Skip to content

Commit daad9ad

Browse files
wraithgarwraithgar
committedJul 18, 2023
deps: semver@7.5.4
·
v11.2.0arborist-v6.4.0
1 parent 47be5ce commit daad9ad

File tree

6 files changed

+49
-22
lines changed

6 files changed

+49
-22
lines changed
 

‎node_modules/semver/classes/range.js

+4-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ class Range {
3838
this.set = this.raw
3939
.split('||')
4040
// map the range to a 2d array of comparators
41-
.map(r => this.parseRange(r))
41+
.map(r => this.parseRange(r.trim()))
4242
// throw out any comparator lists that are empty
4343
// this generally means that it was not a valid range, which is allowed
4444
// in loose mode, but will still throw if the WHOLE range is invalid.
@@ -98,15 +98,18 @@ class Range {
9898
const hr = loose ? re[t.HYPHENRANGELOOSE] : re[t.HYPHENRANGE]
9999
range = range.replace(hr, hyphenReplace(this.options.includePrerelease))
100100
debug('hyphen replace', range)
101+
101102
// `> 1.2.3 < 1.2.5` => `>1.2.3 <1.2.5`
102103
range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace)
103104
debug('comparator trim', range)
104105

105106
// `~ 1.2.3` => `~1.2.3`
106107
range = range.replace(re[t.TILDETRIM], tildeTrimReplace)
108+
debug('tilde trim', range)
107109

108110
// `^ 1.2.3` => `^1.2.3`
109111
range = range.replace(re[t.CARETTRIM], caretTrimReplace)
112+
debug('caret trim', range)
110113

111114
// At this point, the range is completely trimmed and
112115
// ready to be split into comparators.

‎node_modules/semver/internal/constants.js

+5
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER ||
99
// Max safe segment length for coercion.
1010
const MAX_SAFE_COMPONENT_LENGTH = 16
1111

12+
// Max safe length for a build identifier. The max length minus 6 characters for
13+
// the shortest version with a build 0.0.0+BUILD.
14+
const MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6
15+
1216
const RELEASE_TYPES = [
1317
'major',
1418
'premajor',
@@ -22,6 +26,7 @@ const RELEASE_TYPES = [
2226
module.exports = {
2327
MAX_LENGTH,
2428
MAX_SAFE_COMPONENT_LENGTH,
29+
MAX_SAFE_BUILD_LENGTH,
2530
MAX_SAFE_INTEGER,
2631
RELEASE_TYPES,
2732
SEMVER_SPEC_VERSION,

‎node_modules/semver/internal/re.js

+32-13
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
const { MAX_SAFE_COMPONENT_LENGTH } = require('./constants')
1+
const {
2+
MAX_SAFE_COMPONENT_LENGTH,
3+
MAX_SAFE_BUILD_LENGTH,
4+
MAX_LENGTH,
5+
} = require('./constants')
26
const debug = require('./debug')
37
exports = module.exports = {}
48

@@ -9,16 +13,31 @@ const src = exports.src = []
913
const t = exports.t = {}
1014
let R = 0
1115

16+
const LETTERDASHNUMBER = '[a-zA-Z0-9-]'
17+
18+
// Replace some greedy regex tokens to prevent regex dos issues. These regex are
19+
// used internally via the safeRe object since all inputs in this library get
20+
// normalized first to trim and collapse all extra whitespace. The original
21+
// regexes are exported for userland consumption and lower level usage. A
22+
// future breaking change could export the safer regex only with a note that
23+
// all input should have extra whitespace removed.
24+
const safeRegexReplacements = [
25+
['\\s', 1],
26+
['\\d', MAX_LENGTH],
27+
[LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH],
28+
]
29+
30+
const makeSafeRegex = (value) => {
31+
for (const [token, max] of safeRegexReplacements) {
32+
value = value
33+
.split(`${token}*`).join(`${token}{0,${max}}`)
34+
.split(`${token}+`).join(`${token}{1,${max}}`)
35+
}
36+
return value
37+
}
38+
1239
const createToken = (name, value, isGlobal) => {
13-
// Replace all greedy whitespace to prevent regex dos issues. These regex are
14-
// used internally via the safeRe object since all inputs in this library get
15-
// normalized first to trim and collapse all extra whitespace. The original
16-
// regexes are exported for userland consumption and lower level usage. A
17-
// future breaking change could export the safer regex only with a note that
18-
// all input should have extra whitespace removed.
19-
const safe = value
20-
.split('\\s*').join('\\s{0,1}')
21-
.split('\\s+').join('\\s')
40+
const safe = makeSafeRegex(value)
2241
const index = R++
2342
debug(name, index, value)
2443
t[name] = index
@@ -34,13 +53,13 @@ const createToken = (name, value, isGlobal) => {
3453
// A single `0`, or a non-zero digit followed by zero or more digits.
3554

3655
createToken('NUMERICIDENTIFIER', '0|[1-9]\\d*')
37-
createToken('NUMERICIDENTIFIERLOOSE', '[0-9]+')
56+
createToken('NUMERICIDENTIFIERLOOSE', '\\d+')
3857

3958
// ## Non-numeric Identifier
4059
// Zero or more digits, followed by a letter or hyphen, and then zero or
4160
// more letters, digits, or hyphens.
4261

43-
createToken('NONNUMERICIDENTIFIER', '\\d*[a-zA-Z-][a-zA-Z0-9-]*')
62+
createToken('NONNUMERICIDENTIFIER', `\\d*[a-zA-Z-]${LETTERDASHNUMBER}*`)
4463

4564
// ## Main Version
4665
// Three dot-separated numeric identifiers.
@@ -75,7 +94,7 @@ createToken('PRERELEASELOOSE', `(?:-?(${src[t.PRERELEASEIDENTIFIERLOOSE]
7594
// ## Build Metadata Identifier
7695
// Any combination of digits, letters, or hyphens.
7796

78-
createToken('BUILDIDENTIFIER', '[0-9A-Za-z-]+')
97+
createToken('BUILDIDENTIFIER', `${LETTERDASHNUMBER}+`)
7998

8099
// ## Build Metadata
81100
// Plus sign, followed by one or more period-separated build metadata

‎node_modules/semver/package.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "semver",
3-
"version": "7.5.2",
3+
"version": "7.5.4",
44
"description": "The semantic version parser used by npm.",
55
"main": "index.js",
66
"scripts": {
@@ -14,7 +14,7 @@
1414
},
1515
"devDependencies": {
1616
"@npmcli/eslint-config": "^4.0.0",
17-
"@npmcli/template-oss": "4.15.1",
17+
"@npmcli/template-oss": "4.17.0",
1818
"tap": "^16.0.0"
1919
},
2020
"license": "ISC",
@@ -53,7 +53,7 @@
5353
"author": "GitHub Inc.",
5454
"templateOSS": {
5555
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
56-
"version": "4.15.1",
56+
"version": "4.17.0",
5757
"engines": ">=10",
5858
"ciVersions": [
5959
"10.0.0",

‎package-lock.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@
143143
"proc-log": "^3.0.0",
144144
"qrcode-terminal": "^0.12.0",
145145
"read": "^2.1.0",
146-
"semver": "^7.5.2",
146+
"semver": "^7.5.4",
147147
"sigstore": "^1.7.0",
148148
"ssri": "^10.0.4",
149149
"supports-color": "^9.3.1",
@@ -11472,9 +11472,9 @@
1147211472
}
1147311473
},
1147411474
"node_modules/semver": {
11475-
"version": "7.5.2",
11476-
"resolved": "https://registry.npmjs.org/semver/-/semver-7.5.2.tgz",
11477-
"integrity": "sha512-SoftuTROv/cRjCze/scjGyiDtcUyxw1rgYQSZY7XTmtR5hX+dm76iDbTH8TkLPHCQmlbQVSSbNZCPM2hb0knnQ==",
11475+
"version": "7.5.4",
11476+
"resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
11477+
"integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
1147811478
"inBundle": true,
1147911479
"dependencies": {
1148011480
"lru-cache": "^6.0.0"

‎package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@
108108
"proc-log": "^3.0.0",
109109
"qrcode-terminal": "^0.12.0",
110110
"read": "^2.1.0",
111-
"semver": "^7.5.2",
111+
"semver": "^7.5.4",
112112
"sigstore": "^1.7.0",
113113
"ssri": "^10.0.4",
114114
"supports-color": "^9.3.1",

0 commit comments

Comments
 (0)
Please sign in to comment.