo/a/bar', 'foo/b/bar', 'foo/c/bar' ]
- * ```
- * @param {String} `pattern` String with brace pattern to process.
- * @param {Object} `options` Any [options](#options) to change how expansion is performed. See the [braces][] library for all available options.
- * @return {Array}
- * @api public
- */
-
-micromatch.braces = (pattern, options) => {
-  if (typeof pattern !== 'string') throw new TypeError('Expected a string');
-  if ((options && options.nobrace === true) || !/\{.*\}/.test(pattern)) {
-    return [pattern];
-  }
-  return braces(pattern, options);
-};
-
-/**
- * Expand braces
- */
-
-micromatch.braceExpand = (pattern, options) => {
-  if (typeof pattern !== 'string') throw new TypeError('Expected a string');
-  return micromatch.braces(pattern, { ...options, expand: true });
-};
-
-/**
- * Expose micromatch
- */
-
-module.exports = micromatch;
-
-
 /***/ }),
 
 /***/ 38545:
@@ -206718,7 +206263,7 @@ const util_1 = __webpack_require__(76904);
 const errors_1 = __webpack_require__(52495);
 const parsers_1 = __webpack_require__(82244);
 const semver = __webpack_require__(41009);
-const micromatch = __webpack_require__(15305);
+const micromatch = __webpack_require__(70850);
 const pathUtil = __webpack_require__(71017);
 const event_loop_spinner_1 = __webpack_require__(77158);
 const parseNpmLockV2Project = async (pkgJsonContent, pkgLockContent, options) => {
@@ -286599,11 +286144,12 @@ const PREMATURE_CLOSE = new Error('Premature close')
 
 const queueTick = __webpack_require__(63522)
 const FIFO = __webpack_require__(91607)
+const TextDecoder = __webpack_require__(27540)
 
 /* eslint-disable no-multi-spaces */
 
-// 27 bits used total (4 from shared, 13 from read, and 10 from write)
-const MAX = ((1 << 27) - 1)
+// 29 bits used total (4 from shared, 14 from read, and 11 from write)
+const MAX = ((1 << 29) - 1)
 
 // Shared state
 const OPENING       = 0b0001
@@ -286615,25 +286161,27 @@ const NOT_OPENING = MAX ^ OPENING
 const NOT_PREDESTROYING = MAX ^ PREDESTROYING
 
 // Read state (4 bit offset from shared state)
-const READ_ACTIVE           = 0b0000000000001 << 4
-const READ_UPDATING         = 0b0000000000010 << 4
-const READ_PRIMARY          = 0b0000000000100 << 4
-const READ_QUEUED           = 0b0000000001000 << 4
-const READ_RESUMED          = 0b0000000010000 << 4
-const READ_PIPE_DRAINED     = 0b0000000100000 << 4
-const READ_ENDING           = 0b0000001000000 << 4
-const READ_EMIT_DATA        = 0b0000010000000 << 4
-const READ_EMIT_READABLE    = 0b0000100000000 << 4
-const READ_EMITTED_READABLE = 0b0001000000000 << 4
-const READ_DONE             = 0b0010000000000 << 4
-const READ_NEXT_TICK        = 0b0100000000000 << 4
-const READ_NEEDS_PUSH       = 0b1000000000000 << 4
+const READ_ACTIVE           = 0b00000000000001 << 4
+const READ_UPDATING         = 0b00000000000010 << 4
+const READ_PRIMARY          = 0b00000000000100 << 4
+const READ_QUEUED           = 0b00000000001000 << 4
+const READ_RESUMED          = 0b00000000010000 << 4
+const READ_PIPE_DRAINED     = 0b00000000100000 << 4
+const READ_ENDING           = 0b00000001000000 << 4
+const READ_EMIT_DATA        = 0b00000010000000 << 4
+const READ_EMIT_READABLE    = 0b00000100000000 << 4
+const READ_EMITTED_READABLE = 0b00001000000000 << 4
+const READ_DONE             = 0b00010000000000 << 4
+const READ_NEXT_TICK        = 0b00100000000000 << 4
+const READ_NEEDS_PUSH       = 0b01000000000000 << 4
+const READ_READ_AHEAD       = 0b10000000000000 << 4
 
 // Combined read state
 const READ_FLOWING = READ_RESUMED | READ_PIPE_DRAINED
 const READ_ACTIVE_AND_NEEDS_PUSH = READ_ACTIVE | READ_NEEDS_PUSH
 const READ_PRIMARY_AND_ACTIVE = READ_PRIMARY | READ_ACTIVE
 const READ_EMIT_READABLE_AND_QUEUED = READ_EMIT_READABLE | READ_QUEUED
+const READ_RESUMED_READ_AHEAD = READ_RESUMED | READ_READ_AHEAD
 
 const READ_NOT_ACTIVE             = MAX ^ READ_ACTIVE
 const READ_NON_PRIMARY            = MAX ^ READ_PRIMARY
@@ -286645,18 +286193,21 @@ const READ_NOT_ENDING             = MAX ^ READ_ENDING
 const READ_PIPE_NOT_DRAINED       = MAX ^ READ_FLOWING
 const READ_NOT_NEXT_TICK          = MAX ^ READ_NEXT_TICK
 const READ_NOT_UPDATING           = MAX ^ READ_UPDATING
-
-// Write state (17 bit offset, 4 bit offset from shared state and 13 from read state)
-const WRITE_ACTIVE     = 0b0000000001 << 17
-const WRITE_UPDATING   = 0b0000000010 << 17
-const WRITE_PRIMARY    = 0b0000000100 << 17
-const WRITE_QUEUED     = 0b0000001000 << 17
-const WRITE_UNDRAINED  = 0b0000010000 << 17
-const WRITE_DONE       = 0b0000100000 << 17
-const WRITE_EMIT_DRAIN = 0b0001000000 << 17
-const WRITE_NEXT_TICK  = 0b0010000000 << 17
-const WRITE_WRITING    = 0b0100000000 << 17
-const WRITE_FINISHING  = 0b1000000000 << 17
+const READ_NO_READ_AHEAD          = MAX ^ READ_READ_AHEAD
+const READ_PAUSED_NO_READ_AHEAD   = MAX ^ READ_RESUMED_READ_AHEAD
+
+// Write state (18 bit offset, 4 bit offset from shared state and 14 from read state)
+const WRITE_ACTIVE     = 0b00000000001 << 18
+const WRITE_UPDATING   = 0b00000000010 << 18
+const WRITE_PRIMARY    = 0b00000000100 << 18
+const WRITE_QUEUED     = 0b00000001000 << 18
+const WRITE_UNDRAINED  = 0b00000010000 << 18
+const WRITE_DONE       = 0b00000100000 << 18
+const WRITE_EMIT_DRAIN = 0b00001000000 << 18
+const WRITE_NEXT_TICK  = 0b00010000000 << 18
+const WRITE_WRITING    = 0b00100000000 << 18
+const WRITE_FINISHING  = 0b01000000000 << 18
+const WRITE_CORKED     = 0b10000000000 << 18
 
 const WRITE_NOT_ACTIVE    = MAX ^ (WRITE_ACTIVE | WRITE_WRITING)
 const WRITE_NON_PRIMARY   = MAX ^ WRITE_PRIMARY
@@ -286665,6 +286216,7 @@ const WRITE_DRAINED       = MAX ^ WRITE_UNDRAINED
 const WRITE_NOT_QUEUED    = MAX ^ WRITE_QUEUED
 const WRITE_NOT_NEXT_TICK = MAX ^ WRITE_NEXT_TICK
 const WRITE_NOT_UPDATING  = MAX ^ WRITE_UPDATING
+const WRITE_NOT_CORKED    = MAX ^ WRITE_CORKED
 
 // Combined shared state
 const ACTIVE = READ_ACTIVE | WRITE_ACTIVE
@@ -286683,7 +286235,7 @@ const READ_PRIMARY_STATUS = OPEN_STATUS | READ_ENDING | READ_DONE
 const READ_STATUS = OPEN_STATUS | READ_DONE | READ_QUEUED
 const READ_ENDING_STATUS = OPEN_STATUS | READ_ENDING | READ_QUEUED
 const READ_READABLE_STATUS = OPEN_STATUS | READ_EMIT_READABLE | READ_QUEUED | READ_EMITTED_READABLE
-const SHOULD_NOT_READ = OPEN_STATUS | READ_ACTIVE | READ_ENDING | READ_DONE | READ_NEEDS_PUSH
+const SHOULD_NOT_READ = OPEN_STATUS | READ_ACTIVE | READ_ENDING | READ_DONE | READ_NEEDS_PUSH | READ_READ_AHEAD
 const READ_BACKPRESSURE_STATUS = DESTROY_STATUS | READ_ENDING | READ_DONE
 const READ_UPDATE_SYNC_STATUS = READ_UPDATING | OPEN_STATUS | READ_NEXT_TICK | READ_PRIMARY
 
@@ -286692,7 +286244,7 @@ const WRITE_PRIMARY_STATUS = OPEN_STATUS | WRITE_FINISHING | WRITE_DONE
 const WRITE_QUEUED_AND_UNDRAINED = WRITE_QUEUED | WRITE_UNDRAINED
 const WRITE_QUEUED_AND_ACTIVE = WRITE_QUEUED | WRITE_ACTIVE
 const WRITE_DRAIN_STATUS = WRITE_QUEUED | WRITE_UNDRAINED | OPEN_STATUS | WRITE_ACTIVE
-const WRITE_STATUS = OPEN_STATUS | WRITE_ACTIVE | WRITE_QUEUED
+const WRITE_STATUS = OPEN_STATUS | WRITE_ACTIVE | WRITE_QUEUED | WRITE_CORKED
 const WRITE_PRIMARY_AND_ACTIVE = WRITE_PRIMARY | WRITE_ACTIVE
 const WRITE_ACTIVE_AND_WRITING = WRITE_ACTIVE | WRITE_WRITING
 const WRITE_FINISHING_STATUS = OPEN_STATUS | WRITE_FINISHING | WRITE_QUEUED_AND_ACTIVE | WRITE_DONE
@@ -286826,8 +286378,9 @@ class ReadableState {
   constructor (stream, { highWaterMark = 16384, map = null, mapReadable, byteLength, byteLengthReadable } = {}) {
     this.stream = stream
     this.queue = new FIFO()
-    this.highWaterMark = highWaterMark
+    this.highWaterMark = highWaterMark === 0 ? 1 : highWaterMark
     this.buffered = 0
+    this.readAhead = highWaterMark > 0
     this.error = null
     this.pipeline = null
     this.byteLength = byteLengthReadable || byteLength || defaultByteLength
@@ -286877,7 +286430,11 @@ class ReadableState {
       return false
     }
 
-    if (this.map !== null) data = this.map(data)
+    if (this.map !== null) {
+      data = this.map(data)
+      if (data === null) return this.buffered < this.highWaterMark
+    }
+
     this.buffered += this.byteLength(data)
     this.queue.push(data)
 
@@ -286917,6 +286474,11 @@ class ReadableState {
       return data
     }
 
+    if (this.readAhead === false) {
+      stream._duplexState |= READ_READ_AHEAD
+      this.updateNextTick()
+    }
+
     return null
   }
 
@@ -286938,7 +286500,7 @@ class ReadableState {
     do {
       this.drain()
 
-      while (this.buffered < this.highWaterMark && (stream._duplexState & SHOULD_NOT_READ) === 0) {
+      while (this.buffered < this.highWaterMark && (stream._duplexState & SHOULD_NOT_READ) === READ_READ_AHEAD) {
         stream._duplexState |= READ_ACTIVE_AND_NEEDS_PUSH
         stream._read(this.afterRead)
         this.drain()
@@ -287111,6 +286673,7 @@ function afterWrite (err) {
 function afterRead (err) {
   if (err) this.stream.destroy(err)
   this.stream._duplexState &= READ_NOT_ACTIVE
+  if (this.readAhead === false && (this.stream._duplexState & READ_RESUMED) === 0) this.stream._duplexState &= READ_NO_READ_AHEAD
   this.updateCallback()
 }
 
@@ -287168,7 +286731,7 @@ function afterTransform (err, data) {
 function newListener (name) {
   if (this._readableState !== null) {
     if (name === 'data') {
-      this._duplexState |= (READ_EMIT_DATA | READ_RESUMED)
+      this._duplexState |= (READ_EMIT_DATA | READ_RESUMED_READ_AHEAD)
       this._readableState.updateNextTick()
     }
     if (name === 'readable') {
@@ -287261,12 +286824,26 @@ class Readable extends Stream {
   constructor (opts) {
     super(opts)
 
-    this._duplexState |= OPENING | WRITE_DONE
+    this._duplexState |= OPENING | WRITE_DONE | READ_READ_AHEAD
     this._readableState = new ReadableState(this, opts)
 
     if (opts) {
+      if (this._readableState.readAhead === false) this._duplexState &= READ_NO_READ_AHEAD
       if (opts.read) this._read = opts.read
       if (opts.eagerOpen) this._readableState.updateNextTick()
+      if (opts.encoding) this.setEncoding(opts.encoding)
+    }
+  }
+
+  setEncoding (encoding) {
+    const dec = new TextDecoder(encoding)
+    const map = this._readableState.map || echo
+    this._readableState.map = mapOrSkip
+    return this
+
+    function mapOrSkip (data) {
+      const next = dec.push(data)
+      return next === '' ? null : map(next)
     }
   }
 
@@ -287296,13 +286873,13 @@ class Readable extends Stream {
   }
 
   resume () {
-    this._duplexState |= READ_RESUMED
+    this._duplexState |= READ_RESUMED_READ_AHEAD
     this._readableState.updateNextTick()
     return this
   }
 
   pause () {
-    this._duplexState &= READ_PAUSED
+    this._duplexState &= (this._readableState.readAhead === false ? READ_PAUSED_NO_READ_AHEAD : READ_PAUSED)
     return this
   }
 
@@ -287430,6 +287007,15 @@ class Writable extends Stream {
     }
   }
 
+  cork () {
+    this._duplexState |= WRITE_CORKED
+  }
+
+  uncork () {
+    this._duplexState &= WRITE_NOT_CORKED
+    this._writableState.updateNextTick()
+  }
+
   _writev (batch, cb) {
     cb(null)
   }
@@ -287474,7 +287060,7 @@ class Duplex extends Readable { // and Writable
   constructor (opts) {
     super(opts)
 
-    this._duplexState = OPENING
+    this._duplexState = OPENING | (this._duplexState & READ_READ_AHEAD)
     this._writableState = new WritableState(this, opts)
 
     if (opts) {
@@ -287484,6 +287070,15 @@ class Duplex extends Readable { // and Writable
     }
   }
 
+  cork () {
+    this._duplexState |= WRITE_CORKED
+  }
+
+  uncork () {
+    this._duplexState &= WRITE_NOT_CORKED
+    this._writableState.updateNextTick()
+  }
+
   _writev (batch, cb) {
     cb(null)
   }
@@ -287643,6 +287238,10 @@ function pipeline (stream, ...streams) {
   }
 }
 
+function echo (s) {
+  return s
+}
+
 function isStream (stream) {
   return !!stream._readableState || !!stream._writableState
 }
@@ -288531,6 +288130,198 @@ Pack.prototype._read = function (n) {
 module.exports = Pack
 
 
+/***/ }),
+
+/***/ 27540:
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+const PassThroughDecoder = __webpack_require__(30558)
+const UTF8Decoder = __webpack_require__(86888)
+
+module.exports = class TextDecoder {
+  constructor (encoding = 'utf8') {
+    this.encoding = normalizeEncoding(encoding)
+
+    switch (this.encoding) {
+      case 'utf8':
+        this.decoder = new UTF8Decoder()
+        break
+      case 'utf16le':
+      case 'base64':
+        throw new Error('Unsupported encoding: ' + this.encoding)
+      default:
+        this.decoder = new PassThroughDecoder(this.encoding)
+    }
+  }
+
+  push (data) {
+    if (typeof data === 'string') return data
+    return this.decoder.decode(data)
+  }
+
+  // For Node.js compatibility
+  write (data) {
+    return this.push(data)
+  }
+
+  end (data) {
+    let result = ''
+    if (data) result = this.push(data)
+    result += this.decoder.flush()
+    return result
+  }
+}
+
+function normalizeEncoding (encoding) {
+  encoding = encoding.toLowerCase()
+
+  switch (encoding) {
+    case 'utf8':
+    case 'utf-8':
+      return 'utf8'
+    case 'ucs2':
+    case 'ucs-2':
+    case 'utf16le':
+    case 'utf-16le':
+      return 'utf16le'
+    case 'latin1':
+    case 'binary':
+      return 'latin1'
+    case 'base64':
+    case 'ascii':
+    case 'hex':
+      return encoding
+    default:
+      throw new Error('Unknown encoding: ' + encoding)
+  }
+};
+
+
+/***/ }),
+
+/***/ 30558:
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+const b4a = __webpack_require__(85792)
+
+module.exports = class PassThroughDecoder {
+  constructor (encoding) {
+    this.encoding = encoding
+  }
+
+  decode (tail) {
+    return b4a.toString(tail, this.encoding)
+  }
+
+  flush () {
+    return ''
+  }
+}
+
+
+/***/ }),
+
+/***/ 86888:
+/***/ ((module, __unused_webpack_exports, __webpack_require__) => {
+
+const b4a = __webpack_require__(85792)
+
+/**
+ * https://encoding.spec.whatwg.org/#utf-8-decoder
+ */
+module.exports = class UTF8Decoder {
+  constructor () {
+    this.codePoint = 0
+    this.bytesSeen = 0
+    this.bytesNeeded = 0
+    this.lowerBoundary = 0x80
+    this.upperBoundary = 0xbf
+  }
+
+  decode (data) {
+    // If we have a fast path, just sniff if the last part is a boundary
+    if (this.bytesNeeded === 0) {
+      let isBoundary = true
+
+      for (let i = Math.max(0, data.byteLength - 4), n = data.byteLength; i < n && isBoundary; i++) {
+        isBoundary = data[i] <= 0x7f
+      }
+
+      if (isBoundary) return b4a.toString(data, 'utf8')
+    }
+
+    let result = ''
+
+    for (let i = 0, n = data.byteLength; i < n; i++) {
+      const byte = data[i]
+
+      if (this.bytesNeeded === 0) {
+        if (byte <= 0x7f) {
+          result += String.fromCharCode(byte)
+        } else if (byte >= 0xc2 && byte <= 0xdf) {
+          this.bytesNeeded = 1
+          this.codePoint = byte & 0x1f
+        } else if (byte >= 0xe0 && byte <= 0xef) {
+          if (byte === 0xe0) this.lowerBoundary = 0xa0
+          else if (byte === 0xed) this.upperBoundary = 0x9f
+          this.bytesNeeded = 2
+          this.codePoint = byte & 0xf
+        } else if (byte >= 0xf0 && byte <= 0xf4) {
+          if (byte === 0xf0) this.lowerBoundary = 0x90
+          if (byte === 0xf4) this.upperBoundary = 0x8f
+          this.bytesNeeded = 3
+          this.codePoint = byte & 0x7
+        } else {
+          result += '\ufffd'
+        }
+
+        continue
+      }
+
+      if (byte < this.lowerBoundary || byte > this.upperBoundary) {
+        this.codePoint = 0
+        this.bytesNeeded = 0
+        this.bytesSeen = 0
+        this.lowerBoundary = 0x80
+        this.upperBoundary = 0xbf
+
+        result += '\ufffd'
+
+        continue
+      }
+
+      this.lowerBoundary = 0x80
+      this.upperBoundary = 0xbf
+
+      this.codePoint = (this.codePoint << 6) | (byte & 0x3f)
+      this.bytesSeen++
+
+      if (this.bytesSeen !== this.bytesNeeded) continue
+
+      result += String.fromCodePoint(this.codePoint)
+
+      this.codePoint = 0
+      this.bytesNeeded = 0
+      this.bytesSeen = 0
+    }
+
+    return result
+  }
+
+  flush () {
+    const result = this.bytesNeeded > 0 ? '\ufffd' : ''
+
+    this.codePoint = 0
+    this.bytesNeeded = 0
+    this.bytesSeen = 0
+    this.lowerBoundary = 0x80
+    this.upperBoundary = 0xbf
+
+    return result
+  }
+}
+
+
 /***/ }),
 
 /***/ 75575: