From e59be6aa84c5176f11178176b74656c6759921b7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 27 Jul 2026 20:22:09 +0000 Subject: [PATCH 1/5] Pin patched brace-expansion release --- package-lock.json | 65 +++-------------------------------------------- package.json | 5 +++- 2 files changed, 8 insertions(+), 62 deletions(-) diff --git a/package-lock.json b/package-lock.json index 79add779..354d5b41 100644 --- a/package-lock.json +++ b/package-lock.json @@ -70,22 +70,6 @@ "minimatch": "^3.0.4" } }, - "node_modules/@actions/cache/node_modules/balanced-match": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", - "license": "MIT" - }, - "node_modules/@actions/cache/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, "node_modules/@actions/cache/node_modules/minimatch": { "version": "3.1.5", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", @@ -3250,15 +3234,15 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/browserslist": { @@ -3542,12 +3526,6 @@ "dev": true, "license": "MIT" }, - "node_modules/concat-map": { - "version": "0.0.1", - "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", - "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", - "license": "MIT" - }, "node_modules/convert-source-map": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz", @@ -4564,23 +4542,6 @@ "node": ">=10.13.0" } }, - "node_modules/glob/node_modules/balanced-match": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", - "dev": true, - "license": "MIT" - }, - "node_modules/glob/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0" - } - }, "node_modules/glob/node_modules/minimatch": { "version": "9.0.9", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", @@ -6644,24 +6605,6 @@ "node": ">=8" } }, - "node_modules/test-exclude/node_modules/balanced-match": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", - "dev": true, - "license": "MIT" - }, - "node_modules/test-exclude/node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, "node_modules/test-exclude/node_modules/glob": { "version": "7.2.3", "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz", diff --git a/package.json b/package.json index 75b79b56..8fdba25d 100644 --- a/package.json +++ b/package.json @@ -75,5 +75,8 @@ "bugs": { "url": "https://github.com/actions/setup-java/issues" }, - "homepage": "https://github.com/actions/setup-java#readme" + "homepage": "https://github.com/actions/setup-java#readme", + "overrides": { + "brace-expansion": "5.0.8" + } } From 0c2970d1e64874d8b1151518569a13657ae41052 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 27 Jul 2026 20:23:30 +0000 Subject: [PATCH 2/5] Rebuild action bundles --- dist/cleanup/index.js | 863 +++++++++++++++++++++++------------------- dist/setup/index.js | 863 +++++++++++++++++++++++------------------- package-lock.json | 375 +----------------- package.json | 2 +- 4 files changed, 952 insertions(+), 1151 deletions(-) diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js index ef311c41..50117ea1 100644 --- a/dist/cleanup/index.js +++ b/dist/cleanup/index.js @@ -1,291 +1,6 @@ import { createRequire as __WEBPACK_EXTERNAL_createRequire } from "module"; /******/ var __webpack_modules__ = ({ -/***/ 8638: -/***/ ((module) => { - - -module.exports = balanced; -function balanced(a, b, str) { - if (a instanceof RegExp) a = maybeMatch(a, str); - if (b instanceof RegExp) b = maybeMatch(b, str); - - var r = range(a, b, str); - - return r && { - start: r[0], - end: r[1], - pre: str.slice(0, r[0]), - body: str.slice(r[0] + a.length, r[1]), - post: str.slice(r[1] + b.length) - }; -} - -function maybeMatch(reg, str) { - var m = str.match(reg); - return m ? m[0] : null; -} - -balanced.range = range; -function range(a, b, str) { - var begs, beg, left, right, result; - var ai = str.indexOf(a); - var bi = str.indexOf(b, ai + 1); - var i = ai; - - if (ai >= 0 && bi > 0) { - if(a===b) { - return [ai, bi]; - } - begs = []; - left = str.length; - - while (i >= 0 && !result) { - if (i == ai) { - begs.push(i); - ai = str.indexOf(a, i + 1); - } else if (begs.length == 1) { - result = [ begs.pop(), bi ]; - } else { - beg = begs.pop(); - if (beg < left) { - left = beg; - right = bi; - } - - bi = str.indexOf(b, i + 1); - } - - i = ai < bi && ai >= 0 ? ai : bi; - } - - if (begs.length) { - result = [ left, right ]; - } - } - - return result; -} - - -/***/ }), - -/***/ 6533: -/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { - -var concatMap = __nccwpck_require__(7087); -var balanced = __nccwpck_require__(8638); - -module.exports = expandTop; - -var escSlash = '\0SLASH'+Math.random()+'\0'; -var escOpen = '\0OPEN'+Math.random()+'\0'; -var escClose = '\0CLOSE'+Math.random()+'\0'; -var escComma = '\0COMMA'+Math.random()+'\0'; -var escPeriod = '\0PERIOD'+Math.random()+'\0'; - -function numeric(str) { - return parseInt(str, 10) == str - ? parseInt(str, 10) - : str.charCodeAt(0); -} - -function escapeBraces(str) { - return str.split('\\\\').join(escSlash) - .split('\\{').join(escOpen) - .split('\\}').join(escClose) - .split('\\,').join(escComma) - .split('\\.').join(escPeriod); -} - -function unescapeBraces(str) { - return str.split(escSlash).join('\\') - .split(escOpen).join('{') - .split(escClose).join('}') - .split(escComma).join(',') - .split(escPeriod).join('.'); -} - - -// Basically just str.split(","), but handling cases -// where we have nested braced sections, which should be -// treated as individual members, like {a,{b,c},d} -function parseCommaParts(str) { - if (!str) - return ['']; - - var parts = []; - var m = balanced('{', '}', str); - - if (!m) - return str.split(','); - - var pre = m.pre; - var body = m.body; - var post = m.post; - var p = pre.split(','); - - p[p.length-1] += '{' + body + '}'; - var postParts = parseCommaParts(post); - if (post.length) { - p[p.length-1] += postParts.shift(); - p.push.apply(p, postParts); - } - - parts.push.apply(parts, p); - - return parts; -} - -function expandTop(str, options) { - if (!str) - return []; - - options = options || {}; - var max = options.max == null ? Infinity : options.max; - - // I don't know why Bash 4.3 does this, but it does. - // Anything starting with {} will have the first two bytes preserved - // but *only* at the top level, so {},a}b will not expand to anything, - // but a{},b}c will be expanded to [a}c,abc]. - // One could argue that this is a bug in Bash, but since the goal of - // this module is to match Bash's rules, we escape a leading {} - if (str.substr(0, 2) === '{}') { - str = '\\{\\}' + str.substr(2); - } - - return expand(escapeBraces(str), max, true).map(unescapeBraces); -} - -function identity(e) { - return e; -} - -function embrace(str) { - return '{' + str + '}'; -} -function isPadded(el) { - return /^-?0\d/.test(el); -} - -function lte(i, y) { - return i <= y; -} -function gte(i, y) { - return i >= y; -} - -function expand(str, max, isTop) { - var expansions = []; - - // The `{a},b}` rewrite below restarts expansion on a rewritten string with - // the same `max` and `isTop = true`. Loop instead of recursing so a long run - // of non-expanding `{}` groups can't exhaust the call stack. - for (;;) { - var m = balanced('{', '}', str); - if (!m || /\$$/.test(m.pre)) return [str]; - - var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - var isSequence = isNumericSequence || isAlphaSequence; - var isOptions = m.body.indexOf(',') >= 0; - if (!isSequence && !isOptions) { - // {a},b} - if (m.post.match(/,(?!,).*\}/)) { - str = m.pre + '{' + m.body + escClose + m.post; - isTop = true - continue - } - return [str]; - } - - var n; - if (isSequence) { - n = m.body.split(/\.\./); - } else { - n = parseCommaParts(m.body); - if (n.length === 1) { - // x{{a,b}}y ==> x{a}y x{b}y - n = expand(n[0], max, false).map(embrace); - if (n.length === 1) { - var post = m.post.length - ? expand(m.post, max, false) - : ['']; - return post.map(function(p) { - return m.pre + n[0] + p; - }); - } - } - } - - // at this point, n is the parts, and we know it's not a comma set - // with a single entry. - - // no need to expand pre, since it is guaranteed to be free of brace-sets - var pre = m.pre; - var post = m.post.length - ? expand(m.post, max, false) - : ['']; - - var N; - - if (isSequence) { - var x = numeric(n[0]); - var y = numeric(n[1]); - var width = Math.max(n[0].length, n[1].length) - var incr = n.length == 3 - ? Math.max(Math.abs(numeric(n[2])), 1) - : 1; - var test = lte; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte; - } - var pad = n.some(isPadded); - - N = []; - - for (var i = x; test(i, y) && N.length < max; i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === '\\') - c = ''; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join('0'); - if (i < 0) - c = '-' + z + c.slice(1); - else - c = z + c; - } - } - } - N.push(c); - } - } else { - N = concatMap(n, function(el) { return expand(el, max, false) }); - } - - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); - } - } - - return expansions; - } -} - - -/***/ }), - /***/ 2593: /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { @@ -298,7 +13,7 @@ var path = (function () { try { return __nccwpck_require__(6928) } catch (e) {}} minimatch.sep = path.sep var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {} -var expand = __nccwpck_require__(6533) +var expand = __nccwpck_require__(8968) var plTypes = { '!': { open: '(?:(?!(?:', close: '))[^/]*?)'}, @@ -6449,26 +6164,6 @@ class Agent extends http.Agent { exports.Agent = Agent; //# sourceMappingURL=index.js.map -/***/ }), - -/***/ 7087: -/***/ ((module) => { - -module.exports = function (xs, fn) { - var res = []; - for (var i = 0; i < xs.length; i++) { - var x = fn(xs[i], i); - if (isArray(x)) res.push.apply(res, x); - else res.push(x); - } - return res; -}; - -var isArray = Array.isArray || function (xs) { - return Object.prototype.toString.call(xs) === '[object Array]'; -}; - - /***/ }), /***/ 6110: @@ -39012,6 +38707,340 @@ exports.w = { /***/ }), +/***/ 2649: +/***/ ((__unused_webpack_module, exports) => { + + +Object.defineProperty(exports, "__esModule", ({ value: true })); +exports.range = exports.balanced = void 0; +const balanced = (a, b, str) => { + const ma = a instanceof RegExp ? maybeMatch(a, str) : a; + const mb = b instanceof RegExp ? maybeMatch(b, str) : b; + const r = ma !== null && mb != null && (0, exports.range)(ma, mb, str); + return (r && { + start: r[0], + end: r[1], + pre: str.slice(0, r[0]), + body: str.slice(r[0] + ma.length, r[1]), + post: str.slice(r[1] + mb.length), + }); +}; +exports.balanced = balanced; +const maybeMatch = (reg, str) => { + const m = str.match(reg); + return m ? m[0] : null; +}; +const range = (a, b, str) => { + let begs, beg, left, right = undefined, result; + let ai = str.indexOf(a); + let bi = str.indexOf(b, ai + 1); + let i = ai; + if (ai >= 0 && bi > 0) { + if (a === b) { + return [ai, bi]; + } + begs = []; + left = str.length; + while (i >= 0 && !result) { + if (i === ai) { + begs.push(i); + ai = str.indexOf(a, i + 1); + } + else if (begs.length === 1) { + const r = begs.pop(); + if (r !== undefined) + result = [r, bi]; + } + else { + beg = begs.pop(); + if (beg !== undefined && beg < left) { + left = beg; + right = bi; + } + bi = str.indexOf(b, i + 1); + } + i = ai < bi && ai >= 0 ? ai : bi; + } + if (begs.length && right !== undefined) { + result = [left, right]; + } + } + return result; +}; +exports.range = range; +//# sourceMappingURL=index.js.map + +/***/ }), + +/***/ 8968: +/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { + + +Object.defineProperty(exports, "__esModule", ({ value: true })); +exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0; +exports.expand = expand; +const balanced_match_1 = __nccwpck_require__(2649); +const escSlash = '\0SLASH' + Math.random() + '\0'; +const escOpen = '\0OPEN' + Math.random() + '\0'; +const escClose = '\0CLOSE' + Math.random() + '\0'; +const escComma = '\0COMMA' + Math.random() + '\0'; +const escPeriod = '\0PERIOD' + Math.random() + '\0'; +const escSlashPattern = new RegExp(escSlash, 'g'); +const escOpenPattern = new RegExp(escOpen, 'g'); +const escClosePattern = new RegExp(escClose, 'g'); +const escCommaPattern = new RegExp(escComma, 'g'); +const escPeriodPattern = new RegExp(escPeriod, 'g'); +const slashPattern = /\\\\/g; +const openPattern = /\\{/g; +const closePattern = /\\}/g; +const commaPattern = /\\,/g; +const periodPattern = /\\\./g; +exports.EXPANSION_MAX = 100_000; +// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An +// input like `'{a,b}'.repeat(1500)` stays under that count - its output is +// truncated to 100k results - while making every result ~1500 characters +// long. The result set, and the intermediate arrays built while combining +// brace sets, then grow large enough to exhaust memory and crash the process +// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of +// characters the accumulator may hold at any point, so memory stays flat no +// matter how many brace groups are chained. The limit sits well above any +// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M +// characters) so legitimate input is unaffected. +exports.EXPANSION_MAX_LENGTH = 4_000_000; +function numeric(str) { + return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); +} +function escapeBraces(str) { + return str + .replace(slashPattern, escSlash) + .replace(openPattern, escOpen) + .replace(closePattern, escClose) + .replace(commaPattern, escComma) + .replace(periodPattern, escPeriod); +} +function unescapeBraces(str) { + return str + .replace(escSlashPattern, '\\') + .replace(escOpenPattern, '{') + .replace(escClosePattern, '}') + .replace(escCommaPattern, ',') + .replace(escPeriodPattern, '.'); +} +/** + * Basically just str.split(","), but handling cases + * where we have nested braced sections, which should be + * treated as individual members, like {a,{b,c},d} + */ +function parseCommaParts(str) { + if (!str) { + return ['']; + } + const parts = []; + const m = (0, balanced_match_1.balanced)('{', '}', str); + if (!m) { + return str.split(','); + } + const { pre, body, post } = m; + const p = pre.split(','); + p[p.length - 1] += '{' + body + '}'; + const postParts = parseCommaParts(post); + if (post.length) { + ; + p[p.length - 1] += postParts.shift(); + p.push.apply(p, postParts); + } + parts.push.apply(parts, p); + return parts; +} +function expand(str, options = {}) { + if (!str) { + return []; + } + const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options; + // I don't know why Bash 4.3 does this, but it does. + // Anything starting with {} will have the first two bytes preserved + // but *only* at the top level, so {},a}b will not expand to anything, + // but a{},b}c will be expanded to [a}c,abc]. + // One could argue that this is a bug in Bash, but since the goal of + // this module is to match Bash's rules, we escape a leading {} + if (str.slice(0, 2) === '{}') { + str = '\\{\\}' + str.slice(2); + } + return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); +} +function embrace(str) { + return '{' + str + '}'; +} +function isPadded(el) { + return /^-?0\d/.test(el); +} +function lte(i, y) { + return i <= y; +} +function gte(i, y) { + return i >= y; +} +// Build `{ acc[a] + pre + values[v] }` for every combination, capping the +// number of results at `max` and the total number of characters at `maxLength`. +// This is the one place output grows, so bounding it here keeps the single +// accumulator - and therefore memory - flat regardless of how many brace groups +// are combined (CVE-2026-14257). +function combine(acc, pre, values, max, maxLength, dropEmpties) { + const out = []; + let length = 0; + for (let a = 0; a < acc.length; a++) { + for (let v = 0; v < values.length; v++) { + if (out.length >= max) + return out; + const expansion = acc[a] + pre + values[v]; + // Bash drops empty results at the top level. Skip them before they count + // against `max`, so `max` bounds the number of *kept* results. + if (dropEmpties && !expansion) + continue; + if (length + expansion.length > maxLength) + return out; + out.push(expansion); + length += expansion.length; + } + } + return out; +} +// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`) +// sequence body. +function expandSequence(body, isAlphaSequence, max) { + const n = body.split(/\.\./); + const N = []; + // A sequence body always splits into two or three parts, but the compiler + // can't know that. + /* c8 ignore start */ + if (n[0] === undefined || n[1] === undefined) { + return N; + } + /* c8 ignore stop */ + const x = numeric(n[0]); + const y = numeric(n[1]); + const width = Math.max(n[0].length, n[1].length); + let incr = n.length === 3 && n[2] !== undefined ? + Math.max(Math.abs(numeric(n[2])), 1) + : 1; + let test = lte; + const reverse = y < x; + if (reverse) { + incr *= -1; + test = gte; + } + const pad = n.some(isPadded); + for (let i = x; test(i, y) && N.length < max; i += incr) { + let c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === '\\') { + c = ''; + } + } + else { + c = String(i); + if (pad) { + const need = width - c.length; + if (need > 0) { + const z = new Array(need + 1).join('0'); + if (i < 0) { + c = '-' + z + c.slice(1); + } + else { + c = z + c; + } + } + } + } + N.push(c); + } + return N; +} +function expand_(str, max, maxLength, isTop) { + // Consume the string's top-level brace groups left to right, threading a + // running set of combined prefixes (`acc`). Expanding the tail iteratively - + // rather than recursing on `m.post` once per group - keeps the native stack + // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no + // longer overflow the stack, and leaves a single accumulator whose size + // `maxLength` bounds directly (CVE-2026-14257). + let acc = ['']; + // Bash drops empty results, but only when the *first* top-level group is a + // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop + // is on the final strings, so it is applied to whichever `combine` produces + // them (the one with no brace set left in the tail). + let dropEmpties = false; + let firstGroup = true; + for (;;) { + const m = (0, balanced_match_1.balanced)('{', '}', str); + // No brace set left: the rest of the string is literal. + if (!m) { + return combine(acc, str, [''], max, maxLength, dropEmpties); + } + // no need to expand pre, since it is guaranteed to be free of brace-sets + const pre = m.pre; + if (/\$$/.test(pre)) { + acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length); + firstGroup = false; + if (!m.post.length) + break; + str = m.post; + continue; + } + const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + const isSequence = isNumericSequence || isAlphaSequence; + const isOptions = m.body.indexOf(',') >= 0; + if (!isSequence && !isOptions) { + // {a},b} + if (m.post.match(/,(?!,).*\}/)) { + str = m.pre + '{' + m.body + escClose + m.post; + isTop = true; + continue; + } + // Nothing here expands, so the whole remaining string is literal. + return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties); + } + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + let values; + if (isSequence) { + values = expandSequence(m.body, isAlphaSequence, max); + } + else { + let n = parseCommaParts(m.body); + if (n.length === 1 && n[0] !== undefined) { + // x{{a,b}}y ==> x{a}y x{b}y + n = expand_(n[0], max, maxLength, false).map(embrace); + //XXX is this necessary? Can't seem to hit it in tests. + /* c8 ignore start */ + if (n.length === 1) { + acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; + continue; + } + /* c8 ignore stop */ + } + values = []; + for (let j = 0; j < n.length; j++) { + values.push.apply(values, expand_(n[j], max, maxLength, false)); + } + } + acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; + } + return acc; +} +//# sourceMappingURL=index.js.map + +/***/ }), + /***/ 8658: /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { @@ -97116,6 +97145,17 @@ const closePattern = /\\}/g; const commaPattern = /\\,/g; const periodPattern = /\\\./g; const EXPANSION_MAX = 100_000; +// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An +// input like `'{a,b}'.repeat(1500)` stays under that count - its output is +// truncated to 100k results - while making every result ~1500 characters +// long. The result set, and the intermediate arrays built while combining +// brace sets, then grow large enough to exhaust memory and crash the process +// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of +// characters the accumulator may hold at any point, so memory stays flat no +// matter how many brace groups are chained. The limit sits well above any +// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M +// characters) so legitimate input is unaffected. +const EXPANSION_MAX_LENGTH = 4_000_000; function numeric(str) { return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); } @@ -97165,7 +97205,7 @@ function expand(str, options = {}) { if (!str) { return []; } - const { max = EXPANSION_MAX } = options; + const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options; // I don't know why Bash 4.3 does this, but it does. // Anything starting with {} will have the first two bytes preserved // but *only* at the top level, so {},a}b will not expand to anything, @@ -97175,7 +97215,7 @@ function expand(str, options = {}) { if (str.slice(0, 2) === '{}') { str = '\\{\\}' + str.slice(2); } - return expand_(escapeBraces(str), max, true).map(unescapeBraces); + return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); } function embrace(str) { return '{' + str + '}'; @@ -97189,25 +97229,112 @@ function lte(i, y) { function gte(i, y) { return i >= y; } -function expand_(str, max, isTop) { - /** @type {string[]} */ - const expansions = []; - // The `{a},b}` rewrite below restarts expansion on a rewritten string with - // the same `max` and `isTop = true`. Loop instead of recursing so a long run - // of non-expanding `{}` groups can't exhaust the call stack. +// Build `{ acc[a] + pre + values[v] }` for every combination, capping the +// number of results at `max` and the total number of characters at `maxLength`. +// This is the one place output grows, so bounding it here keeps the single +// accumulator - and therefore memory - flat regardless of how many brace groups +// are combined (CVE-2026-14257). +function combine(acc, pre, values, max, maxLength, dropEmpties) { + const out = []; + let length = 0; + for (let a = 0; a < acc.length; a++) { + for (let v = 0; v < values.length; v++) { + if (out.length >= max) + return out; + const expansion = acc[a] + pre + values[v]; + // Bash drops empty results at the top level. Skip them before they count + // against `max`, so `max` bounds the number of *kept* results. + if (dropEmpties && !expansion) + continue; + if (length + expansion.length > maxLength) + return out; + out.push(expansion); + length += expansion.length; + } + } + return out; +} +// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`) +// sequence body. +function expandSequence(body, isAlphaSequence, max) { + const n = body.split(/\.\./); + const N = []; + // A sequence body always splits into two or three parts, but the compiler + // can't know that. + /* c8 ignore start */ + if (n[0] === undefined || n[1] === undefined) { + return N; + } + /* c8 ignore stop */ + const x = numeric(n[0]); + const y = numeric(n[1]); + const width = Math.max(n[0].length, n[1].length); + let incr = n.length === 3 && n[2] !== undefined ? + Math.max(Math.abs(numeric(n[2])), 1) + : 1; + let test = lte; + const reverse = y < x; + if (reverse) { + incr *= -1; + test = gte; + } + const pad = n.some(isPadded); + for (let i = x; test(i, y) && N.length < max; i += incr) { + let c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === '\\') { + c = ''; + } + } + else { + c = String(i); + if (pad) { + const need = width - c.length; + if (need > 0) { + const z = new Array(need + 1).join('0'); + if (i < 0) { + c = '-' + z + c.slice(1); + } + else { + c = z + c; + } + } + } + } + N.push(c); + } + return N; +} +function expand_(str, max, maxLength, isTop) { + // Consume the string's top-level brace groups left to right, threading a + // running set of combined prefixes (`acc`). Expanding the tail iteratively - + // rather than recursing on `m.post` once per group - keeps the native stack + // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no + // longer overflow the stack, and leaves a single accumulator whose size + // `maxLength` bounds directly (CVE-2026-14257). + let acc = ['']; + // Bash drops empty results, but only when the *first* top-level group is a + // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop + // is on the final strings, so it is applied to whichever `combine` produces + // them (the one with no brace set left in the tail). + let dropEmpties = false; + let firstGroup = true; for (;;) { const m = balanced('{', '}', str); - if (!m) - return [str]; + // No brace set left: the rest of the string is literal. + if (!m) { + return combine(acc, str, [''], max, maxLength, dropEmpties); + } // no need to expand pre, since it is guaranteed to be free of brace-sets const pre = m.pre; - if (/\$$/.test(m.pre)) { - const post = m.post.length ? expand_(m.post, max, false) : ['']; - for (let k = 0; k < post.length && k < max; k++) { - const expansion = pre + '{' + m.body + '}' + post[k]; - expansions.push(expansion); - } - return expansions; + if (/\$$/.test(pre)) { + acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length); + firstGroup = false; + if (!m.post.length) + break; + str = m.post; + continue; } const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); @@ -97220,90 +97347,44 @@ function expand_(str, max, isTop) { isTop = true; continue; } - return [str]; + // Nothing here expands, so the whole remaining string is literal. + return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties); } - // Only expand post once we know this brace set actually expands. Computing - // it before the early returns above expanded post a second time on every - // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up - // exponentially. - const post = m.post.length ? expand_(m.post, max, false) : ['']; - let n; + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + let values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence(m.body, isAlphaSequence, max); } else { - n = parseCommaParts(m.body); + let n = parseCommaParts(m.body); if (n.length === 1 && n[0] !== undefined) { // x{{a,b}}y ==> x{a}y x{b}y - n = expand_(n[0], max, false).map(embrace); + n = expand_(n[0], max, maxLength, false).map(embrace); //XXX is this necessary? Can't seem to hit it in tests. /* c8 ignore start */ if (n.length === 1) { - return post.map(p => m.pre + n[0] + p); + acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; + continue; } /* c8 ignore stop */ } - } - // at this point, n is the parts, and we know it's not a comma set - // with a single entry. - let N; - if (isSequence && n[0] !== undefined && n[1] !== undefined) { - const x = numeric(n[0]); - const y = numeric(n[1]); - const width = Math.max(n[0].length, n[1].length); - let incr = n.length === 3 && n[2] !== undefined ? - Math.max(Math.abs(numeric(n[2])), 1) - : 1; - let test = lte; - const reverse = y < x; - if (reverse) { - incr *= -1; - test = gte; - } - const pad = n.some(isPadded); - N = []; - for (let i = x; test(i, y) && N.length < max; i += incr) { - let c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === '\\') { - c = ''; - } - } - else { - c = String(i); - if (pad) { - const need = width - c.length; - if (need > 0) { - const z = new Array(need + 1).join('0'); - if (i < 0) { - c = '-' + z + c.slice(1); - } - else { - c = z + c; - } - } - } - } - N.push(c); - } - } - else { - N = []; + values = []; for (let j = 0; j < n.length; j++) { - N.push.apply(N, expand_(n[j], max, false)); + values.push.apply(values, expand_(n[j], max, maxLength, false)); } } - for (let j = 0; j < N.length; j++) { - for (let k = 0; k < post.length && expansions.length < max; k++) { - const expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) { - expansions.push(expansion); - } - } - } - return expansions; + acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; } + return acc; } //# sourceMappingURL=index.js.map ;// CONCATENATED MODULE: ./node_modules/minimatch/dist/esm/assert-valid-pattern.js diff --git a/dist/setup/index.js b/dist/setup/index.js index 8c7de79c..6a54d1ed 100644 --- a/dist/setup/index.js +++ b/dist/setup/index.js @@ -1,291 +1,6 @@ import { createRequire as __WEBPACK_EXTERNAL_createRequire } from "module"; /******/ var __webpack_modules__ = ({ -/***/ 8638: -/***/ ((module) => { - - -module.exports = balanced; -function balanced(a, b, str) { - if (a instanceof RegExp) a = maybeMatch(a, str); - if (b instanceof RegExp) b = maybeMatch(b, str); - - var r = range(a, b, str); - - return r && { - start: r[0], - end: r[1], - pre: str.slice(0, r[0]), - body: str.slice(r[0] + a.length, r[1]), - post: str.slice(r[1] + b.length) - }; -} - -function maybeMatch(reg, str) { - var m = str.match(reg); - return m ? m[0] : null; -} - -balanced.range = range; -function range(a, b, str) { - var begs, beg, left, right, result; - var ai = str.indexOf(a); - var bi = str.indexOf(b, ai + 1); - var i = ai; - - if (ai >= 0 && bi > 0) { - if(a===b) { - return [ai, bi]; - } - begs = []; - left = str.length; - - while (i >= 0 && !result) { - if (i == ai) { - begs.push(i); - ai = str.indexOf(a, i + 1); - } else if (begs.length == 1) { - result = [ begs.pop(), bi ]; - } else { - beg = begs.pop(); - if (beg < left) { - left = beg; - right = bi; - } - - bi = str.indexOf(b, i + 1); - } - - i = ai < bi && ai >= 0 ? ai : bi; - } - - if (begs.length) { - result = [ left, right ]; - } - } - - return result; -} - - -/***/ }), - -/***/ 6533: -/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { - -var concatMap = __nccwpck_require__(7087); -var balanced = __nccwpck_require__(8638); - -module.exports = expandTop; - -var escSlash = '\0SLASH'+Math.random()+'\0'; -var escOpen = '\0OPEN'+Math.random()+'\0'; -var escClose = '\0CLOSE'+Math.random()+'\0'; -var escComma = '\0COMMA'+Math.random()+'\0'; -var escPeriod = '\0PERIOD'+Math.random()+'\0'; - -function numeric(str) { - return parseInt(str, 10) == str - ? parseInt(str, 10) - : str.charCodeAt(0); -} - -function escapeBraces(str) { - return str.split('\\\\').join(escSlash) - .split('\\{').join(escOpen) - .split('\\}').join(escClose) - .split('\\,').join(escComma) - .split('\\.').join(escPeriod); -} - -function unescapeBraces(str) { - return str.split(escSlash).join('\\') - .split(escOpen).join('{') - .split(escClose).join('}') - .split(escComma).join(',') - .split(escPeriod).join('.'); -} - - -// Basically just str.split(","), but handling cases -// where we have nested braced sections, which should be -// treated as individual members, like {a,{b,c},d} -function parseCommaParts(str) { - if (!str) - return ['']; - - var parts = []; - var m = balanced('{', '}', str); - - if (!m) - return str.split(','); - - var pre = m.pre; - var body = m.body; - var post = m.post; - var p = pre.split(','); - - p[p.length-1] += '{' + body + '}'; - var postParts = parseCommaParts(post); - if (post.length) { - p[p.length-1] += postParts.shift(); - p.push.apply(p, postParts); - } - - parts.push.apply(parts, p); - - return parts; -} - -function expandTop(str, options) { - if (!str) - return []; - - options = options || {}; - var max = options.max == null ? Infinity : options.max; - - // I don't know why Bash 4.3 does this, but it does. - // Anything starting with {} will have the first two bytes preserved - // but *only* at the top level, so {},a}b will not expand to anything, - // but a{},b}c will be expanded to [a}c,abc]. - // One could argue that this is a bug in Bash, but since the goal of - // this module is to match Bash's rules, we escape a leading {} - if (str.substr(0, 2) === '{}') { - str = '\\{\\}' + str.substr(2); - } - - return expand(escapeBraces(str), max, true).map(unescapeBraces); -} - -function identity(e) { - return e; -} - -function embrace(str) { - return '{' + str + '}'; -} -function isPadded(el) { - return /^-?0\d/.test(el); -} - -function lte(i, y) { - return i <= y; -} -function gte(i, y) { - return i >= y; -} - -function expand(str, max, isTop) { - var expansions = []; - - // The `{a},b}` rewrite below restarts expansion on a rewritten string with - // the same `max` and `isTop = true`. Loop instead of recursing so a long run - // of non-expanding `{}` groups can't exhaust the call stack. - for (;;) { - var m = balanced('{', '}', str); - if (!m || /\$$/.test(m.pre)) return [str]; - - var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - var isSequence = isNumericSequence || isAlphaSequence; - var isOptions = m.body.indexOf(',') >= 0; - if (!isSequence && !isOptions) { - // {a},b} - if (m.post.match(/,(?!,).*\}/)) { - str = m.pre + '{' + m.body + escClose + m.post; - isTop = true - continue - } - return [str]; - } - - var n; - if (isSequence) { - n = m.body.split(/\.\./); - } else { - n = parseCommaParts(m.body); - if (n.length === 1) { - // x{{a,b}}y ==> x{a}y x{b}y - n = expand(n[0], max, false).map(embrace); - if (n.length === 1) { - var post = m.post.length - ? expand(m.post, max, false) - : ['']; - return post.map(function(p) { - return m.pre + n[0] + p; - }); - } - } - } - - // at this point, n is the parts, and we know it's not a comma set - // with a single entry. - - // no need to expand pre, since it is guaranteed to be free of brace-sets - var pre = m.pre; - var post = m.post.length - ? expand(m.post, max, false) - : ['']; - - var N; - - if (isSequence) { - var x = numeric(n[0]); - var y = numeric(n[1]); - var width = Math.max(n[0].length, n[1].length) - var incr = n.length == 3 - ? Math.max(Math.abs(numeric(n[2])), 1) - : 1; - var test = lte; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte; - } - var pad = n.some(isPadded); - - N = []; - - for (var i = x; test(i, y) && N.length < max; i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === '\\') - c = ''; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join('0'); - if (i < 0) - c = '-' + z + c.slice(1); - else - c = z + c; - } - } - } - N.push(c); - } - } else { - N = concatMap(n, function(el) { return expand(el, max, false) }); - } - - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); - } - } - - return expansions; - } -} - - -/***/ }), - /***/ 2593: /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { @@ -298,7 +13,7 @@ var path = (function () { try { return __nccwpck_require__(6928) } catch (e) {}} minimatch.sep = path.sep var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {} -var expand = __nccwpck_require__(6533) +var expand = __nccwpck_require__(8968) var plTypes = { '!': { open: '(?:(?!(?:', close: '))[^/]*?)'}, @@ -27953,26 +27668,6 @@ class Agent extends http.Agent { exports.Agent = Agent; //# sourceMappingURL=index.js.map -/***/ }), - -/***/ 7087: -/***/ ((module) => { - -module.exports = function (xs, fn) { - var res = []; - for (var i = 0; i < xs.length; i++) { - var x = fn(xs[i], i); - if (isArray(x)) res.push.apply(res, x); - else res.push(x); - } - return res; -}; - -var isArray = Array.isArray || function (xs) { - return Object.prototype.toString.call(xs) === '[object Array]'; -}; - - /***/ }), /***/ 6110: @@ -64575,6 +64270,340 @@ exports.w = { /***/ }), +/***/ 2649: +/***/ ((__unused_webpack_module, exports) => { + + +Object.defineProperty(exports, "__esModule", ({ value: true })); +exports.range = exports.balanced = void 0; +const balanced = (a, b, str) => { + const ma = a instanceof RegExp ? maybeMatch(a, str) : a; + const mb = b instanceof RegExp ? maybeMatch(b, str) : b; + const r = ma !== null && mb != null && (0, exports.range)(ma, mb, str); + return (r && { + start: r[0], + end: r[1], + pre: str.slice(0, r[0]), + body: str.slice(r[0] + ma.length, r[1]), + post: str.slice(r[1] + mb.length), + }); +}; +exports.balanced = balanced; +const maybeMatch = (reg, str) => { + const m = str.match(reg); + return m ? m[0] : null; +}; +const range = (a, b, str) => { + let begs, beg, left, right = undefined, result; + let ai = str.indexOf(a); + let bi = str.indexOf(b, ai + 1); + let i = ai; + if (ai >= 0 && bi > 0) { + if (a === b) { + return [ai, bi]; + } + begs = []; + left = str.length; + while (i >= 0 && !result) { + if (i === ai) { + begs.push(i); + ai = str.indexOf(a, i + 1); + } + else if (begs.length === 1) { + const r = begs.pop(); + if (r !== undefined) + result = [r, bi]; + } + else { + beg = begs.pop(); + if (beg !== undefined && beg < left) { + left = beg; + right = bi; + } + bi = str.indexOf(b, i + 1); + } + i = ai < bi && ai >= 0 ? ai : bi; + } + if (begs.length && right !== undefined) { + result = [left, right]; + } + } + return result; +}; +exports.range = range; +//# sourceMappingURL=index.js.map + +/***/ }), + +/***/ 8968: +/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { + + +Object.defineProperty(exports, "__esModule", ({ value: true })); +exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0; +exports.expand = expand; +const balanced_match_1 = __nccwpck_require__(2649); +const escSlash = '\0SLASH' + Math.random() + '\0'; +const escOpen = '\0OPEN' + Math.random() + '\0'; +const escClose = '\0CLOSE' + Math.random() + '\0'; +const escComma = '\0COMMA' + Math.random() + '\0'; +const escPeriod = '\0PERIOD' + Math.random() + '\0'; +const escSlashPattern = new RegExp(escSlash, 'g'); +const escOpenPattern = new RegExp(escOpen, 'g'); +const escClosePattern = new RegExp(escClose, 'g'); +const escCommaPattern = new RegExp(escComma, 'g'); +const escPeriodPattern = new RegExp(escPeriod, 'g'); +const slashPattern = /\\\\/g; +const openPattern = /\\{/g; +const closePattern = /\\}/g; +const commaPattern = /\\,/g; +const periodPattern = /\\\./g; +exports.EXPANSION_MAX = 100_000; +// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An +// input like `'{a,b}'.repeat(1500)` stays under that count - its output is +// truncated to 100k results - while making every result ~1500 characters +// long. The result set, and the intermediate arrays built while combining +// brace sets, then grow large enough to exhaust memory and crash the process +// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of +// characters the accumulator may hold at any point, so memory stays flat no +// matter how many brace groups are chained. The limit sits well above any +// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M +// characters) so legitimate input is unaffected. +exports.EXPANSION_MAX_LENGTH = 4_000_000; +function numeric(str) { + return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); +} +function escapeBraces(str) { + return str + .replace(slashPattern, escSlash) + .replace(openPattern, escOpen) + .replace(closePattern, escClose) + .replace(commaPattern, escComma) + .replace(periodPattern, escPeriod); +} +function unescapeBraces(str) { + return str + .replace(escSlashPattern, '\\') + .replace(escOpenPattern, '{') + .replace(escClosePattern, '}') + .replace(escCommaPattern, ',') + .replace(escPeriodPattern, '.'); +} +/** + * Basically just str.split(","), but handling cases + * where we have nested braced sections, which should be + * treated as individual members, like {a,{b,c},d} + */ +function parseCommaParts(str) { + if (!str) { + return ['']; + } + const parts = []; + const m = (0, balanced_match_1.balanced)('{', '}', str); + if (!m) { + return str.split(','); + } + const { pre, body, post } = m; + const p = pre.split(','); + p[p.length - 1] += '{' + body + '}'; + const postParts = parseCommaParts(post); + if (post.length) { + ; + p[p.length - 1] += postParts.shift(); + p.push.apply(p, postParts); + } + parts.push.apply(parts, p); + return parts; +} +function expand(str, options = {}) { + if (!str) { + return []; + } + const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options; + // I don't know why Bash 4.3 does this, but it does. + // Anything starting with {} will have the first two bytes preserved + // but *only* at the top level, so {},a}b will not expand to anything, + // but a{},b}c will be expanded to [a}c,abc]. + // One could argue that this is a bug in Bash, but since the goal of + // this module is to match Bash's rules, we escape a leading {} + if (str.slice(0, 2) === '{}') { + str = '\\{\\}' + str.slice(2); + } + return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); +} +function embrace(str) { + return '{' + str + '}'; +} +function isPadded(el) { + return /^-?0\d/.test(el); +} +function lte(i, y) { + return i <= y; +} +function gte(i, y) { + return i >= y; +} +// Build `{ acc[a] + pre + values[v] }` for every combination, capping the +// number of results at `max` and the total number of characters at `maxLength`. +// This is the one place output grows, so bounding it here keeps the single +// accumulator - and therefore memory - flat regardless of how many brace groups +// are combined (CVE-2026-14257). +function combine(acc, pre, values, max, maxLength, dropEmpties) { + const out = []; + let length = 0; + for (let a = 0; a < acc.length; a++) { + for (let v = 0; v < values.length; v++) { + if (out.length >= max) + return out; + const expansion = acc[a] + pre + values[v]; + // Bash drops empty results at the top level. Skip them before they count + // against `max`, so `max` bounds the number of *kept* results. + if (dropEmpties && !expansion) + continue; + if (length + expansion.length > maxLength) + return out; + out.push(expansion); + length += expansion.length; + } + } + return out; +} +// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`) +// sequence body. +function expandSequence(body, isAlphaSequence, max) { + const n = body.split(/\.\./); + const N = []; + // A sequence body always splits into two or three parts, but the compiler + // can't know that. + /* c8 ignore start */ + if (n[0] === undefined || n[1] === undefined) { + return N; + } + /* c8 ignore stop */ + const x = numeric(n[0]); + const y = numeric(n[1]); + const width = Math.max(n[0].length, n[1].length); + let incr = n.length === 3 && n[2] !== undefined ? + Math.max(Math.abs(numeric(n[2])), 1) + : 1; + let test = lte; + const reverse = y < x; + if (reverse) { + incr *= -1; + test = gte; + } + const pad = n.some(isPadded); + for (let i = x; test(i, y) && N.length < max; i += incr) { + let c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === '\\') { + c = ''; + } + } + else { + c = String(i); + if (pad) { + const need = width - c.length; + if (need > 0) { + const z = new Array(need + 1).join('0'); + if (i < 0) { + c = '-' + z + c.slice(1); + } + else { + c = z + c; + } + } + } + } + N.push(c); + } + return N; +} +function expand_(str, max, maxLength, isTop) { + // Consume the string's top-level brace groups left to right, threading a + // running set of combined prefixes (`acc`). Expanding the tail iteratively - + // rather than recursing on `m.post` once per group - keeps the native stack + // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no + // longer overflow the stack, and leaves a single accumulator whose size + // `maxLength` bounds directly (CVE-2026-14257). + let acc = ['']; + // Bash drops empty results, but only when the *first* top-level group is a + // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop + // is on the final strings, so it is applied to whichever `combine` produces + // them (the one with no brace set left in the tail). + let dropEmpties = false; + let firstGroup = true; + for (;;) { + const m = (0, balanced_match_1.balanced)('{', '}', str); + // No brace set left: the rest of the string is literal. + if (!m) { + return combine(acc, str, [''], max, maxLength, dropEmpties); + } + // no need to expand pre, since it is guaranteed to be free of brace-sets + const pre = m.pre; + if (/\$$/.test(pre)) { + acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length); + firstGroup = false; + if (!m.post.length) + break; + str = m.post; + continue; + } + const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + const isSequence = isNumericSequence || isAlphaSequence; + const isOptions = m.body.indexOf(',') >= 0; + if (!isSequence && !isOptions) { + // {a},b} + if (m.post.match(/,(?!,).*\}/)) { + str = m.pre + '{' + m.body + escClose + m.post; + isTop = true; + continue; + } + // Nothing here expands, so the whole remaining string is literal. + return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties); + } + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + let values; + if (isSequence) { + values = expandSequence(m.body, isAlphaSequence, max); + } + else { + let n = parseCommaParts(m.body); + if (n.length === 1 && n[0] !== undefined) { + // x{{a,b}}y ==> x{a}y x{b}y + n = expand_(n[0], max, maxLength, false).map(embrace); + //XXX is this necessary? Can't seem to hit it in tests. + /* c8 ignore start */ + if (n.length === 1) { + acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; + continue; + } + /* c8 ignore stop */ + } + values = []; + for (let j = 0; j < n.length; j++) { + values.push.apply(values, expand_(n[j], max, maxLength, false)); + } + } + acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; + } + return acc; +} +//# sourceMappingURL=index.js.map + +/***/ }), + /***/ 9373: /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { @@ -128350,6 +128379,17 @@ const closePattern = /\\}/g; const commaPattern = /\\,/g; const periodPattern = /\\\./g; const EXPANSION_MAX = 100_000; +// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An +// input like `'{a,b}'.repeat(1500)` stays under that count - its output is +// truncated to 100k results - while making every result ~1500 characters +// long. The result set, and the intermediate arrays built while combining +// brace sets, then grow large enough to exhaust memory and crash the process +// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of +// characters the accumulator may hold at any point, so memory stays flat no +// matter how many brace groups are chained. The limit sits well above any +// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M +// characters) so legitimate input is unaffected. +const EXPANSION_MAX_LENGTH = 4_000_000; function numeric(str) { return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); } @@ -128399,7 +128439,7 @@ function expand(str, options = {}) { if (!str) { return []; } - const { max = EXPANSION_MAX } = options; + const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options; // I don't know why Bash 4.3 does this, but it does. // Anything starting with {} will have the first two bytes preserved // but *only* at the top level, so {},a}b will not expand to anything, @@ -128409,7 +128449,7 @@ function expand(str, options = {}) { if (str.slice(0, 2) === '{}') { str = '\\{\\}' + str.slice(2); } - return expand_(escapeBraces(str), max, true).map(unescapeBraces); + return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); } function embrace(str) { return '{' + str + '}'; @@ -128423,25 +128463,112 @@ function lte(i, y) { function gte(i, y) { return i >= y; } -function expand_(str, max, isTop) { - /** @type {string[]} */ - const expansions = []; - // The `{a},b}` rewrite below restarts expansion on a rewritten string with - // the same `max` and `isTop = true`. Loop instead of recursing so a long run - // of non-expanding `{}` groups can't exhaust the call stack. +// Build `{ acc[a] + pre + values[v] }` for every combination, capping the +// number of results at `max` and the total number of characters at `maxLength`. +// This is the one place output grows, so bounding it here keeps the single +// accumulator - and therefore memory - flat regardless of how many brace groups +// are combined (CVE-2026-14257). +function combine(acc, pre, values, max, maxLength, dropEmpties) { + const out = []; + let length = 0; + for (let a = 0; a < acc.length; a++) { + for (let v = 0; v < values.length; v++) { + if (out.length >= max) + return out; + const expansion = acc[a] + pre + values[v]; + // Bash drops empty results at the top level. Skip them before they count + // against `max`, so `max` bounds the number of *kept* results. + if (dropEmpties && !expansion) + continue; + if (length + expansion.length > maxLength) + return out; + out.push(expansion); + length += expansion.length; + } + } + return out; +} +// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`) +// sequence body. +function expandSequence(body, isAlphaSequence, max) { + const n = body.split(/\.\./); + const N = []; + // A sequence body always splits into two or three parts, but the compiler + // can't know that. + /* c8 ignore start */ + if (n[0] === undefined || n[1] === undefined) { + return N; + } + /* c8 ignore stop */ + const x = numeric(n[0]); + const y = numeric(n[1]); + const width = Math.max(n[0].length, n[1].length); + let incr = n.length === 3 && n[2] !== undefined ? + Math.max(Math.abs(numeric(n[2])), 1) + : 1; + let test = lte; + const reverse = y < x; + if (reverse) { + incr *= -1; + test = gte; + } + const pad = n.some(isPadded); + for (let i = x; test(i, y) && N.length < max; i += incr) { + let c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === '\\') { + c = ''; + } + } + else { + c = String(i); + if (pad) { + const need = width - c.length; + if (need > 0) { + const z = new Array(need + 1).join('0'); + if (i < 0) { + c = '-' + z + c.slice(1); + } + else { + c = z + c; + } + } + } + } + N.push(c); + } + return N; +} +function expand_(str, max, maxLength, isTop) { + // Consume the string's top-level brace groups left to right, threading a + // running set of combined prefixes (`acc`). Expanding the tail iteratively - + // rather than recursing on `m.post` once per group - keeps the native stack + // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no + // longer overflow the stack, and leaves a single accumulator whose size + // `maxLength` bounds directly (CVE-2026-14257). + let acc = ['']; + // Bash drops empty results, but only when the *first* top-level group is a + // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop + // is on the final strings, so it is applied to whichever `combine` produces + // them (the one with no brace set left in the tail). + let dropEmpties = false; + let firstGroup = true; for (;;) { const m = balanced('{', '}', str); - if (!m) - return [str]; + // No brace set left: the rest of the string is literal. + if (!m) { + return combine(acc, str, [''], max, maxLength, dropEmpties); + } // no need to expand pre, since it is guaranteed to be free of brace-sets const pre = m.pre; - if (/\$$/.test(m.pre)) { - const post = m.post.length ? expand_(m.post, max, false) : ['']; - for (let k = 0; k < post.length && k < max; k++) { - const expansion = pre + '{' + m.body + '}' + post[k]; - expansions.push(expansion); - } - return expansions; + if (/\$$/.test(pre)) { + acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length); + firstGroup = false; + if (!m.post.length) + break; + str = m.post; + continue; } const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); @@ -128454,90 +128581,44 @@ function expand_(str, max, isTop) { isTop = true; continue; } - return [str]; + // Nothing here expands, so the whole remaining string is literal. + return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties); } - // Only expand post once we know this brace set actually expands. Computing - // it before the early returns above expanded post a second time on every - // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up - // exponentially. - const post = m.post.length ? expand_(m.post, max, false) : ['']; - let n; + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + let values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence(m.body, isAlphaSequence, max); } else { - n = parseCommaParts(m.body); + let n = parseCommaParts(m.body); if (n.length === 1 && n[0] !== undefined) { // x{{a,b}}y ==> x{a}y x{b}y - n = expand_(n[0], max, false).map(embrace); + n = expand_(n[0], max, maxLength, false).map(embrace); //XXX is this necessary? Can't seem to hit it in tests. /* c8 ignore start */ if (n.length === 1) { - return post.map(p => m.pre + n[0] + p); + acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; + continue; } /* c8 ignore stop */ } - } - // at this point, n is the parts, and we know it's not a comma set - // with a single entry. - let N; - if (isSequence && n[0] !== undefined && n[1] !== undefined) { - const x = numeric(n[0]); - const y = numeric(n[1]); - const width = Math.max(n[0].length, n[1].length); - let incr = n.length === 3 && n[2] !== undefined ? - Math.max(Math.abs(numeric(n[2])), 1) - : 1; - let test = lte; - const reverse = y < x; - if (reverse) { - incr *= -1; - test = gte; - } - const pad = n.some(isPadded); - N = []; - for (let i = x; test(i, y) && N.length < max; i += incr) { - let c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === '\\') { - c = ''; - } - } - else { - c = String(i); - if (pad) { - const need = width - c.length; - if (need > 0) { - const z = new Array(need + 1).join('0'); - if (i < 0) { - c = '-' + z + c.slice(1); - } - else { - c = z + c; - } - } - } - } - N.push(c); - } - } - else { - N = []; + values = []; for (let j = 0; j < n.length; j++) { - N.push.apply(N, expand_(n[j], max, false)); + values.push.apply(values, expand_(n[j], max, maxLength, false)); } } - for (let j = 0; j < N.length; j++) { - for (let k = 0; k < post.length && expansions.length < max; k++) { - const expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) { - expansions.push(expansion); - } - } - } - return expansions; + acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; } + return acc; } //# sourceMappingURL=index.js.map ;// CONCATENATED MODULE: ./node_modules/minimatch/dist/esm/assert-valid-pattern.js diff --git a/package-lock.json b/package-lock.json index 354d5b41..3f71f07d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -37,7 +37,7 @@ "lint-staged": "^17.2.0", "prettier": "^3.9.5", "ts-jest": "^29.4.11", - "typescript": "^7.0.2" + "typescript": "^6.0.3" }, "engines": { "node": ">=24.0.0" @@ -2285,346 +2285,6 @@ "url": "https://opencollective.com/eslint" } }, - "node_modules/@typescript/typescript-aix-ppc64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz", - "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==", - "cpu": [ - "ppc64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "aix" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-darwin-arm64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz", - "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-darwin-x64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz", - "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-freebsd-arm64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz", - "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-freebsd-x64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz", - "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-linux-arm": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz", - "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==", - "cpu": [ - "arm" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-linux-arm64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz", - "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-linux-loong64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz", - "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==", - "cpu": [ - "loong64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-linux-mips64el": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz", - "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==", - "cpu": [ - "mips64el" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-linux-ppc64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz", - "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==", - "cpu": [ - "ppc64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-linux-riscv64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz", - "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==", - "cpu": [ - "riscv64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-linux-s390x": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz", - "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==", - "cpu": [ - "s390x" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-linux-x64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz", - "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-netbsd-arm64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz", - "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "netbsd" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-netbsd-x64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz", - "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "netbsd" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-openbsd-arm64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz", - "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "openbsd" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-openbsd-x64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz", - "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "openbsd" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-sunos-x64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz", - "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "sunos" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-win32-arm64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz", - "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==", - "cpu": [ - "arm64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=16.20.0" - } - }, - "node_modules/@typescript/typescript-win32-x64": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz", - "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==", - "cpu": [ - "x64" - ], - "dev": true, - "license": "Apache-2.0", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=16.20.0" - } - }, "node_modules/@typespec/ts-http-runtime": { "version": "0.3.6", "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.6.tgz", @@ -6805,38 +6465,17 @@ } }, "node_modules/typescript": { - "version": "7.0.2", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz", - "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==", + "version": "6.0.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz", + "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==", "dev": true, "license": "Apache-2.0", "bin": { - "tsc": "bin/tsc" + "tsc": "bin/tsc", + "tsserver": "bin/tsserver" }, "engines": { - "node": ">=16.20.0" - }, - "optionalDependencies": { - "@typescript/typescript-aix-ppc64": "7.0.2", - "@typescript/typescript-darwin-arm64": "7.0.2", - "@typescript/typescript-darwin-x64": "7.0.2", - "@typescript/typescript-freebsd-arm64": "7.0.2", - "@typescript/typescript-freebsd-x64": "7.0.2", - "@typescript/typescript-linux-arm": "7.0.2", - "@typescript/typescript-linux-arm64": "7.0.2", - "@typescript/typescript-linux-loong64": "7.0.2", - "@typescript/typescript-linux-mips64el": "7.0.2", - "@typescript/typescript-linux-ppc64": "7.0.2", - "@typescript/typescript-linux-riscv64": "7.0.2", - "@typescript/typescript-linux-s390x": "7.0.2", - "@typescript/typescript-linux-x64": "7.0.2", - "@typescript/typescript-netbsd-arm64": "7.0.2", - "@typescript/typescript-netbsd-x64": "7.0.2", - "@typescript/typescript-openbsd-arm64": "7.0.2", - "@typescript/typescript-openbsd-x64": "7.0.2", - "@typescript/typescript-sunos-x64": "7.0.2", - "@typescript/typescript-win32-arm64": "7.0.2", - "@typescript/typescript-win32-x64": "7.0.2" + "node": ">=14.17" } }, "node_modules/uglify-js": { diff --git a/package.json b/package.json index 8fdba25d..29b311ea 100644 --- a/package.json +++ b/package.json @@ -70,7 +70,7 @@ "lint-staged": "^17.2.0", "prettier": "^3.9.5", "ts-jest": "^29.4.11", - "typescript": "^7.0.2" + "typescript": "^6.0.3" }, "bugs": { "url": "https://github.com/actions/setup-java/issues" From 9aff09e346b59743be3c9923eaa86e811967766f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 27 Jul 2026 20:56:20 +0000 Subject: [PATCH 3/5] Refresh licensed npm cache records --- .licenses/npm/@nodable/entities.dep.yml | Bin 218 -> 218 bytes .licenses/npm/balanced-match-1.0.2.dep.yml | Bin 2592 -> 0 bytes ...h-4.0.4.dep.yml => balanced-match.dep.yml} | Bin 1414 -> 1412 bytes .licenses/npm/brace-expansion-1.1.15.dep.yml | Bin 2581 -> 0 bytes ...-5.0.7.dep.yml => brace-expansion.dep.yml} | Bin 1390 -> 1388 bytes .licenses/npm/concat-map.dep.yml | Bin 1379 -> 0 bytes .licenses/npm/fast-xml-parser.dep.yml | Bin 1439 -> 1440 bytes .licenses/npm/is-unsafe.dep.yml | Bin 1433 -> 1433 bytes .licenses/npm/path-expression-matcher.dep.yml | Bin 1402 -> 1402 bytes ...aming.dep.yml => xml-naming-0.1.0.dep.yml} | Bin .licenses/npm/xml-naming-0.3.0.dep.yml | Bin 0 -> 1374 bytes 11 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 .licenses/npm/balanced-match-1.0.2.dep.yml rename .licenses/npm/{balanced-match-4.0.4.dep.yml => balanced-match.dep.yml} (98%) delete mode 100644 .licenses/npm/brace-expansion-1.1.15.dep.yml rename .licenses/npm/{brace-expansion-5.0.7.dep.yml => brace-expansion.dep.yml} (97%) delete mode 100644 .licenses/npm/concat-map.dep.yml rename .licenses/npm/{xml-naming.dep.yml => xml-naming-0.1.0.dep.yml} (100%) create mode 100644 .licenses/npm/xml-naming-0.3.0.dep.yml diff --git a/.licenses/npm/@nodable/entities.dep.yml b/.licenses/npm/@nodable/entities.dep.yml index 28658831632f36bd02db8388ebb4d44d8380694e..b02eaad68046200848221181b569282aff978fff 100644 GIT binary patch delta 13 Ucmcb`c#Cm@Io)i%w2^99!H32B#mB&&PgpaY`oN5R z&-Hl)TUU2$gSzFK*H&maaj8uRo%~C{?C%-yp@G@Iv!GSIIPoLmwAP-?YPmd0+m6+u zR{iqp*hxMd^;ikL{GXOi)?zT&*Gn5*24)q^!KhK!!mJ>rG06(D=$in*itly>|KJnA z-IkX3fq#tE>8$0kwQyJ8!^ig@eu3XSDLi^sc-PralZ;Nl?Efa&LK!)JR+v#Xs#-Koy!ZeLLHaL96!9^!TF)qC4U(8fV3D8Ry31HqdfCh zQCm0b;18qO5#|d<{|d48PMX34wgsF;WzeGp~VecPS+}PqR4PCp3G62kg!A65kSh z8xXk6p+wRP93|MhhAm<72GOGjn$q$)^k8dRW)6FuGl*apv69C7G-9yZvt3>gl#w8G zMzb|TCbA`2xj<%|1M(RMP;8Y5KEO$Ch@TYDibpJk!;vQjIuddo)+Z9Q15D-AhyT`J_GqVZug4Mtn3g`h;&pYo1at z^p0F%t`4V8?khvL#T|YB-RmFd7dMz5++_M`;PLa9bS%HOL;pr}jnvi-lA0>fiTp(S zE^Cb_J*X9e)Q*ZO>-NGUqbO@nbbx_qP`SxuE89I~RDg#ggw>`3lvX=)%sPRF6833T z$PAcNs-ka1YcgYJ?qn@A-I_|!O>*wIxpRX`k<|`Swm=kgxlKoSta?M8(591x#qmhC zMctQ{%jI@0;q5TRwmXxw1B8lRLyhI^QKL$^v!B9AJoI@jb>&ehEqvY^tkkyXcFePS zrm7VY0mBs4hPpIN$f)-QMk9%sw6tsHS|zE&g$Uc0_)F&ZXeRjFX1oBUoB##XF~ zovLefv@#3TmeOj+v2m(W+|F|KK{#E*nP`;(ZMOw(QyiILx6ik9mDM%n;%p#h!)}xu z2$BI!BEz?IoX2cWP#L+vxU<`&jX%5c@AvJ)6ilsqnLc!_;JeT+rW=$vyC@V!a!pI=#YoY7?aqV zh3N#7Q6u&a7nH30Ah6>cp1*~X*m9+Lw0Vm8!z!g!6f78u_Y4gE`+yDOAaEY|eC^S~ zU;7W1WlRx}2Ay{4z?2?W%$Dt3AMbg}qtHs4M`0S{(u3kSy|zE{gn8u0JhA31<7hpI zwHBibQvihCkPS%IerMQqm$1YdxP<{1PPAZt06c72c$Ir;n0y&jG4mH|Hfc&Ya*nF8 zGv^k&bN3HZ>Q!yt{7q23+M72opH(=#j^xW_6&{>3;^!2&hS9&tDm?QJ@MW^frUG)x hA^x|lqGvhfAirf5ex1K%)&DW8hF?1TrTYDk(O-#1BaHw6 diff --git a/.licenses/npm/brace-expansion-5.0.7.dep.yml b/.licenses/npm/brace-expansion.dep.yml similarity index 97% rename from .licenses/npm/brace-expansion-5.0.7.dep.yml rename to .licenses/npm/brace-expansion.dep.yml index 7a7cd583a62e7350152b653b69ce5de04508066b..bc757a22e211fc88f5f745f7b2a0fec09c7b4961 100644 GIT binary patch delta 19 acmaFI^@eMLI-|uz4PWNm%#w{&UswQ0X9raP delta 21 ccmaFE^^R+TI-~hS4PVy$l8n@%jTK*509SPgEC2ui diff --git a/.licenses/npm/concat-map.dep.yml b/.licenses/npm/concat-map.dep.yml deleted file mode 100644 index 20216b958a5dad1d375f3762384fce62ca190930..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1379 zcmY*ZORwTK6yE1o9NlhODZq5gE*H$jYDkb1=Jskd3zHadC$UlN3`OdXpU>toofWZt z&iC@clgT78vR89ztZAg5^zxj1SA)~m%<0qg)AY~8U(Yx<=RR>`-^=0pC{{*#{aq1y zTIo(|xF#pttFt_!{^b4H&1bWt_NQ?_ZEQbtx5n-v%YyUL~DwlyT^_ z9$=59nQFQOxbO z??>(=;bV`1i2;IN8^TtEeAt8AIJU-X+{xJvkv9xR(Dbk|z3W&rs>)UUo(V?0qOB-D z^Cer-OIBh1lF~b`*X6DzREVsoKd4+$R(#N3yjZ5h{@w~!RaAym1a-r+by?}|1|EY?8JUU|;zkCaxtE`S?BSEZngwwb8;VwY!v zwmY#cD+U=$Ko`7N2{5q@E9xnju}ADP7F4aXJdbqQ4lcw~=c3$x2>!ONXHl9M e!LsFsP4OUpYwaccS8p#8?j^Ym7@n&yUy~ma1+z5( diff --git a/.licenses/npm/fast-xml-parser.dep.yml b/.licenses/npm/fast-xml-parser.dep.yml index 8f13da7e0913f19569ad237f44260c210cd9ba31..07fd88dd4831b4c54a93ff30700e1d291e773332 100644 GIT binary patch delta 15 WcmbQwy?}dyDvP0kp5aD~a#jE%bOa;- delta 14 VcmZ3$J)e7mDzl}Y@kY&ZRsbL)1O5O2 diff --git a/.licenses/npm/is-unsafe.dep.yml b/.licenses/npm/is-unsafe.dep.yml index 8b7d7e6559c7b7b3194211ba652e410e75d1bebe..a0e275d488eb3214fcf07c4a69d436f07ec694a3 100644 GIT binary patch delta 16 XcmbQqJ(GKaEUS^8fu6xerE*pPCI$pJ delta 16 XcmbQqJ(GKaEUTfOfu7+;rE*pPCISRF diff --git a/.licenses/npm/path-expression-matcher.dep.yml b/.licenses/npm/path-expression-matcher.dep.yml index 7740897fb15e0bf13786ed82cc030c485de55601..a671e7d7c7af1601ad461b941850a4f0a76454ca 100644 GIT binary patch delta 12 Tcmeyx^^0qQKBLh_120wpAqE61 delta 12 Tcmeyx^^0qQKBM7A120wpApry` diff --git a/.licenses/npm/xml-naming.dep.yml b/.licenses/npm/xml-naming-0.1.0.dep.yml similarity index 100% rename from .licenses/npm/xml-naming.dep.yml rename to .licenses/npm/xml-naming-0.1.0.dep.yml diff --git a/.licenses/npm/xml-naming-0.3.0.dep.yml b/.licenses/npm/xml-naming-0.3.0.dep.yml new file mode 100644 index 0000000000000000000000000000000000000000..caf39f1881fe4a921b2ef44c8cb0971644f21af1 GIT binary patch literal 1374 zcmZ8h%Z}qV5WMRv8gtqOWM^gr9dX+jQw&ZBOo+M>?TfB*bT8G<2Y@%;SldQ40GmmCnEUwmpnbkw6q zdRX35H8k|Fd`7)|gYw1J%kv`pj`UN!YG*%t)!OE^vCppw|PTt9}SH>AZ%1|pudAQJN ztdQ7*bR4B5eWbdr#uJ2E4dNF%!#Wh`gRRs6FR7v$O?`J{+ZIqpAMIN;O0TpsM%M~f zHq_{P>g8Z7XCfU{2YWx*R?=N@t+@N>8#S`(Jfa$aDCu@hZ_2iMvNTF#N9BhRk{ar6 zY8;o_b*EtD+{Kl9M~nxAipfBY;~Y}28+CL~=_Q`0L#Ip|QllLFVY0|HF6hS-Iz2yO zkOoG2G@vMG@VdXV^m)!Ncm*C;%Z!V>Vdg(7QZujPG!AGDlaSSDSm-v8@7{wH~P<*{W{Bxtu6yS!kau?BR;vyDI}ma?o|qBCN| zo^haJ8zqTr=kcOFlnBR_;(Yfi_|vweZJw+df{zRgqsN5J?I18tBA$k{j?(DKu@sa8 zY1ZjdXQuSBWiIUcM)<`g&od_}&a+bB7(%fq-^*Wk!9t1zFPu3Wk*Bj*XECbK1wg3H q*o@@t_lCVs2`SFNJq);UqBV;W;9+FhyWCsBGMKjq|4G095qtyg1*?Vt literal 0 HcmV?d00001 From 401a74ac1346d16277f5c8e97e899b641adfecff Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 27 Jul 2026 21:23:50 +0000 Subject: [PATCH 4/5] Restore compatible brace expansion versions --- dist/cleanup/index.js | 641 ++++++++++++++++++++---------------------- dist/setup/index.js | 641 ++++++++++++++++++++---------------------- package-lock.json | 57 ++++ package.json | 5 +- 4 files changed, 670 insertions(+), 674 deletions(-) diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js index 50117ea1..6e93cdde 100644 --- a/dist/cleanup/index.js +++ b/dist/cleanup/index.js @@ -1,6 +1,291 @@ import { createRequire as __WEBPACK_EXTERNAL_createRequire } from "module"; /******/ var __webpack_modules__ = ({ +/***/ 8638: +/***/ ((module) => { + + +module.exports = balanced; +function balanced(a, b, str) { + if (a instanceof RegExp) a = maybeMatch(a, str); + if (b instanceof RegExp) b = maybeMatch(b, str); + + var r = range(a, b, str); + + return r && { + start: r[0], + end: r[1], + pre: str.slice(0, r[0]), + body: str.slice(r[0] + a.length, r[1]), + post: str.slice(r[1] + b.length) + }; +} + +function maybeMatch(reg, str) { + var m = str.match(reg); + return m ? m[0] : null; +} + +balanced.range = range; +function range(a, b, str) { + var begs, beg, left, right, result; + var ai = str.indexOf(a); + var bi = str.indexOf(b, ai + 1); + var i = ai; + + if (ai >= 0 && bi > 0) { + if(a===b) { + return [ai, bi]; + } + begs = []; + left = str.length; + + while (i >= 0 && !result) { + if (i == ai) { + begs.push(i); + ai = str.indexOf(a, i + 1); + } else if (begs.length == 1) { + result = [ begs.pop(), bi ]; + } else { + beg = begs.pop(); + if (beg < left) { + left = beg; + right = bi; + } + + bi = str.indexOf(b, i + 1); + } + + i = ai < bi && ai >= 0 ? ai : bi; + } + + if (begs.length) { + result = [ left, right ]; + } + } + + return result; +} + + +/***/ }), + +/***/ 6533: +/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { + +var concatMap = __nccwpck_require__(7087); +var balanced = __nccwpck_require__(8638); + +module.exports = expandTop; + +var escSlash = '\0SLASH'+Math.random()+'\0'; +var escOpen = '\0OPEN'+Math.random()+'\0'; +var escClose = '\0CLOSE'+Math.random()+'\0'; +var escComma = '\0COMMA'+Math.random()+'\0'; +var escPeriod = '\0PERIOD'+Math.random()+'\0'; + +function numeric(str) { + return parseInt(str, 10) == str + ? parseInt(str, 10) + : str.charCodeAt(0); +} + +function escapeBraces(str) { + return str.split('\\\\').join(escSlash) + .split('\\{').join(escOpen) + .split('\\}').join(escClose) + .split('\\,').join(escComma) + .split('\\.').join(escPeriod); +} + +function unescapeBraces(str) { + return str.split(escSlash).join('\\') + .split(escOpen).join('{') + .split(escClose).join('}') + .split(escComma).join(',') + .split(escPeriod).join('.'); +} + + +// Basically just str.split(","), but handling cases +// where we have nested braced sections, which should be +// treated as individual members, like {a,{b,c},d} +function parseCommaParts(str) { + if (!str) + return ['']; + + var parts = []; + var m = balanced('{', '}', str); + + if (!m) + return str.split(','); + + var pre = m.pre; + var body = m.body; + var post = m.post; + var p = pre.split(','); + + p[p.length-1] += '{' + body + '}'; + var postParts = parseCommaParts(post); + if (post.length) { + p[p.length-1] += postParts.shift(); + p.push.apply(p, postParts); + } + + parts.push.apply(parts, p); + + return parts; +} + +function expandTop(str, options) { + if (!str) + return []; + + options = options || {}; + var max = options.max == null ? Infinity : options.max; + + // I don't know why Bash 4.3 does this, but it does. + // Anything starting with {} will have the first two bytes preserved + // but *only* at the top level, so {},a}b will not expand to anything, + // but a{},b}c will be expanded to [a}c,abc]. + // One could argue that this is a bug in Bash, but since the goal of + // this module is to match Bash's rules, we escape a leading {} + if (str.substr(0, 2) === '{}') { + str = '\\{\\}' + str.substr(2); + } + + return expand(escapeBraces(str), max, true).map(unescapeBraces); +} + +function identity(e) { + return e; +} + +function embrace(str) { + return '{' + str + '}'; +} +function isPadded(el) { + return /^-?0\d/.test(el); +} + +function lte(i, y) { + return i <= y; +} +function gte(i, y) { + return i >= y; +} + +function expand(str, max, isTop) { + var expansions = []; + + // The `{a},b}` rewrite below restarts expansion on a rewritten string with + // the same `max` and `isTop = true`. Loop instead of recursing so a long run + // of non-expanding `{}` groups can't exhaust the call stack. + for (;;) { + var m = balanced('{', '}', str); + if (!m || /\$$/.test(m.pre)) return [str]; + + var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + var isSequence = isNumericSequence || isAlphaSequence; + var isOptions = m.body.indexOf(',') >= 0; + if (!isSequence && !isOptions) { + // {a},b} + if (m.post.match(/,(?!,).*\}/)) { + str = m.pre + '{' + m.body + escClose + m.post; + isTop = true + continue + } + return [str]; + } + + var n; + if (isSequence) { + n = m.body.split(/\.\./); + } else { + n = parseCommaParts(m.body); + if (n.length === 1) { + // x{{a,b}}y ==> x{a}y x{b}y + n = expand(n[0], max, false).map(embrace); + if (n.length === 1) { + var post = m.post.length + ? expand(m.post, max, false) + : ['']; + return post.map(function(p) { + return m.pre + n[0] + p; + }); + } + } + } + + // at this point, n is the parts, and we know it's not a comma set + // with a single entry. + + // no need to expand pre, since it is guaranteed to be free of brace-sets + var pre = m.pre; + var post = m.post.length + ? expand(m.post, max, false) + : ['']; + + var N; + + if (isSequence) { + var x = numeric(n[0]); + var y = numeric(n[1]); + var width = Math.max(n[0].length, n[1].length) + var incr = n.length == 3 + ? Math.max(Math.abs(numeric(n[2])), 1) + : 1; + var test = lte; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte; + } + var pad = n.some(isPadded); + + N = []; + + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === '\\') + c = ''; + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join('0'); + if (i < 0) + c = '-' + z + c.slice(1); + else + c = z + c; + } + } + } + N.push(c); + } + } else { + N = concatMap(n, function(el) { return expand(el, max, false) }); + } + + for (var j = 0; j < N.length; j++) { + for (var k = 0; k < post.length && expansions.length < max; k++) { + var expansion = pre + N[j] + post[k]; + if (!isTop || isSequence || expansion) + expansions.push(expansion); + } + } + + return expansions; + } +} + + +/***/ }), + /***/ 2593: /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { @@ -13,7 +298,7 @@ var path = (function () { try { return __nccwpck_require__(6928) } catch (e) {}} minimatch.sep = path.sep var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {} -var expand = __nccwpck_require__(8968) +var expand = __nccwpck_require__(6533) var plTypes = { '!': { open: '(?:(?!(?:', close: '))[^/]*?)'}, @@ -6164,6 +6449,26 @@ class Agent extends http.Agent { exports.Agent = Agent; //# sourceMappingURL=index.js.map +/***/ }), + +/***/ 7087: +/***/ ((module) => { + +module.exports = function (xs, fn) { + var res = []; + for (var i = 0; i < xs.length; i++) { + var x = fn(xs[i], i); + if (isArray(x)) res.push.apply(res, x); + else res.push(x); + } + return res; +}; + +var isArray = Array.isArray || function (xs) { + return Object.prototype.toString.call(xs) === '[object Array]'; +}; + + /***/ }), /***/ 6110: @@ -38707,340 +39012,6 @@ exports.w = { /***/ }), -/***/ 2649: -/***/ ((__unused_webpack_module, exports) => { - - -Object.defineProperty(exports, "__esModule", ({ value: true })); -exports.range = exports.balanced = void 0; -const balanced = (a, b, str) => { - const ma = a instanceof RegExp ? maybeMatch(a, str) : a; - const mb = b instanceof RegExp ? maybeMatch(b, str) : b; - const r = ma !== null && mb != null && (0, exports.range)(ma, mb, str); - return (r && { - start: r[0], - end: r[1], - pre: str.slice(0, r[0]), - body: str.slice(r[0] + ma.length, r[1]), - post: str.slice(r[1] + mb.length), - }); -}; -exports.balanced = balanced; -const maybeMatch = (reg, str) => { - const m = str.match(reg); - return m ? m[0] : null; -}; -const range = (a, b, str) => { - let begs, beg, left, right = undefined, result; - let ai = str.indexOf(a); - let bi = str.indexOf(b, ai + 1); - let i = ai; - if (ai >= 0 && bi > 0) { - if (a === b) { - return [ai, bi]; - } - begs = []; - left = str.length; - while (i >= 0 && !result) { - if (i === ai) { - begs.push(i); - ai = str.indexOf(a, i + 1); - } - else if (begs.length === 1) { - const r = begs.pop(); - if (r !== undefined) - result = [r, bi]; - } - else { - beg = begs.pop(); - if (beg !== undefined && beg < left) { - left = beg; - right = bi; - } - bi = str.indexOf(b, i + 1); - } - i = ai < bi && ai >= 0 ? ai : bi; - } - if (begs.length && right !== undefined) { - result = [left, right]; - } - } - return result; -}; -exports.range = range; -//# sourceMappingURL=index.js.map - -/***/ }), - -/***/ 8968: -/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { - - -Object.defineProperty(exports, "__esModule", ({ value: true })); -exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0; -exports.expand = expand; -const balanced_match_1 = __nccwpck_require__(2649); -const escSlash = '\0SLASH' + Math.random() + '\0'; -const escOpen = '\0OPEN' + Math.random() + '\0'; -const escClose = '\0CLOSE' + Math.random() + '\0'; -const escComma = '\0COMMA' + Math.random() + '\0'; -const escPeriod = '\0PERIOD' + Math.random() + '\0'; -const escSlashPattern = new RegExp(escSlash, 'g'); -const escOpenPattern = new RegExp(escOpen, 'g'); -const escClosePattern = new RegExp(escClose, 'g'); -const escCommaPattern = new RegExp(escComma, 'g'); -const escPeriodPattern = new RegExp(escPeriod, 'g'); -const slashPattern = /\\\\/g; -const openPattern = /\\{/g; -const closePattern = /\\}/g; -const commaPattern = /\\,/g; -const periodPattern = /\\\./g; -exports.EXPANSION_MAX = 100_000; -// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An -// input like `'{a,b}'.repeat(1500)` stays under that count - its output is -// truncated to 100k results - while making every result ~1500 characters -// long. The result set, and the intermediate arrays built while combining -// brace sets, then grow large enough to exhaust memory and crash the process -// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of -// characters the accumulator may hold at any point, so memory stays flat no -// matter how many brace groups are chained. The limit sits well above any -// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M -// characters) so legitimate input is unaffected. -exports.EXPANSION_MAX_LENGTH = 4_000_000; -function numeric(str) { - return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); -} -function escapeBraces(str) { - return str - .replace(slashPattern, escSlash) - .replace(openPattern, escOpen) - .replace(closePattern, escClose) - .replace(commaPattern, escComma) - .replace(periodPattern, escPeriod); -} -function unescapeBraces(str) { - return str - .replace(escSlashPattern, '\\') - .replace(escOpenPattern, '{') - .replace(escClosePattern, '}') - .replace(escCommaPattern, ',') - .replace(escPeriodPattern, '.'); -} -/** - * Basically just str.split(","), but handling cases - * where we have nested braced sections, which should be - * treated as individual members, like {a,{b,c},d} - */ -function parseCommaParts(str) { - if (!str) { - return ['']; - } - const parts = []; - const m = (0, balanced_match_1.balanced)('{', '}', str); - if (!m) { - return str.split(','); - } - const { pre, body, post } = m; - const p = pre.split(','); - p[p.length - 1] += '{' + body + '}'; - const postParts = parseCommaParts(post); - if (post.length) { - ; - p[p.length - 1] += postParts.shift(); - p.push.apply(p, postParts); - } - parts.push.apply(parts, p); - return parts; -} -function expand(str, options = {}) { - if (!str) { - return []; - } - const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options; - // I don't know why Bash 4.3 does this, but it does. - // Anything starting with {} will have the first two bytes preserved - // but *only* at the top level, so {},a}b will not expand to anything, - // but a{},b}c will be expanded to [a}c,abc]. - // One could argue that this is a bug in Bash, but since the goal of - // this module is to match Bash's rules, we escape a leading {} - if (str.slice(0, 2) === '{}') { - str = '\\{\\}' + str.slice(2); - } - return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); -} -function embrace(str) { - return '{' + str + '}'; -} -function isPadded(el) { - return /^-?0\d/.test(el); -} -function lte(i, y) { - return i <= y; -} -function gte(i, y) { - return i >= y; -} -// Build `{ acc[a] + pre + values[v] }` for every combination, capping the -// number of results at `max` and the total number of characters at `maxLength`. -// This is the one place output grows, so bounding it here keeps the single -// accumulator - and therefore memory - flat regardless of how many brace groups -// are combined (CVE-2026-14257). -function combine(acc, pre, values, max, maxLength, dropEmpties) { - const out = []; - let length = 0; - for (let a = 0; a < acc.length; a++) { - for (let v = 0; v < values.length; v++) { - if (out.length >= max) - return out; - const expansion = acc[a] + pre + values[v]; - // Bash drops empty results at the top level. Skip them before they count - // against `max`, so `max` bounds the number of *kept* results. - if (dropEmpties && !expansion) - continue; - if (length + expansion.length > maxLength) - return out; - out.push(expansion); - length += expansion.length; - } - } - return out; -} -// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`) -// sequence body. -function expandSequence(body, isAlphaSequence, max) { - const n = body.split(/\.\./); - const N = []; - // A sequence body always splits into two or three parts, but the compiler - // can't know that. - /* c8 ignore start */ - if (n[0] === undefined || n[1] === undefined) { - return N; - } - /* c8 ignore stop */ - const x = numeric(n[0]); - const y = numeric(n[1]); - const width = Math.max(n[0].length, n[1].length); - let incr = n.length === 3 && n[2] !== undefined ? - Math.max(Math.abs(numeric(n[2])), 1) - : 1; - let test = lte; - const reverse = y < x; - if (reverse) { - incr *= -1; - test = gte; - } - const pad = n.some(isPadded); - for (let i = x; test(i, y) && N.length < max; i += incr) { - let c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === '\\') { - c = ''; - } - } - else { - c = String(i); - if (pad) { - const need = width - c.length; - if (need > 0) { - const z = new Array(need + 1).join('0'); - if (i < 0) { - c = '-' + z + c.slice(1); - } - else { - c = z + c; - } - } - } - } - N.push(c); - } - return N; -} -function expand_(str, max, maxLength, isTop) { - // Consume the string's top-level brace groups left to right, threading a - // running set of combined prefixes (`acc`). Expanding the tail iteratively - - // rather than recursing on `m.post` once per group - keeps the native stack - // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no - // longer overflow the stack, and leaves a single accumulator whose size - // `maxLength` bounds directly (CVE-2026-14257). - let acc = ['']; - // Bash drops empty results, but only when the *first* top-level group is a - // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop - // is on the final strings, so it is applied to whichever `combine` produces - // them (the one with no brace set left in the tail). - let dropEmpties = false; - let firstGroup = true; - for (;;) { - const m = (0, balanced_match_1.balanced)('{', '}', str); - // No brace set left: the rest of the string is literal. - if (!m) { - return combine(acc, str, [''], max, maxLength, dropEmpties); - } - // no need to expand pre, since it is guaranteed to be free of brace-sets - const pre = m.pre; - if (/\$$/.test(pre)) { - acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length); - firstGroup = false; - if (!m.post.length) - break; - str = m.post; - continue; - } - const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - const isSequence = isNumericSequence || isAlphaSequence; - const isOptions = m.body.indexOf(',') >= 0; - if (!isSequence && !isOptions) { - // {a},b} - if (m.post.match(/,(?!,).*\}/)) { - str = m.pre + '{' + m.body + escClose + m.post; - isTop = true; - continue; - } - // Nothing here expands, so the whole remaining string is literal. - return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties); - } - if (firstGroup) { - dropEmpties = isTop && !isSequence; - firstGroup = false; - } - let values; - if (isSequence) { - values = expandSequence(m.body, isAlphaSequence, max); - } - else { - let n = parseCommaParts(m.body); - if (n.length === 1 && n[0] !== undefined) { - // x{{a,b}}y ==> x{a}y x{b}y - n = expand_(n[0], max, maxLength, false).map(embrace); - //XXX is this necessary? Can't seem to hit it in tests. - /* c8 ignore start */ - if (n.length === 1) { - acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length); - if (!m.post.length) - break; - str = m.post; - continue; - } - /* c8 ignore stop */ - } - values = []; - for (let j = 0; j < n.length; j++) { - values.push.apply(values, expand_(n[j], max, maxLength, false)); - } - } - acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); - if (!m.post.length) - break; - str = m.post; - } - return acc; -} -//# sourceMappingURL=index.js.map - -/***/ }), - /***/ 8658: /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { diff --git a/dist/setup/index.js b/dist/setup/index.js index 6a54d1ed..d351f277 100644 --- a/dist/setup/index.js +++ b/dist/setup/index.js @@ -1,6 +1,291 @@ import { createRequire as __WEBPACK_EXTERNAL_createRequire } from "module"; /******/ var __webpack_modules__ = ({ +/***/ 8638: +/***/ ((module) => { + + +module.exports = balanced; +function balanced(a, b, str) { + if (a instanceof RegExp) a = maybeMatch(a, str); + if (b instanceof RegExp) b = maybeMatch(b, str); + + var r = range(a, b, str); + + return r && { + start: r[0], + end: r[1], + pre: str.slice(0, r[0]), + body: str.slice(r[0] + a.length, r[1]), + post: str.slice(r[1] + b.length) + }; +} + +function maybeMatch(reg, str) { + var m = str.match(reg); + return m ? m[0] : null; +} + +balanced.range = range; +function range(a, b, str) { + var begs, beg, left, right, result; + var ai = str.indexOf(a); + var bi = str.indexOf(b, ai + 1); + var i = ai; + + if (ai >= 0 && bi > 0) { + if(a===b) { + return [ai, bi]; + } + begs = []; + left = str.length; + + while (i >= 0 && !result) { + if (i == ai) { + begs.push(i); + ai = str.indexOf(a, i + 1); + } else if (begs.length == 1) { + result = [ begs.pop(), bi ]; + } else { + beg = begs.pop(); + if (beg < left) { + left = beg; + right = bi; + } + + bi = str.indexOf(b, i + 1); + } + + i = ai < bi && ai >= 0 ? ai : bi; + } + + if (begs.length) { + result = [ left, right ]; + } + } + + return result; +} + + +/***/ }), + +/***/ 6533: +/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { + +var concatMap = __nccwpck_require__(7087); +var balanced = __nccwpck_require__(8638); + +module.exports = expandTop; + +var escSlash = '\0SLASH'+Math.random()+'\0'; +var escOpen = '\0OPEN'+Math.random()+'\0'; +var escClose = '\0CLOSE'+Math.random()+'\0'; +var escComma = '\0COMMA'+Math.random()+'\0'; +var escPeriod = '\0PERIOD'+Math.random()+'\0'; + +function numeric(str) { + return parseInt(str, 10) == str + ? parseInt(str, 10) + : str.charCodeAt(0); +} + +function escapeBraces(str) { + return str.split('\\\\').join(escSlash) + .split('\\{').join(escOpen) + .split('\\}').join(escClose) + .split('\\,').join(escComma) + .split('\\.').join(escPeriod); +} + +function unescapeBraces(str) { + return str.split(escSlash).join('\\') + .split(escOpen).join('{') + .split(escClose).join('}') + .split(escComma).join(',') + .split(escPeriod).join('.'); +} + + +// Basically just str.split(","), but handling cases +// where we have nested braced sections, which should be +// treated as individual members, like {a,{b,c},d} +function parseCommaParts(str) { + if (!str) + return ['']; + + var parts = []; + var m = balanced('{', '}', str); + + if (!m) + return str.split(','); + + var pre = m.pre; + var body = m.body; + var post = m.post; + var p = pre.split(','); + + p[p.length-1] += '{' + body + '}'; + var postParts = parseCommaParts(post); + if (post.length) { + p[p.length-1] += postParts.shift(); + p.push.apply(p, postParts); + } + + parts.push.apply(parts, p); + + return parts; +} + +function expandTop(str, options) { + if (!str) + return []; + + options = options || {}; + var max = options.max == null ? Infinity : options.max; + + // I don't know why Bash 4.3 does this, but it does. + // Anything starting with {} will have the first two bytes preserved + // but *only* at the top level, so {},a}b will not expand to anything, + // but a{},b}c will be expanded to [a}c,abc]. + // One could argue that this is a bug in Bash, but since the goal of + // this module is to match Bash's rules, we escape a leading {} + if (str.substr(0, 2) === '{}') { + str = '\\{\\}' + str.substr(2); + } + + return expand(escapeBraces(str), max, true).map(unescapeBraces); +} + +function identity(e) { + return e; +} + +function embrace(str) { + return '{' + str + '}'; +} +function isPadded(el) { + return /^-?0\d/.test(el); +} + +function lte(i, y) { + return i <= y; +} +function gte(i, y) { + return i >= y; +} + +function expand(str, max, isTop) { + var expansions = []; + + // The `{a},b}` rewrite below restarts expansion on a rewritten string with + // the same `max` and `isTop = true`. Loop instead of recursing so a long run + // of non-expanding `{}` groups can't exhaust the call stack. + for (;;) { + var m = balanced('{', '}', str); + if (!m || /\$$/.test(m.pre)) return [str]; + + var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + var isSequence = isNumericSequence || isAlphaSequence; + var isOptions = m.body.indexOf(',') >= 0; + if (!isSequence && !isOptions) { + // {a},b} + if (m.post.match(/,(?!,).*\}/)) { + str = m.pre + '{' + m.body + escClose + m.post; + isTop = true + continue + } + return [str]; + } + + var n; + if (isSequence) { + n = m.body.split(/\.\./); + } else { + n = parseCommaParts(m.body); + if (n.length === 1) { + // x{{a,b}}y ==> x{a}y x{b}y + n = expand(n[0], max, false).map(embrace); + if (n.length === 1) { + var post = m.post.length + ? expand(m.post, max, false) + : ['']; + return post.map(function(p) { + return m.pre + n[0] + p; + }); + } + } + } + + // at this point, n is the parts, and we know it's not a comma set + // with a single entry. + + // no need to expand pre, since it is guaranteed to be free of brace-sets + var pre = m.pre; + var post = m.post.length + ? expand(m.post, max, false) + : ['']; + + var N; + + if (isSequence) { + var x = numeric(n[0]); + var y = numeric(n[1]); + var width = Math.max(n[0].length, n[1].length) + var incr = n.length == 3 + ? Math.max(Math.abs(numeric(n[2])), 1) + : 1; + var test = lte; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte; + } + var pad = n.some(isPadded); + + N = []; + + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === '\\') + c = ''; + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join('0'); + if (i < 0) + c = '-' + z + c.slice(1); + else + c = z + c; + } + } + } + N.push(c); + } + } else { + N = concatMap(n, function(el) { return expand(el, max, false) }); + } + + for (var j = 0; j < N.length; j++) { + for (var k = 0; k < post.length && expansions.length < max; k++) { + var expansion = pre + N[j] + post[k]; + if (!isTop || isSequence || expansion) + expansions.push(expansion); + } + } + + return expansions; + } +} + + +/***/ }), + /***/ 2593: /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => { @@ -13,7 +298,7 @@ var path = (function () { try { return __nccwpck_require__(6928) } catch (e) {}} minimatch.sep = path.sep var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {} -var expand = __nccwpck_require__(8968) +var expand = __nccwpck_require__(6533) var plTypes = { '!': { open: '(?:(?!(?:', close: '))[^/]*?)'}, @@ -27668,6 +27953,26 @@ class Agent extends http.Agent { exports.Agent = Agent; //# sourceMappingURL=index.js.map +/***/ }), + +/***/ 7087: +/***/ ((module) => { + +module.exports = function (xs, fn) { + var res = []; + for (var i = 0; i < xs.length; i++) { + var x = fn(xs[i], i); + if (isArray(x)) res.push.apply(res, x); + else res.push(x); + } + return res; +}; + +var isArray = Array.isArray || function (xs) { + return Object.prototype.toString.call(xs) === '[object Array]'; +}; + + /***/ }), /***/ 6110: @@ -64270,340 +64575,6 @@ exports.w = { /***/ }), -/***/ 2649: -/***/ ((__unused_webpack_module, exports) => { - - -Object.defineProperty(exports, "__esModule", ({ value: true })); -exports.range = exports.balanced = void 0; -const balanced = (a, b, str) => { - const ma = a instanceof RegExp ? maybeMatch(a, str) : a; - const mb = b instanceof RegExp ? maybeMatch(b, str) : b; - const r = ma !== null && mb != null && (0, exports.range)(ma, mb, str); - return (r && { - start: r[0], - end: r[1], - pre: str.slice(0, r[0]), - body: str.slice(r[0] + ma.length, r[1]), - post: str.slice(r[1] + mb.length), - }); -}; -exports.balanced = balanced; -const maybeMatch = (reg, str) => { - const m = str.match(reg); - return m ? m[0] : null; -}; -const range = (a, b, str) => { - let begs, beg, left, right = undefined, result; - let ai = str.indexOf(a); - let bi = str.indexOf(b, ai + 1); - let i = ai; - if (ai >= 0 && bi > 0) { - if (a === b) { - return [ai, bi]; - } - begs = []; - left = str.length; - while (i >= 0 && !result) { - if (i === ai) { - begs.push(i); - ai = str.indexOf(a, i + 1); - } - else if (begs.length === 1) { - const r = begs.pop(); - if (r !== undefined) - result = [r, bi]; - } - else { - beg = begs.pop(); - if (beg !== undefined && beg < left) { - left = beg; - right = bi; - } - bi = str.indexOf(b, i + 1); - } - i = ai < bi && ai >= 0 ? ai : bi; - } - if (begs.length && right !== undefined) { - result = [left, right]; - } - } - return result; -}; -exports.range = range; -//# sourceMappingURL=index.js.map - -/***/ }), - -/***/ 8968: -/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { - - -Object.defineProperty(exports, "__esModule", ({ value: true })); -exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0; -exports.expand = expand; -const balanced_match_1 = __nccwpck_require__(2649); -const escSlash = '\0SLASH' + Math.random() + '\0'; -const escOpen = '\0OPEN' + Math.random() + '\0'; -const escClose = '\0CLOSE' + Math.random() + '\0'; -const escComma = '\0COMMA' + Math.random() + '\0'; -const escPeriod = '\0PERIOD' + Math.random() + '\0'; -const escSlashPattern = new RegExp(escSlash, 'g'); -const escOpenPattern = new RegExp(escOpen, 'g'); -const escClosePattern = new RegExp(escClose, 'g'); -const escCommaPattern = new RegExp(escComma, 'g'); -const escPeriodPattern = new RegExp(escPeriod, 'g'); -const slashPattern = /\\\\/g; -const openPattern = /\\{/g; -const closePattern = /\\}/g; -const commaPattern = /\\,/g; -const periodPattern = /\\\./g; -exports.EXPANSION_MAX = 100_000; -// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An -// input like `'{a,b}'.repeat(1500)` stays under that count - its output is -// truncated to 100k results - while making every result ~1500 characters -// long. The result set, and the intermediate arrays built while combining -// brace sets, then grow large enough to exhaust memory and crash the process -// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of -// characters the accumulator may hold at any point, so memory stays flat no -// matter how many brace groups are chained. The limit sits well above any -// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M -// characters) so legitimate input is unaffected. -exports.EXPANSION_MAX_LENGTH = 4_000_000; -function numeric(str) { - return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); -} -function escapeBraces(str) { - return str - .replace(slashPattern, escSlash) - .replace(openPattern, escOpen) - .replace(closePattern, escClose) - .replace(commaPattern, escComma) - .replace(periodPattern, escPeriod); -} -function unescapeBraces(str) { - return str - .replace(escSlashPattern, '\\') - .replace(escOpenPattern, '{') - .replace(escClosePattern, '}') - .replace(escCommaPattern, ',') - .replace(escPeriodPattern, '.'); -} -/** - * Basically just str.split(","), but handling cases - * where we have nested braced sections, which should be - * treated as individual members, like {a,{b,c},d} - */ -function parseCommaParts(str) { - if (!str) { - return ['']; - } - const parts = []; - const m = (0, balanced_match_1.balanced)('{', '}', str); - if (!m) { - return str.split(','); - } - const { pre, body, post } = m; - const p = pre.split(','); - p[p.length - 1] += '{' + body + '}'; - const postParts = parseCommaParts(post); - if (post.length) { - ; - p[p.length - 1] += postParts.shift(); - p.push.apply(p, postParts); - } - parts.push.apply(parts, p); - return parts; -} -function expand(str, options = {}) { - if (!str) { - return []; - } - const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options; - // I don't know why Bash 4.3 does this, but it does. - // Anything starting with {} will have the first two bytes preserved - // but *only* at the top level, so {},a}b will not expand to anything, - // but a{},b}c will be expanded to [a}c,abc]. - // One could argue that this is a bug in Bash, but since the goal of - // this module is to match Bash's rules, we escape a leading {} - if (str.slice(0, 2) === '{}') { - str = '\\{\\}' + str.slice(2); - } - return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); -} -function embrace(str) { - return '{' + str + '}'; -} -function isPadded(el) { - return /^-?0\d/.test(el); -} -function lte(i, y) { - return i <= y; -} -function gte(i, y) { - return i >= y; -} -// Build `{ acc[a] + pre + values[v] }` for every combination, capping the -// number of results at `max` and the total number of characters at `maxLength`. -// This is the one place output grows, so bounding it here keeps the single -// accumulator - and therefore memory - flat regardless of how many brace groups -// are combined (CVE-2026-14257). -function combine(acc, pre, values, max, maxLength, dropEmpties) { - const out = []; - let length = 0; - for (let a = 0; a < acc.length; a++) { - for (let v = 0; v < values.length; v++) { - if (out.length >= max) - return out; - const expansion = acc[a] + pre + values[v]; - // Bash drops empty results at the top level. Skip them before they count - // against `max`, so `max` bounds the number of *kept* results. - if (dropEmpties && !expansion) - continue; - if (length + expansion.length > maxLength) - return out; - out.push(expansion); - length += expansion.length; - } - } - return out; -} -// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`) -// sequence body. -function expandSequence(body, isAlphaSequence, max) { - const n = body.split(/\.\./); - const N = []; - // A sequence body always splits into two or three parts, but the compiler - // can't know that. - /* c8 ignore start */ - if (n[0] === undefined || n[1] === undefined) { - return N; - } - /* c8 ignore stop */ - const x = numeric(n[0]); - const y = numeric(n[1]); - const width = Math.max(n[0].length, n[1].length); - let incr = n.length === 3 && n[2] !== undefined ? - Math.max(Math.abs(numeric(n[2])), 1) - : 1; - let test = lte; - const reverse = y < x; - if (reverse) { - incr *= -1; - test = gte; - } - const pad = n.some(isPadded); - for (let i = x; test(i, y) && N.length < max; i += incr) { - let c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === '\\') { - c = ''; - } - } - else { - c = String(i); - if (pad) { - const need = width - c.length; - if (need > 0) { - const z = new Array(need + 1).join('0'); - if (i < 0) { - c = '-' + z + c.slice(1); - } - else { - c = z + c; - } - } - } - } - N.push(c); - } - return N; -} -function expand_(str, max, maxLength, isTop) { - // Consume the string's top-level brace groups left to right, threading a - // running set of combined prefixes (`acc`). Expanding the tail iteratively - - // rather than recursing on `m.post` once per group - keeps the native stack - // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no - // longer overflow the stack, and leaves a single accumulator whose size - // `maxLength` bounds directly (CVE-2026-14257). - let acc = ['']; - // Bash drops empty results, but only when the *first* top-level group is a - // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop - // is on the final strings, so it is applied to whichever `combine` produces - // them (the one with no brace set left in the tail). - let dropEmpties = false; - let firstGroup = true; - for (;;) { - const m = (0, balanced_match_1.balanced)('{', '}', str); - // No brace set left: the rest of the string is literal. - if (!m) { - return combine(acc, str, [''], max, maxLength, dropEmpties); - } - // no need to expand pre, since it is guaranteed to be free of brace-sets - const pre = m.pre; - if (/\$$/.test(pre)) { - acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length); - firstGroup = false; - if (!m.post.length) - break; - str = m.post; - continue; - } - const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - const isSequence = isNumericSequence || isAlphaSequence; - const isOptions = m.body.indexOf(',') >= 0; - if (!isSequence && !isOptions) { - // {a},b} - if (m.post.match(/,(?!,).*\}/)) { - str = m.pre + '{' + m.body + escClose + m.post; - isTop = true; - continue; - } - // Nothing here expands, so the whole remaining string is literal. - return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties); - } - if (firstGroup) { - dropEmpties = isTop && !isSequence; - firstGroup = false; - } - let values; - if (isSequence) { - values = expandSequence(m.body, isAlphaSequence, max); - } - else { - let n = parseCommaParts(m.body); - if (n.length === 1 && n[0] !== undefined) { - // x{{a,b}}y ==> x{a}y x{b}y - n = expand_(n[0], max, maxLength, false).map(embrace); - //XXX is this necessary? Can't seem to hit it in tests. - /* c8 ignore start */ - if (n.length === 1) { - acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length); - if (!m.post.length) - break; - str = m.post; - continue; - } - /* c8 ignore stop */ - } - values = []; - for (let j = 0; j < n.length; j++) { - values.push.apply(values, expand_(n[j], max, maxLength, false)); - } - } - acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); - if (!m.post.length) - break; - str = m.post; - } - return acc; -} -//# sourceMappingURL=index.js.map - -/***/ }), - /***/ 9373: /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { diff --git a/package-lock.json b/package-lock.json index 3f71f07d..c8473e39 100644 --- a/package-lock.json +++ b/package-lock.json @@ -70,6 +70,22 @@ "minimatch": "^3.0.4" } }, + "node_modules/@actions/cache/node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "license": "MIT" + }, + "node_modules/@actions/cache/node_modules/brace-expansion": { + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, "node_modules/@actions/cache/node_modules/minimatch": { "version": "3.1.5", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", @@ -3186,6 +3202,12 @@ "dev": true, "license": "MIT" }, + "node_modules/concat-map": { + "version": "0.0.1", + "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", + "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", + "license": "MIT" + }, "node_modules/convert-source-map": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz", @@ -4202,6 +4224,23 @@ "node": ">=10.13.0" } }, + "node_modules/glob/node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "dev": true, + "license": "MIT" + }, + "node_modules/glob/node_modules/brace-expansion": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0" + } + }, "node_modules/glob/node_modules/minimatch": { "version": "9.0.9", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", @@ -6265,6 +6304,24 @@ "node": ">=8" } }, + "node_modules/test-exclude/node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "dev": true, + "license": "MIT" + }, + "node_modules/test-exclude/node_modules/brace-expansion": { + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, "node_modules/test-exclude/node_modules/glob": { "version": "7.2.3", "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz", diff --git a/package.json b/package.json index 29b311ea..99f83283 100644 --- a/package.json +++ b/package.json @@ -75,8 +75,5 @@ "bugs": { "url": "https://github.com/actions/setup-java/issues" }, - "homepage": "https://github.com/actions/setup-java#readme", - "overrides": { - "brace-expansion": "5.0.8" - } + "homepage": "https://github.com/actions/setup-java#readme" } From 4c79f31322023055405d8067c335c47a6018fcbb Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 27 Jul 2026 21:35:17 +0000 Subject: [PATCH 5/5] Restore transitive dependency license records --- .licenses/npm/balanced-match-1.0.2.dep.yml | Bin 0 -> 2592 bytes .licenses/npm/brace-expansion-1.1.16.dep.yml | Bin 0 -> 2581 bytes .licenses/npm/concat-map.dep.yml | Bin 0 -> 1379 bytes 3 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 .licenses/npm/balanced-match-1.0.2.dep.yml create mode 100644 .licenses/npm/brace-expansion-1.1.16.dep.yml create mode 100644 .licenses/npm/concat-map.dep.yml diff --git a/.licenses/npm/balanced-match-1.0.2.dep.yml b/.licenses/npm/balanced-match-1.0.2.dep.yml new file mode 100644 index 0000000000000000000000000000000000000000..36095592b7638eb5cace9a13698a3b9cda74b142 GIT binary patch literal 2592 zcmeHJ&5qkP5Wedv20jG4fNUq}&AC)7(QCG{WKeQ8i=qcgqAjM9XpmGkM%#Dqkg|o)i%w2^99!H32B#mB&&PgpaY`oN5R z&-Hl)TUU2$gSzFK*H&maaj8uRo%~C{?C%-yp@G@Iv!GSIIPoLmwAP-?YPmd0+m6+u zR{iqp*hxMd^;ikL{GXOi)?zT&*Gn5*24)q^!KhK!!mJ>rG06(D=$in*itly>|KJnA z-IkX3fq#tE>8$0kwQyJ8!^ig@eu3XSDLi^sc-PralZ;Nl?Efa&LK!)JR+v#Xs#-Koy!ZeLLHaL96!9^!TF)qC4U(8fV3D8Ry31HqdfCh zQCm0b;18qO5#|d<{|d48PMX34wgsF;WzeGp~VecPS+}PqR4PCp3G62kg!A65kSh z8xXk6p+wRP93|MhhAm<72GOGjn$q$)^k8dRW)6FuGl*apv69C7G-9yZvt3>gl#w8G zMzb|TCbA`2xj<%|1M(RMP;8V;vM*4W54*{-TS_+!A6+8*Q?halz0_skeb zvQnk0-G@FzAc3#vo_o%j@qzJpJZiH>%qZ`&LX5@7L)L1k+R+Em+0Plhp5XQ4$ea#X z)gGFW?wcm-PBXf0X+u&nJay zrtkY&X6?S~bJ0zoQ>bMjT8+j=n$h_}&qia?s_zP+XB6-`3llaXGUB6|(IgUU@NTiNa@qXIk}A*?nPptRbVW7Y{Yl(0{$ zLT13EQWbq8T9X+&b0=$|>DE+&Zjy7y&7B)mimY~svIU}`%WXQsW7Qk#gf^WlERILA zE$Y6sTrRh332%ofw%wVe9UxTn8fq+Oj~Z3Vo&6L};-SxLsVk34Y2owUV5PQ2w_~2w zGgTdFQ4jQhBB8;*?vwp!V@HkthZRLn#^R*&5@Y?lVi_tI%t4ak6-Q@S8Ft%b< z>{MN=qm@~xwv<*oj*U~5;&zs+55nmh&P1yWXuB-Fv5et@i+iDjVQ&? zGaP5=UDBGx^A*tjdmixg$#Y;!o`x2C8O7w&#*b4z-v)k6n{B*_5(XLzK!-eB#+by` zEKDbuj2f|bxS(X^2Z0^u@cb>5#Fi_~qs>#yA66-?qF}*Lyk}tO-v?|M2Z8gz=WCA^ z{@Q=AEMtm*H0ZQT2d4D6VzzAO`gqS%9)(uYJPOkommU9zflC(I*1=7}|D8At0u zthE?jm;xa5hHOBx_B+F_yM!gyz%2~8aH0kC1K?rH!mHd%!{p1LikZJyvq@9Jk#kgy zojJGIox6XSQm<btGRdtMK5Q5kIHEHH`jER^gdtoofWZt z&iC@clgT78vR89ztZAg5^zxj1SA)~m%<0qg)AY~8U(Yx<=RR>`-^=0pC{{*#{aq1y zTIo(|xF#pttFt_!{^b4H&1bWt_NQ?_ZEQbtx5n-v%YyUL~DwlyT^_ z9$=59nQFQOxbO z??>(=;bV`1i2;IN8^TtEeAt8AIJU-X+{xJvkv9xR(Dbk|z3W&rs>)UUo(V?0qOB-D z^Cer-OIBh1lF~b`*X6DzREVsoKd4+$R(#N3yjZ5h{@w~!RaAym1a-r+by?}|1|EY?8JUU|;zkCaxtE`S?BSEZngwwb8;VwY!v zwmY#cD+U=$Ko`7N2{5q@E9xnju}ADP7F4aXJdbqQ4lcw~=c3$x2>!ONXHl9M e!LsFsP4OUpYwaccS8p#8?j^Ym7@n&yUy~ma1+z5( literal 0 HcmV?d00001