2026-08-30 00:10:11 +03:00
lockfileVersion : '9.0'
settings :
autoInstallPeers : true
excludeLinksFromLockfile : false
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
overrides :
brace-expansion@1 : ^1.1.18
brace-expansion@2 : ^2.1.4
brace-expansion@5 : ^5.0.9
js-yaml@3 : ^3.15.2
js-yaml@4 : ^4.3.2
ws@8 : ^8.21.3
socket.io-parser : ^4.2.7
linkify-it : ^5.0.2
markdown-it : ^14.3.1
got@9 : ^11.8.6
body-parser@2 : ^2.3.0
2026-08-30 00:10:11 +03:00
importers :
. :
devDependencies :
'@arethetypeswrong/cli' :
specifier : ^0.18.5
version : 0.18 .5
'@babel/cli' :
specifier : ^7.29.7
version : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/core' :
specifier : ^7.29.7
version : 7.29 .7 (supports-color@7.2.0)
'@babel/preset-env' :
specifier : ^7.29.7
version : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/register' :
specifier : ^7.29.7
version : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@eslint/js' :
specifier : ^10.0.1
version : 10.0 .1 (eslint@10.8.0(supports-color@7.2.0))
'@rolldown/plugin-babel' :
specifier : 0.2 .3
version : 0.2 .3 (@babel/core@7.29.7(supports-color@7.2.0))(rolldown@1.2.0)
ava :
specifier : ^3.0.0
version : 3.15 .0 (supports-color@7.2.0)
babel-plugin-add-module-exports :
specifier : ^1.0.4
version : 1.0 .4
babel-plugin-istanbul :
specifier : ^8.0.0
version : 8.0 .0 (supports-color@7.2.0)
core-js :
specifier : ^3.49.0
version : 3.49 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
coveralls-next :
specifier : ^6.0.2
version : 6.0 .2
2026-08-30 00:10:11 +03:00
docdash :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
specifier : ^2.0.2
version : 2.0 .2
2026-08-30 00:10:11 +03:00
eslint :
specifier : ^10.8.0
version : 10.8 .0 (supports-color@7.2.0)
eslint-config-airbnb-extended :
specifier : ^3.1.0
version : 3.1 .0 (@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(@typescript-eslint/utils@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10(supports-color@7.2.0))(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
eslint-plugin-ava :
specifier : ^17.0.1
version : 17.0 .1 (eslint@10.8.0(supports-color@7.2.0))
eslint-plugin-import :
specifier : ^2.32.0
version : 2.32 .0 (@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)
gh-pages :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
specifier : ^6.3.0
version : 6.3 .0
2026-08-30 00:10:11 +03:00
jsdoc :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
specifier : ^4.0.5
version : 4.0 .5
2026-08-30 00:10:11 +03:00
nyc :
specifier : ^18.0.0
version : 18.0 .0 (supports-color@7.2.0)
publint :
specifier : ^0.3.22
version : 0.3 .22
regenerator-runtime :
specifier : ^0.14.1
version : 0.14 .1
sinon :
specifier : ^22.0.0
version : 22.0 .0
terser :
specifier : ^5.49.0
version : 5.49 .0
testem :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
specifier : ^3.20.2
version : 3.20 .2 (@babel/core@7.29.7(supports-color@7.2.0))(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(underscore@1.13.8)
2026-08-30 00:10:11 +03:00
tsdown :
specifier : ^0.22.14
version : 0.22 .14 (@arethetypeswrong/core@0.18.5)(publint@0.3.22)(typescript@5.9.3)
typescript :
specifier : ^5.9.3
version : 5.9 .3
yamljs :
specifier : ^0.3.0
version : 0.3 .0
packages :
'@andrewbranch/untar.js@1.0.3' :
resolution : {integrity : sha512-Jh15/qVmrLGhkKJBdXlK1+9tY4lZruYjsgkDFj08ZmDiWVBLJcqkok7Z0/R0In+i1rScBpJlSvrTS2Lm41Pbnw==}
'@arethetypeswrong/cli@0.18.5' :
resolution : {integrity : sha512-gM+8vRsQOD/Uc7EnBedUhkG5OCsDWE4uoak5QvomGpMpaky0Eh41p04nIMgrWb8EOmqZUJGc6zz9hsP6E56R7g==}
engines : {node : '>=20' }
hasBin : true
'@arethetypeswrong/core@0.18.5' :
resolution : {integrity : sha512-9ytjzGwxjm9Uz7I9avfbt5vlQt6uk9uRRESzJjqrznl6WKvI6dwYTo+vJ3U02Wrq/mR3iql/PzhvHhKdJIAjDQ==}
engines : {node : '>=20' }
'@babel/cli@7.29.7' :
resolution : {integrity : sha512-/75HwRbAYPqXv/Ax1h7Fg3IZfXgdU98jnA8H93/m/QBaPV3Hp5ICoLqzGYye1yHBCgpmXvtqgSUN8oOKX5tojQ==}
engines : {node : '>=6.9.0' }
hasBin : true
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/code-frame@7.29.7' :
resolution : {integrity : sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
engines : {node : '>=6.9.0' }
'@babel/compat-data@7.29.7' :
resolution : {integrity : sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==}
engines : {node : '>=6.9.0' }
'@babel/core@7.29.7' :
resolution : {integrity : sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
engines : {node : '>=6.9.0' }
'@babel/generator@7.29.7' :
resolution : {integrity : sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
engines : {node : '>=6.9.0' }
'@babel/helper-annotate-as-pure@7.29.7' :
resolution : {integrity : sha512-OoK6239jHPuSQOoS0kfTVKn0b/rVTk0seKq4Gd2UMLtmOVLjDC0ki3e+c90Trqv2gMfvJFqkiljrr568+qddiw==}
engines : {node : '>=6.9.0' }
'@babel/helper-compilation-targets@7.29.7' :
resolution : {integrity : sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
engines : {node : '>=6.9.0' }
'@babel/helper-create-class-features-plugin@7.29.7' :
resolution : {integrity : sha512-IY3ZD9Tmooqr3TUhc3DUWxiuo8xx1DWLhd5M7hQ+ZWJamqM2BbalrBJb2MisSLoYorOj75U03qULCxQTY9r3hg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/helper-create-regexp-features-plugin@7.29.7' :
resolution : {integrity : sha512-907Uymvqgg1dwUA+7IGwFAOSYzQOuzPXKNJ1yxzwPffzkYFg2q2eHi1fIOs6sXkG9NbIUMunnUlkYsfRFNvomg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/helper-define-polyfill-provider@0.6.8' :
resolution : {integrity : sha512-47UwBLPpQi1NoWzLuHNjRoHlYXMwIJoBf7MFou6viC/sIHWYygpvr0B6IAyh5sBdA2nr2LPIRww8lfaUVQINBA==}
peerDependencies :
'@babel/core' : ^7.4.0 || ^8.0.0-0 <8.0.0
'@babel/helper-globals@7.29.7' :
resolution : {integrity : sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
engines : {node : '>=6.9.0' }
'@babel/helper-member-expression-to-functions@7.29.7' :
resolution : {integrity : sha512-j+7JYmk1JYDtACIGj0QJqqWZjoUpMoEikQGADMaHgCMCSDqd2+P32rfcibUNrGOMWrlzK1WJBdxrB3JJQZwWtg==}
engines : {node : '>=6.9.0' }
'@babel/helper-module-imports@7.29.7' :
resolution : {integrity : sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
engines : {node : '>=6.9.0' }
'@babel/helper-module-transforms@7.29.7' :
resolution : {integrity : sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/helper-optimise-call-expression@7.29.7' :
resolution : {integrity : sha512-+kmGVjcT9RGYzoDwdwEqEvGgKe3BYq+O1iGzjFubaNgZHwYHP6lsF2Yghf4kEuv9BV7tYDZ913aBW9am6YKong==}
engines : {node : '>=6.9.0' }
'@babel/helper-plugin-utils@7.29.7' :
resolution : {integrity : sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==}
engines : {node : '>=6.9.0' }
'@babel/helper-remap-async-to-generator@7.29.7' :
resolution : {integrity : sha512-16AMiW26DbXWBbr3B8wNozKM0ydMLB892vaOaJW/fPJdnT8vJk5sdkQcU/isqUxyCE0cEoa8wZOcbgDuC4b6Og==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/helper-replace-supers@7.29.7' :
resolution : {integrity : sha512-atfGXWSeCiF4DnKZIfmJfQRkSw9b9gNNXR1kqKjbhG4pGYCOnkp8OcTB8E3NXjBu8NpheSnOeNKz8KT7UNFTmQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/helper-skip-transparent-expression-wrappers@7.29.7' :
resolution : {integrity : sha512-brcMGQaVzIeUb+6/bs1Av0f8YuNNjKY2JyvfRCsFuFsdKccEQ5Ges2y74D74NZ1Rz8lKJ9ksJkfqwQFJ/iNEyQ==}
engines : {node : '>=6.9.0' }
'@babel/helper-string-parser@7.29.7' :
resolution : {integrity : sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
engines : {node : '>=6.9.0' }
'@babel/helper-validator-identifier@7.29.7' :
resolution : {integrity : sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
engines : {node : '>=6.9.0' }
'@babel/helper-validator-option@7.29.7' :
resolution : {integrity : sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
engines : {node : '>=6.9.0' }
'@babel/helper-wrap-function@7.29.7' :
resolution : {integrity : sha512-iES0Skag9ERIF68aXadpO6dbXa03mNWK3sEqJaMnLNs/eC3l0lkImdfoy6Y09/SfkpawdAB4RjQ7PVA7TcVGdw==}
engines : {node : '>=6.9.0' }
'@babel/helpers@7.29.7' :
resolution : {integrity : sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
engines : {node : '>=6.9.0' }
'@babel/parser@7.29.7' :
resolution : {integrity : sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==}
engines : {node : '>=6.0.0' }
hasBin : true
'@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.29.7' :
resolution : {integrity : sha512-j8SrR0zLZrRsC09DlszEx8FpMiwukKffYXMK0d5LmOglO7vGG6sz/BR/20yHqWH+Lnn31JTt2PE3hIWNgM2J6w==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/plugin-bugfix-safari-class-field-initializer-scope@7.29.7' :
resolution : {integrity : sha512-r8j8escF+U2FUHo0KOhPUdMzUO+jp9fInva6+ACVAF3Y97Ev+5iNZwiqTghmzNeWwDkOPlYuTcfb1vDaoZKmAQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.29.7' :
resolution : {integrity : sha512-GE1TFSiuFeGsCxmYXZl8HwoPrVlwe4rHPFE8weieGKZqnDORK+Ar3vgWMgW+AOxQ6/2TgLSKx9p6W7O4rC6qgQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/plugin-bugfix-safari-rest-destructuring-rhs-array@7.29.7' :
resolution : {integrity : sha512-oBNVCvnO5tND+xSopWvV8WNGfpTfgP4Zr/YXXSj8zfmcPktp5Ku/aZlsIowgSD4fjmgHn6sGmB9APVsU5zOdhA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.29.7' :
resolution : {integrity : sha512-QQt9qKHZ2sg/kivaLr7lnQr8HVrQDdBNSfCsTjiDxRuX/K5ORyKq+Bu8Xr0cDE3Dfkv0cw28Ve0EKyKMvulkOw==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.13.0
'@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@7.29.7' :
resolution : {integrity : sha512-pn6QacGLgvCcwc+syUhKE/qSjV2D1IHDB84RNxWYSt1mW3K/SCtjinZ2p0cETJxAWBjPy3K/1lHwG5BjjPxNlw==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2' :
resolution : {integrity : sha512-SOSkfJDddaM7mak6cPEpswyTRnuRltl429hMraQEglW+OkovnCzsiszTmsrlY//qLFjCpQDFRvjdm2wA5pPm9w==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-syntax-import-assertions@7.29.7' :
resolution : {integrity : sha512-/An1OCBN93thpBAGyfsK2pcf0jvju1SAtKkL2Ny++B5Sy6sqgzXDQH1cZxWbF96Wuk+bn41MDA9bLd4VVAw6rw==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-syntax-import-attributes@7.29.7' :
resolution : {integrity : sha512-zGYcYfq/WmZ4V+kBIXQon9dSSc8ircGZqw9ZaNhhGj9nZkeBu1jHLBDQqYYi5WA9uawvA2sIMbry2nCFhf5Djg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-syntax-unicode-sets-regex@7.18.6' :
resolution : {integrity : sha512-727YkEAPwSIQTv5im8QHz3upqp92JTWhidIC81Tdx4VJYIte/VndKf1qKrfnnhPLiPghStWfvC/iFaMCQu7Nqg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/plugin-transform-arrow-functions@7.29.7' :
resolution : {integrity : sha512-N7zArUXWzAMzm+/N0uPBeVB3Fam5lMxtUwMmDK5f/IBBS7a7p1qeUoxd/6CckXoxUdgsntq1Dh8xNW06maZbDQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-async-generator-functions@7.29.7' :
resolution : {integrity : sha512-d98gXZkgswvkyohMBABkhm3GeXhYj8psWfwQ2C7gtfrKGTykQa/iOIi+JJhwMjPlZ6Vm2XN+DCf3Es1EoG4ZLA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-async-to-generator@7.29.7' :
resolution : {integrity : sha512-pcUb2SS+RMo9TWVBwKGI5ShtoG7R+zBsFmCKDa6fe8c+hPr3XJlZgoE5j6i8W7gDjhyvy+85vmYexanvXh3d1w==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-block-scoped-functions@7.29.7' :
resolution : {integrity : sha512-cUSmjh72N+rN4PrkFlN1dJwNCwjVp5d38/CQrEsFggkD10UiFlBFgdH3tv5dNsLuHY+3S8db2xCHjhZcv5WgvA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-block-scoping@7.29.7' :
resolution : {integrity : sha512-ONyr4+AZhKh8yKWInVxU9AXA9EbsyeLcL6V0dJy6M2/62vuvpGm29zzuymbTpdc451GEpDIdAyPLP3r+P61yKQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-class-properties@7.29.7' :
resolution : {integrity : sha512-GtcpjFvanPfzNQi3eTitsCqtRRmmqzpy/A+yhTR1HaZo1Ly3EA8ZXxlPyHdR8/IuRMYc3E4wdGBewB2QKQjAaA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-class-static-block@7.29.7' :
resolution : {integrity : sha512-kibJgmEdX2iMwsHY2tSZNDgj8PwIlCQz7FK9KuGKO8zsuoUwSEhoNnNVp/emKWrbY4HeO6kkXfdMqRKKKXBm2A==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.12.0
'@babel/plugin-transform-classes@7.29.7' :
resolution : {integrity : sha512-qV0OGGBVacduzQHE649JyCneOFI/maT+YKsO+K4Yi3xv2wTPNjM/W2o2gdzMwEAZz7fXNTHAe0NcSg30bIN69g==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-computed-properties@7.29.7' :
resolution : {integrity : sha512-RK7/IyU5phpuCdBAuig5VkzG/EnbDaui5SQGdU9BFrHdV+mV4cUjLMQ9lJDjLNtWHsqtiefpGZUXQP2BiTYMsA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-destructuring@7.29.7' :
resolution : {integrity : sha512-iPX8aD6H9zV5s7ZsqTdNocPN/MGQ5sSMnElKrktxjJRMnB2jN/1p2+R7GkfD6CAYoVFqy5A4XnSIUeGgJzIWpg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-dotall-regex@7.29.7' :
resolution : {integrity : sha512-3qc18hsD2RdZiyJNDNc7HQpv6xbncwh8FYtxNFFzclSyh/trPD9KkVR9BDECUjDLvb7yJVF15GfYUuC+LMkkiQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-duplicate-keys@7.29.7' :
resolution : {integrity : sha512-6IvRRriEMqnBwD6chtxdLpMYCHWEzN+oL5cyQtjykya19UgzbmKhxmhZgKC/LHxS2nYr9Q/qYPZ5Lr6jOL9+yQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-duplicate-named-capturing-groups-regex@7.29.7' :
resolution : {integrity : sha512-2wiIyo2BjtgU7HufSeDnL9L2O7zr8jmhFKuSr65VpRkUiRKRNpb0mdlk56+XPPKoIrfHqzbMuglDvZun0RISsA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/plugin-transform-dynamic-import@7.29.7' :
resolution : {integrity : sha512-giOlEm/EFjfjr+te9NsdjkUo2v4f8rS/SXPumRVHAtbNcyNlvtREkU1dZzaIDclNpnaVhlCqRdFKhJBjBikzLg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-explicit-resource-management@7.29.7' :
resolution : {integrity : sha512-Rstj7coNz8sE+7Ju7ihpHLI564lsK5pUpNNlvptCIC/16E/S5hbl6n3kESPKdNRmqEWlpn5xpS5Q2dvXBsySLw==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-exponentiation-operator@7.29.7' :
resolution : {integrity : sha512-zFpMOTLZBdW5LfObqcSbL6kefg4R4eLdmvS0wbN9M6D5Mym/sKm9toOoWyVOa+xDjvCnuWcHls2YonXwHvH3CQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-export-namespace-from@7.29.7' :
resolution : {integrity : sha512-24B2nOy2TeJSMheqwPD4DDQOV/elLSIlKxjZt4i05H5AgdPdWR3n18HnNrcJ+j76WJd9gbwb9jPjNYUy6RautA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-for-of@7.29.7' :
resolution : {integrity : sha512-zeSIHh0+E1Um1WJRXCFlHQYu2ieJNdivLLjlBEp+dIBu3S51n+SZZmIXjxnItw6pz56Cn+KvK68BIBVsxq2JiQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-function-name@7.29.7' :
resolution : {integrity : sha512-otRWaHXE6fbAGkePvaj/kvs3HsqXfPhlnzwSOlnFgbqCPMd975dW+4wZ00WFBt+/YlBGcJwNrARQTOJOb4ZrIg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-json-strings@7.29.7' :
resolution : {integrity : sha512-RRnE2+eon1rJAq8MnoF1b5kTpY1vU88twHcvcKMrsqP/jxIRqDVs9iJB5fqPuqyeFAW0wJo4MlUIPpQCq/aRsg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-literals@7.29.7' :
resolution : {integrity : sha512-DZ/oLP21ZuWx1vKqnoNv6/tvEK48AQOBRai40CX9dTjGluvT/YZCyY3rryDtyUqCEoyNroy5KKPwX2iQCiRvyw==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-logical-assignment-operators@7.29.7' :
resolution : {integrity : sha512-A0H91hh6W8MFRkp5TqJmMr39jzGD1A1E1Ysiv2O06Sfbhkapm+XyIzxWCEh5kqwOZ1/8QZ0dY3SeQ7XBqfJd5Q==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-member-expression-literals@7.29.7' :
resolution : {integrity : sha512-hl1kwFZCCiDyfH25Xmco9jTrkPgnS9pmOzSG7W5I4SaGbLeqKv417hcU2RKmaxoPEgsoJh7ZPOrnPGq99bHoUg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-modules-amd@7.29.7' :
resolution : {integrity : sha512-fxtQoH3m5ywUSIfaH0FGCzWu4McsYon5bD3K4XnskC7f+OyQMj7rsOMi4NvvmJ83WwBAg4UCe+ov4VZlqEvyew==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-modules-commonjs@7.29.7' :
resolution : {integrity : sha512-j0vCldybPC5b5dwCQOJ21uKtHzt7hxLygJTg9eF1ScfaikEDNfzn94XoW5Fi+seBR0nCyL23xaBFFkq7dTM8XQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-modules-systemjs@7.29.7' :
resolution : {integrity : sha512-TM2ZcQLoG2/y4HODiStCo10DibYhWhGWAwVv+EQKmG/7GFl0N+AAmUiXOMKM+aiJ9XBJ9AHVZBvTzMnJ2sM3cQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-modules-umd@7.29.7' :
resolution : {integrity : sha512-B4UkaTK3QpgCwJnrxKfMPKdo92CN7OKXAlpAAnM3UPu0Q0lCCk57ylA9AJbRy2v8dDKOPAAWcoR6CMyeoHwRCA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-named-capturing-groups-regex@7.29.7' :
resolution : {integrity : sha512-vuFoLwr4qnv2xbZ16SQd6uPcH5FNrLHhk/Jzo++0XJFcaDsr4gjJVg6j398oMHiC+83k/GiBzviwF5KBJkPUtQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/plugin-transform-new-target@7.29.7' :
resolution : {integrity : sha512-fEo41GmsOUhOBlw8ioo6zvjX5Xc2Lqkzlyfqbpsk3eB6TReV18uhxZ0esfEokVbY2+PVJAQHNKxER6lGrzNd3A==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-nullish-coalescing-operator@7.29.7' :
resolution : {integrity : sha512-idmp1dFaekP9GbcMvG24Kvw2BfhFZjHnNJCkV4WuIY4PskJzwI3f1N5OdgYke38T7rftO6ERulFRn2cFeZwRkg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-numeric-separator@7.29.7' :
resolution : {integrity : sha512-zR7fv/z14OjgHl4AgRtkDBvBMhIzCxqV/qN/2BCRC7LjFwvuzjYe7gDWxC4Wl/SNsLM6SE1IWvRPYMgSJaUvNw==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-object-rest-spread@7.29.7' :
resolution : {integrity : sha512-Ld98jn4c0smUywL57m7SgsHq3OpThOa6LqZJif3G6jYOovPleoFhVrBJ1WegRApSFB2wu4+RelAj9AC9G08Z4A==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-object-super@7.29.7' :
resolution : {integrity : sha512-Ea/diGcw0twB5IlZPO5sgET6fJsLJqPABqTuFWIR+iMPGPZJkATEIWx0wa+aEQ5UY1CBQyP/gkAiLEqn1vBiQA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-optional-catch-binding@7.29.7' :
resolution : {integrity : sha512-sLsyndxK2VwX6yNUOakMb7Sh553ZTe/vVM1XJ+9Z5aW1ytsc8xOIwmyk05NNjN60vkc5/KqoTH6hB4V41LJhng==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-optional-chaining@7.29.7' :
resolution : {integrity : sha512-6GM1dhvK3gNODkXcEcMCOLEDCLSoZ/sBbro2Ax8HURyasQ4NshagQixkRFdh5niI6E4gmA/jYI/4aT7rRos3ZQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-parameters@7.29.7' :
resolution : {integrity : sha512-ZDOBqV/qLYJI0YElr8DcENEyARsFQeESqWXH6gZlghYXuPPjvweuDhP4VyEi4BlUBlLRFZVjxoZDMjxhLW766g==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-private-methods@7.29.7' :
resolution : {integrity : sha512-/6Rz4DK1ETDEM/bWHsPHcaEe7ZaT1EqSXjtSP/L0DijOYuaUhiRiOKcwpZ8P7zR4xXEHc2ITdiCgBm9Tpyv9ug==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-private-property-in-object@7.29.7' :
resolution : {integrity : sha512-+BNo06dnrzdNNqCm1X6YUaVv0DKk8Q+JYcoZfOkLhYWNCXzlwTSRq8zGWayT1csjcpNXV9CQTBRRbmTLZac5cA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-property-literals@7.29.7' :
resolution : {integrity : sha512-bOMRLQuI0A5ZqHq3OWJ89/rXpJ/NJrbVhXiP4zwPGMs6kpcVsuTUNjwoE30K0Qm3mf48a/TnRYYD6vPNqcg6jA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-regenerator@7.29.7' :
resolution : {integrity : sha512-rNNFV0DBAJp988xW2DOntfDoYn1eR8GGF5AT5vYc+rjyfaQkM242c9tZUHHPe7KYaiJizXPWhQTzzdbXySyhBw==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-regexp-modifiers@7.29.7' :
resolution : {integrity : sha512-mB5Fs0VWrJ42ZCmc8114v60qetdaUVNkj9PmSZRmanCZM3S9hm0CFRLjRmYIsuXav14l2jvZ+4T8iiCGnhj3nQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/plugin-transform-reserved-words@7.29.7' :
resolution : {integrity : sha512-5+YhdpVgmfSmwZyLMftfaiffLRMHjzIRHFHHLdibcSyJm2pasMrKHrO3Ptrt2DRshjvpgjEJJ1zVW14WPq/6QA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-shorthand-properties@7.29.7' :
resolution : {integrity : sha512-I+WYbGBAiCn7nA6xBrlgPH+MB7HWb4u8pv5S0Pv7OtwNvIFvCCb24YlttKEeUFVurfBCEaOTnuhlqsb7f0Z5Dg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-spread@7.29.7' :
resolution : {integrity : sha512-/u5K1QWada7tbYNqTjMh96718g9NTwh9tfPJMsSmVsQwGT447FskV+KcfeXkXq2GWki4EM/MuTdmBec+hOuVTQ==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-sticky-regex@7.29.7' :
resolution : {integrity : sha512-BCHzNYJGe9l7EpwwDBN/ztlL2NYFFq8hp9ddjtUEM9f2O7S7kKV/lL6Fwo7IF7NSkYhPK2vO+86nIGltA90MsA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-template-literals@7.29.7' :
resolution : {integrity : sha512-NCSEJ4sLFU2gqAub45HYh4fus2yQ36rr6ei6vpU7NdoJqCpxvEG8E6eJpscGyXP3VHD2Ny+fSXr04k1hoUrFqA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-typeof-symbol@7.29.7' :
resolution : {integrity : sha512-223mNGoTkBiTEWFoK+Q6Go3tueMRclO8vxxxxquNCYuNI4jWOofFKJRRDu6SDrB8Sgo1UEGW9T4GAQ8ZyRso1A==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-unicode-escapes@7.29.7' :
resolution : {integrity : sha512-jCfXxSjf94lf4E0hKE0AByxF6F3/pVFqRdUUNkDJhsY0m1ZKjnN6ZYyMeHNpzflxb/0q5b7t3p+BE+SLF1WOtA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-unicode-property-regex@7.29.7' :
resolution : {integrity : sha512-OgZ+zoAJgZLUCunsTRQ5LAjOywDv5zzZ2/hQ5aMw1pGXyY2rtE8/chXYUmu3AlVHKpm10KEdG9aMwbI/K76ZGw==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-unicode-regex@7.29.7' :
resolution : {integrity : sha512-7D/x/23/d/3VqZ0QA+LGbZMlGwZjztBygSWWWsfTPoQ1oQ6Q1P6Mr3d0kk42XabyUVw+fha3LqdRsFqeKqvCyA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/plugin-transform-unicode-sets-regex@7.29.7' :
resolution : {integrity : sha512-BLOhLht9DOJwIxlmp91wHvkXv1lguuHS3/FwUO8HL1H0u8s4hR1gASVFyilu9iGtcTRYqjTZmlsFFeQletntEg==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0
'@babel/preset-env@7.29.7' :
resolution : {integrity : sha512-GYzX36n1nsciIb0uyH0GHwxwtNwPQIcpxSeiVLDtG/B7jB5xXgchnmL1f/jCX5o+pwnaDBtO60ONSJhEBJfxYA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/preset-modules@0.1.6-no-external-plugins' :
resolution : {integrity : sha512-HrcgcIESLm9aIR842yhJ5RWan/gebQUJ6E/E5+rf0y9o6oj7w0Br+sWuL6kEQ/o/AdfvR1Je9jG18/gnpwjEyA==}
peerDependencies :
'@babel/core' : ^7.0.0-0 || ^8.0.0-0 <8.0.0
'@babel/register@7.29.7' :
resolution : {integrity : sha512-AMGJoWuES861riy6pcB0fphE1YXybtQnBYQMuIyPv6mKLiosfa79BKTnAOyx215c/3RJPJpdQwoHZ3earVH7AA==}
engines : {node : '>=6.9.0' }
peerDependencies :
'@babel/core' : ^7.0.0-0
'@babel/template@7.29.7' :
resolution : {integrity : sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
engines : {node : '>=6.9.0' }
'@babel/traverse@7.29.7' :
resolution : {integrity : sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==}
engines : {node : '>=6.9.0' }
'@babel/types@7.29.7' :
resolution : {integrity : sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
engines : {node : '>=6.9.0' }
'@braidai/lang@1.1.2' :
resolution : {integrity : sha512-qBcknbBufNHlui137Hft8xauQMTZDKdophmLFv05r2eNmdIv/MlPuP4TdUknHG68UdWLgVZwgxVe735HzJNIwA==}
'@colors/colors@1.5.0' :
resolution : {integrity : sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==}
engines : {node : '>=0.1.90' }
'@concordance/react@2.0.0' :
resolution : {integrity : sha512-huLSkUuM2/P+U0uy2WwlKuixMsTODD8p4JVQBI4VKeopkiN0C7M3N9XYVawb4M+4spN5RrO/eLhk7KoQX6nsfA==}
engines : {node : '>=6.12.3 <7 || >=8.9.4 <9 || >=10.0.0' }
'@emnapi/core@1.10.0' :
resolution : {integrity : sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
'@emnapi/core@1.11.2' :
resolution : {integrity : sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==}
'@emnapi/runtime@1.10.0' :
resolution : {integrity : sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}
'@emnapi/runtime@1.11.2' :
resolution : {integrity : sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==}
'@emnapi/wasi-threads@1.2.1' :
resolution : {integrity : sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}
'@emnapi/wasi-threads@1.2.2' :
resolution : {integrity : sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==}
'@eslint-community/eslint-utils@4.9.1' :
resolution : {integrity : sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==}
engines : {node : ^12.22.0 || ^14.17.0 || >=16.0.0}
peerDependencies :
eslint : ^6.0.0 || ^7.0.0 || >=8.0.0
'@eslint-community/regexpp@4.12.2' :
resolution : {integrity : sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==}
engines : {node : ^12.0.0 || ^14.0.0 || >=16.0.0}
'@eslint/config-array@0.23.5' :
resolution : {integrity : sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
'@eslint/config-helpers@0.7.0' :
resolution : {integrity : sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
'@eslint/core@1.2.1' :
resolution : {integrity : sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
'@eslint/js@10.0.1' :
resolution : {integrity : sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
peerDependencies :
eslint : ^10.0.0
peerDependenciesMeta :
eslint :
optional : true
'@eslint/json@2.0.0' :
resolution : {integrity : sha512-P32ZJMIopNWQd1SFhd0tgjfA/hgzUuVSqHmMi2273QaLWHWimXq6V+qL4DNKnjGzO/aNECtYW+rEJ/pWB6uP+w==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
'@eslint/object-schema@3.0.5' :
resolution : {integrity : sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
'@eslint/plugin-kit@0.7.2' :
resolution : {integrity : sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
'@humanfs/core@0.19.2' :
resolution : {integrity : sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==}
engines : {node : '>=18.18.0' }
'@humanfs/node@0.16.8' :
resolution : {integrity : sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==}
engines : {node : '>=18.18.0' }
'@humanfs/types@0.15.0' :
resolution : {integrity : sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==}
engines : {node : '>=18.18.0' }
'@humanwhocodes/module-importer@1.0.1' :
resolution : {integrity : sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==}
engines : {node : '>=12.22' }
'@humanwhocodes/momoa@3.3.10' :
resolution : {integrity : sha512-KWiFQpSAqEIyrTXko3hFNLeQvSK8zXlJQzhhxsyVn58WFRYXST99b3Nqnu+ttOtjds2Pl2grUHGpe2NzhPynuQ==}
engines : {node : '>=18' }
'@humanwhocodes/retry@0.4.3' :
resolution : {integrity : sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
engines : {node : '>=18.18' }
'@isaacs/cliui@8.0.2' :
resolution : {integrity : sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
engines : {node : '>=12' }
'@istanbuljs/load-nyc-config@1.1.0' :
resolution : {integrity : sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==}
engines : {node : '>=8' }
'@istanbuljs/schema@0.1.6' :
resolution : {integrity : sha512-+Sg6GCR/wy1oSmQDFq4LQDAhm3ETKnorxN+y5nbLULOR3P0c14f2Wurzj3/xqPXtasLFfHd5iRFQ7AJt4KH2cw==}
engines : {node : '>=8' }
'@jridgewell/gen-mapping@0.3.13' :
resolution : {integrity : sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
'@jridgewell/remapping@2.3.5' :
resolution : {integrity : sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
'@jridgewell/resolve-uri@3.1.2' :
resolution : {integrity : sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
engines : {node : '>=6.0.0' }
'@jridgewell/source-map@0.3.11' :
resolution : {integrity : sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA==}
'@jridgewell/sourcemap-codec@1.5.5' :
resolution : {integrity : sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
'@jridgewell/trace-mapping@0.3.31' :
resolution : {integrity : sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@jsdoc/salty@0.2.12' :
resolution : {integrity : sha512-TuB0x50EoAvEX/UEWITd8Mkn3WhiTjSvbTMCLj0BhsQEl5iUzjXdA0bETEVpTk+5TGTLR6QktI9H4hLviVeaAQ==}
engines : {node : '>=v12.0.0' }
2026-08-30 00:10:11 +03:00
'@loaderkit/resolve@1.0.6' :
resolution : {integrity : sha512-G8FdIoF5CypfwmD9rl8BXod5HDn8JqB0CCNBXDTaRZ+yRYhARrrSToX1zg1zy9jX3zLqigsELwhT4gNtkdQAUg==}
'@napi-rs/wasm-runtime@1.1.6' :
resolution : {integrity : sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==}
peerDependencies :
'@emnapi/core' : ^1.7.1
'@emnapi/runtime' : ^1.7.1
'@next/eslint-plugin-next@16.2.9' :
resolution : {integrity : sha512-UZi8+YT/MLgTC9nrrn2Xd4lBYv1B7lVmtWHfPcthAI5Tt/C1LuDe6DfmtCtJ+WQod3ksY4VrKSvk3oMVAnL7qw==}
'@nicolo-ribaudo/chokidar-2@2.1.8-no-fsevents.3' :
resolution : {integrity : sha512-s88O1aVtXftvp5bCPB7WnmXc5IwOZZ7YPuwNPt+GtOOXpPvad1LfbmjYv+qII7zP6RU2QGnqve27dnLycEnyEQ==}
'@nodelib/fs.scandir@2.1.5' :
resolution : {integrity : sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
engines : {node : '>= 8' }
'@nodelib/fs.stat@2.0.5' :
resolution : {integrity : sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
engines : {node : '>= 8' }
'@nodelib/fs.walk@1.2.8' :
resolution : {integrity : sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
engines : {node : '>= 8' }
'@oxc-project/types@0.140.0' :
resolution : {integrity : sha512-h5LUOzGArYemnW1NMz/DuuQhBi96J6JL2Bk8zE4kvqxB5Sg3jxmCiH4uyOWHDkiKSt5vWlG4FIwCR/DbstcNRQ==}
'@package-json/types@0.0.12' :
resolution : {integrity : sha512-uu43FGU34B5VM9mCNjXCwLaGHYjXdNincqKLaraaCW+7S2+SmiBg1Nv8bPnmschrIfZmfKNY9f3fC376MRrObw==}
'@pkgjs/parseargs@0.11.0' :
resolution : {integrity : sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
engines : {node : '>=14' }
'@publint/pack@0.1.6' :
resolution : {integrity : sha512-3uVNyGcVplhPZSLVyeIpL7+cIRn1YCSNHLG/rUIlBQMVH8YuN9++YF+5+UDIIO9RW98dujiUoTltO7RDB5bFJA==}
engines : {node : '>=18' }
'@quansync/fs@1.0.0' :
resolution : {integrity : sha512-4TJ3DFtlf1L5LDMaM6CanJ/0lckGNtJcMjQ1NAV6zDmA0tEHKZtxNKin8EgPaVX1YzljbxckyT2tJrpQKAtngQ==}
'@rolldown/binding-android-arm64@1.2.0' :
resolution : {integrity : sha512-9yB1l95IrJuNGDFdOYe79vdApdz6WWBCObE+rQ2LUliYUlcyFwSYIb2xb5/Ifw7dAtMy2ZqNyd8QTSOc7duAKw==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ arm64]
os : [ android]
'@rolldown/binding-darwin-arm64@1.2.0' :
resolution : {integrity : sha512-pexNaW9ACLUOaBITOpU6qVu4VrsOFIjTv6bzgu0YUATo4eUJx0V605PxwZfndpPOn0ilqGqvGQ0M8UW0IE24jg==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ arm64]
os : [ darwin]
'@rolldown/binding-darwin-x64@1.2.0' :
resolution : {integrity : sha512-NqKYaq0355ZmNMG4QGpxtEDxsc7tGDhjhCm4PpE0cwnBW+5Il95LJyq414niEiaKLVjnVHBEjSo1wngKxJNiFw==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ x64]
os : [ darwin]
'@rolldown/binding-freebsd-x64@1.2.0' :
resolution : {integrity : sha512-3vPoHzh6eBTz9IbB0/qZdSr0Qeks2echn+I4cHu2joV74VriPDdldswksEDzrl1mBB+oPRi+67+3Ib59paxIPQ==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ x64]
os : [ freebsd]
'@rolldown/binding-linux-arm-gnueabihf@1.2.0' :
resolution : {integrity : sha512-E6NNefZ1bUVmKJq2tJkf45J4Zyczj7qm9rUT7NY+Xo2474Y13qWAwc2tvBt0BAVbmtXR1llkxXg0Ou1jbDf2SQ==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ arm]
os : [ linux]
'@rolldown/binding-linux-arm64-gnu@1.2.0' :
resolution : {integrity : sha512-D+TgkdgM1vu+7/Fpf8+v0ARW+RXEP9Ccazgm8zQ4JFFd9Q7SrYQ2TakU5S5ihazQDgpKyAgZDOcIFsvoHmTZ8w==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ arm64]
os : [ linux]
libc : [ glibc]
'@rolldown/binding-linux-arm64-musl@1.2.0' :
resolution : {integrity : sha512-wUqdwJBbAv0APN87GecstdMUtLjjNTs0hBALpxETD73mccFxdmt/XeizXDtN5RAlBwNKmI+Tg+blect2G+8IeQ==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ arm64]
os : [ linux]
libc : [ musl]
'@rolldown/binding-linux-ppc64-gnu@1.2.0' :
resolution : {integrity : sha512-9DtF35qR9/NrfhM4oxLplCzVVjE+KKm8Pjemi0i/sdhAWkUasjmSo8WTTubNJClhSHCfyk2yeyoXDQEDPtDAAw==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ ppc64]
os : [ linux]
libc : [ glibc]
'@rolldown/binding-linux-s390x-gnu@1.2.0' :
resolution : {integrity : sha512-RzuHrBh8X8Hntd2N4VR02QGEciq/9JhcZoTpR/Cee6otRrlILGCf3cg2ygHuih+ZebUnWmMrDX6ITI85btO6rQ==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ s390x]
os : [ linux]
libc : [ glibc]
'@rolldown/binding-linux-x64-gnu@1.2.0' :
resolution : {integrity : sha512-MK7L0018jjh1jR3mh21G2j1zAVcpscJBlPo2z19pRjv2XOYGRhaV4LyiD8HO6nCDdZln9IFgCMIV5yt4E3klGQ==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ x64]
os : [ linux]
libc : [ glibc]
'@rolldown/binding-linux-x64-musl@1.2.0' :
resolution : {integrity : sha512-gyrxLQ9NfGb/9LoVnC4kb9miUghw1mghnkfYvNHSnVIXriabnfgGPUP4RLcJm87q3KgYz4FYUG8IDiWUT+CpSw==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ x64]
os : [ linux]
libc : [ musl]
'@rolldown/binding-openharmony-arm64@1.2.0' :
resolution : {integrity : sha512-/6VFMQGRmrhP77KXDC+StIxGzcNp5JOIyYtw0CQ8gPlzhpiIRucYfoM5FaFamHd5BJYIdH86yfP46l1p3WdrFA==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ arm64]
os : [ openharmony]
'@rolldown/binding-wasm32-wasi@1.2.0' :
resolution : {integrity : sha512-rwdbUL465kisF24WEJLvP3JrEG6E5GRuIHt5wpMwHGERtHe4Wm2CIvtf5gTBgr2tGOHKh5NdKEAFS2VkOPE91g==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ wasm32]
'@rolldown/binding-win32-arm64-msvc@1.2.0' :
resolution : {integrity : sha512-+5suHwRiKGmhwyUaNT8a5QbrBvLFh2DbO910TEmGRH1aSxwrCezodvGQnulv4uiWEIv1Kq4ypRsJ5+O+ry1DiA==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ arm64]
os : [ win32]
'@rolldown/binding-win32-x64-msvc@1.2.0' :
resolution : {integrity : sha512-WfFv6/qGufotqBSBzBYwgpCkJBk8Nj7697LL9vTz/XWc67e0r3oewu8iMRwQj3AUL45GVD7wVsPjCsAAtW66Wg==}
engines : {node : ^20.19.0 || >=22.12.0}
cpu : [ x64]
os : [ win32]
'@rolldown/plugin-babel@0.2.3' :
resolution : {integrity : sha512-+zEk16yGlz1F9STiRr6uG9hmIXb6nprjLczV/htGptYuLoCuxb+itZ03RKCEeOhBpDDd1NU7qF6x1VLMUp62bw==}
engines : {node : '>=22.12.0 || ^24.0.0' }
peerDependencies :
'@babel/core' : ^7.29.0 || ^8.0.0-rc.1
'@babel/plugin-transform-runtime' : ^7.29.0 || ^8.0.0-rc.1
'@babel/runtime' : ^7.27.0 || ^8.0.0-rc.1
rolldown : ^1.0.0-rc.5
vite : ^8.0.0
peerDependenciesMeta :
'@babel/plugin-transform-runtime' :
optional : true
'@babel/runtime' :
optional : true
vite :
optional : true
'@rolldown/pluginutils@1.0.1' :
resolution : {integrity : sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==}
'@rtsao/scc@1.1.0' :
resolution : {integrity : sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==}
'@sec-ant/readable-stream@0.4.1' :
resolution : {integrity : sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==}
'@sindresorhus/is@4.6.0' :
resolution : {integrity : sha512-t09vSN3MdfsyCHoFcTRCH/iUtG7OJ0CsjzB8cjAmKc/va/kIgeDI/TxsigdncE/4be734m0cvIYwNaV4i2XqAw==}
engines : {node : '>=10' }
'@sindresorhus/merge-streams@4.0.0' :
resolution : {integrity : sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==}
engines : {node : '>=18' }
'@sinonjs/commons@3.0.1' :
resolution : {integrity : sha512-K3mCHKQ9sVh8o1C9cxkwxaOmXoAMlDxC1mYyHrjqOWEcBjYr76t96zL2zlj5dUGZ3HSw240X1qgH3Mjf1yJWpQ==}
'@sinonjs/fake-timers@15.4.0' :
resolution : {integrity : sha512-DsG+8/LscQIQg68J6Ef3dv10u6nVyetYn923s3/sus5eaGfTo1of5WMZSLf0UJc9KDuKPilPH0UDJCjvNbDNCA==}
'@sinonjs/samsam@10.0.2' :
resolution : {integrity : sha512-8lVwD1Df1BmzoaOLhMcGGcz/Jyr5QY2KSB75/YK1QgKzoabTeLdIVyhXNZK9ojfSKSdirbXqdbsXXqP9/Ve8+A==}
'@socket.io/component-emitter@3.1.2' :
resolution : {integrity : sha512-9BCxFwvbGg/RsZK9tjXd8s4UcwR0MWeFQ1XEKIQVVvAGJyINdrqKMcTRyLoK8Rse1GjzLV9cwjWV1olXRWEXVA==}
'@stylistic/eslint-plugin@5.10.0' :
resolution : {integrity : sha512-nPK52ZHvot8Ju/0A4ucSX1dcPV2/1clx0kLcH5wDmrE4naKso7TUC/voUyU1O9OTKTrR6MYip6LP0ogEMQ9jPQ==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
eslint : ^9.0.0 || ^10.0.0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@szmarczak/http-timer@4.0.6' :
resolution : {integrity : sha512-4BAffykYOgO+5nzBWYwE3W90sBgLJoUPRWWcL8wlyiM8IB8ipJz3UMJ9KXQd1RKQXpKp8Tutn80HZtWsu2u76w==}
engines : {node : '>=10' }
2026-08-30 00:10:11 +03:00
'@tybys/wasm-util@0.10.3' :
resolution : {integrity : sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@types/cacheable-request@6.0.3' :
resolution : {integrity : sha512-IQ3EbTzGxIigb1I3qPZc1rWJnH0BmSKv5QYTalEwweFvyBDLSAe24zP0le/hyi7ecGfZVlIVAg4BZqb8WBwKqw==}
2026-08-30 00:10:11 +03:00
'@types/cors@2.8.19' :
resolution : {integrity : sha512-mFNylyeyqN93lfe/9CSxOGREz8cpzAhH+E93xJ4xWQf62V8sQ/24reV2nyzUWM6H6Xji+GGHpkbLe7pVoUEskg==}
'@types/esrecurse@4.3.1' :
resolution : {integrity : sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw==}
'@types/estree@1.0.9' :
resolution : {integrity : sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@types/http-cache-semantics@4.2.0' :
resolution : {integrity : sha512-L3LgimLHXtGkWikKnsPg0/VFx9OGZaC+eN1u4r+OB1XRqH3meBIAVC2zr1WdMH+RHmnRkqliQAOHNJ/E0j/e0Q==}
2026-08-30 00:10:11 +03:00
'@types/json-schema@7.0.15' :
resolution : {integrity : sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
'@types/json5@0.0.29' :
resolution : {integrity : sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==}
'@types/keyv@3.1.4' :
resolution : {integrity : sha512-BQ5aZNSCpj7D6K2ksrRCTmKRLEpnPvWDiLPfoGyhZ++8YtiK9d/3DBKPJgry359X/P1PfruyYwvnvwFjuEiEIg==}
'@types/linkify-it@5.0.0' :
resolution : {integrity : sha512-sVDA58zAw4eWAffKOaQH5/5j3XeayukzDk+ewSsnv3p4yJEZHCCzMDiZM8e0OUrRvmpGZ85jf4yDHkHsgBNr9Q==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@types/markdown-it@14.2.0' :
resolution : {integrity : sha512-NoQ2yGlLWj4wpxMs+TYmRKk3thDrQ97agr7sFqfLsAlvoS8SNQuTrlObhFqG9iugdTtgOE9jpJ6FNM4ZGsa5xQ==}
2026-08-30 00:10:11 +03:00
'@types/mdurl@2.0.0' :
resolution : {integrity : sha512-RGdgjQUZba5p6QEFAVx2OGb8rQDL/cPRG7GiedRzMcJ1tYnUANBncjbSB1NRGwbvjcPeikRABz2nshyPk1bhWg==}
'@types/node@25.9.3' :
resolution : {integrity : sha512-603BddQMv3pUcr4U2dhujk83N2tTDVr/34wII2B6bJy6g+8WD6yUb11jszNs0gdi4PesVWl7ABt8nYMVpnLUcg==}
'@types/normalize-package-data@2.4.4' :
resolution : {integrity : sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==}
'@types/responselike@1.0.3' :
resolution : {integrity : sha512-H/+L+UkTV33uf49PH5pCAUBVPNj2nDBXTN+qS1dOwyyg24l3CcicicCA7ca+HMvJBZcFgl5r8e+RR6elsb4Lyw==}
'@types/ws@8.18.1' :
resolution : {integrity : sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
'@typescript-eslint/eslint-plugin@8.61.0' :
resolution : {integrity : sha512-bFNvl9ZczlVb+wR2Akszf3gHfKVj/8WanXaGJ3UstTA7brNKg0cNdk6X1Psu5V7MZ2oQtzZKOEzIUehaoxbDGw==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
'@typescript-eslint/parser' : ^8.61.0
eslint : ^8.57.0 || ^9.0.0 || ^10.0.0
typescript : '>=4.8.4 <6.1.0'
'@typescript-eslint/parser@8.61.0' :
resolution : {integrity : sha512-5B7PfA2e1NQGCnDHd/0lW7W3gvp3d59Ryw54FYO8Uswxo9f6ikw3AZV+Xj/TvpImmpsiYyUqAfhC6kJID1jF6w==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
eslint : ^8.57.0 || ^9.0.0 || ^10.0.0
typescript : '>=4.8.4 <6.1.0'
'@typescript-eslint/project-service@8.61.0' :
resolution : {integrity : sha512-DV42F7MLJO6Rax7SK1yg43tcnEfGUrurSpSxKuVX+a3RCTzBlH3fuxprrOJXKCJGAaw82xXocikJ0uQaqwXgGA==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
typescript : '>=4.8.4 <6.1.0'
'@typescript-eslint/scope-manager@8.61.0' :
resolution : {integrity : sha512-IWdXFHFSb6mlC3HPc7QsLDm5zYEbUla6trDEHf32D3/dnuUyXd87plScSNXSbm0/RxMvObpI17sv/EDTGrGZkA==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
'@typescript-eslint/tsconfig-utils@8.61.0' :
resolution : {integrity : sha512-O5Amvdv9ztMpxpf+vmFULGG78IE6Qwdr3bCGvqwG4nwc9H2qXkOYJJnRbRHyMkQTjv1d03olqwwwzHLMqpFePQ==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
typescript : '>=4.8.4 <6.1.0'
'@typescript-eslint/type-utils@8.61.0' :
resolution : {integrity : sha512-TuBiQYIkd97yBfInHCTKVYMbX4kvEmpOEuixIuzCU9p8BGT1SfyyO0d0IfDMbPIHcjn/hWnusUX5e8v5Xg+X8A==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
eslint : ^8.57.0 || ^9.0.0 || ^10.0.0
typescript : '>=4.8.4 <6.1.0'
'@typescript-eslint/types@8.61.0' :
resolution : {integrity : sha512-9QTQpZ5Iin4CdIodfbDQFSeiSJKidgYJYug1P9CC2xWgUTvlmixViqDZNciMjwLBZyJnG4tGmPl97rVAFb1AJg==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
'@typescript-eslint/typescript-estree@8.61.0' :
resolution : {integrity : sha512-42zatd5qSvvcV1JdDBCLxYRznvP4eIHpPoZXdkPFnAmanA4FuZ5dibSnCBggY8hQnqajPpoGjXFdZ7fIJKQnlA==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
typescript : '>=4.8.4 <6.1.0'
'@typescript-eslint/utils@8.61.0' :
resolution : {integrity : sha512-3bzFt7ImFMW/jVYwJamDoe/dMOdFLSC6pom6rRjdh4SZJEYupyMzem8e7vKZLclLfpHjlwSAXOUxtKxGXUiLqA==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
eslint : ^8.57.0 || ^9.0.0 || ^10.0.0
typescript : '>=4.8.4 <6.1.0'
'@typescript-eslint/visitor-keys@8.61.0' :
resolution : {integrity : sha512-QVLZu3ZPQEE+HICQyAMZ2yLQhxf0meY/wx6Hx14YcTNj13JB3qHlX3lJ02L3fLGHgERRH71kvYDwiXIguT3AjQ==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
'@unrs/resolver-binding-android-arm-eabi@1.12.2' :
resolution : {integrity : sha512-g5T90pqg1bo/7mytQx6F4iBNC0Wsh9cu+z9veDbFjc7HjpesJFWD7QMS0NGStXM075+7dJPPVvBbpZlnrdpi/w==}
cpu : [ arm]
os : [ android]
'@unrs/resolver-binding-android-arm64@1.12.2' :
resolution : {integrity : sha512-YGCRZv/9GLhwmz6mYDeTsm/92BAyR28l6c2ReweVW5pWgfsitWLY8upvfRlGdoyD8HjeTHSYJWyZGD4KJA/nFQ==}
cpu : [ arm64]
os : [ android]
'@unrs/resolver-binding-darwin-arm64@1.12.2' :
resolution : {integrity : sha512-u9DiNT1auQMO20A9SyTuG3wUgQWB9Z7KjAg0uFuCDR1FsAY8A0CG2S6JpHS1xwm/w1G08bjXZDcyOCjv1WAm2w==}
cpu : [ arm64]
os : [ darwin]
'@unrs/resolver-binding-darwin-x64@1.12.2' :
resolution : {integrity : sha512-f7rPLi/T1HVKZu/u6t87lroib16n8vrSzcyxI7lg4BGO9UF26KhQL44sd9eOUgrTYhvRXtWOIZT5PejdPyJfUA==}
cpu : [ x64]
os : [ darwin]
'@unrs/resolver-binding-freebsd-x64@1.12.2' :
resolution : {integrity : sha512-BpcOjWCJub6nRZUS2zA20pmLvjtqAtGejETaIyRLiZiQf++cbrjltLA5NN/xaXfqeOBOSlMFbemIl5/S5tljmg==}
cpu : [ x64]
os : [ freebsd]
'@unrs/resolver-binding-linux-arm-gnueabihf@1.12.2' :
resolution : {integrity : sha512-vZTDvdSISZjJx66OzJqtsOhzifbqRjbmI1Mnu49fQDwog5GtDI4QidRiEAYbZCRj9C8YZEW+3ZjqsyS9GR4k2A==}
cpu : [ arm]
os : [ linux]
'@unrs/resolver-binding-linux-arm-musleabihf@1.12.2' :
resolution : {integrity : sha512-BiPI+IrIlwcW4nLLMM21+B1dFPzd55yAVgVGrdgDjNef+ch03GdxrcyaIz8X9SsQirh/kCQ7mviyWlMxdh2D7g==}
cpu : [ arm]
os : [ linux]
'@unrs/resolver-binding-linux-arm64-gnu@1.12.2' :
resolution : {integrity : sha512-zJc0H99FEPoFfSrNpa91HYfxzfAJCr502oxNK1cfdC9hlaFI43RT+JFCann9JUgZmLzzntChHyn13Sgn9ljHNg==}
cpu : [ arm64]
os : [ linux]
libc : [ glibc]
'@unrs/resolver-binding-linux-arm64-musl@1.12.2' :
resolution : {integrity : sha512-KQ3Lki6l+Pz1k/eBipN41ES+YUK30beLGb9YqcB1O542cyLCNE6GaxrfcY3T6EezmGGk84wb5XyO9loTM9tkcA==}
cpu : [ arm64]
os : [ linux]
libc : [ musl]
'@unrs/resolver-binding-linux-loong64-gnu@1.12.2' :
resolution : {integrity : sha512-3SJGEh1DborhG6pyxvhPzCT4bbSIVihsvgJc13P1bHG7KLdNDaF9T3gsTwFc7Jw/5Y5/iWOjkEx7Zy0NvCGX3Q==}
cpu : [ loong64]
os : [ linux]
libc : [ glibc]
'@unrs/resolver-binding-linux-loong64-musl@1.12.2' :
resolution : {integrity : sha512-jiuG/Obbel7uw1PwHNFfrkiKhLAF6mnyZ6aWlOAVN9WqKm8v0OFGnciJIHu8+CMvXLQ8AD51LPzAoUfT21D5Ew==}
cpu : [ loong64]
os : [ linux]
libc : [ musl]
'@unrs/resolver-binding-linux-ppc64-gnu@1.12.2' :
resolution : {integrity : sha512-q7xRvVpmcfeL+LlZg8Pbbo6QaTZwDU5BaGZbwfhkEsXJn3Was8xYfE0RBH266xZt0rM6B7i8xAYIvjthuUIWHg==}
cpu : [ ppc64]
os : [ linux]
libc : [ glibc]
'@unrs/resolver-binding-linux-riscv64-gnu@1.12.2' :
resolution : {integrity : sha512-0CVdx6lcnT3Q9inOH8tsMIOJ6ImndllMjqJHg8RLVdB7Vq4SfkEXl9mCSsVNuNA4MCYycRicCUxPCabVHJRr6A==}
cpu : [ riscv64]
os : [ linux]
libc : [ glibc]
'@unrs/resolver-binding-linux-riscv64-musl@1.12.2' :
resolution : {integrity : sha512-iOwlRo9vnp6R6ohHQS11n0NnfdXx/omhkocmIfaPRpQhKZ+3BDMkkdRVh53qjkFkpPddf+FETA28NwGN7l5l+w==}
cpu : [ riscv64]
os : [ linux]
libc : [ musl]
'@unrs/resolver-binding-linux-s390x-gnu@1.12.2' :
resolution : {integrity : sha512-HYJtLfXq94q8iZNFT1lknx258wlkkWhZeUXJRqzKBBUJ00CvZ+N33zgbCqimLjsyw5Va6uUxhVa12mI+kaveEw==}
cpu : [ s390x]
os : [ linux]
libc : [ glibc]
'@unrs/resolver-binding-linux-x64-gnu@1.12.2' :
resolution : {integrity : sha512-mPsUhunKKDih5O96Y6enDQyHc1SqBPlY1E/SfMWDM3EdJ95Z9CArPeCVwCCqbP45ljvivdEk8Fxn+SIb1rDAJQ==}
cpu : [ x64]
os : [ linux]
libc : [ glibc]
'@unrs/resolver-binding-linux-x64-musl@1.12.2' :
resolution : {integrity : sha512-azrt6+5ydLd8Vt210AAFis/lZevSfPw93EJRIJG+xPu4WCJ8K0kppCTpMyLPcKT7H15M4Jnt2tMp5bOvCkRC6A==}
cpu : [ x64]
os : [ linux]
libc : [ musl]
'@unrs/resolver-binding-openharmony-arm64@1.12.2' :
resolution : {integrity : sha512-YZ9hP4O0X9PQb8eO980qmLNGH4zT3I9+SZTdt0Pr0YyuGQhYKoOZkV02VzrzyOZJ5xIJ3UFIenKkUkGg8GjgWQ==}
cpu : [ arm64]
os : [ openharmony]
'@unrs/resolver-binding-wasm32-wasi@1.12.2' :
resolution : {integrity : sha512-tYFDIkMxSflfEc/h92ZWNsZlHSwgimbNHSO3PL2JWQHfCuC2q316jMyYU9TIWZsFK2bQwyK5VAdYgn8ygPj69A==}
engines : {node : '>=14.0.0' }
cpu : [ wasm32]
'@unrs/resolver-binding-win32-arm64-msvc@1.12.2' :
resolution : {integrity : sha512-qzNyg3xL0VPQmCaUh+N5jSitce6k+uCBfMDesWRnlULOZaqUkaJ0ybdT+UqlAWJoQjuqfIU/0Ptx9bteN4D82g==}
cpu : [ arm64]
os : [ win32]
'@unrs/resolver-binding-win32-ia32-msvc@1.12.2' :
resolution : {integrity : sha512-WD9sY00OfpHVGfsnHZoA8jVT+esS/Bg8z8jzxp5BnDCjjwsuKsPQrzswwpFy4J1AUJbXPRfkpcX0mXrzeXW79g==}
cpu : [ ia32]
os : [ win32]
'@unrs/resolver-binding-win32-x64-msvc@1.12.2' :
resolution : {integrity : sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==}
cpu : [ x64]
os : [ win32]
'@xmldom/xmldom@0.9.10' :
resolution : {integrity : sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==}
engines : {node : '>=14.6' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
deprecated : this version has critical issues, please update to the latest version
2026-08-30 00:10:11 +03:00
'@yuku-codegen/binding-darwin-arm64@0.7.3' :
resolution : {integrity : sha512-hbssEr7iLNCWWdUbEt8cuOjUQ9loI+U/BVmdhNQ4CV1wAFGvWDO3niK9JD2WwTC9iib7E498qgZ3L/xJnoSb3A==}
cpu : [ arm64]
os : [ darwin]
'@yuku-codegen/binding-darwin-x64@0.7.3' :
resolution : {integrity : sha512-WqwST3vVcNBTd1zaT1vP6pU8NkjJlLWN37Kqomc2c6TG9eky6sbAfHIhZEjSSyqFrMqsAt3mIu0jQZAODi401g==}
cpu : [ x64]
os : [ darwin]
'@yuku-codegen/binding-freebsd-x64@0.7.3' :
resolution : {integrity : sha512-mCci4UPkZXYflXuHnPGl5sDsotBPLaBryFylDwZcqposktmumoOBIKp2gpzEmxQL/XlGdVWksmpYw9IRY43FNQ==}
cpu : [ x64]
os : [ freebsd]
'@yuku-codegen/binding-linux-arm-gnu@0.7.3' :
resolution : {integrity : sha512-F1QIaRH5SeahrYjZVrVvIb5nHCZQMF7+YWAy6yTJh0Y2r2wLgqOQuhbOWcoKk+AyBiTOO2nAsFHNpVqRq2GjGw==}
cpu : [ arm]
os : [ linux]
libc : [ glibc]
'@yuku-codegen/binding-linux-arm-musl@0.7.3' :
resolution : {integrity : sha512-JvkWNmN8MFbboX/5grRsAldGaB8ArRFgAaUYfQoohsqcuJZee8SLtc6itvwuntPbN9MGStn4GzdWk2lmSURqbA==}
cpu : [ arm]
os : [ linux]
libc : [ musl]
'@yuku-codegen/binding-linux-arm64-gnu@0.7.3' :
resolution : {integrity : sha512-DUnMTE/HCA7j1BAipWclGZCYfLZ/4SV5lldmV2kDmVMIywcw4PhtQ4Rfd/tO1K82JkjhQ+4a8XApcOIksOacnQ==}
cpu : [ arm64]
os : [ linux]
libc : [ glibc]
'@yuku-codegen/binding-linux-arm64-musl@0.7.3' :
resolution : {integrity : sha512-pNnXMnm9dlqd3V8C7nHaXgZnMLwP/CyM8B4mSAnkqVlhj2t3b8CMjesEV85SCbFlagzJk8FapfSghfxcXKuBow==}
cpu : [ arm64]
os : [ linux]
libc : [ musl]
'@yuku-codegen/binding-linux-x64-gnu@0.7.3' :
resolution : {integrity : sha512-o5GRppYvYvPl4UJbgRSZpXXDh6rOWQzX0yLB+tDzv31T7mOuLitU6zgQZxzw5rwhPJDffCt/AVKMbtizEo+UtA==}
cpu : [ x64]
os : [ linux]
libc : [ glibc]
'@yuku-codegen/binding-linux-x64-musl@0.7.3' :
resolution : {integrity : sha512-GdiyLD1bM3lhTUeGkA9ZZLjqU+xt5uVihgPm0e6TdBjCi6DMZORWe02oDlRbn9OZaV7AZosngXAq2jLk3TrBEw==}
cpu : [ x64]
os : [ linux]
libc : [ musl]
'@yuku-codegen/binding-win32-arm64@0.7.3' :
resolution : {integrity : sha512-uQrxQDBQFIAUgHJIxcB/FAAUk0Wkyj3xGpHrp/C258nXnCTAH0KDaqyK5RN/TCkVYrpH+uCl+rGnwDLSGnPBkQ==}
cpu : [ arm64]
os : [ win32]
'@yuku-codegen/binding-win32-x64@0.7.3' :
resolution : {integrity : sha512-UoF7tqMnVMUmIXPgDjFLhRezea6HaypwLDWNenCFxfJCzQNEa41lcHpxq1AN2Xl6GLzIDfAb+lQDi/O+zPCfyg==}
cpu : [ x64]
os : [ win32]
'@yuku-parser/binding-darwin-arm64@0.7.3' :
resolution : {integrity : sha512-JcFQSNEnjtyHQRjXO0G5rQt5xHq5MR+9nHqh+wt5MP30XIiccUYlcMIa3s7CBmj8E8WPGZC08k7LNGrA1OISTA==}
cpu : [ arm64]
os : [ darwin]
'@yuku-parser/binding-darwin-x64@0.7.3' :
resolution : {integrity : sha512-U0kNeI3VygP/+8sTOLTeLTjUyTYZfl9Wuq6xVKWPXHb2K7oI0sm8JXJ5xlhAbkUDQRi0N6yK5TKxS0sQT5M6UQ==}
cpu : [ x64]
os : [ darwin]
'@yuku-parser/binding-freebsd-x64@0.7.3' :
resolution : {integrity : sha512-Xc08FQTvxovy6pX+Co9fgv3N1H0OpLpph/ClbwnJkcdphY3kzN2GgIfir35kpPp8mOzlQgtAVQdeDyAYyjwx4w==}
cpu : [ x64]
os : [ freebsd]
'@yuku-parser/binding-linux-arm-gnu@0.7.3' :
resolution : {integrity : sha512-6bHeDiUd+0bmoJJ5wZVG+PcJkXQUdjy/AzHsOVcOSUtHtRTX2H3Z5RIHyPAh5OveLtT4RHyqaO3fEQGnHGX5/Q==}
cpu : [ arm]
os : [ linux]
libc : [ glibc]
'@yuku-parser/binding-linux-arm-musl@0.7.3' :
resolution : {integrity : sha512-trGERNLJGvXkkyvdWBKspTOBATd4lcmpPFPcy5HI5kC3rC3ZMHQDJ356OMSVUsR2NQnl++F0ZTZQucao9hrbeQ==}
cpu : [ arm]
os : [ linux]
libc : [ musl]
'@yuku-parser/binding-linux-arm64-gnu@0.7.3' :
resolution : {integrity : sha512-p1ELmzhqAX7SFUvH/tR5zSb8NsWZQ8ulw7PqatfXNmJMy34bkivtL0z2jPpVoMJXf5o2+TwBN29Z31CLL0wvkA==}
cpu : [ arm64]
os : [ linux]
libc : [ glibc]
'@yuku-parser/binding-linux-arm64-musl@0.7.3' :
resolution : {integrity : sha512-dZ79SrJ002ZXfBDmpQ47SF+06Q5bGOjFeoSK8xO97ter/bjLBgxSO4d7i9hhf+uj4xkrTPc/OFNVaeBAF3L4dA==}
cpu : [ arm64]
os : [ linux]
libc : [ musl]
'@yuku-parser/binding-linux-x64-gnu@0.7.3' :
resolution : {integrity : sha512-LjT64hVGWWbOmOYS+Fd8qScgyRxgUbudhFJbw8aeUVnhiNR1np36KnE0VFWrJeu7rTdNxuzVyV5o9JLqhBDTVQ==}
cpu : [ x64]
os : [ linux]
libc : [ glibc]
'@yuku-parser/binding-linux-x64-musl@0.7.3' :
resolution : {integrity : sha512-5Nw3v5BqYbOi0ZdV+SImgVYa0KDBVAY/ZNPilTsJJU4phqa2cqEW4+aMgyieE/4bqpojt/B931kM+7pipazP9g==}
cpu : [ x64]
os : [ linux]
libc : [ musl]
'@yuku-parser/binding-win32-arm64@0.7.3' :
resolution : {integrity : sha512-lFYXgHiq8tJKa6/e1/q8Su+IJVV4/CjoXbIJ7/GdPXPp9Hx0gh/8HqmGSsrwlY2w8/ohBcar9wxjm1rQ8D16bg==}
cpu : [ arm64]
os : [ win32]
'@yuku-parser/binding-win32-x64@0.7.3' :
resolution : {integrity : sha512-wy/fs4OrHBhKW8LDyZJRMyMQ3QOfbSQDp0WtMbtzWCVui/vTQEUJMGnwvRCppjchS/qIQfbWzIw/HSjogJqZFA==}
cpu : [ x64]
os : [ win32]
'@yuku-toolchain/types@0.7.3' :
resolution : {integrity : sha512-ezarjq3dcl8Nx3iJ9VeAc7vhzvHyRoSvr7bLX76T+ljRq73IbZ11X2RFCblfK6YxW2DsjkzU6MPnr3JWDYqYYQ==}
accepts@1.3.8 :
resolution : {integrity : sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==}
engines : {node : '>= 0.6' }
accepts@2.0.0 :
resolution : {integrity : sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==}
engines : {node : '>= 0.6' }
acorn-jsx@5.3.2 :
resolution : {integrity : sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
peerDependencies :
acorn : ^6.0.0 || ^7.0.0 || ^8.0.0
acorn-walk@8.3.5 :
resolution : {integrity : sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==}
engines : {node : '>=0.4.0' }
acorn@8.17.0 :
resolution : {integrity : sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==}
engines : {node : '>=0.4.0' }
hasBin : true
aggregate-error@3.1.0 :
resolution : {integrity : sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==}
engines : {node : '>=8' }
ajv@6.15.0 :
resolution : {integrity : sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==}
ansi-align@3.0.1 :
resolution : {integrity : sha512-IOfwwBF5iczOjp/WeY4YxyjqAFMQoZufdQWDd19SEExbVLNXqvpzSJ/M7Za4/sCPmQ0+GRquoA7bGcINcxew6w==}
ansi-escapes@7.3.0 :
resolution : {integrity : sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg==}
engines : {node : '>=18' }
ansi-regex@5.0.1 :
resolution : {integrity : sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
engines : {node : '>=8' }
ansi-regex@6.2.2 :
resolution : {integrity : sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==}
engines : {node : '>=12' }
ansi-styles@4.3.0 :
resolution : {integrity : sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
engines : {node : '>=8' }
ansi-styles@5.2.0 :
resolution : {integrity : sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==}
engines : {node : '>=10' }
ansi-styles@6.2.3 :
resolution : {integrity : sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==}
engines : {node : '>=12' }
ansis@4.3.1 :
resolution : {integrity : sha512-BJ8/l4R5LRE7hW9WdSuGYrLSHi2ynxeFpDFbH0K/CgNeY/tyhk+vO6TYxXC5r5CpUhNVX310xzPsN/H9lCdfOA==}
engines : {node : '>=14' }
any-promise@1.3.0 :
resolution : {integrity : sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
anymatch@3.1.3 :
resolution : {integrity : sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
engines : {node : '>= 8' }
append-transform@2.0.0 :
resolution : {integrity : sha512-7yeyCEurROLQJFv5Xj4lEGTy0borxepjFv1g22oAdqFu//SrAlDl1O1Nxx15SH1RoliUml6p8dwJW9jvZughhg==}
engines : {node : '>=8' }
archy@1.0.0 :
resolution : {integrity : sha512-Xg+9RwCg/0p32teKdGMPTPnVXKD0w3DfHnFTficozsAgsvq2XenPJq/MYpzzQ/v8zrOyJn6Ds39VA4JIDwFfqw==}
argparse@1.0.10 :
resolution : {integrity : sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==}
argparse@2.0.1 :
resolution : {integrity : sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
aria-query@5.3.2 :
resolution : {integrity : sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==}
engines : {node : '>= 0.4' }
array-buffer-byte-length@1.0.2 :
resolution : {integrity : sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw==}
engines : {node : '>= 0.4' }
array-find-index@1.0.2 :
resolution : {integrity : sha512-M1HQyIXcBGtVywBt8WVdim+lrNaK7VHp99Qt5pSNziXznKHViIBbXWtfRTpEFpF/c4FdfxNAsCCwPp5phBYJtw==}
engines : {node : '>=0.10.0' }
array-includes@3.1.9 :
resolution : {integrity : sha512-FmeCCAenzH0KH381SPT5FZmiA/TmpndpcaShhfgEN9eCVjnFBqq3l1xrI42y8+PPLI6hypzou4GXw00WHmPBLQ==}
engines : {node : '>= 0.4' }
array-union@2.1.0 :
resolution : {integrity : sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==}
engines : {node : '>=8' }
array.prototype.findlast@1.2.5 :
resolution : {integrity : sha512-CVvd6FHg1Z3POpBLxO6E6zr+rSKEQ9L6rZHAaY7lLfhKsWYUBBOuMs0e9o24oopj6H+geRCX0YJ+TJLBK2eHyQ==}
engines : {node : '>= 0.4' }
array.prototype.findlastindex@1.2.6 :
resolution : {integrity : sha512-F/TKATkzseUExPlfvmwQKGITM3DGTK+vkAsCZoDc5daVygbJBnjEUCbgkAvVFsgfXfX4YIqZ/27G3k3tdXrTxQ==}
engines : {node : '>= 0.4' }
array.prototype.flat@1.3.3 :
resolution : {integrity : sha512-rwG/ja1neyLqCuGZ5YYrznA62D4mZXg0i1cIskIUKSiqF3Cje9/wXAls9B9s1Wa2fomMsIv8czB8jZcPmxCXFg==}
engines : {node : '>= 0.4' }
array.prototype.flatmap@1.3.3 :
resolution : {integrity : sha512-Y7Wt51eKJSyi80hFrJCePGGNo5ktJCslFuboqJsbf57CCPcm5zztluPlc4/aD8sWsKvlwatezpV4U1efk8kpjg==}
engines : {node : '>= 0.4' }
array.prototype.tosorted@1.1.4 :
resolution : {integrity : sha512-p6Fx8B7b7ZhL/gmUsAy0D15WhvDccw3mnGNbZpi3pmeJdxtWsj2jEaI4Y6oo3XiHfzuSgPwKc04MYt6KgvC/wA==}
engines : {node : '>= 0.4' }
arraybuffer.prototype.slice@1.0.4 :
resolution : {integrity : sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==}
engines : {node : '>= 0.4' }
arrgv@1.0.2 :
resolution : {integrity : sha512-a4eg4yhp7mmruZDQFqVMlxNRFGi/i1r87pt8SDHy0/I8PqSXoUTlWZRdAZo0VXgvEARcujbtTk8kiZRi1uDGRw==}
engines : {node : '>=8.0.0' }
arrify@1.0.1 :
resolution : {integrity : sha512-3CYzex9M9FGQjCGMGyi6/31c8GJbgb0qGyrx5HWxPd0aCwh4cB2YjMb2Xf9UuoogrMrlO9cTqnB5rI5GHZTcUA==}
engines : {node : '>=0.10.0' }
arrify@2.0.1 :
resolution : {integrity : sha512-3duEwti880xqi4eAMN8AyR4a0ByT90zoYdLlevfrvU43vb0YZwZVfxOgxWrLXXXpyugL0hNZc9G6BiB5B3nUug==}
engines : {node : '>=8' }
ast-types-flow@0.0.8 :
resolution : {integrity : sha512-OH/2E5Fg20h2aPrbe+QL8JZQFko0YZaF+j4mnQ7BGhfavO7OpSLa8a0y9sBwomHdSbkhTS8TQNayBfnW5DwbvQ==}
astral-regex@2.0.0 :
resolution : {integrity : sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==}
engines : {node : '>=8' }
async-function@1.0.0 :
resolution : {integrity : sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==}
engines : {node : '>= 0.4' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
async@3.2.6 :
resolution : {integrity : sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==}
2026-08-30 00:10:11 +03:00
ava@3.15.0 :
resolution : {integrity : sha512-HGAnk1SHPk4Sx6plFAUkzV/XC1j9+iQhOzt4vBly18/yo0AV8Oytx7mtJd/CR8igCJ5p160N/Oo/cNJi2uSeWA==}
engines : {node : '>=10.18.0 <11 || >=12.14.0 <12.17.0 || >=12.17.0 <13 || >=14.0.0 <15 || >=15' }
hasBin : true
available-typed-arrays@1.0.7 :
resolution : {integrity : sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
engines : {node : '>= 0.4' }
axe-core@4.12.1 :
resolution : {integrity : sha512-s7iGf5GaVMxEG0ENN9x+xTr7GFZCb1ZP/1uATUpCEK2X78nDB3RwbtFCo9pGAf9ru+VwoQ464DkaLEeRM08wJA==}
engines : {node : '>=4' }
axobject-query@4.1.0 :
resolution : {integrity : sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==}
engines : {node : '>= 0.4' }
babel-plugin-add-module-exports@1.0.4 :
resolution : {integrity : sha512-g+8yxHUZ60RcyaUpfNzy56OtWW+x9cyEe9j+CranqLiqbju2yf/Cy6ZtYK40EZxtrdHllzlVZgLmcOUCTlJ7Jg==}
babel-plugin-istanbul@8.0.0 :
resolution : {integrity : sha512-18wCskrN3DgbuBmp1gr7LBGT8xdz5xhQQqFvFhVxbkl8VBCrMKQ2YtqBWtUal1Zrc1HTuX0011+Brjw78TCFkg==}
engines : {node : '>=18' }
babel-plugin-polyfill-corejs2@0.4.17 :
resolution : {integrity : sha512-aTyf30K/rqAsNwN76zYrdtx8obu0E4KoUME29B1xj+B3WxgvWkp943vYQ+z8Mv3lw9xHXMHpvSPOBxzAkIa94w==}
peerDependencies :
'@babel/core' : ^7.4.0 || ^8.0.0-0 <8.0.0
babel-plugin-polyfill-corejs3@0.14.2 :
resolution : {integrity : sha512-coWpDLJ410R781Npmn/SIBZEsAetR4xVi0SxLMXPaMO4lSf1MwnkGYMtkFxew0Dn8B3/CpbpYxN0JCgg8mn67g==}
peerDependencies :
'@babel/core' : ^7.4.0 || ^8.0.0-0 <8.0.0
babel-plugin-polyfill-regenerator@0.6.8 :
resolution : {integrity : sha512-M762rNHfSF1EV3SLtnCJXFoQbbIIz0OyRwnCmV0KPC7qosSfCO0QLTSuJX3ayAebubhE6oYBAYPrBA5ljowaZg==}
peerDependencies :
'@babel/core' : ^7.4.0 || ^8.0.0-0 <8.0.0
backbone@1.6.1 :
resolution : {integrity : sha512-YQzWxOrIgL6BoFnZjThVN99smKYhyEXXFyJJ2lsF1wJLyo4t+QjmkLrH8/fN22FZ4ykF70Xq7PgTugJVR4zS9Q==}
balanced-match@1.0.2 :
resolution : {integrity : sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
balanced-match@4.0.4 :
resolution : {integrity : sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
engines : {node : 18 || 20 || >=22}
base64-js@1.5.1 :
resolution : {integrity : sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
base64id@2.0.0 :
resolution : {integrity : sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog==}
engines : {node : ^4.5.0 || >= 5.9}
baseline-browser-mapping@2.10.37 :
resolution : {integrity : sha512-girxaJ7WZssDOFhzCGZTDKoTa1gk6A1TbflaYTpykLJ4UU9Fz9kx1aREM8JCuoVHbL8X8T/mJg7w2oYSq72Oig==}
engines : {node : '>=6.0.0' }
hasBin : true
binary-extensions@2.3.0 :
resolution : {integrity : sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
engines : {node : '>=8' }
bl@4.1.0 :
resolution : {integrity : sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==}
bluebird@3.7.2 :
resolution : {integrity : sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==}
blueimp-md5@2.19.0 :
resolution : {integrity : sha512-DRQrD6gJyy8FbiE4s+bDoXS9hiW3Vbx5uCdwvcCf3zLHL+Iv7LtGHLpr+GZV8rHG8tK766FGYBwRbu8pELTt+w==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
body-parser@2.3.0 :
resolution : {integrity : sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==}
2026-08-30 00:10:11 +03:00
engines : {node : '>=18' }
boxen@5.1.2 :
resolution : {integrity : sha512-9gYgQKXx+1nP8mP7CzFyaUARhg7D3n1dF/FnErWmu9l6JvGpNUN278h0aSb+QjoiKSWG+iZ3uHrcqk0qrY9RQQ==}
engines : {node : '>=10' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
brace-expansion@1.1.18 :
resolution : {integrity : sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==}
2026-08-30 00:10:11 +03:00
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
brace-expansion@2.1.4 :
resolution : {integrity : sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==}
2026-08-30 00:10:11 +03:00
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
brace-expansion@5.0.9 :
resolution : {integrity : sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
engines : {node : 20 || >=22}
2026-08-30 00:10:11 +03:00
braces@3.0.3 :
resolution : {integrity : sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
engines : {node : '>=8' }
browserslist@4.28.2 :
resolution : {integrity : sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==}
engines : {node : ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
hasBin : true
buffer-from@1.1.2 :
resolution : {integrity : sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
buffer@5.7.1 :
resolution : {integrity : sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==}
bytes@3.1.2 :
resolution : {integrity : sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
engines : {node : '>= 0.8' }
cac@7.0.0 :
resolution : {integrity : sha512-tixWYgm5ZoOD+3g6UTea91eow5z6AAHaho3g0V9CNSNb45gM8SmflpAc+GRd1InC4AqN/07Unrgp56Y94N9hJQ==}
engines : {node : '>=20.19.0' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
cacheable-lookup@5.0.4 :
resolution : {integrity : sha512-2/kNscPhpcxrOigMZzbiWF7dz8ilhb/nIHU3EyZiXWXpeq/au8qJ8VhdftMkty3n7Gj6HIGalQG8oiBNB3AJgA==}
engines : {node : '>=10.6.0' }
cacheable-request@7.0.4 :
resolution : {integrity : sha512-v+p6ongsrp0yTGbJXjgxPow2+DL93DASP4kXCDKb8/bwRtt9OEF3whggkkDkGNzgcWy2XaF4a8nZglC7uElscg==}
2026-08-30 00:10:11 +03:00
engines : {node : '>=8' }
caching-transform@4.0.0 :
resolution : {integrity : sha512-kpqOvwXnjjN44D89K5ccQC+RUrsy7jB/XLlRrx0D7/2HNcTPqzsb6XgYoErwko6QsV184CA2YgS1fxDiiDZMWA==}
engines : {node : '>=8' }
call-bind-apply-helpers@1.0.2 :
resolution : {integrity : sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
engines : {node : '>= 0.4' }
call-bind@1.0.9 :
resolution : {integrity : sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==}
engines : {node : '>= 0.4' }
call-bound@1.0.4 :
resolution : {integrity : sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
engines : {node : '>= 0.4' }
callsites@3.1.0 :
resolution : {integrity : sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
engines : {node : '>=6' }
camelcase@5.3.1 :
resolution : {integrity : sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==}
engines : {node : '>=6' }
camelcase@6.3.0 :
resolution : {integrity : sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==}
engines : {node : '>=10' }
caniuse-lite@1.0.30001799 :
resolution : {integrity : sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==}
catharsis@0.9.0 :
resolution : {integrity : sha512-prMTQVpcns/tzFgFVkVp6ak6RykZyWb3gu8ckUpd6YkTlacOd3DXGJjIpD4Q6zJirizvaiAjSSHlOsA+6sNh2A==}
engines : {node : '>= 10' }
chalk@4.1.2 :
resolution : {integrity : sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
engines : {node : '>=10' }
chalk@5.6.2 :
resolution : {integrity : sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==}
engines : {node : ^12.17.0 || ^14.13 || >=16.0.0}
char-regex@1.0.2 :
resolution : {integrity : sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==}
engines : {node : '>=10' }
charm@1.0.2 :
resolution : {integrity : sha512-wqW3VdPnlSWT4eRiYX+hcs+C6ViBPUWk1qTCd+37qw9kEm/a5n2qcyQDMBWvSYKN/ctqZzeXNQaeBjOetJJUkw==}
chokidar@3.6.0 :
resolution : {integrity : sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
engines : {node : '>= 8.10.0' }
chokidar@5.0.0 :
resolution : {integrity : sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==}
engines : {node : '>= 20.19.0' }
chunkd@2.0.1 :
resolution : {integrity : sha512-7d58XsFmOq0j6el67Ug9mHf9ELUXsQXYJBkyxhH/k+6Ke0qXRnv0kbemx+Twc6fRJ07C49lcbdgm9FL1Ei/6SQ==}
ci-info@2.0.0 :
resolution : {integrity : sha512-5tK7EtrZ0N+OLFMthtqOj4fI2Jeb88C4CAZPu25LDVUgXJ0A3Js4PMGqrn0JU1W0Mh1/Z8wZzYPxqUrXeBboCQ==}
ci-parallel-vars@1.0.1 :
resolution : {integrity : sha512-uvzpYrpmidaoxvIQHM+rKSrigjOe9feHYbw4uOI2gdfe1C3xIlxO+kVXq83WQWNniTf8bAxVpy+cQeFQsMERKg==}
cjs-module-lexer@1.4.3 :
resolution : {integrity : sha512-9z8TZaGM1pfswYeXrUpzPrkx8UnWYdhJclsiYMm6x/w5+nN+8Tf/LnAgfLGQCm59qAOxU8WwHEq2vNwF6i4j+Q==}
clean-stack@2.2.0 :
resolution : {integrity : sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==}
engines : {node : '>=6' }
clean-yaml-object@0.1.0 :
resolution : {integrity : sha512-3yONmlN9CSAkzNwnRCiJQ7Q2xK5mWuEfL3PuTZcAUzhObbXsfsnMptJzXwz93nc5zn9V9TwCVMmV7w4xsm43dw==}
engines : {node : '>=0.10.0' }
cli-boxes@2.2.1 :
resolution : {integrity : sha512-y4coMcylgSCdVinjiDBuR8PCC2bLjyGTwEmPb9NHR/QaNU6EUOXcTY/s6VjGMD6ENSEaeQYHCY0GNGS5jfMwPw==}
engines : {node : '>=6' }
cli-cursor@3.1.0 :
resolution : {integrity : sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==}
engines : {node : '>=8' }
cli-highlight@2.1.11 :
resolution : {integrity : sha512-9KDcoEVwyUXrjcJNvHD0NFc/hiwe/WPVYIleQh2O1N2Zro5gWJZ/K+3DGn8w8P/F6FxOgzyC5bxDyHIgCSPhGg==}
engines : {node: '>=8.0.0', npm : '>=5.0.0' }
hasBin : true
cli-spinners@2.9.2 :
resolution : {integrity : sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg==}
engines : {node : '>=6' }
cli-table3@0.6.5 :
resolution : {integrity : sha512-+W/5efTR7y5HRD7gACw9yQjqMVvEMLBHmboM/kPWam+H+Hmyrgjh6YncVKK122YZkXrLudzTuAukUw9FnMf7IQ==}
engines : {node : 10 .* || >= 12.*}
cli-truncate@2.1.0 :
resolution : {integrity : sha512-n8fOixwDD6b/ObinzTrp1ZKFzbgvKZvuz/TvejnLn1aQfC6r52XEx85FmuC+3HI+JM7coBRXUvNqEU2PHVrHpg==}
engines : {node : '>=8' }
cliui@6.0.0 :
resolution : {integrity : sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==}
cliui@7.0.4 :
resolution : {integrity : sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==}
clone-deep@4.0.1 :
resolution : {integrity : sha512-neHB9xuzh/wk0dIHweyAXv2aPGZIVk3pLMe+/RNzINf17fe0OG96QroktYAUm7SM1PBnzTabaLboqqxDyMU+SQ==}
engines : {node : '>=6' }
clone-response@1.0.3 :
resolution : {integrity : sha512-ROoL94jJH2dUVML2Y/5PEDNaSHgeOdSDicUyS7izcF63G6sTc/FTjLub4b8Il9S8S0beOfYt0TaA5qvFK+w0wA==}
clone@1.0.4 :
resolution : {integrity : sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==}
engines : {node : '>=0.8' }
code-excerpt@3.0.0 :
resolution : {integrity : sha512-VHNTVhd7KsLGOqfX3SyeO8RyYPMp1GJOg194VITk04WMYCv4plV68YWe6TJZxd9MhobjtpMRnVky01gqZsalaw==}
engines : {node : '>=10' }
color-convert@2.0.1 :
resolution : {integrity : sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
engines : {node : '>=7.0.0' }
color-name@1.1.4 :
resolution : {integrity : sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
commander@10.0.1 :
resolution : {integrity : sha512-y4Mg2tXshplEbSGzx7amzPwKKOCGuoSRP/CjEdwwk0FOGlUbq6lKuoyDZTNZkmxHdJtp54hdfY/JUrdL7Xfdug==}
engines : {node : '>=14' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
commander@13.1.0 :
resolution : {integrity : sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==}
engines : {node : '>=18' }
2026-08-30 00:10:11 +03:00
commander@14.0.3 :
resolution : {integrity : sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
engines : {node : '>=20' }
commander@2.20.3 :
resolution : {integrity : sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==}
commander@6.2.1 :
resolution : {integrity : sha512-U7VdrJFnJgo4xjrHpTzu0yrHPGImdsmD95ZlgYSEajAn2JKzDhDTPG9kBTefmObL2w/ngeZnilk+OV9CG3d7UA==}
engines : {node : '>= 6' }
comment-parser@1.4.7 :
resolution : {integrity : sha512-0h+uSNtQGW3D98eQt3jJ8L06Fves8hncB4V/PKdw/Qb8Hnk19VaKuTr55UNRYiSoVa7WwrFls+rh3ux9agmkeQ==}
engines : {node : '>= 12.0.0' }
common-path-prefix@3.0.0 :
resolution : {integrity : sha512-QE33hToZseCH3jS0qN96O/bSh3kaw/h+Tq7ngyY9eWDUnTlTNUyqfqvCXioLe5Na5jFsL78ra/wuBU4iuEgd4w==}
commondir@1.0.1 :
resolution : {integrity : sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==}
compressible@2.0.18 :
resolution : {integrity : sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==}
engines : {node : '>= 0.6' }
compression@1.8.1 :
resolution : {integrity : sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==}
engines : {node : '>= 0.8.0' }
concat-map@0.0.1 :
resolution : {integrity : sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
concordance@5.0.4 :
resolution : {integrity : sha512-OAcsnTEYu1ARJqWVGwf4zh4JDfHZEaSNlNccFmt8YjB2l/n19/PF2viLINHc57vO4FKIAFl2FWASIGZZWZ2Kxw==}
engines : {node : '>=10.18.0 <11 || >=12.14.0 <13 || >=14' }
configstore@5.0.1 :
resolution : {integrity : sha512-aMKprgk5YhBNyH25hj8wGt2+D52Sw1DRRIzqBwLp2Ya9mFmY8KPvvtvmna8SxVR9JMZ4kzMD68N22vlaRpkeFA==}
engines : {node : '>=8' }
confusing-browser-globals@1.0.11 :
resolution : {integrity : sha512-JsPKdmh8ZkmnHxDk55FZ1TqVLvEQTvoByJZRN9jzI0UjxK/QgAmsphz7PGtqgPieQZ/CQcHWXCR7ATDNhGe+YA==}
consolidate@1.0.4 :
resolution : {integrity : sha512-RuZ3xnqEDsxiwaoIkqVeeK3gg9qxw7+YKYX2tKhLs1eukVKMgSr4VYI3iYFsRHi4TloHYDlugrz3kvkjs3nynA==}
engines : {node : '>=14' }
peerDependencies :
'@babel/core' : ^7.22.5
arc-templates : ^0.5.3
atpl : '>=0.7.6'
bracket-template : ^1.1.5
coffee-script : ^1.12.7
dot : ^1.1.3
dust : ^0.3.0
dustjs-helpers : ^1.7.4
dustjs-linkedin : ^2.7.5
eco : ^1.1.0-rc-3
ect : ^0.5.9
ejs : ^3.1.5
haml-coffee : ^1.14.1
hamlet : ^0.3.3
hamljs : ^0.6.2
handlebars : ^4.7.6
hogan.js : ^3.0.2
htmling : ^0.0.8
jazz : ^0.0.18
jqtpl : ~1.1.0
just : ^0.1.8
liquid-node : ^3.0.1
liquor : ^0.0.5
lodash : ^4.17.20
mote : ^0.2.0
mustache : ^4.0.1
nunjucks : ^3.2.2
plates : ~0.4.11
pug : ^3.0.0
qejs : ^3.0.5
ractive : ^1.3.12
react : '>=16.13.1'
react-dom : '>=16.13.1'
slm : ^2.0.0
swig : ^1.4.2
swig-templates : ^2.0.3
teacup : ^2.0.0
templayed : '>=0.2.3'
then-pug : '*'
tinyliquid : ^0.2.34
toffee : ^0.3.6
twig : ^1.15.2
twing : ^5.0.2
underscore : ^1.11.0
vash : ^0.13.0
velocityjs : ^2.0.1
walrus : ^0.10.1
whiskers : ^0.4.0
peerDependenciesMeta :
'@babel/core' :
optional : true
arc-templates :
optional : true
atpl :
optional : true
bracket-template :
optional : true
coffee-script :
optional : true
dot :
optional : true
dust :
optional : true
dustjs-helpers :
optional : true
dustjs-linkedin :
optional : true
eco :
optional : true
ect :
optional : true
ejs :
optional : true
haml-coffee :
optional : true
hamlet :
optional : true
hamljs :
optional : true
handlebars :
optional : true
hogan.js :
optional : true
htmling :
optional : true
jazz :
optional : true
jqtpl :
optional : true
just :
optional : true
liquid-node :
optional : true
liquor :
optional : true
lodash :
optional : true
mote :
optional : true
mustache :
optional : true
nunjucks :
optional : true
plates :
optional : true
pug :
optional : true
qejs :
optional : true
ractive :
optional : true
react :
optional : true
react-dom :
optional : true
slm :
optional : true
swig :
optional : true
swig-templates :
optional : true
teacup :
optional : true
templayed :
optional : true
then-pug :
optional : true
tinyliquid :
optional : true
toffee :
optional : true
twig :
optional : true
twing :
optional : true
underscore :
optional : true
vash :
optional : true
velocityjs :
optional : true
walrus :
optional : true
whiskers :
optional : true
content-disposition@1.1.0 :
resolution : {integrity : sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==}
engines : {node : '>=18' }
content-type@1.0.5 :
resolution : {integrity : sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==}
engines : {node : '>= 0.6' }
content-type@2.0.0 :
resolution : {integrity : sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==}
engines : {node : '>=18' }
convert-source-map@1.9.0 :
resolution : {integrity : sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==}
convert-source-map@2.0.0 :
resolution : {integrity : sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
convert-to-spaces@1.0.2 :
resolution : {integrity : sha512-cj09EBuObp9gZNQCzc7hByQyrs6jVGE+o9kSJmeUoj+GiPiJvi5LYqEH/Hmme4+MTLHM+Ejtq+FChpjjEnsPdQ==}
engines : {node : '>= 4' }
cookie-signature@1.2.2 :
resolution : {integrity : sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==}
engines : {node : '>=6.6.0' }
cookie@0.7.2 :
resolution : {integrity : sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==}
engines : {node : '>= 0.6' }
core-js-compat@3.49.0 :
resolution : {integrity : sha512-VQXt1jr9cBz03b331DFDCCP90b3fanciLkgiOoy8SBHy06gNf+vQ1A3WFLqG7I8TipYIKeYK9wxd0tUrvHcOZA==}
core-js@3.49.0 :
resolution : {integrity : sha512-es1U2+YTtzpwkxVLwAFdSpaIMyQaq0PBgm3YD1W3Qpsn1NAmO3KSgZfu+oGSWVu6NvLHoHCV/aYcsE5wiB7ALg==}
cors@2.8.6 :
resolution : {integrity : sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==}
engines : {node : '>= 0.10' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
coveralls-next@6.0.2 :
resolution : {integrity : sha512-RzaxMFLKyk8p6Rmv4hfNPpLOV16IpraguQGr+BzpPoQUJSFY2ISNPzlsPhq0ogUrz8dAR3P+379ECMjhNqPVWg==}
engines : {node : '>=20' }
2026-08-30 00:10:11 +03:00
hasBin : true
cross-spawn@7.0.6 :
resolution : {integrity : sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
engines : {node : '>= 8' }
crypto-random-string@2.0.0 :
resolution : {integrity : sha512-v1plID3y9r/lPhviJ1wrXpLeyUIGAZ2SHNYTEapm7/8A9nLPoyvVp3RK/EPFqn5kEznyWgYZNsRtYYIWbuG8KA==}
engines : {node : '>=8' }
currently-unhandled@0.4.1 :
resolution : {integrity : sha512-/fITjgjGU50vjQ4FH6eUoYu+iUoUKIXws2hL15JJpIR+BbTxaXQsMuuyjtNh2WqsSBS5nsaZHFsFecyw5CCAng==}
engines : {node : '>=0.10.0' }
damerau-levenshtein@1.0.8 :
resolution : {integrity : sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==}
data-view-buffer@1.0.2 :
resolution : {integrity : sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==}
engines : {node : '>= 0.4' }
data-view-byte-length@1.0.2 :
resolution : {integrity : sha512-tuhGbE6CfTM9+5ANGf+oQb72Ky/0+s3xKUpHvShfiz2RxMFgFPjsXuRLBVMtvMs15awe45SRb83D6wH4ew6wlQ==}
engines : {node : '>= 0.4' }
data-view-byte-offset@1.0.1 :
resolution : {integrity : sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==}
engines : {node : '>= 0.4' }
date-time@3.1.0 :
resolution : {integrity : sha512-uqCUKXE5q1PNBXjPqvwhwJf9SwMoAHBgWJ6DcrnS5o+W2JOiIILl0JEdVD8SGujrNS02GGxgwAg2PN2zONgtjg==}
engines : {node : '>=6' }
debug@2.6.9 :
resolution : {integrity : sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==}
peerDependencies :
supports-color : '*'
peerDependenciesMeta :
supports-color :
optional : true
debug@3.2.7 :
resolution : {integrity : sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==}
peerDependencies :
supports-color : '*'
peerDependenciesMeta :
supports-color :
optional : true
debug@4.4.3 :
resolution : {integrity : sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
engines : {node : '>=6.0' }
peerDependencies :
supports-color : '*'
peerDependenciesMeta :
supports-color :
optional : true
decamelize@1.2.0 :
resolution : {integrity : sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==}
engines : {node : '>=0.10.0' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
decompress-response@6.0.0 :
resolution : {integrity : sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==}
engines : {node : '>=10' }
2026-08-30 00:10:11 +03:00
deep-extend@0.6.0 :
resolution : {integrity : sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==}
engines : {node : '>=4.0.0' }
deep-is@0.1.4 :
resolution : {integrity : sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
default-require-extensions@3.0.1 :
resolution : {integrity : sha512-eXTJmRbm2TIt9MgWTsOH1wEuhew6XGZcMeGKCtLedIg/NCsg1iBePXkceTdK4Fii7pzmN9tGsZhKzZ4h7O/fxw==}
engines : {node : '>=8' }
defaults@1.0.4 :
resolution : {integrity : sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
defer-to-connect@2.0.1 :
resolution : {integrity : sha512-4tvttepXG1VaYGrRibk5EwJd1t4udunSOVMdLSAL6mId1ix438oPwPZMALY41FCijukO1L0twNcGsdzS7dHgDg==}
engines : {node : '>=10' }
2026-08-30 00:10:11 +03:00
define-data-property@1.1.4 :
resolution : {integrity : sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
engines : {node : '>= 0.4' }
define-properties@1.2.1 :
resolution : {integrity : sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
engines : {node : '>= 0.4' }
defu@6.1.7 :
resolution : {integrity : sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==}
del@6.1.1 :
resolution : {integrity : sha512-ua8BhapfP0JUJKC/zV9yHHDW/rDoDxP4Zhn3AkA6/xT6gY7jYXJiaeyBZznYVujhZZET+UgcbZiQ7sN3WqcImg==}
engines : {node : '>=10' }
depd@2.0.0 :
resolution : {integrity : sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==}
engines : {node : '>= 0.8' }
diff@9.0.0 :
resolution : {integrity : sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw==}
engines : {node : '>=0.3.1' }
dir-glob@3.0.1 :
resolution : {integrity : sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==}
engines : {node : '>=8' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
docdash@2.0.2 :
resolution : {integrity : sha512-3SDDheh9ddrwjzf6dPFe1a16M6ftstqTNjik2+1fx46l24H9dD2osT2q9y+nBEC1wWz4GIqA48JmicOLQ0R8xA==}
2026-08-30 00:10:11 +03:00
doctrine@2.1.0 :
resolution : {integrity : sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==}
engines : {node : '>=0.10.0' }
dot-prop@5.3.0 :
resolution : {integrity : sha512-QM8q3zDe58hqUqjraQOmzZ1LIH9SWQJTlEKCH4kJ2oQvLZk7RbQXvtDM2XEq3fwkV9CCvvH4LA0AV+ogFsBM2Q==}
engines : {node : '>=8' }
dts-resolver@3.0.0 :
resolution : {integrity : sha512-1T1f+z+4tl9XD+m+0HBgWoL/nm0bOIffyWaUuUSBlFg/86IWvfx+wjNaO/ybU0AJzG9/Mi5hBUgGV6zCmWEN7Q==}
engines : {node : ^22.18.0 || >=24.0.0}
peerDependencies :
oxc-resolver : '>=11.0.0'
peerDependenciesMeta :
oxc-resolver :
optional : true
dunder-proto@1.0.1 :
resolution : {integrity : sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
engines : {node : '>= 0.4' }
eastasianwidth@0.2.0 :
resolution : {integrity : sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==}
ee-first@1.1.1 :
resolution : {integrity : sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
electron-to-chromium@1.5.372 :
resolution : {integrity : sha512-M3yhbAlilnwqC8D21t28UCDGHyitShTmmLRU/H+b74P6Ski16Nb9HONYEaVpMj/pwC7BEo5B95FpjODLCWbtfA==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
email-addresses@5.0.0 :
resolution : {integrity : sha512-4OIPYlA6JXqtVn8zpHpGiI7vE6EQOAg16aGnDMIAlZVinnoZ8208tW1hAbjWydgN/4PLTT9q+O1K6AH/vALJGw==}
2026-08-30 00:10:11 +03:00
emittery@0.8.1 :
resolution : {integrity : sha512-uDfvUjVrfGJJhymx/kz6prltenw1u7WrCg1oa94zYY8xxVpLLUu045LAT0dhDZdXG58/EpPL/5kA180fQ/qudg==}
engines : {node : '>=10' }
emoji-regex@8.0.0 :
resolution : {integrity : sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
emoji-regex@9.2.2 :
resolution : {integrity : sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==}
emojilib@2.4.0 :
resolution : {integrity : sha512-5U0rVMU5Y2n2+ykNLQqMoqklN9ICBT/KsvC1Gz6vqHbz2AXXGkG+Pm5rMWk/8Vjrr/mY9985Hi8DYzn1F09Nyw==}
empathic@2.0.1 :
resolution : {integrity : sha512-YGRs8knHhKHVShLkFET/rWAU8kmHbOV5LwN938RHI0pljAJ1Gf6SzXsSmRaEzcXTtOOmVqJ5+WtQPL5uigY50Q==}
engines : {node : '>=14' }
encodeurl@2.0.0 :
resolution : {integrity : sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==}
engines : {node : '>= 0.8' }
end-of-stream@1.4.5 :
resolution : {integrity : sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==}
engine.io-parser@5.2.3 :
resolution : {integrity : sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q==}
engines : {node : '>=10.0.0' }
engine.io@6.6.8 :
resolution : {integrity : sha512-2agL3ueZhqxoVrfmntO8yuVj+uNSlIOnhykYHk3Cq0ShYPdUjjUiSJrQvXjq01I9jAuI0Zl2YO8Evv5Mqytm5g==}
engines : {node : '>=10.2.0' }
enhanced-resolve@5.24.0 :
resolution : {integrity : sha512-SkE2t82KlkkxQRVMVLAGKxLfORGQfrkx5dkj+vlgXRVNEdPc4eZcR+J/Fvj8C+yKSFH5L0q3NFlyufOVQnCcYQ==}
engines : {node : '>=10.13.0' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
entities@4.5.0 :
resolution : {integrity : sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==}
engines : {node : '>=0.12' }
2026-08-30 00:10:11 +03:00
environment@1.1.0 :
resolution : {integrity : sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==}
engines : {node : '>=18' }
equal-length@1.0.1 :
resolution : {integrity : sha512-TK2m7MvWPt/v3dan0BCNp99pytIE5UGrUj7F0KZirNX8xz8fDFUAZfgm8uB5FuQq9u0sMeDocYBfEhsd1nwGoA==}
engines : {node : '>=4' }
error-ex@1.3.4 :
resolution : {integrity : sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==}
es-abstract@1.24.2 :
resolution : {integrity : sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==}
engines : {node : '>= 0.4' }
es-define-property@1.0.1 :
resolution : {integrity : sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
engines : {node : '>= 0.4' }
es-errors@1.3.0 :
resolution : {integrity : sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
engines : {node : '>= 0.4' }
es-iterator-helpers@1.3.3 :
resolution : {integrity : sha512-0PuBxFi+4uPanB97iDxCLWuHeYud2FALrw5HFZGtAF38UpJDbDC8frwp2cnDyae692CQ0dou60UwWfhgsa4U/g==}
engines : {node : '>= 0.4' }
es-object-atoms@1.1.2 :
resolution : {integrity : sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
engines : {node : '>= 0.4' }
es-set-tostringtag@2.1.0 :
resolution : {integrity : sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
engines : {node : '>= 0.4' }
es-shim-unscopables@1.1.0 :
resolution : {integrity : sha512-d9T8ucsEhh8Bi1woXCf+TIKDIROLG5WCkxg8geBCbvk22kzwC5G2OnXVMO6FUsvQlgUUXQ2itephWDLqDzbeCw==}
engines : {node : '>= 0.4' }
es-to-primitive@1.3.0 :
resolution : {integrity : sha512-w+5mJ3GuFL+NjVtJlvydShqE1eN3h3PbI7/5LAsYJP/2qtuMXjfL2LpHSRqo4b4eSF5K/DH1JXKUAHSB2UW50g==}
engines : {node : '>= 0.4' }
es6-error@4.1.1 :
resolution : {integrity : sha512-Um/+FxMr9CISWh0bi5Zv0iOD+4cFh5qLeks1qhAopKVAJw3drgKbKySikp7wGhDL0HPeaja0P5ULZrxLkniUVg==}
escalade@3.2.0 :
resolution : {integrity : sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
engines : {node : '>=6' }
escape-goat@2.1.1 :
resolution : {integrity : sha512-8/uIhbG12Csjy2JEW7D9pHbreaVaS/OpN3ycnyvElTdwM5n6GY6W6e2IPemfvGZeUMqZ9A/3GqIZMgKnBhAw/Q==}
engines : {node : '>=8' }
escape-html@1.0.3 :
resolution : {integrity : sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==}
escape-string-regexp@1.0.5 :
resolution : {integrity : sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
engines : {node : '>=0.8.0' }
escape-string-regexp@2.0.0 :
resolution : {integrity : sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==}
engines : {node : '>=8' }
escape-string-regexp@4.0.0 :
resolution : {integrity : sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
engines : {node : '>=10' }
eslint-compat-utils@0.5.1 :
resolution : {integrity : sha512-3z3vFexKIEnjHE3zCMRo6fn/e44U7T1khUjg+Hp0ZQMCigh28rALD0nPFBcGZuiLC5rLZa2ubQHDRln09JfU2Q==}
engines : {node : '>=12' }
peerDependencies :
eslint : '>=6.0.0'
eslint-config-airbnb-extended@3.1.0 :
resolution : {integrity : sha512-uUE5+8gQ9h+QqHOI0OIBIQW0+/bA4l/GE1i5fPAGk64Y5lBKxyZRNDcQUGSaovOzX7yMa0Q+3MS1lj5bq/BC/Q==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
eslint : ^9.0.0
eslint-import-context@0.1.9 :
resolution : {integrity : sha512-K9Hb+yRaGAGUbwjhFNHvSmmkZs9+zbuoe3kFQ4V1wYjrepUFYM2dZAfNtjbbj3qsPfUfsA68Bx/ICWQMi+C8Eg==}
engines : {node : ^12.20.0 || ^14.18.0 || >=16.0.0}
peerDependencies :
unrs-resolver : ^1.0.0
peerDependenciesMeta :
unrs-resolver :
optional : true
eslint-import-resolver-node@0.3.10 :
resolution : {integrity : sha512-tRrKqFyCaKict5hOd244sL6EQFNycnMQnBe+j8uqGNXYzsImGbGUU4ibtoaBmv5FLwJwcFJNeg1GeVjQfbMrDQ==}
eslint-import-resolver-typescript@4.4.5 :
resolution : {integrity : sha512-nbE5XLph6TLtGYcu/U6e6ZVXyKBhbDWK5cLGk76eJ7NdZpwf1P9EFkpt1Z01mNZNrrilsAYWKH6zUkL4reoXbw==}
engines : {node : ^16.17.0 || >=18.6.0}
peerDependencies :
eslint : '*'
eslint-plugin-import : '*'
eslint-plugin-import-x : '*'
peerDependenciesMeta :
eslint-plugin-import :
optional : true
eslint-plugin-import-x :
optional : true
eslint-module-utils@2.13.0 :
resolution : {integrity : sha512-bLohSkT6469rRs8czj0tLTD8vaeIS/whvPRJVjDr7IuoTT1k5DYDERlNycjDj/HkOlvQdYurmfZ/g3fG5bgeLQ==}
engines : {node : '>=4' }
peerDependencies :
'@typescript-eslint/parser' : '*'
eslint : '*'
eslint-import-resolver-node : '*'
eslint-import-resolver-typescript : '*'
eslint-import-resolver-webpack : '*'
peerDependenciesMeta :
'@typescript-eslint/parser' :
optional : true
eslint :
optional : true
eslint-import-resolver-node :
optional : true
eslint-import-resolver-typescript :
optional : true
eslint-import-resolver-webpack :
optional : true
eslint-plugin-ava@17.0.1 :
resolution : {integrity : sha512-l2K1XWF0BgBcc+kJfObY4ijzRCniStxAMCtDEEu8RzTmICNv07+JqJHGNkThluu1PxDvQdNZedvyc2+SUus1qg==}
engines : {node : '>=22' }
peerDependencies :
eslint : '>=10'
eslint-plugin-es-x@7.8.0 :
resolution : {integrity : sha512-7Ds8+wAAoV3T+LAKeu39Y5BzXCrGKrcISfgKEqTS4BDN8SFEDQd0S43jiQ8vIa3wUKD07qitZdfzlenSi8/0qQ==}
engines : {node : ^14.18.0 || >=16.0.0}
peerDependencies :
eslint : '>=8'
eslint-plugin-import-x@4.16.2 :
resolution : {integrity : sha512-rM9K8UBHcWKpzQzStn1YRN2T5NvdeIfSVoKu/lKF41znQXHAUcBbYXe5wd6GNjZjTrP7viQ49n1D83x/2gYgIw==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
'@typescript-eslint/utils' : ^8.56.0
eslint : ^8.57.0 || ^9.0.0 || ^10.0.0
eslint-import-resolver-node : '*'
peerDependenciesMeta :
'@typescript-eslint/utils' :
optional : true
eslint-import-resolver-node :
optional : true
eslint-plugin-import@2.32.0 :
resolution : {integrity : sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==}
engines : {node : '>=4' }
peerDependencies :
'@typescript-eslint/parser' : '*'
eslint : ^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 || ^9
peerDependenciesMeta :
'@typescript-eslint/parser' :
optional : true
eslint-plugin-jsx-a11y@6.10.2 :
resolution : {integrity : sha512-scB3nz4WmG75pV8+3eRUQOHZlNSUhFNq37xnpgRkCCELU3XMvXAxLk1eqWWyE22Ki4Q01Fnsw9BA3cJHDPgn2Q==}
engines : {node : '>=4.0' }
peerDependencies :
eslint : ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9
eslint-plugin-n@17.24.0 :
resolution : {integrity : sha512-/gC7/KAYmfNnPNOb3eu8vw+TdVnV0zhdQwexsw6FLXbhzroVj20vRn2qL8lDWDGnAQ2J8DhdfvXxX9EoxvERvw==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
eslint : '>=8.23.0'
eslint-plugin-react-hooks@7.1.1 :
resolution : {integrity : sha512-f2I7Gw6JbvCexzIInuSbZpfdQ44D7iqdWX01FKLvrPgqxoE7oMj8clOfto8U6vYiz4yd5oKu39rRSVOe1zRu0g==}
engines : {node : '>=18' }
peerDependencies :
eslint : ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0 || ^10.0.0
eslint-plugin-react@7.37.5 :
resolution : {integrity : sha512-Qteup0SqU15kdocexFNAJMvCJEfa2xUKNV4CC1xsVMrIIqEy3SQ/rqyxCWNzfrd3/ldy6HMlD2e0JDVpDg2qIA==}
engines : {node : '>=4' }
peerDependencies :
eslint : ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7
eslint-scope@9.1.2 :
resolution : {integrity : sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
eslint-visitor-keys@3.4.3 :
resolution : {integrity : sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
engines : {node : ^12.22.0 || ^14.17.0 || >=16.0.0}
eslint-visitor-keys@4.2.1 :
resolution : {integrity : sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
eslint-visitor-keys@5.0.1 :
resolution : {integrity : sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
eslint@10.8.0 :
resolution : {integrity : sha512-nuKKvN+oIBO0koN7Tm7dlkmnkc21mtt0QJLwAKzjLq14y6lRTdVG36MZHJ8eQHwdJMwZbQNMlPOYedMq/oVJvQ==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
hasBin : true
peerDependencies :
jiti : '*'
peerDependenciesMeta :
jiti :
optional : true
espree@10.4.0 :
resolution : {integrity : sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
espree@11.2.0 :
resolution : {integrity : sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw==}
engines : {node : ^20.19.0 || ^22.13.0 || >=24}
esprima@4.0.1 :
resolution : {integrity : sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==}
engines : {node : '>=4' }
hasBin : true
espurify@3.2.0 :
resolution : {integrity : sha512-+jfGpC1eUu7s4M8sXnnoUsQfEQ1qqkEr/S+V47QR+GC/NODe98s4iPYq/2KrNaS1guTjHBhMS4j9N3NOObT1WQ==}
esquery@1.7.0 :
resolution : {integrity : sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==}
engines : {node : '>=0.10' }
esrecurse@4.3.0 :
resolution : {integrity : sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==}
engines : {node : '>=4.0' }
estraverse@5.3.0 :
resolution : {integrity : sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
engines : {node : '>=4.0' }
esutils@2.0.3 :
resolution : {integrity : sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
engines : {node : '>=0.10.0' }
etag@1.8.1 :
resolution : {integrity : sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==}
engines : {node : '>= 0.6' }
eventemitter3@4.0.7 :
resolution : {integrity : sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==}
events-to-array@2.0.3 :
resolution : {integrity : sha512-f/qE2gImHRa4Cp2y1stEOSgw8wTFyUdVJX7G//bMwbaV9JqISFxg99NbmVQeP7YLnDUZ2un851jlaDrlpmGehQ==}
engines : {node : '>=12' }
execa@9.6.1 :
resolution : {integrity : sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA==}
engines : {node : ^18.19.0 || >=20.5.0}
express@5.2.1 :
resolution : {integrity : sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==}
engines : {node : '>= 18' }
fast-deep-equal@3.1.3 :
resolution : {integrity : sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
fast-diff@1.3.0 :
resolution : {integrity : sha512-VxPP4NqbUjj6MaAOafWeUn2cXWLcCtljklUtZf0Ind4XQ+QPtmA0b18zZy0jIQx+ExRVCR/ZQpBmik5lXshNsw==}
fast-glob@3.3.1 :
resolution : {integrity : sha512-kNFPyjhh5cKjrUltxs+wFx+ZkbRaxxmZ+X0ZU31SOsxCEtP9VPgtq2teZw1DebupL5GmDaNQ6yKMMVcM41iqDg==}
engines : {node : '>=8.6.0' }
fast-glob@3.3.3 :
resolution : {integrity : sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
engines : {node : '>=8.6.0' }
fast-json-stable-stringify@2.1.0 :
resolution : {integrity : sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
fast-levenshtein@2.0.6 :
resolution : {integrity : sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
fastq@1.20.1 :
resolution : {integrity : sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
fdir@6.5.0 :
resolution : {integrity : sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
engines : {node : '>=12.0.0' }
peerDependencies :
picomatch : ^3 || ^4
peerDependenciesMeta :
picomatch :
optional : true
fflate@0.8.3 :
resolution : {integrity : sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==}
figures@3.2.0 :
resolution : {integrity : sha512-yaduQFRKLXYOGgEn6AZau90j3ggSOyiqXU0F9JZfeXYhNa+Jk4X+s45A2zg5jns87GAFa34BBm2kXw4XpNcbdg==}
engines : {node : '>=8' }
figures@6.1.0 :
resolution : {integrity : sha512-d+l3qxjSesT4V7v2fh+QnmFnUWv9lSpjarhShNTgBOfA0ttejbQUAlHLitbjkoRiDulW0OPoQPYIGhIC8ohejg==}
engines : {node : '>=18' }
file-entry-cache@8.0.0 :
resolution : {integrity : sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
engines : {node : '>=16.0.0' }
filename-reserved-regex@2.0.0 :
resolution : {integrity : sha512-lc1bnsSr4L4Bdif8Xb/qrtokGbq5zlsms/CYH8PP+WtCkGNF65DPiQY8vG3SakEdRn8Dlnm+gW/qWKKjS5sZzQ==}
engines : {node : '>=4' }
filenamify@4.3.0 :
resolution : {integrity : sha512-hcFKyUG57yWGAzu1CMt/dPzYZuv+jAJUT85bL8mrXvNe6hWj6yEHEc4EdcgiA6Z3oi1/9wXJdZPXF2dZNgwgOg==}
engines : {node : '>=8' }
fill-range@7.1.1 :
resolution : {integrity : sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
engines : {node : '>=8' }
finalhandler@2.1.1 :
resolution : {integrity : sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==}
engines : {node : '>= 18.0.0' }
find-cache-dir@2.1.0 :
resolution : {integrity : sha512-Tq6PixE0w/VMFfCgbONnkiQIVol/JJL7nRMi20fqzA4NRs9AfeqMGeRdPi3wIhYkxjeBaWh2rxwapn5Tu3IqOQ==}
engines : {node : '>=6' }
find-cache-dir@3.3.2 :
resolution : {integrity : sha512-wXZV5emFEjrridIgED11OoUKLxiYjAcqot/NJdAkOhlJ+vGzwhOAfcG5OX1jP+S0PcjEn8bdMJv+g2jwQ3Onig==}
engines : {node : '>=8' }
find-up@3.0.0 :
resolution : {integrity : sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==}
engines : {node : '>=6' }
find-up@4.1.0 :
resolution : {integrity : sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==}
engines : {node : '>=8' }
find-up@5.0.0 :
resolution : {integrity : sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
engines : {node : '>=10' }
flat-cache@4.0.1 :
resolution : {integrity : sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
engines : {node : '>=16' }
flatted@3.4.2 :
resolution : {integrity : sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
follow-redirects@1.16.0 :
resolution : {integrity : sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==}
engines : {node : '>=4.0' }
peerDependencies :
debug : '*'
peerDependenciesMeta :
debug :
optional : true
for-each@0.3.5 :
resolution : {integrity : sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
engines : {node : '>= 0.4' }
foreground-child@2.0.0 :
resolution : {integrity : sha512-dCIq9FpEcyQyXKCkyzmlPTFNgrCzPudOe+mhvJU5zAtlBnGVy2yKxtfsxK2tQBThwq225jcvBjpw1Gr40uzZCA==}
engines : {node : '>=8.0.0' }
foreground-child@3.3.1 :
resolution : {integrity : sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==}
engines : {node : '>=14' }
forwarded@0.2.0 :
resolution : {integrity : sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
engines : {node : '>= 0.6' }
fresh@2.0.0 :
resolution : {integrity : sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==}
engines : {node : '>= 0.8' }
fromentries@1.3.2 :
resolution : {integrity : sha512-cHEpEQHUg0f8XdtZCc2ZAhrHzKzT0MrFUTcvx+hfxYu7rGMDc5SKoXFh+n4YigxsHXRzc6OrCshdR1bWH6HHyg==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
fs-extra@11.4.0 :
resolution : {integrity : sha512-EQsFzMUJkCKGr1ePqlYADkIUmHW1s3ZXr5Yqy6wbGrfUCphpl2maM/kyOIRA2HpP3AaFQTZXD4ldjek+nccddA==}
engines : {node : '>=14.14' }
2026-08-30 00:10:11 +03:00
fs-readdir-recursive@1.1.0 :
resolution : {integrity : sha512-GNanXlVr2pf02+sPN40XN8HG+ePaNcvM0q5mZBd668Obwb0yD5GiUbZOFgwn8kGMY6I3mdyDJzieUy3PTYyTRA==}
fs.realpath@1.0.0 :
resolution : {integrity : sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
fsevents@2.3.3 :
resolution : {integrity : sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
engines : {node : ^8.16.0 || ^10.6.0 || >=11.0.0}
os : [ darwin]
function-bind@1.1.2 :
resolution : {integrity : sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
function.prototype.name@1.2.0 :
resolution : {integrity : sha512-jObKIik1P2QjPHP5nz5BaOtUlfgS0fWo8IUByNXkM+o+02sJOi94em77GwJKQSJ3gfPHdgzLNrHc1uokV4P/ew==}
engines : {node : '>= 0.4' }
functions-have-names@1.2.3 :
resolution : {integrity : sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==}
generator-function@2.0.1 :
resolution : {integrity : sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==}
engines : {node : '>= 0.4' }
gensync@1.0.0-beta.2 :
resolution : {integrity : sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
engines : {node : '>=6.9.0' }
get-caller-file@2.0.5 :
resolution : {integrity : sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==}
engines : {node : 6 .* || 8.* || >= 10.*}
get-intrinsic@1.3.0 :
resolution : {integrity : sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
engines : {node : '>= 0.4' }
get-package-type@0.1.0 :
resolution : {integrity : sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==}
engines : {node : '>=8.0.0' }
get-proto@1.0.1 :
resolution : {integrity : sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
engines : {node : '>= 0.4' }
get-stream@5.2.0 :
resolution : {integrity : sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==}
engines : {node : '>=8' }
get-stream@9.0.1 :
resolution : {integrity : sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA==}
engines : {node : '>=18' }
get-symbol-description@1.1.0 :
resolution : {integrity : sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==}
engines : {node : '>= 0.4' }
get-tsconfig@4.14.0 :
resolution : {integrity : sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==}
get-tsconfig@5.0.0-beta.5 :
resolution : {integrity : sha512-/6gFNr0N04nob252sTQxyFLi3eKFRqIg1I87YcqAMT1i6SQrSF6KujUEQrtrjMV0H/eejTCltLdDSTEMzHbnsQ==}
engines : {node : '>=20.20.0' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
gh-pages@6.3.0 :
resolution : {integrity : sha512-Ot5lU6jK0Eb+sszG8pciXdjMXdBJ5wODvgjR+imihTqsUWF2K6dJ9HST55lgqcs8wWcw6o6wAsUzfcYRhJPXbA==}
2026-08-30 00:10:11 +03:00
engines : {node : '>=10' }
hasBin : true
glob-parent@5.1.2 :
resolution : {integrity : sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
engines : {node : '>= 6' }
glob-parent@6.0.2 :
resolution : {integrity : sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
engines : {node : '>=10.13.0' }
glob@10.5.0 :
resolution : {integrity : sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==}
deprecated : Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
hasBin : true
glob@13.0.6 :
resolution : {integrity : sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==}
engines : {node : 18 || 20 || >=22}
glob@7.2.3 :
resolution : {integrity : sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
deprecated : Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
global-dirs@3.0.1 :
resolution : {integrity : sha512-NBcGGFbBA9s1VzD41QXDG+3++t9Mn5t1FpLdhESY6oKY4gYTFpX4wO3sqGUa0Srjtbfj3szX0RnemmrVRUdULA==}
engines : {node : '>=10' }
globals@15.15.0 :
resolution : {integrity : sha512-7ACyT3wmyp3I61S4fG682L0VA2RGD9otkqGJIwNUMF1SWUombIIk+af1unuDYgMm082aHYwD+mzJvv9Iu8dsgg==}
engines : {node : '>=18' }
globals@17.6.0 :
resolution : {integrity : sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==}
engines : {node : '>=18' }
globalthis@1.0.4 :
resolution : {integrity : sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==}
engines : {node : '>= 0.4' }
globby@11.1.0 :
resolution : {integrity : sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==}
engines : {node : '>=10' }
globrex@0.1.2 :
resolution : {integrity : sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg==}
gopd@1.2.0 :
resolution : {integrity : sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
engines : {node : '>= 0.4' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
got@11.8.6 :
resolution : {integrity : sha512-6tfZ91bOr7bOXnK7PRDCGBLa1H4U080YHNaAQ2KsMGlLEzRbk44nsZF2E1IeRc3vtJHPVbKCYgdFbaGO2ljd8g==}
engines : {node : '>=10.19.0' }
2026-08-30 00:10:11 +03:00
graceful-fs@4.2.11 :
resolution : {integrity : sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
growly@1.3.0 :
resolution : {integrity : sha512-+xGQY0YyAWCnqy7Cd++hc2JqMYzlm0dG30Jd0beaA64sROr8C4nt8Yc9V5Ro3avlSUDTN0ulqP/VBKi1/lLygw==}
has-bigints@1.1.0 :
resolution : {integrity : sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==}
engines : {node : '>= 0.4' }
has-flag@4.0.0 :
resolution : {integrity : sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
engines : {node : '>=8' }
has-property-descriptors@1.0.2 :
resolution : {integrity : sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==}
has-proto@1.2.0 :
resolution : {integrity : sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ==}
engines : {node : '>= 0.4' }
has-symbols@1.1.0 :
resolution : {integrity : sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
engines : {node : '>= 0.4' }
has-tostringtag@1.0.2 :
resolution : {integrity : sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
engines : {node : '>= 0.4' }
has-yarn@2.1.0 :
resolution : {integrity : sha512-UqBRqi4ju7T+TqGNdqAO0PaSVGsDGJUBQvk9eUWNGRY1CFGDzYhLWoM7JQEemnlvVcv/YEmc2wNW8BC24EnUsw==}
engines : {node : '>=8' }
hasha@5.2.2 :
resolution : {integrity : sha512-Hrp5vIK/xr5SkeN2onO32H0MgNZ0f17HRNH39WfL0SYUNOTZ5Lz1TJ8Pajo/87dYGEFlLMm7mIc/k/s6Bvz9HQ==}
engines : {node : '>=8' }
hasown@2.0.4 :
resolution : {integrity : sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
engines : {node : '>= 0.4' }
hermes-estree@0.25.1 :
resolution : {integrity : sha512-0wUoCcLp+5Ev5pDW2OriHC2MJCbwLwuRx+gAqMTOkGKJJiBCLjtrvy4PWUGn6MIVefecRpzoOZ/UV6iGdOr+Cw==}
hermes-parser@0.25.1 :
resolution : {integrity : sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}
highlight.js@10.7.3 :
resolution : {integrity : sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==}
hookable@6.1.1 :
resolution : {integrity : sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ==}
hosted-git-info@2.8.9 :
resolution : {integrity : sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==}
html-escaper@2.0.2 :
resolution : {integrity : sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==}
http-cache-semantics@4.2.0 :
resolution : {integrity : sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==}
http-errors@2.0.1 :
resolution : {integrity : sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
engines : {node : '>= 0.8' }
http-proxy@1.18.1 :
resolution : {integrity : sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==}
engines : {node : '>=8.0.0' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
http2-wrapper@1.0.3 :
resolution : {integrity : sha512-V+23sDMr12Wnz7iTcDeJr3O6AIxlnvT/bmaAAAP/Xda35C90p9599p0F1eHR/N1KILWSoWVAiOMFjBBXaXSMxg==}
engines : {node : '>=10.19.0' }
2026-08-30 00:10:11 +03:00
human-signals@8.0.1 :
resolution : {integrity : sha512-eKCa6bwnJhvxj14kZk5NCPc6Hb6BdsU9DZcOnmQKSnO1VKrfV0zCvtttPZUsBvjmNDn8rpcJfpwSYnHBjc95MQ==}
engines : {node : '>=18.18.0' }
iconv-lite@0.7.2 :
resolution : {integrity : sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==}
engines : {node : '>=0.10.0' }
ieee754@1.2.1 :
resolution : {integrity : sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
ignore-by-default@2.1.0 :
resolution : {integrity : sha512-yiWd4GVmJp0Q6ghmM2B/V3oZGRmjrKLXvHR3TE1nfoXsmoggllfZUQe74EN0fJdPFZu2NIvNdrMMLm3OsV7Ohw==}
engines : {node : '>=10 <11 || >=12 <13 || >=14' }
ignore@5.3.2 :
resolution : {integrity : sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
engines : {node : '>= 4' }
ignore@7.0.5 :
resolution : {integrity : sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
engines : {node : '>= 4' }
import-lazy@2.1.0 :
resolution : {integrity : sha512-m7ZEHgtw69qOGw+jwxXkHlrlIPdTGkyh66zXZ1ajZbxkDBNjSY/LGbmjc7h0s2ELsUDTAhFr55TrPSSqJGPG0A==}
engines : {node : '>=4' }
import-local@3.2.0 :
resolution : {integrity : sha512-2SPlun1JUPWoM6t3F0dw0FkCF/jWY8kttcY4f599GLTSjh2OCuuhdTkJQsEcZzBqbXZGKMK2OqW1oZsjtf/gQA==}
engines : {node : '>=8' }
hasBin : true
import-without-cache@0.4.0 :
resolution : {integrity : sha512-NkJQA7oZ4YHQhd2+H3BoRFKF3d/XNsiKpHZCQEMH9pDX27hQQLsTyOocyRgaIVtf8gHX3Nt3LPkR4e5EdtPAGQ==}
engines : {node : ^22.18.0 || >=24.0.0}
imurmurhash@0.1.4 :
resolution : {integrity : sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
engines : {node : '>=0.8.19' }
indent-string@4.0.0 :
resolution : {integrity : sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==}
engines : {node : '>=8' }
inflight@1.0.6 :
resolution : {integrity : sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
deprecated : This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
inherits@2.0.4 :
resolution : {integrity : sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
ini@1.3.8 :
resolution : {integrity : sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==}
ini@2.0.0 :
resolution : {integrity : sha512-7PnF4oN3CvZF23ADhA5wRaYEQpJ8qygSkbtTXWBeXWXmEVRXK+1ITciHWwHhsjv1TmW0MgacIv6hEi5pX5NQdA==}
engines : {node : '>=10' }
internal-slot@1.1.0 :
resolution : {integrity : sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
engines : {node : '>= 0.4' }
ipaddr.js@1.9.1 :
resolution : {integrity : sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==}
engines : {node : '>= 0.10' }
irregular-plurals@3.5.0 :
resolution : {integrity : sha512-1ANGLZ+Nkv1ptFb2pa8oG8Lem4krflKuX/gINiHJHjJUKaJHk/SXk5x6K3J+39/p0h1RQ2saROclJJ+QLvETCQ==}
engines : {node : '>=8' }
is-array-buffer@3.0.5 :
resolution : {integrity : sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==}
engines : {node : '>= 0.4' }
is-arrayish@0.2.1 :
resolution : {integrity : sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==}
is-async-function@2.1.1 :
resolution : {integrity : sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ==}
engines : {node : '>= 0.4' }
is-bigint@1.1.0 :
resolution : {integrity : sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ==}
engines : {node : '>= 0.4' }
is-binary-path@2.1.0 :
resolution : {integrity : sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
engines : {node : '>=8' }
is-boolean-object@1.2.2 :
resolution : {integrity : sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==}
engines : {node : '>= 0.4' }
is-bun-module@2.0.0 :
resolution : {integrity : sha512-gNCGbnnnnFAUGKeZ9PdbyeGYJqewpmc2aKHUEMO5nQPWU9lOmv7jcmQIv+qHD8fXW6W7qfuCwX4rY9LNRjXrkQ==}
is-callable@1.2.7 :
resolution : {integrity : sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==}
engines : {node : '>= 0.4' }
is-ci@2.0.0 :
resolution : {integrity : sha512-YfJT7rkpQB0updsdHLGWrvhBJfcfzNNawYDNIyQXJz0IViGf75O8EBPKSdvw2rF+LGCsX4FZ8tcr3b19LcZq4w==}
hasBin : true
is-core-module@2.16.2 :
resolution : {integrity : sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==}
engines : {node : '>= 0.4' }
is-data-view@1.0.2 :
resolution : {integrity : sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw==}
engines : {node : '>= 0.4' }
is-date-object@1.1.0 :
resolution : {integrity : sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==}
engines : {node : '>= 0.4' }
is-docker@2.2.1 :
resolution : {integrity : sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==}
engines : {node : '>=8' }
hasBin : true
is-document.all@1.0.0 :
resolution : {integrity : sha512-+XSoyS05OdBbhFuELhgTCpFNHkpBOJqtsZfUFFpe5QTw+9Sjbh8zitxhQkYAo6wV7e1Vb8cAPvpCk9jGam/82g==}
engines : {node : '>= 0.4' }
is-error@2.2.2 :
resolution : {integrity : sha512-IOQqts/aHWbiisY5DuPJQ0gcbvaLFCa7fBa9xoLfxBZvQ+ZI/Zh9xoI7Gk+G64N0FdK4AbibytHht2tWgpJWLg==}
is-extglob@2.1.1 :
resolution : {integrity : sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
engines : {node : '>=0.10.0' }
is-finalizationregistry@1.1.1 :
resolution : {integrity : sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg==}
engines : {node : '>= 0.4' }
is-fullwidth-code-point@3.0.0 :
resolution : {integrity : sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
engines : {node : '>=8' }
is-generator-function@1.1.2 :
resolution : {integrity : sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==}
engines : {node : '>= 0.4' }
is-glob@4.0.3 :
resolution : {integrity : sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
engines : {node : '>=0.10.0' }
is-installed-globally@0.4.0 :
resolution : {integrity : sha512-iwGqO3J21aaSkC7jWnHP/difazwS7SFeIqxv6wEtLU8Y5KlzFTjyqcSIT0d8s4+dDhKytsk9PJZ2BkS5eZwQRQ==}
engines : {node : '>=10' }
is-interactive@1.0.0 :
resolution : {integrity : sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==}
engines : {node : '>=8' }
is-map@2.0.3 :
resolution : {integrity : sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==}
engines : {node : '>= 0.4' }
is-negative-zero@2.0.3 :
resolution : {integrity : sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw==}
engines : {node : '>= 0.4' }
is-npm@5.0.0 :
resolution : {integrity : sha512-WW/rQLOazUq+ST/bCAVBp/2oMERWLsR7OrKyt052dNDk4DHcDE0/7QSXITlmi+VBcV13DfIbysG3tZJm5RfdBA==}
engines : {node : '>=10' }
is-number-object@1.1.1 :
resolution : {integrity : sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw==}
engines : {node : '>= 0.4' }
is-number@7.0.0 :
resolution : {integrity : sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
engines : {node : '>=0.12.0' }
is-obj@2.0.0 :
resolution : {integrity : sha512-drqDG3cbczxxEJRoOXcOjtdp1J/lyp1mNn0xaznRs8+muBhgQcrnbspox5X5fOw0HnMnbfDzvnEMEtqDEJEo8w==}
engines : {node : '>=8' }
is-path-cwd@2.2.0 :
resolution : {integrity : sha512-w942bTcih8fdJPJmQHFzkS76NEP8Kzzvmw92cXsazb8intwLqPibPPdXf4ANdKV3rYMuuQYGIWtvz9JilB3NFQ==}
engines : {node : '>=6' }
is-path-inside@3.0.3 :
resolution : {integrity : sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==}
engines : {node : '>=8' }
is-plain-obj@4.1.0 :
resolution : {integrity : sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==}
engines : {node : '>=12' }
is-plain-object@2.0.4 :
resolution : {integrity : sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==}
engines : {node : '>=0.10.0' }
is-plain-object@5.0.0 :
resolution : {integrity : sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==}
engines : {node : '>=0.10.0' }
is-promise@4.0.0 :
resolution : {integrity : sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==}
is-regex@1.2.1 :
resolution : {integrity : sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==}
engines : {node : '>= 0.4' }
is-set@2.0.3 :
resolution : {integrity : sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg==}
engines : {node : '>= 0.4' }
is-shared-array-buffer@1.0.4 :
resolution : {integrity : sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==}
engines : {node : '>= 0.4' }
is-stream@2.0.1 :
resolution : {integrity : sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==}
engines : {node : '>=8' }
is-stream@4.0.1 :
resolution : {integrity : sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A==}
engines : {node : '>=18' }
is-string@1.1.1 :
resolution : {integrity : sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==}
engines : {node : '>= 0.4' }
is-symbol@1.1.1 :
resolution : {integrity : sha512-9gGx6GTtCQM73BgmHQXfDmLtfjjTUDSyoxTCbp5WtoixAhfgsDirWIcVQ/IHpvI5Vgd5i/J5F7B9cN/WlVbC/w==}
engines : {node : '>= 0.4' }
is-typed-array@1.1.15 :
resolution : {integrity : sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
engines : {node : '>= 0.4' }
is-typedarray@1.0.0 :
resolution : {integrity : sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==}
is-unicode-supported@0.1.0 :
resolution : {integrity : sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==}
engines : {node : '>=10' }
is-unicode-supported@2.1.0 :
resolution : {integrity : sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ==}
engines : {node : '>=18' }
is-weakmap@2.0.2 :
resolution : {integrity : sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==}
engines : {node : '>= 0.4' }
is-weakref@1.1.1 :
resolution : {integrity : sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew==}
engines : {node : '>= 0.4' }
is-weakset@2.0.4 :
resolution : {integrity : sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==}
engines : {node : '>= 0.4' }
is-windows@1.0.2 :
resolution : {integrity : sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==}
engines : {node : '>=0.10.0' }
is-wsl@2.2.0 :
resolution : {integrity : sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==}
engines : {node : '>=8' }
is-yarn-global@0.3.0 :
resolution : {integrity : sha512-VjSeb/lHmkoyd8ryPVIKvOCn4D1koMqY+vqyjjUfc3xyKtP4dYOxM44sZrnqQSzSds3xyOrUTLTC9LVCVgLngw==}
isarray@2.0.5 :
resolution : {integrity : sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
isexe@2.0.0 :
resolution : {integrity : sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
isobject@3.0.1 :
resolution : {integrity : sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg==}
engines : {node : '>=0.10.0' }
istanbul-lib-coverage@3.2.2 :
resolution : {integrity : sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==}
engines : {node : '>=8' }
istanbul-lib-hook@3.0.0 :
resolution : {integrity : sha512-Pt/uge1Q9s+5VAZ+pCo16TYMWPBIl+oaNIjgLQxcX0itS6ueeaA+pEfThZpH8WxhFgCiEb8sAJY6MdUKgiIWaQ==}
engines : {node : '>=8' }
istanbul-lib-instrument@6.0.3 :
resolution : {integrity : sha512-Vtgk7L/R2JHyyGW07spoFlB8/lpjiOLTjMdms6AFMraYt3BaJauod/NGrfnVG/y4Ix1JEuMRPDPEj2ua+zz1/Q==}
engines : {node : '>=10' }
istanbul-lib-processinfo@3.0.1 :
resolution : {integrity : sha512-s3mX05h5wGZeScG6XnOanygPh4SJu5ujMc9YbvpnLGXWy1cRiGbp0NdVcjHxgoZt3WfQppfBsa0y+gWdYJ2pGQ==}
engines : {node : 20 || >=22}
istanbul-lib-report@3.0.1 :
resolution : {integrity : sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==}
engines : {node : '>=10' }
istanbul-lib-source-maps@4.0.1 :
resolution : {integrity : sha512-n3s8EwkdFIJCG3BPKBYvskgXGoy88ARzvegkitk60NxRdwltLOTaH7CUiMRXvwYorl0Q712iEjcWB+fK/MrWVw==}
engines : {node : '>=10' }
istanbul-reports@3.2.0 :
resolution : {integrity : sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==}
engines : {node : '>=8' }
iterator.prototype@1.1.5 :
resolution : {integrity : sha512-H0dkQoCa3b2VEeKQBOxFph+JAbcrQdE7KC0UkqwpLmv2EC4P41QXP+rqo9wYodACiG5/WM5s9oDApTU8utwj9g==}
engines : {node : '>= 0.4' }
jackspeak@3.4.3 :
resolution : {integrity : sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==}
js-string-escape@1.0.1 :
resolution : {integrity : sha512-Smw4xcfIQ5LVjAOuJCvN/zIodzA/BBSsluuoSykP+lUvScIi4U6RJLfwHet5cxFnCswUjISV8oAXaqaJDY3chg==}
engines : {node : '>= 0.8' }
js-tokens@4.0.0 :
resolution : {integrity : sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
js-yaml@3.15.2 :
resolution : {integrity : sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==}
2026-08-30 00:10:11 +03:00
hasBin : true
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
js-yaml@4.3.2 :
resolution : {integrity : sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==}
2026-08-30 00:10:11 +03:00
hasBin : true
js2xmlparser@4.0.2 :
resolution : {integrity : sha512-6n4D8gLlLf1n5mNLQPRfViYzu9RATblzPEtm1SthMX1Pjao0r9YI9nw7ZIfRxQMERS87mcswrg+r/OYrPRX6jA==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
jsdoc@4.0.5 :
resolution : {integrity : sha512-P4C6MWP9yIlMiK8nwoZvxN84vb6MsnXcHuy7XzVOvQoCizWX5JFCBsWIIWKXBltpoRZXddUOVQmCTOZt9yDj9g==}
2026-08-30 00:10:11 +03:00
engines : {node : '>=12.0.0' }
hasBin : true
jsesc@3.1.0 :
resolution : {integrity : sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
engines : {node : '>=6' }
hasBin : true
json-buffer@3.0.1 :
resolution : {integrity : sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
json-parse-better-errors@1.0.2 :
resolution : {integrity : sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==}
json-parse-even-better-errors@2.3.1 :
resolution : {integrity : sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==}
json-schema-traverse@0.4.1 :
resolution : {integrity : sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
json-stable-stringify-without-jsonify@1.0.1 :
resolution : {integrity : sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
json5@1.0.2 :
resolution : {integrity : sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==}
hasBin : true
json5@2.2.3 :
resolution : {integrity : sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
engines : {node : '>=6' }
hasBin : true
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
jsonfile@6.2.1 :
resolution : {integrity : sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==}
2026-08-30 00:10:11 +03:00
jsx-ast-utils@3.3.5 :
resolution : {integrity : sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==}
engines : {node : '>=4.0' }
keyv@4.5.4 :
resolution : {integrity : sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
kind-of@6.0.3 :
resolution : {integrity : sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==}
engines : {node : '>=0.10.0' }
klaw@3.0.0 :
resolution : {integrity : sha512-0Fo5oir+O9jnXu5EefYbVK+mHMBeEVEy2cmctR1O1NECcCkPRreJKrS6Qt/j3KC2C148Dfo9i3pCmCMsdqGr0g==}
language-subtag-registry@0.3.23 :
resolution : {integrity : sha512-0K65Lea881pHotoGEa5gDlMxt3pctLi2RplBb7Ezh4rRdLEOtgi7n4EwK9lamnUCkKBqaeKRVebTq6BAxSkpXQ==}
language-tags@1.0.9 :
resolution : {integrity : sha512-MbjN408fEndfiQXbFQ1vnd+1NoLDsnQW41410oQBXiyXDMYH5z505juWa4KUE1LqxRC7DgOgZDbKLxHIwm27hA==}
engines : {node : '>=0.10' }
latest-version@5.1.0 :
resolution : {integrity : sha512-weT+r0kTkRQdCdYCNtkMwWXQTMEswKrFBkm4ckQOMVhhqhIMI1UT2hMj+1iigIhgSZm5gTmrRXBNoGUgaTY1xA==}
engines : {node : '>=8' }
lcov-parse@1.0.0 :
resolution : {integrity : sha512-aprLII/vPzuQvYZnDRU78Fns9I2Ag3gi4Ipga/hxnVMCZC8DnR2nI7XBqrPoywGfxqIx/DgarGvDJZAD3YBTgQ==}
hasBin : true
levn@0.4.1 :
resolution : {integrity : sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
engines : {node : '>= 0.8.0' }
lines-and-columns@1.2.4 :
resolution : {integrity : sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
linkify-it@5.0.2 :
resolution : {integrity : sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==}
2026-08-30 00:10:11 +03:00
load-json-file@5.3.0 :
resolution : {integrity : sha512-cJGP40Jc/VXUsp8/OrnyKyTZ1y6v/dphm3bioS+RrKXjK2BB6wHUd6JptZEFDGgGahMT+InnZO5i1Ei9mpC8Bw==}
engines : {node : '>=6' }
locate-path@3.0.0 :
resolution : {integrity : sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==}
engines : {node : '>=6' }
locate-path@5.0.0 :
resolution : {integrity : sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==}
engines : {node : '>=8' }
locate-path@6.0.0 :
resolution : {integrity : sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
engines : {node : '>=10' }
lodash.debounce@4.0.8 :
resolution : {integrity : sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==}
lodash.flattendeep@4.4.0 :
resolution : {integrity : sha512-uHaJFihxmJcEX3kT4I23ABqKKalJ/zDrDg0lsFtc1h+3uw49SIJ5beyhx5ExVRti3AvKoOJngIj7xz3oylPdWQ==}
lodash@4.18.1 :
resolution : {integrity : sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==}
log-symbols@4.1.0 :
resolution : {integrity : sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==}
engines : {node : '>=10' }
loose-envify@1.4.0 :
resolution : {integrity : sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
hasBin : true
lowercase-keys@2.0.0 :
resolution : {integrity : sha512-tqNXrS78oMOE73NMxK4EMLQsQowWf8jKooH9g7xPavRT706R6bkQJ6DY2Te7QukaZsulxa30wQ7bk0pm4XiHmA==}
engines : {node : '>=8' }
lru-cache@10.4.3 :
resolution : {integrity : sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
lru-cache@11.5.1 :
resolution : {integrity : sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==}
engines : {node : 20 || >=22}
lru-cache@5.1.1 :
resolution : {integrity : sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
make-dir@2.1.0 :
resolution : {integrity : sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==}
engines : {node : '>=6' }
make-dir@3.1.0 :
resolution : {integrity : sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==}
engines : {node : '>=8' }
make-dir@4.0.0 :
resolution : {integrity : sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==}
engines : {node : '>=10' }
map-age-cleaner@0.1.3 :
resolution : {integrity : sha512-bJzx6nMoP6PDLPBFmg7+xRKeFZvFboMrGlxmNj9ClvX53KrmvM5bXFXEWjbz4cz1AFn+jWJ9z/DJSz7hrs0w3w==}
engines : {node : '>=6' }
markdown-it-anchor@8.6.7 :
resolution : {integrity : sha512-FlCHFwNnutLgVTflOYHPW2pPcl2AACqVzExlkGQNsi4CJgqOHN7YTgDd4LuhgN1BFO3TS0vLAruV1Td6dwWPJA==}
peerDependencies :
'@types/markdown-it' : '*'
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
markdown-it : ^14.3.1
2026-08-30 00:10:11 +03:00
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
markdown-it@14.3.1 :
resolution : {integrity : sha512-4Ej49aYTDFIQ+uBkfX8GBvJGccoARxxPep+7aWTs55ozbjQJpW9M26Fe53vnGgvLeVzva/amzjQQaQu9w0vMhA==}
2026-08-30 00:10:11 +03:00
hasBin : true
marked-terminal@7.3.0 :
resolution : {integrity : sha512-t4rBvPsHc57uE/2nJOLmMbZCQ4tgAccAED3ngXQqW6g+TxA488JzJ+FK3lQkzBQOI1mRV/r/Kq+1ZlJ4D0owQw==}
engines : {node : '>=16.0.0' }
peerDependencies :
marked : '>=1 <16'
marked@4.3.0 :
resolution : {integrity : sha512-PRsaiG84bK+AMvxziE/lCFss8juXjNaWzVbN5tXAm4XjeaS9NAHhop+PjQxz2A9h8Q4M/xGmzP8vqNwy6JeK0A==}
engines : {node : '>= 12' }
hasBin : true
marked@9.1.6 :
resolution : {integrity : sha512-jcByLnIFkd5gSXZmjNvS1TlmRhCXZjIzHYlaGkPlLIekG55JDR2Z4va9tZwCiP+/RDERiNhMOFu01xd6O5ct1Q==}
engines : {node : '>= 16' }
hasBin : true
matcher@3.0.0 :
resolution : {integrity : sha512-OkeDaAZ/bQCxeFAozM55PKcKU0yJMPGifLwV4Qgjitu+5MoAfSQN4lsLJeXZ1b8w0x+/Emda6MZgXS1jvsapng==}
engines : {node : '>=10' }
math-intrinsics@1.1.0 :
resolution : {integrity : sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
engines : {node : '>= 0.4' }
md5-hex@3.0.1 :
resolution : {integrity : sha512-BUiRtTtV39LIJwinWBjqVsU9xhdnz7/i889V859IBFpuqGAj6LuOvHv5XLbgZ2R7ptJoJaEcxkv88/h25T7Ciw==}
engines : {node : '>=8' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
mdurl@2.1.0 :
resolution : {integrity : sha512-1+HBaOx0zi/dQWht8rNv9MYf9qqpqL/kxI0hXImU6Y547zM6Sni8BQibt7ifgMcYtQg41ao3Ivd6cnSM86inpg==}
2026-08-30 00:10:11 +03:00
media-typer@1.1.0 :
resolution : {integrity : sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==}
engines : {node : '>= 0.8' }
mem@8.1.1 :
resolution : {integrity : sha512-qFCFUDs7U3b8mBDPyz5EToEKoAkgCzqquIgi9nkkR9bixxOVOre+09lbuH7+9Kn2NFpm56M3GUWVbU2hQgdACA==}
engines : {node : '>=10' }
merge-descriptors@2.0.0 :
resolution : {integrity : sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==}
engines : {node : '>=18' }
merge2@1.4.1 :
resolution : {integrity : sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
engines : {node : '>= 8' }
micro-spelling-correcter@1.1.1 :
resolution : {integrity : sha512-lkJ3Rj/mtjlRcHk6YyCbvZhyWTOzdBvTHsxMmZSk5jxN1YyVSQ+JETAom55mdzfcyDrY/49Z7UCW760BK30crg==}
micromatch@4.0.8 :
resolution : {integrity : sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
engines : {node : '>=8.6' }
mime-db@1.52.0 :
resolution : {integrity : sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
engines : {node : '>= 0.6' }
mime-db@1.54.0 :
resolution : {integrity : sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==}
engines : {node : '>= 0.6' }
mime-types@2.1.35 :
resolution : {integrity : sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
engines : {node : '>= 0.6' }
mime-types@3.0.2 :
resolution : {integrity : sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==}
engines : {node : '>=18' }
mimic-fn@2.1.0 :
resolution : {integrity : sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==}
engines : {node : '>=6' }
mimic-fn@3.1.0 :
resolution : {integrity : sha512-Ysbi9uYW9hFyfrThdDEQuykN4Ey6BuwPD2kpI5ES/nFTDn/98yxYNLZJcgUAKPT/mcrLLKaGzJR9YVxJrIdASQ==}
engines : {node : '>=8' }
mimic-response@1.0.1 :
resolution : {integrity : sha512-j5EctnkH7amfV/q5Hgmoal1g2QHFJRraOtmx0JpIqkxhBhI/lJSl1nMpQ45hVarwNETOoWEimndZ4QK0RHxuxQ==}
engines : {node : '>=4' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
mimic-response@3.1.0 :
resolution : {integrity : sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==}
engines : {node : '>=10' }
2026-08-30 00:10:11 +03:00
minimatch@10.2.5 :
resolution : {integrity : sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
engines : {node : 18 || 20 || >=22}
minimatch@3.1.5 :
resolution : {integrity : sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
minimatch@9.0.9 :
resolution : {integrity : sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==}
engines : {node : '>=16 || 14 >=14.17' }
minimist@1.2.8 :
resolution : {integrity : sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
minipass@7.1.3 :
resolution : {integrity : sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==}
engines : {node : '>=16 || 14 >=14.17' }
mkdirp@1.0.4 :
resolution : {integrity : sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==}
engines : {node : '>=10' }
hasBin : true
mkdirp@3.0.1 :
resolution : {integrity : sha512-+NsyUUAZDmo6YVHzL/stxSu3t9YS1iljliy3BSDrXJ/dkn1KYdmtZODGGjLcc9XLgVVpH4KshHB8XmZgMhaBXg==}
engines : {node : '>=10' }
hasBin : true
mri@1.2.0 :
resolution : {integrity : sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==}
engines : {node : '>=4' }
ms@2.0.0 :
resolution : {integrity : sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==}
ms@2.1.3 :
resolution : {integrity : sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
mustache@4.2.0 :
resolution : {integrity : sha512-71ippSywq5Yb7/tVYyGbkBggbU8H3u5Rz56fH60jGFgr8uHwxs+aSKeqmluIVzM0m0kB7xQjKS6qPfd0b2ZoqQ==}
hasBin : true
mz@2.7.0 :
resolution : {integrity : sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
napi-postinstall@0.3.4 :
resolution : {integrity : sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==}
engines : {node : ^12.20.0 || ^14.18.0 || >=16.0.0}
hasBin : true
natural-compare@1.4.0 :
resolution : {integrity : sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
negotiator@0.6.3 :
resolution : {integrity : sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==}
engines : {node : '>= 0.6' }
negotiator@0.6.4 :
resolution : {integrity : sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==}
engines : {node : '>= 0.6' }
negotiator@1.0.0 :
resolution : {integrity : sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==}
engines : {node : '>= 0.6' }
node-emoji@2.2.0 :
resolution : {integrity : sha512-Z3lTE9pLaJF47NyMhd4ww1yFTAP8YhYI8SleJiHzM46Fgpm5cnNzSl9XfzFNqbaz+VlJrIj3fXQ4DeN1Rjm6cw==}
engines : {node : '>=18' }
node-exports-info@1.6.0 :
resolution : {integrity : sha512-pyFS63ptit/P5WqUkt+UUfe+4oevH+bFeIiPPdfb0pFeYEu/1ELnJu5l+5EcTKYL5M7zaAa7S8ddywgXypqKCw==}
engines : {node : '>= 0.4' }
node-preload@0.2.1 :
resolution : {integrity : sha512-RM5oyBy45cLEoHqCeh+MNuFAxO0vTFBLskvQbOKnEE7YTTSN4tbN8QWDIPQ6L+WvKsB/qLEGpYe2ZZ9d4W9OIQ==}
engines : {node : '>=8' }
node-releases@2.0.47 :
resolution : {integrity : sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og==}
engines : {node : '>=18' }
normalize-package-data@2.5.0 :
resolution : {integrity : sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==}
normalize-path@3.0.0 :
resolution : {integrity : sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
engines : {node : '>=0.10.0' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
normalize-url@6.1.0 :
resolution : {integrity : sha512-DlL+XwOy3NxAQ8xuC0okPgK46iuVNAK01YN7RueYBqqFeGsBjV9XmCAzAdgt+667bCl5kPh9EqKKDwnaPG1I7A==}
engines : {node : '>=10' }
2026-08-30 00:10:11 +03:00
npm-run-path@6.0.0 :
resolution : {integrity : sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
engines : {node : '>=18' }
nyc@18.0.0 :
resolution : {integrity : sha512-G5UyHinFkB1BxqGTrmZdB6uIYH0+v7ZnVssuflUDi+J+RhKWyAhRT1RCehBSI6jLFLuUUgFDyLt49mUtdO1XeQ==}
engines : {node : 20 || >=22}
hasBin : true
object-assign@4.1.1 :
resolution : {integrity : sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
engines : {node : '>=0.10.0' }
object-inspect@1.13.4 :
resolution : {integrity : sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
engines : {node : '>= 0.4' }
object-keys@1.1.1 :
resolution : {integrity : sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==}
engines : {node : '>= 0.4' }
object.assign@4.1.7 :
resolution : {integrity : sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw==}
engines : {node : '>= 0.4' }
object.entries@1.1.9 :
resolution : {integrity : sha512-8u/hfXFRBD1O0hPUjioLhoWFHRmt6tKA4/vZPyckBr18l1KE9uHrFaFaUi8MDRTpi4uak2goyPTSNJLXX2k2Hw==}
engines : {node : '>= 0.4' }
object.fromentries@2.0.8 :
resolution : {integrity : sha512-k6E21FzySsSK5a21KRADBd/NGneRegFO5pLHfdQLpRDETUNJueLXs3WCzyQ3tFRDYgbq3KHGXfTbi2bs8WQ6rQ==}
engines : {node : '>= 0.4' }
object.groupby@1.0.3 :
resolution : {integrity : sha512-+Lhy3TQTuzXI5hevh8sBGqbmurHbbIjAi0Z4S63nthVLmLxfbj4T54a4CfZrXIrt9iP4mVAPYMo/v99taj3wjQ==}
engines : {node : '>= 0.4' }
object.values@1.2.1 :
resolution : {integrity : sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==}
engines : {node : '>= 0.4' }
obug@2.1.4 :
resolution : {integrity : sha512-4a+OsYv9UktOJKE+l1A4OufDgdRF9PifWj+tJnHURo/P+WOxpG4GzUFL9qCalmWauao6ogiG+QvnCovwPoyAWA==}
engines : {node : '>=12.20.0' }
on-finished@2.4.1 :
resolution : {integrity : sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==}
engines : {node : '>= 0.8' }
on-headers@1.1.0 :
resolution : {integrity : sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==}
engines : {node : '>= 0.8' }
once@1.4.0 :
resolution : {integrity : sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
onetime@5.1.2 :
resolution : {integrity : sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==}
engines : {node : '>=6' }
optionator@0.9.4 :
resolution : {integrity : sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
engines : {node : '>= 0.8.0' }
ora@5.4.1 :
resolution : {integrity : sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==}
engines : {node : '>=10' }
own-keys@1.0.1 :
resolution : {integrity : sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==}
engines : {node : '>= 0.4' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
p-cancelable@2.1.1 :
resolution : {integrity : sha512-BZOr3nRQHOntUjTrH8+Lh54smKHoHyur8We1V8DSMVrl5A2malOOwuJRnKRDjSnkoeBh4at6BwEnb5I7Jl31wg==}
engines : {node : '>=8' }
2026-08-30 00:10:11 +03:00
p-defer@1.0.0 :
resolution : {integrity : sha512-wB3wfAxZpk2AzOfUMJNL+d36xothRSyj8EXOa4f6GMqYDN9BJaaSISbsk+wS9abmnebVw95C2Kb5t85UmpCxuw==}
engines : {node : '>=4' }
p-event@4.2.0 :
resolution : {integrity : sha512-KXatOjCRXXkSePPb1Nbi0p0m+gQAwdlbhi4wQKJPI1HsMQS9g+Sqp2o+QHziPr7eYJyOZet836KoHEVM1mwOrQ==}
engines : {node : '>=8' }
p-finally@1.0.0 :
resolution : {integrity : sha512-LICb2p9CB7FS+0eR1oqWnHhp0FljGLZCWBE9aix0Uye9W8LTQPwMTYVGWQWIw9RdQiDg4+epXQODwIYJtSJaow==}
engines : {node : '>=4' }
p-limit@2.3.0 :
resolution : {integrity : sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==}
engines : {node : '>=6' }
p-limit@3.1.0 :
resolution : {integrity : sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
engines : {node : '>=10' }
p-locate@3.0.0 :
resolution : {integrity : sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==}
engines : {node : '>=6' }
p-locate@4.1.0 :
resolution : {integrity : sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==}
engines : {node : '>=8' }
p-locate@5.0.0 :
resolution : {integrity : sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
engines : {node : '>=10' }
p-map@3.0.0 :
resolution : {integrity : sha512-d3qXVTF/s+W+CdJ5A29wywV2n8CQQYahlgz2bFiA+4eVNJbHJodPZ+/gXwPGh0bOqA+j8S+6+ckmvLGPk1QpxQ==}
engines : {node : '>=8' }
p-map@4.0.0 :
resolution : {integrity : sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==}
engines : {node : '>=10' }
p-timeout@3.2.0 :
resolution : {integrity : sha512-rhIwUycgwwKcP9yTOOFK/AKsAopjjCakVqLHePO3CC6Mir1Z99xT+R63jZxAT5lFZLa2inS5h+ZS2GvR99/FBg==}
engines : {node : '>=8' }
p-try@2.2.0 :
resolution : {integrity : sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==}
engines : {node : '>=6' }
package-hash@4.0.0 :
resolution : {integrity : sha512-whdkPIooSu/bASggZ96BWVvZTRMOFxnyUG5PnTSGKoJE2gd5mbVNmR2Nj20QFzxYYgAXpoqC+AiXzl+UMRh7zQ==}
engines : {node : '>=8' }
package-json-from-dist@1.0.1 :
resolution : {integrity : sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
package-json@6.5.0 :
resolution : {integrity : sha512-k3bdm2n25tkyxcjSKzB5x8kfVxlMdgsbPr0GkZcwHsLpba6cBjqCt1KlcChKEvxHIcTB1FVMuwoijZ26xex5MQ==}
engines : {node : '>=8' }
package-manager-detector@1.8.0 :
resolution : {integrity : sha512-yQA4H19AmPEoMUeavPMDIe1higySl/gH/yaQrkT/s07Qp+7pp2hYz30N3z2l5BkjVkF9Ow6o0wjJamm2y7Sn0A==}
parse-json@4.0.0 :
resolution : {integrity : sha512-aOIos8bujGN93/8Ox/jPLh7RwVnPEysynVFE+fQZyg6jKELEHwzgKdLRFHUgXJL6kylijVSBC4BvN9OmsB48Rw==}
engines : {node : '>=4' }
parse-json@5.2.0 :
resolution : {integrity : sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
engines : {node : '>=8' }
parse-ms@2.1.0 :
resolution : {integrity : sha512-kHt7kzLoS9VBZfUsiKjv43mr91ea+U05EyKkEtqp7vNbHxmaVuEqN7XxeEVnGrMtYOAxGrDElSi96K7EgO1zCA==}
engines : {node : '>=6' }
parse-ms@4.0.0 :
resolution : {integrity : sha512-TXfryirbmq34y8QBwgqCVLi+8oA3oWx2eAnSn62ITyEhEYaWRlVZ2DvMM9eZbMs/RfxPu/PK/aBLyGj4IrqMHw==}
engines : {node : '>=18' }
parse5-htmlparser2-tree-adapter@6.0.1 :
resolution : {integrity : sha512-qPuWvbLgvDGilKc5BoicRovlT4MtYT6JfJyBOMDsKoiT+GiuP5qyrPCnR9HcPECIJJmZh5jRndyNThnhhb/vlA==}
parse5@5.1.1 :
resolution : {integrity : sha512-ugq4DFI0Ptb+WWjAdOK16+u/nHfiIrcE+sh8kZMaM0WllQKLI9rOUq6c2b7cwPkXdzfQESqvoqK6ug7U/Yyzug==}
parse5@6.0.1 :
resolution : {integrity : sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw==}
parseurl@1.3.3 :
resolution : {integrity : sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==}
engines : {node : '>= 0.8' }
path-exists@3.0.0 :
resolution : {integrity : sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ==}
engines : {node : '>=4' }
path-exists@4.0.0 :
resolution : {integrity : sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
engines : {node : '>=8' }
path-is-absolute@1.0.1 :
resolution : {integrity : sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
engines : {node : '>=0.10.0' }
path-key@3.1.1 :
resolution : {integrity : sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
engines : {node : '>=8' }
path-key@4.0.0 :
resolution : {integrity : sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==}
engines : {node : '>=12' }
path-parse@1.0.7 :
resolution : {integrity : sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
path-scurry@1.11.1 :
resolution : {integrity : sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
engines : {node : '>=16 || 14 >=14.18' }
path-scurry@2.0.2 :
resolution : {integrity : sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==}
engines : {node : 18 || 20 || >=22}
path-to-regexp@8.4.2 :
resolution : {integrity : sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==}
path-type@4.0.0 :
resolution : {integrity : sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==}
engines : {node : '>=8' }
picocolors@1.1.1 :
resolution : {integrity : sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
picomatch@2.3.2 :
resolution : {integrity : sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
engines : {node : '>=8.6' }
picomatch@4.0.5 :
resolution : {integrity : sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
engines : {node : '>=12' }
pify@4.0.1 :
resolution : {integrity : sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==}
engines : {node : '>=6' }
pirates@4.0.7 :
resolution : {integrity : sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
engines : {node : '>= 6' }
pkg-conf@3.1.0 :
resolution : {integrity : sha512-m0OTbR/5VPNPqO1ph6Fqbj7Hv6QU7gR/tQW40ZqrL1rjgCU85W6C1bJn0BItuJqnR98PWzw7Z8hHeChD1WrgdQ==}
engines : {node : '>=6' }
pkg-dir@3.0.0 :
resolution : {integrity : sha512-/E57AYkoeQ25qkxMj5PBOVgF8Kiu/h7cYS30Z5+R7WaiCCBfLq58ZI/dSeaEKb9WVJV5n/03QwrN3IeWIFllvw==}
engines : {node : '>=6' }
pkg-dir@4.2.0 :
resolution : {integrity : sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==}
engines : {node : '>=8' }
plur@4.0.0 :
resolution : {integrity : sha512-4UGewrYgqDFw9vV6zNV+ADmPAUAfJPKtGvb/VdpQAx25X5f3xXdGdyOEVFwkl8Hl/tl7+xbeHqSEM+D5/TirUg==}
engines : {node : '>=10' }
possible-typed-array-names@1.1.0 :
resolution : {integrity : sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
engines : {node : '>= 0.4' }
prelude-ls@1.2.1 :
resolution : {integrity : sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
engines : {node : '>= 0.8.0' }
pretty-ms@7.0.1 :
resolution : {integrity : sha512-973driJZvxiGOQ5ONsFhOF/DtzPMOMtgC11kCpUrPGMTgqp2q/1gwzCquocrN33is0VZ5GFHXZYMM9l6h67v2Q==}
engines : {node : '>=10' }
pretty-ms@9.3.0 :
resolution : {integrity : sha512-gjVS5hOP+M3wMm5nmNOucbIrqudzs9v/57bWRHQWLYklXqoXKrVfYW2W9+glfGsqtPgpiz5WwyEEB+ksXIx3gQ==}
engines : {node : '>=18' }
printf@0.6.1 :
resolution : {integrity : sha512-is0ctgGdPJ5951KulgfzvHGwJtZ5ck8l042vRkV6jrkpBzTmb/lueTqguWHy2JfVA+RY6gFVlaZgUS0j7S/dsw==}
engines : {node : '>= 0.9.0' }
proc-log@6.1.0 :
resolution : {integrity : sha512-iG+GYldRf2BQ0UDUAd6JQ/RwzaQy6mXmsk/IzlYyal4A4SNFw54MeH4/tLkF4I5WoWG9SQwuqWzS99jaFQHBuQ==}
engines : {node : ^20.17.0 || >=22.9.0}
process-on-spawn@1.1.0 :
resolution : {integrity : sha512-JOnOPQ/8TZgjs1JIH/m9ni7FfimjNa/PRx7y/Wb5qdItsnhO0jE4AT7fC0HjC28DUQWDr50dwSYZLdRMlqDq3Q==}
engines : {node : '>=8' }
prop-types@15.8.1 :
resolution : {integrity : sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==}
proxy-addr@2.0.7 :
resolution : {integrity : sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
engines : {node : '>= 0.10' }
publint@0.3.22 :
resolution : {integrity : sha512-6Z/scsr5CA7APdwyF35EY88CqgDj1textWuY788DVTJYPCWVv/Wn9G6KmLnrVRnStgYcahqN4wCDLZGSbQJ69w==}
engines : {node : '>=18' }
hasBin : true
pump@3.0.4 :
resolution : {integrity : sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
punycode.js@2.3.1 :
resolution : {integrity : sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA==}
engines : {node : '>=6' }
2026-08-30 00:10:11 +03:00
punycode@2.3.1 :
resolution : {integrity : sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
engines : {node : '>=6' }
pupa@2.1.1 :
resolution : {integrity : sha512-l1jNAspIBSFqbT+y+5FosojNpVpF94nlI+wDUpqP9enwOTfHx9f0gh5nB96vl+6yTpsJsypeNrwfzPrKuHB41A==}
engines : {node : '>=8' }
qs@6.15.2 :
resolution : {integrity : sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==}
engines : {node : '>=0.6' }
quansync@1.0.0 :
resolution : {integrity : sha512-5xZacEEufv3HSTPQuchrvV6soaiACMFnq1H8wkVioctoH3TRha9Sz66lOxRwPK/qZj7HPiSveih9yAyh98gvqA==}
queue-microtask@1.2.3 :
resolution : {integrity : sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
quick-lru@5.1.1 :
resolution : {integrity : sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==}
engines : {node : '>=10' }
2026-08-30 00:10:11 +03:00
range-parser@1.2.1 :
resolution : {integrity : sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==}
engines : {node : '>= 0.6' }
raw-body@3.0.2 :
resolution : {integrity : sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==}
engines : {node : '>= 0.10' }
rc@1.2.8 :
resolution : {integrity : sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==}
hasBin : true
react-is@16.13.1 :
resolution : {integrity : sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==}
read-pkg@5.2.0 :
resolution : {integrity : sha512-Ug69mNOpfvKDAc2Q8DRpMjjzdtrnv9HcSMX+4VsZxD1aZ6ZzrIE7rlzXBtWTyhULSMKg076AW6WR5iZpD0JiOg==}
engines : {node : '>=8' }
readable-stream@3.6.2 :
resolution : {integrity : sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
engines : {node : '>= 6' }
readdirp@3.6.0 :
resolution : {integrity : sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
engines : {node : '>=8.10.0' }
readdirp@5.0.0 :
resolution : {integrity : sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==}
engines : {node : '>= 20.19.0' }
reflect.getprototypeof@1.0.10 :
resolution : {integrity : sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==}
engines : {node : '>= 0.4' }
regenerate-unicode-properties@10.2.2 :
resolution : {integrity : sha512-m03P+zhBeQd1RGnYxrGyDAPpWX/epKirLrp8e3qevZdVkKtnCrjjWczIbYc8+xd6vcTStVlqfycTx1KR4LOr0g==}
engines : {node : '>=4' }
regenerate@1.4.2 :
resolution : {integrity : sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A==}
regenerator-runtime@0.14.1 :
resolution : {integrity : sha512-dYnhHh0nJoMfnkZs6GmmhFknAGRrLznOu5nc9ML+EJxGvrx6H7teuevqVqCuPcPK//3eDrrjQhehXVx9cnkGdw==}
regexp.prototype.flags@1.5.4 :
resolution : {integrity : sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
engines : {node : '>= 0.4' }
regexpu-core@6.4.0 :
resolution : {integrity : sha512-0ghuzq67LI9bLXpOX/ISfve/Mq33a4aFRzoQYhnnok1JOFpmE/A2TBGkNVenOGEeSBCjIiWcc6MVOG5HEQv0sA==}
engines : {node : '>=4' }
registry-auth-token@4.2.2 :
resolution : {integrity : sha512-PC5ZysNb42zpFME6D/XlIgtNGdTl8bBOCw90xQLVMpzuuubJKYDWFAEuUNc+Cn8Z8724tg2SDhDRrkVEsqfDMg==}
engines : {node : '>=6.0.0' }
registry-url@5.1.0 :
resolution : {integrity : sha512-8acYXXTI0AkQv6RAOjE3vOaIXZkT9wo4LOFbBKYQEEnnMNBpKqdUrI6S4NT0KPIo/WVvJ5tE/X5LF/TQUf0ekw==}
engines : {node : '>=8' }
regjsgen@0.8.0 :
resolution : {integrity : sha512-RvwtGe3d7LvWiDQXeQw8p5asZUmfU1G/l6WbUXeHta7Y2PEIvBTwH6E2EfmYUK8pxcxEdEmaomqyp0vZZ7C+3Q==}
regjsparser@0.13.1 :
resolution : {integrity : sha512-dLsljMd9sqwRkby8zhO1gSg3PnJIBFid8f4CQj/sXx+7cKx+E7u0PKhZ+U4wmhx7EfmtvnA318oVaIkAB1lRJw==}
hasBin : true
release-zalgo@1.0.0 :
resolution : {integrity : sha512-gUAyHVHPPC5wdqX/LG4LWtRYtgjxyX78oanFNTMMyFEfOqdC54s3eE82imuWKbOeqYht2CrNf64Qb8vgmmtZGA==}
engines : {node : '>=4' }
require-directory@2.1.1 :
resolution : {integrity : sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==}
engines : {node : '>=0.10.0' }
require-main-filename@2.0.0 :
resolution : {integrity : sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==}
requires-port@1.0.0 :
resolution : {integrity : sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==}
requizzle@0.2.4 :
resolution : {integrity : sha512-JRrFk1D4OQ4SqovXOgdav+K8EAhSB/LJZqCz8tbX0KObcdeM15Ss59ozWMBWmmINMagCwmqn4ZNryUGpBsl6Jw==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
resolve-alpn@1.2.1 :
resolution : {integrity : sha512-0a1F4l73/ZFZOakJnQ3FvkJ2+gSTQWz/r2KE5OdDY0TxPm5h4GkqkWWfM47T7HsbnOtcJVEF4epCVy6u7Q3K+g==}
2026-08-30 00:10:11 +03:00
resolve-cwd@3.0.0 :
resolution : {integrity : sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==}
engines : {node : '>=8' }
resolve-from@5.0.0 :
resolution : {integrity : sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==}
engines : {node : '>=8' }
resolve-pkg-maps@1.0.0 :
resolution : {integrity : sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
resolve@1.22.12 :
resolution : {integrity : sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==}
engines : {node : '>= 0.4' }
hasBin : true
resolve@2.0.0-next.7 :
resolution : {integrity : sha512-tqt+NBWwyaMgw3zDsnygx4CByWjQEJHOPMdslYhppaQSJUtL/D4JO9CcBBlhPoI8lz9oJIDXkwXfhF4aWqP8xQ==}
engines : {node : '>= 0.4' }
hasBin : true
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
responselike@2.0.1 :
resolution : {integrity : sha512-4gl03wn3hj1HP3yzgdI7d3lCkF95F21Pz4BPGvKHinyQzALR5CapwC8yIi0Rh58DEMQ/SguC03wFj2k0M/mHhw==}
2026-08-30 00:10:11 +03:00
restore-cursor@3.1.0 :
resolution : {integrity : sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==}
engines : {node : '>=8' }
reusify@1.1.0 :
resolution : {integrity : sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
engines : {iojs: '>=1.0.0', node : '>=0.10.0' }
rimraf@3.0.2 :
resolution : {integrity : sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==}
deprecated : Rimraf versions prior to v4 are no longer supported
hasBin : true
rimraf@6.1.3 :
resolution : {integrity : sha512-LKg+Cr2ZF61fkcaK1UdkH2yEBBKnYjTyWzTJT6KNPcSPaiT7HSdhtMXQuN5wkTX0Xu72KQ1l8S42rlmexS2hSA==}
engines : {node : 20 || >=22}
hasBin : true
rolldown-plugin-dts@0.27.13 :
resolution : {integrity : sha512-DeVZJbbB0ajp5q6vABqC8ZCJzxftlxbiV60Bk96GFdQaysGVpgTTVjQu0lUt4Lb+aRCtejfOixtQKDRol7IuVQ==}
engines : {node : ^22.18.0 || >=24.11.0}
peerDependencies :
'@typescript/native-preview' : '*'
'@volar/typescript' : ~2.4.0
rolldown : ^1.0.0
typescript : ^5.0.0 || ^6.0.0 || ~7.0.0
vue-tsc : ~3.2.0 || ~3.3.0
peerDependenciesMeta :
'@typescript/native-preview' :
optional : true
'@volar/typescript' :
optional : true
typescript :
optional : true
vue-tsc :
optional : true
rolldown@1.2.0 :
resolution : {integrity : sha512-u7tgm5l4Yw1iTqUL4EcYOAt7fFvCgQMLeidrnD4GALlC6aOznCjezYajgxeyKw27u0Q5N7fwgCzjVyPIWzwuBA==}
engines : {node : ^20.19.0 || >=22.12.0}
hasBin : true
router@2.2.0 :
resolution : {integrity : sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==}
engines : {node : '>= 18' }
run-parallel@1.2.0 :
resolution : {integrity : sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
sade@1.8.1 :
resolution : {integrity : sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A==}
engines : {node : '>=6' }
safe-array-concat@1.1.4 :
resolution : {integrity : sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg==}
engines : {node : '>=0.4' }
safe-buffer@5.2.1 :
resolution : {integrity : sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
safe-push-apply@1.0.0 :
resolution : {integrity : sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==}
engines : {node : '>= 0.4' }
safe-regex-test@1.1.0 :
resolution : {integrity : sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==}
engines : {node : '>= 0.4' }
safer-buffer@2.1.2 :
resolution : {integrity : sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
semver-diff@3.1.1 :
resolution : {integrity : sha512-GX0Ix/CJcHyB8c4ykpHGIAvLyOwOobtM/8d+TQkAd81/bEjgPHrfba41Vpesr7jX/t8Uh+R3EX9eAS5be+jQYg==}
engines : {node : '>=8' }
semver@5.7.2 :
resolution : {integrity : sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==}
hasBin : true
semver@6.3.1 :
resolution : {integrity : sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
hasBin : true
semver@7.8.5 :
resolution : {integrity : sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
engines : {node : '>=10' }
hasBin : true
send@1.2.1 :
resolution : {integrity : sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==}
engines : {node : '>= 18' }
serialize-error@7.0.1 :
resolution : {integrity : sha512-8I8TjW5KMOKsZQTvoxjuSIa7foAwPWGOts+6o7sgjz41/qMD9VQHEDxi6PBvK2l0MXUmqZyNpUK+T2tQaaElvw==}
engines : {node : '>=10' }
serve-static@2.2.1 :
resolution : {integrity : sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==}
engines : {node : '>= 18' }
set-blocking@2.0.0 :
resolution : {integrity : sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==}
set-function-length@1.2.2 :
resolution : {integrity : sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
engines : {node : '>= 0.4' }
set-function-name@2.0.2 :
resolution : {integrity : sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==}
engines : {node : '>= 0.4' }
set-proto@1.0.0 :
resolution : {integrity : sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==}
engines : {node : '>= 0.4' }
setprototypeof@1.2.0 :
resolution : {integrity : sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==}
shallow-clone@3.0.1 :
resolution : {integrity : sha512-/6KqX+GVUdqPuPPd2LxDDxzX6CAbjJehAAOKlNpqqUpAqPM6HeL8f+o3a+JsyGjn2lv0WY8UsTgUJjU9Ok55NA==}
engines : {node : '>=8' }
shebang-command@2.0.0 :
resolution : {integrity : sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
engines : {node : '>=8' }
shebang-regex@3.0.0 :
resolution : {integrity : sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
engines : {node : '>=8' }
shellwords@0.1.1 :
resolution : {integrity : sha512-vFwSUfQvqybiICwZY5+DAWIPLKsWO31Q91JSKl3UYv+K5c2QRPzn0qzec6QPu1Qc9eHYItiP3NdJqNVqetYAww==}
side-channel-list@1.0.1 :
resolution : {integrity : sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
engines : {node : '>= 0.4' }
side-channel-map@1.0.1 :
resolution : {integrity : sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
engines : {node : '>= 0.4' }
side-channel-weakmap@1.0.2 :
resolution : {integrity : sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
engines : {node : '>= 0.4' }
side-channel@1.1.1 :
resolution : {integrity : sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
engines : {node : '>= 0.4' }
signal-exit@3.0.7 :
resolution : {integrity : sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==}
signal-exit@4.1.0 :
resolution : {integrity : sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
engines : {node : '>=14' }
sinon@22.0.0 :
resolution : {integrity : sha512-sq/6DpdXOrLyfbKlXLg/Usc7xu8YXPeLkOFZRvA3bNUSA2lhbrZ06yuXbH1fkzBPCbz9O10+7hznzUsjaYNm0Q==}
skin-tone@2.0.0 :
resolution : {integrity : sha512-kUMbT1oBJCpgrnKoSr0o6wPtvRWT9W9UKvGLwfJYO2WuahZRHOpEyL1ckyMGgMWh0UdpmaoFqKKD29WTomNEGA==}
engines : {node : '>=8' }
slash@2.0.0 :
resolution : {integrity : sha512-ZYKh3Wh2z1PpEXWr0MpSBZ0V6mZHAQfYevttO11c51CaWjGTaadiKZ+wVt1PbMlDV5qhMFslpZCemhwOK7C89A==}
engines : {node : '>=6' }
slash@3.0.0 :
resolution : {integrity : sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
engines : {node : '>=8' }
slice-ansi@3.0.0 :
resolution : {integrity : sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==}
engines : {node : '>=8' }
socket.io-adapter@2.5.7 :
resolution : {integrity : sha512-e0LyK91f3cUxTmv95/KzoLg47+zF+s/sbxRGDNsyG4dmIP8ZSX8ax6byOxfJXeNNtS/8AZlfD+uP7gBeR7DLlg==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
socket.io-parser@4.2.7 :
resolution : {integrity : sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==}
2026-08-30 00:10:11 +03:00
engines : {node : '>=10.0.0' }
socket.io@4.8.3 :
resolution : {integrity : sha512-2Dd78bqzzjE6KPkD5fHZmDAKRNe3J15q+YHDrIsy9WEkqttc7GY+kT9OBLSMaPbQaEd0x1BjcmtMtXkfpc+T5A==}
engines : {node : '>=10.2.0' }
source-map-support@0.5.21 :
resolution : {integrity : sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==}
source-map@0.6.1 :
resolution : {integrity : sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==}
engines : {node : '>=0.10.0' }
spawn-args@0.2.0 :
resolution : {integrity : sha512-73BoniQDcRWgnLAf/suKH6V5H54gd1KLzwYN9FB6J/evqTV33htH9xwV/4BHek+++jzxpVlZQKKZkqstPQPmQg==}
spawn-wrap@3.0.0 :
resolution : {integrity : sha512-z+s5vv4KzFPJVddGab0xX2n7kQPGMdNUX5l9T8EJqsXdKTWpcxmAqWHpsgHEXoC1taGBCc7b79bi62M5kdbrxQ==}
engines : {node : '>=8' }
spdx-correct@3.2.0 :
resolution : {integrity : sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==}
spdx-exceptions@2.5.0 :
resolution : {integrity : sha512-PiU42r+xO4UbUS1buo3LPJkjlO7430Xn5SVAhdpzzsPHsjbYVflnnFdATgabnLude+Cqu25p6N+g2lw/PFsa4w==}
spdx-expression-parse@3.0.1 :
resolution : {integrity : sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==}
spdx-license-ids@3.0.23 :
resolution : {integrity : sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==}
sprintf-js@1.0.3 :
resolution : {integrity : sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
stable-hash-x@0.2.0 :
resolution : {integrity : sha512-o3yWv49B/o4QZk5ZcsALc6t0+eCelPc44zZsLtCQnZPDwFpDYSWcDnrv2TtMmMbQ7uKo3J0HTURCqckw23czNQ==}
engines : {node : '>=12.0.0' }
stack-utils@2.0.6 :
resolution : {integrity : sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==}
engines : {node : '>=10' }
statuses@2.0.2 :
resolution : {integrity : sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
engines : {node : '>= 0.8' }
stop-iteration-iterator@1.1.0 :
resolution : {integrity : sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
engines : {node : '>= 0.4' }
string-width@4.2.3 :
resolution : {integrity : sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
engines : {node : '>=8' }
string-width@5.1.2 :
resolution : {integrity : sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==}
engines : {node : '>=12' }
string.prototype.includes@2.0.1 :
resolution : {integrity : sha512-o7+c9bW6zpAdJHTtujeePODAhkuicdAryFsfVKwA+wGw89wJ4GTY484WTucM9hLtDEOpOvI+aHnzqnC5lHp4Rg==}
engines : {node : '>= 0.4' }
string.prototype.matchall@4.0.12 :
resolution : {integrity : sha512-6CC9uyBL+/48dYizRf7H7VAYCMCNTBeM78x/VTUe9bFEaxBepPJDa1Ow99LqI/1yF7kuy7Q3cQsYMrcjGUcskA==}
engines : {node : '>= 0.4' }
string.prototype.repeat@1.0.0 :
resolution : {integrity : sha512-0u/TldDbKD8bFCQ/4f5+mNRrXwZ8hg2w7ZR8wa16e8z9XpePWl3eGEcUD0OXpEH/VJH/2G3gjUtR3ZOiBe2S/w==}
string.prototype.trim@1.2.11 :
resolution : {integrity : sha512-PwvK7BU+CMTJGYQCTZb5RWXIML92lftJLhQz1tBzgKiqGxJaMlBAa48POXaNAC2s4y8jr3EFqrkF9+44neS46w==}
engines : {node : '>= 0.4' }
string.prototype.trimend@1.0.10 :
resolution : {integrity : sha512-2+3aDAOmPTmuFwjDnmJG2ctEkQKVki7vOSqaxkv42Mowj1V6PnvuwFCRrR5lChUux1TBskPjfkeTOhqczDMxTw==}
engines : {node : '>= 0.4' }
string.prototype.trimstart@1.0.8 :
resolution : {integrity : sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg==}
engines : {node : '>= 0.4' }
string_decoder@1.3.0 :
resolution : {integrity : sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
strip-ansi@6.0.1 :
resolution : {integrity : sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
engines : {node : '>=8' }
strip-ansi@7.2.0 :
resolution : {integrity : sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==}
engines : {node : '>=12' }
strip-bom@3.0.0 :
resolution : {integrity : sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==}
engines : {node : '>=4' }
strip-bom@4.0.0 :
resolution : {integrity : sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==}
engines : {node : '>=8' }
strip-final-newline@4.0.0 :
resolution : {integrity : sha512-aulFJcD6YK8V1G7iRB5tigAP4TsHBZZrOV8pjV++zdUwmeV8uzbY7yn6h9MswN62adStNZFuCIx4haBnRuMDaw==}
engines : {node : '>=18' }
strip-json-comments@2.0.1 :
resolution : {integrity : sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==}
engines : {node : '>=0.10.0' }
strip-json-comments@3.1.1 :
resolution : {integrity : sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
engines : {node : '>=8' }
strip-outer@1.0.1 :
resolution : {integrity : sha512-k55yxKHwaXnpYGsOzg4Vl8+tDrWylxDEpknGjhTiZB8dFRU5rTo9CAzeycivxV3s+zlTKwrs6WxMxR95n26kwg==}
engines : {node : '>=0.10.0' }
styled_string@0.0.1 :
resolution : {integrity : sha512-DU2KZiB6VbPkO2tGSqQ9n96ZstUPjW7X4sGO6V2m1myIQluX0p1Ol8BrA/l6/EesqhMqXOIXs3cJNOy1UuU2BA==}
supertap@2.0.0 :
resolution : {integrity : sha512-jRzcXlCeDYvKoZGA5oRhYyR3jUIYu0enkSxtmAgHRlD7HwrovTpH4bDSi0py9FtuA8si9cW/fKommJHuaoDHJA==}
engines : {node : '>=10' }
supports-color@7.2.0 :
resolution : {integrity : sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
engines : {node : '>=8' }
supports-hyperlinks@3.2.0 :
resolution : {integrity : sha512-zFObLMyZeEwzAoKCyu1B91U79K2t7ApXuQfo8OuxwXLDgcKxuwM+YvcbIhm6QWqz7mHUH1TVytR1PwVVjEuMig==}
engines : {node : '>=14.18' }
supports-preserve-symlinks-flag@1.0.0 :
resolution : {integrity : sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
engines : {node : '>= 0.4' }
tap-parser@18.3.4 :
resolution : {integrity : sha512-CiqzdpWn2CvONcWp7UNMF9/rCPJwCz0es+qykkgJruu1Y/rAS8A5MEQujmjx9NErfst3dGiZJU3lDS2jBsgbPA==}
engines : {node : 20 || >=22}
hasBin : true
tap-yaml@4.4.2 :
resolution : {integrity : sha512-03mQI7QhfVZHJqGgFyxNTgUbgsG41ZzpWSb7k1Gangmf9hF71Jpb0Fczs7KtOdUDaHx+KxlPUdM2pQJaijebGA==}
engines : {node : 20 || >=22}
tapable@2.3.3 :
resolution : {integrity : sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==}
engines : {node : '>=6' }
temp-dir@2.0.0 :
resolution : {integrity : sha512-aoBAniQmmwtcKp/7BzsH8Cxzv8OL736p7v1ihGb5e9DJ9kTwGWHrQrVB5+lfVDzfGrdRzXch+ig7LHaY1JTOrg==}
engines : {node : '>=8' }
terser@5.49.0 :
resolution : {integrity : sha512-SNiDnXyHSrxVcIOtVbULzcTmniUiwcV7Nwdyj1twVubeTmbjoa8p69KKDpfkdoOavuM4/GRm1+ykI8qqnavHoA==}
engines : {node : '>=10' }
hasBin : true
test-exclude@7.0.2 :
resolution : {integrity : sha512-u9E6A+ZDYdp7a4WnarkXPZOx8Ilz46+kby6p1yZ8zsGTz9gYa6FIS7lj2oezzNKmtdyyJNNmmXDppga5GB7kSw==}
engines : {node : '>=18' }
test-exclude@8.0.0 :
resolution : {integrity : sha512-ZOffsNrXYggvU1mDGHk54I96r26P8SyMjO5slMKSc7+IWmtB/MQKnEC2fP51imB3/pT6YK5cT5E8f+Dd9KdyOQ==}
engines : {node : 20 || >=22}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
testem@3.20.2 :
resolution : {integrity : sha512-Y29LKJ4XHjr2oUZHHIDJbz7/AYDM8soqc7Irg6sfBI5W3nfOuuovyN2SEKnFw4LqGdQe0cFXZG3xAvt00INvWQ==}
2026-08-30 00:10:11 +03:00
engines : {node : ^20.19.0 || ^22.12.0 || >=24.0.0}
hasBin : true
thenify-all@1.6.0 :
resolution : {integrity : sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
engines : {node : '>=0.8' }
thenify@3.3.1 :
resolution : {integrity : sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
time-zone@1.0.0 :
resolution : {integrity : sha512-TIsDdtKo6+XrPtiTm1ssmMngN1sAhyKnTO2kunQWqNPWIVvCm15Wmw4SWInwTVgJ5u/Tr04+8Ei9TNcw4x4ONA==}
engines : {node : '>=4' }
tinyexec@1.2.4 :
resolution : {integrity : sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==}
engines : {node : '>=18' }
tinyglobby@0.2.17 :
resolution : {integrity : sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
engines : {node : '>=12.0.0' }
to-regex-range@5.0.1 :
resolution : {integrity : sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
engines : {node : '>=8.0' }
toasted-notifier@10.1.0 :
resolution : {integrity : sha512-SvAufC4t75lRqwQtComPeDC93j8Toy3BRsD1cMIZ+YdfxTnIyxQb+YCuhXohNFDGJPI+RgOYImkDX76fTo1YDA==}
toidentifier@1.0.1 :
resolution : {integrity : sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==}
engines : {node : '>=0.6' }
tree-kill@1.2.2 :
resolution : {integrity : sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==}
hasBin : true
trim-off-newlines@1.0.3 :
resolution : {integrity : sha512-kh6Tu6GbeSNMGfrrZh6Bb/4ZEHV1QlB4xNDBeog8Y9/QwFlKTRyWvY3Fs9tRDAMZliVUwieMgEdIeL/FtqjkJg==}
engines : {node : '>=0.10.0' }
trim-repeated@1.0.0 :
resolution : {integrity : sha512-pkonvlKk8/ZuR0D5tLW8ljt5I8kmxp2XKymhepUeOdCEfKpZaktSArkLHZt76OB1ZvO9bssUsDty4SWhLvZpLg==}
engines : {node : '>=0.10.0' }
ts-api-utils@2.5.0 :
resolution : {integrity : sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==}
engines : {node : '>=18.12' }
peerDependencies :
typescript : '>=4.8.4'
ts-declaration-location@1.0.7 :
resolution : {integrity : sha512-EDyGAwH1gO0Ausm9gV6T2nUvBgXT5kGoCMJPllOaooZ+4VvJiKBdZE7wK18N1deEowhcUptS+5GXZK8U/fvpwA==}
peerDependencies :
typescript : '>=4.0.0'
tsconfig-paths@3.15.0 :
resolution : {integrity : sha512-2Ac2RgzDe/cn48GvOe3M+o82pEFewD3UPbyoUHHdKasHwJKjds4fLXWf/Ux5kATBKN20oaFGu+jbElp1pos0mg==}
tsdown@0.22.14 :
resolution : {integrity : sha512-ule7Y+fsAN2iZbLDoo7C4KYljFJNJJ+fLshyn+9gozeTspVersWHxwdGB+Dm2hzA38s6muFnUTl0jK3vJm9ifQ==}
engines : {node : ^22.18.0 || >=24.11.0}
hasBin : true
peerDependencies :
'@arethetypeswrong/core' : ^0.18.1
'@tsdown/css' : 0.22 .14
'@tsdown/exe' : 0.22 .14
'@vitejs/devtools' : '*'
publint : ^0.3.8
tsx : '*'
typescript : ^5.0.0 || ^6.0.0 || ^7.0.0
unplugin-unused : ^0.5.0
unrun : '*'
peerDependenciesMeta :
'@arethetypeswrong/core' :
optional : true
'@tsdown/css' :
optional : true
'@tsdown/exe' :
optional : true
'@vitejs/devtools' :
optional : true
publint :
optional : true
tsx :
optional : true
typescript :
optional : true
unplugin-unused :
optional : true
unrun :
optional : true
tslib@2.8.1 :
resolution : {integrity : sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
type-check@0.4.0 :
resolution : {integrity : sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
engines : {node : '>= 0.8.0' }
type-detect@4.0.8 :
resolution : {integrity : sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==}
engines : {node : '>=4' }
type-detect@4.1.0 :
resolution : {integrity : sha512-Acylog8/luQ8L7il+geoSxhEkazvkslg7PSNKOX59mbB9cOveP5aq9h74Y7YU8yDpJwetzQQrfIwtf4Wp4LKcw==}
engines : {node : '>=4' }
type-fest@0.13.1 :
resolution : {integrity : sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg==}
engines : {node : '>=10' }
type-fest@0.20.2 :
resolution : {integrity : sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==}
engines : {node : '>=10' }
type-fest@0.3.1 :
resolution : {integrity : sha512-cUGJnCdr4STbePCgqNFbpVNCepa+kAVohJs1sLhxzdH+gnEoOd8VhbYa7pD3zZYGiURWM2xzEII3fQcRizDkYQ==}
engines : {node : '>=6' }
type-fest@0.6.0 :
resolution : {integrity : sha512-q+MB8nYR1KDLrgr4G5yemftpMC7/QLqVndBmEEdqzmNj5dcFOO4Oo8qlwZE3ULT3+Zim1F8Kq4cBnikNhlCMlg==}
engines : {node : '>=8' }
type-fest@0.8.1 :
resolution : {integrity : sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==}
engines : {node : '>=8' }
type-is@2.1.0 :
resolution : {integrity : sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==}
engines : {node : '>= 18' }
typed-array-buffer@1.0.3 :
resolution : {integrity : sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
engines : {node : '>= 0.4' }
typed-array-byte-length@1.0.3 :
resolution : {integrity : sha512-BaXgOuIxz8n8pIq3e7Atg/7s+DpiYrxn4vdot3w9KbnBhcRQq6o3xemQdIfynqSeXeDrF32x+WvfzmOjPiY9lg==}
engines : {node : '>= 0.4' }
typed-array-byte-offset@1.0.4 :
resolution : {integrity : sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==}
engines : {node : '>= 0.4' }
typed-array-length@1.0.8 :
resolution : {integrity : sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==}
engines : {node : '>= 0.4' }
typedarray-to-buffer@3.1.5 :
resolution : {integrity : sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==}
typescript-eslint@8.61.0 :
resolution : {integrity : sha512-8y31Rd0eGTrDKqhy6vT0HtzhN+YLjQizwX3aA3hPXP/ynSfnrBXcQY5IzsP9/DM7+klX4IUncZZjkchP0z+rUw==}
engines : {node : ^18.18.0 || ^20.9.0 || >=21.1.0}
peerDependencies :
eslint : ^8.57.0 || ^9.0.0 || ^10.0.0
typescript : '>=4.8.4 <6.1.0'
typescript@5.6.1-rc :
resolution : {integrity : sha512-E3b2+1zEFu84jB0YQi9BORDjz9+jGbwwy1Zi3G0LUNw7a7cePUrHMRNy8aPh53nXpkFGVHSxIZo5vKTfYaFiBQ==}
engines : {node : '>=14.17' }
hasBin : true
typescript@5.9.3 :
resolution : {integrity : sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
engines : {node : '>=14.17' }
hasBin : true
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
uc.micro@2.1.0 :
resolution : {integrity : sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==}
2026-08-30 00:10:11 +03:00
unbox-primitive@1.1.0 :
resolution : {integrity : sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==}
engines : {node : '>= 0.4' }
unconfig-core@7.5.0 :
resolution : {integrity : sha512-Su3FauozOGP44ZmKdHy2oE6LPjk51M/TRRjHv2HNCWiDvfvCoxC2lno6jevMA91MYAdCdwP05QnWdWpSbncX/w==}
underscore@1.13.8 :
resolution : {integrity : sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ==}
undici-types@7.24.6 :
resolution : {integrity : sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
unicode-canonical-property-names-ecmascript@2.0.1 :
resolution : {integrity : sha512-dA8WbNeb2a6oQzAQ55YlT5vQAWGV9WXOsi3SskE3bcCdM0P4SDd+24zS/OCacdRq5BkdsRj9q3Pg6YyQoxIGqg==}
engines : {node : '>=4' }
unicode-emoji-modifier-base@1.0.0 :
resolution : {integrity : sha512-yLSH4py7oFH3oG/9K+XWrz1pSi3dfUrWEnInbxMfArOfc1+33BlGPQtLsOYwvdMy11AwUBetYuaRxSPqgkq+8g==}
engines : {node : '>=4' }
unicode-match-property-ecmascript@2.0.0 :
resolution : {integrity : sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q==}
engines : {node : '>=4' }
unicode-match-property-value-ecmascript@2.2.1 :
resolution : {integrity : sha512-JQ84qTuMg4nVkx8ga4A16a1epI9H6uTXAknqxkGF/aFfRLw1xC/Bp24HNLaZhHSkWd3+84t8iXnp1J0kYcZHhg==}
engines : {node : '>=4' }
unicode-property-aliases-ecmascript@2.2.0 :
resolution : {integrity : sha512-hpbDzxUY9BFwX+UeBnxv3Sh1q7HFxj48DTmXchNgRa46lO8uj3/1iEn3MiNUYTg1g9ctIqXCCERn8gYZhHC5lQ==}
engines : {node : '>=4' }
unicorn-magic@0.3.0 :
resolution : {integrity : sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==}
engines : {node : '>=18' }
unique-string@2.0.0 :
resolution : {integrity : sha512-uNaeirEPvpZWSgzwsPGtU2zVSTrn/8L5q/IexZmH0eH6SA73CmAA5U4GwORTxQAZs95TAXLNqeLoPPNO5gZfWg==}
engines : {node : '>=8' }
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
universalify@2.0.1 :
resolution : {integrity : sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==}
engines : {node : '>= 10.0.0' }
2026-08-30 00:10:11 +03:00
unpipe@1.0.0 :
resolution : {integrity : sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==}
engines : {node : '>= 0.8' }
unrs-resolver@1.12.2 :
resolution : {integrity : sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==}
update-browserslist-db@1.2.3 :
resolution : {integrity : sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
hasBin : true
peerDependencies :
browserslist : '>= 4.21.0'
update-notifier@5.1.0 :
resolution : {integrity : sha512-ItnICHbeMh9GqUy31hFPrD1kcuZ3rpxDZbf4KUDavXwS0bW5m7SLbDQpGX3UYr072cbrF5hFUs3r5tUsPwjfHw==}
engines : {node : '>=10' }
uri-js@4.4.1 :
resolution : {integrity : sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
util-deprecate@1.0.2 :
resolution : {integrity : sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
validate-npm-package-license@3.0.4 :
resolution : {integrity : sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==}
validate-npm-package-name@5.0.1 :
resolution : {integrity : sha512-OljLrQ9SQdOUqTaQxqL5dEfZWrXExyyWsozYlAWFawPVNuD83igl7uJD2RTkNMbniIYgt8l81eCJGIdQF7avLQ==}
engines : {node : ^14.17.0 || ^16.13.0 || >=18.0.0}
vary@1.1.2 :
resolution : {integrity : sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
engines : {node : '>= 0.8' }
verkit@0.3.0 :
resolution : {integrity : sha512-Njrh4U8UODGajoZ44QS2C/BsoEM9DTI/aCqY5swsizb+/ap0FamvnCMcZAxrR5+aoC0ZqkawEfpC/N2SBc+xeA==}
engines : {node : '>=18.12.0' }
wcwidth@1.0.1 :
resolution : {integrity : sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==}
well-known-symbols@2.0.0 :
resolution : {integrity : sha512-ZMjC3ho+KXo0BfJb7JgtQ5IBuvnShdlACNkKkdsqBmYw3bPAaJfPeYUo6tLUaT5tG/Gkh7xkpBhKRQ9e7pyg9Q==}
engines : {node : '>=6' }
which-boxed-primitive@1.1.1 :
resolution : {integrity : sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==}
engines : {node : '>= 0.4' }
which-builtin-type@1.2.1 :
resolution : {integrity : sha512-6iBczoX+kDQ7a3+YJBnh3T+KZRxM/iYNPXicqk66/Qfm1b93iu+yOImkg0zHbj5LNOcNv1TEADiZ0xa34B4q6Q==}
engines : {node : '>= 0.4' }
which-collection@1.0.2 :
resolution : {integrity : sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
engines : {node : '>= 0.4' }
which-module@2.0.1 :
resolution : {integrity : sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==}
which-typed-array@1.1.22 :
resolution : {integrity : sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==}
engines : {node : '>= 0.4' }
which@2.0.2 :
resolution : {integrity : sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
engines : {node : '>= 8' }
hasBin : true
widest-line@3.1.0 :
resolution : {integrity : sha512-NsmoXalsWVDMGupxZ5R08ka9flZjjiLvHVAWYOKtiKM8ujtZWr9cRffak+uSE48+Ob8ObalXpwyeUiyDD6QFgg==}
engines : {node : '>=8' }
word-wrap@1.2.5 :
resolution : {integrity : sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
engines : {node : '>=0.10.0' }
wrap-ansi@6.2.0 :
resolution : {integrity : sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==}
engines : {node : '>=8' }
wrap-ansi@7.0.0 :
resolution : {integrity : sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
engines : {node : '>=10' }
wrap-ansi@8.1.0 :
resolution : {integrity : sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==}
engines : {node : '>=12' }
wrappy@1.0.2 :
resolution : {integrity : sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
write-file-atomic@3.0.3 :
resolution : {integrity : sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
ws@8.21.3 :
resolution : {integrity : sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==}
2026-08-30 00:10:11 +03:00
engines : {node : '>=10.0.0' }
peerDependencies :
bufferutil : ^4.0.1
utf-8-validate : '>=5.0.2'
peerDependenciesMeta :
bufferutil :
optional : true
utf-8-validate :
optional : true
xdg-basedir@4.0.0 :
resolution : {integrity : sha512-PSNhEJDejZYV7h50BohL09Er9VaIefr2LMAf3OEmpCkjOi34eYyQYAXUTjEQtZJTKcF0E2UKTh+osDLsgNim9Q==}
engines : {node : '>=8' }
xmlcreate@2.0.4 :
resolution : {integrity : sha512-nquOebG4sngPmGPICTS5EnxqhKbCmz5Ox5hsszI2T6U5qdrJizBc+0ilYSEjTSzU0yZcmvppztXe/5Al5fUwdg==}
y18n@4.0.3 :
resolution : {integrity : sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==}
y18n@5.0.8 :
resolution : {integrity : sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==}
engines : {node : '>=10' }
yallist@3.1.1 :
resolution : {integrity : sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
yaml-types@0.4.0 :
resolution : {integrity : sha512-XfbA30NUg4/LWUiplMbiufUiwYhgB9jvBhTWel7XQqjV+GaB79c2tROu/8/Tu7jO0HvDvnKWtBk5ksWRrhQ/0g==}
engines : {node: '>= 16', npm : '>= 7' }
peerDependencies :
yaml : ^2.3.0
yaml@2.9.0 :
resolution : {integrity : sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==}
engines : {node : '>= 14.6' }
hasBin : true
yamljs@0.3.0 :
resolution : {integrity : sha512-C/FsVVhht4iPQYXOInoxUM/1ELSf9EsgKH34FofQOp6hwCPrW4vG4w5++TED3xRUo8gD7l0P1J1dLlDYzODsTQ==}
hasBin : true
yargs-parser@18.1.3 :
resolution : {integrity : sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==}
engines : {node : '>=6' }
yargs-parser@20.2.9 :
resolution : {integrity : sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==}
engines : {node : '>=10' }
yargs@15.4.1 :
resolution : {integrity : sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==}
engines : {node : '>=8' }
yargs@16.2.0 :
resolution : {integrity : sha512-D1mvvtDG0L5ft/jGWkLpG1+m0eQxOfaBvTNELraWj22wSVUMWxZUvYgJYcKh6jGGIkJFhH4IZPQhR4TKpc8mBw==}
engines : {node : '>=10' }
yocto-queue@0.1.0 :
resolution : {integrity : sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
engines : {node : '>=10' }
yoctocolors@2.1.2 :
resolution : {integrity : sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug==}
engines : {node : '>=18' }
yuku-ast@0.7.3 :
resolution : {integrity : sha512-occyAXtcU4hcl5UPEclWwLqz4J1ZAV8Us4LllmTqAe1YjL5aMbh3GCpzHt6O0sOF+dwBI3BZAcFQqbyX1RiaWg==}
yuku-codegen@0.7.3 :
resolution : {integrity : sha512-hhyJW0TIEwm4kex8XVCS4CZIXHS/3TWWNUum+95Ji5/4W+iaLfUnvwSxJwyNfTzS8cxmd1np+EZ4b8ObLguKEA==}
yuku-parser@0.7.3 :
resolution : {integrity : sha512-5kZ7HR+W+OsNpVtZ9LHruQsgmcoJl4TETrffPq2GbliThsFiy+zHzbMLmSxQJrokzyJqfJ/TPfFkdUDOodJCgA==}
zod-validation-error@4.0.2 :
resolution : {integrity : sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ==}
engines : {node : '>=18.0.0' }
peerDependencies :
zod : ^3.25.0 || ^4.0.0
zod@4.4.3 :
resolution : {integrity : sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
snapshots :
'@andrewbranch/untar.js@1.0.3' : {}
'@arethetypeswrong/cli@0.18.5' :
dependencies :
'@arethetypeswrong/core' : 0.18 .5
chalk : 4.1 .2
cli-table3 : 0.6 .5
commander : 10.0 .1
marked : 9.1 .6
marked-terminal : 7.3 .0 (marked@9.1.6)
semver : 7.8 .5
'@arethetypeswrong/core@0.18.5' :
dependencies :
'@andrewbranch/untar.js' : 1.0 .3
'@loaderkit/resolve' : 1.0 .6
cjs-module-lexer : 1.4 .3
fflate : 0.8 .3
lru-cache : 11.5 .1
semver : 7.8 .5
typescript : 5.6 .1 -rc
validate-npm-package-name : 5.0 .1
'@babel/cli@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@jridgewell/trace-mapping' : 0.3 .31
commander : 6.2 .1
convert-source-map : 2.0 .0
fs-readdir-recursive : 1.1 .0
glob : 7.2 .3
make-dir : 2.1 .0
slash : 2.0 .0
optionalDependencies :
'@nicolo-ribaudo/chokidar-2' : 2.1 .8 -no -fsevents.3
chokidar : 3.6 .0
'@babel/code-frame@7.29.7' :
dependencies :
'@babel/helper-validator-identifier' : 7.29 .7
js-tokens : 4.0 .0
picocolors : 1.1 .1
'@babel/compat-data@7.29.7' : {}
'@babel/core@7.29.7(supports-color@7.2.0)' :
dependencies :
'@babel/code-frame' : 7.29 .7
'@babel/generator' : 7.29 .7
'@babel/helper-compilation-targets' : 7.29 .7
'@babel/helper-module-transforms' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/helpers' : 7.29 .7
'@babel/parser' : 7.29 .7
'@babel/template' : 7.29 .7
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
'@babel/types' : 7.29 .7
'@jridgewell/remapping' : 2.3 .5
convert-source-map : 2.0 .0
debug : 4.4 .3 (supports-color@7.2.0)
gensync : 1.0 .0 -beta.2
json5 : 2.2 .3
semver : 6.3 .1
transitivePeerDependencies :
- supports-color
'@babel/generator@7.29.7' :
dependencies :
'@babel/parser' : 7.29 .7
'@babel/types' : 7.29 .7
'@jridgewell/gen-mapping' : 0.3 .13
'@jridgewell/trace-mapping' : 0.3 .31
jsesc : 3.1 .0
'@babel/helper-annotate-as-pure@7.29.7' :
dependencies :
'@babel/types' : 7.29 .7
'@babel/helper-compilation-targets@7.29.7' :
dependencies :
'@babel/compat-data' : 7.29 .7
'@babel/helper-validator-option' : 7.29 .7
browserslist : 4.28 .2
lru-cache : 5.1 .1
semver : 6.3 .1
'@babel/helper-create-class-features-plugin@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-annotate-as-pure' : 7.29 .7
'@babel/helper-member-expression-to-functions' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-optimise-call-expression' : 7.29 .7
'@babel/helper-replace-supers' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/helper-skip-transparent-expression-wrappers' : 7.29 .7 (supports-color@7.2.0)
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
semver : 6.3 .1
transitivePeerDependencies :
- supports-color
'@babel/helper-create-regexp-features-plugin@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-annotate-as-pure' : 7.29 .7
regexpu-core : 6.4 .0
semver : 6.3 .1
'@babel/helper-define-polyfill-provider@0.6.8(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-compilation-targets' : 7.29 .7
'@babel/helper-plugin-utils' : 7.29 .7
debug : 4.4 .3 (supports-color@7.2.0)
lodash.debounce : 4.0 .8
resolve : 1.22 .12
transitivePeerDependencies :
- supports-color
'@babel/helper-globals@7.29.7' : {}
'@babel/helper-member-expression-to-functions@7.29.7(supports-color@7.2.0)' :
dependencies :
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
'@babel/types' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/helper-module-imports@7.29.7(supports-color@7.2.0)' :
dependencies :
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
'@babel/types' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-module-imports' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-validator-identifier' : 7.29 .7
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/helper-optimise-call-expression@7.29.7' :
dependencies :
'@babel/types' : 7.29 .7
'@babel/helper-plugin-utils@7.29.7' : {}
'@babel/helper-remap-async-to-generator@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-annotate-as-pure' : 7.29 .7
'@babel/helper-wrap-function' : 7.29 .7 (supports-color@7.2.0)
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/helper-replace-supers@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-member-expression-to-functions' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-optimise-call-expression' : 7.29 .7
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/helper-skip-transparent-expression-wrappers@7.29.7(supports-color@7.2.0)' :
dependencies :
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
'@babel/types' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/helper-string-parser@7.29.7' : {}
'@babel/helper-validator-identifier@7.29.7' : {}
'@babel/helper-validator-option@7.29.7' : {}
'@babel/helper-wrap-function@7.29.7(supports-color@7.2.0)' :
dependencies :
'@babel/template' : 7.29 .7
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
'@babel/types' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/helpers@7.29.7' :
dependencies :
'@babel/template' : 7.29 .7
'@babel/types' : 7.29 .7
'@babel/parser@7.29.7' :
dependencies :
'@babel/types' : 7.29 .7
'@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-bugfix-safari-class-field-initializer-scope@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-bugfix-safari-rest-destructuring-rhs-array@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-skip-transparent-expression-wrappers' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-skip-transparent-expression-wrappers' : 7.29 .7 (supports-color@7.2.0)
'@babel/plugin-transform-optional-chaining' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/plugin-syntax-import-assertions@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-syntax-import-attributes@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-syntax-unicode-sets-regex@7.18.6(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-regexp-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-arrow-functions@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-async-generator-functions@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-remap-async-to-generator' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-async-to-generator@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-module-imports' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-remap-async-to-generator' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-block-scoped-functions@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-block-scoping@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-class-properties@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-class-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-class-static-block@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-class-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-classes@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-annotate-as-pure' : 7.29 .7
'@babel/helper-compilation-targets' : 7.29 .7
'@babel/helper-globals' : 7.29 .7
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-replace-supers' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-computed-properties@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/template' : 7.29 .7
'@babel/plugin-transform-destructuring@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-dotall-regex@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-regexp-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-duplicate-keys@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-duplicate-named-capturing-groups-regex@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-regexp-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-dynamic-import@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-explicit-resource-management@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-destructuring' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-exponentiation-operator@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-export-namespace-from@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-for-of@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-skip-transparent-expression-wrappers' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-function-name@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-compilation-targets' : 7.29 .7
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-json-strings@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-literals@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-logical-assignment-operators@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-member-expression-literals@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-modules-amd@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-module-transforms' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-modules-commonjs@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-module-transforms' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-modules-systemjs@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-module-transforms' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-validator-identifier' : 7.29 .7
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-modules-umd@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-module-transforms' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-named-capturing-groups-regex@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-regexp-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-new-target@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-nullish-coalescing-operator@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-numeric-separator@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-object-rest-spread@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-compilation-targets' : 7.29 .7
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-destructuring' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-parameters' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/traverse' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-object-super@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-replace-supers' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-optional-catch-binding@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-optional-chaining@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-skip-transparent-expression-wrappers' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-parameters@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-private-methods@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-class-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-private-property-in-object@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-annotate-as-pure' : 7.29 .7
'@babel/helper-create-class-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-property-literals@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-regenerator@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-regexp-modifiers@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-regexp-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-reserved-words@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-shorthand-properties@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-spread@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-skip-transparent-expression-wrappers' : 7.29 .7 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/plugin-transform-sticky-regex@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-template-literals@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-typeof-symbol@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-unicode-escapes@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-unicode-property-regex@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-regexp-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-unicode-regex@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-regexp-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/plugin-transform-unicode-sets-regex@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-create-regexp-features-plugin' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/preset-env@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)' :
dependencies :
'@babel/compat-data' : 7.29 .7
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-compilation-targets' : 7.29 .7
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/helper-validator-option' : 7.29 .7
'@babel/plugin-bugfix-firefox-class-in-computed-class-key' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-bugfix-safari-class-field-initializer-scope' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-bugfix-safari-rest-destructuring-rhs-array' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-proposal-private-property-in-object' : 7.21 .0 -placeholder-for-preset-env.2(@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-syntax-import-assertions' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-syntax-import-attributes' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-syntax-unicode-sets-regex' : 7.18 .6 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-arrow-functions' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-async-generator-functions' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-async-to-generator' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-block-scoped-functions' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-block-scoping' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-class-properties' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-class-static-block' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-classes' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-computed-properties' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-destructuring' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-dotall-regex' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-duplicate-keys' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-duplicate-named-capturing-groups-regex' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-dynamic-import' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-explicit-resource-management' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-exponentiation-operator' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-export-namespace-from' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-for-of' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-function-name' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-json-strings' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-literals' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-logical-assignment-operators' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-member-expression-literals' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-modules-amd' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-modules-commonjs' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-modules-systemjs' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-modules-umd' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-named-capturing-groups-regex' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-new-target' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-nullish-coalescing-operator' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-numeric-separator' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-object-rest-spread' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-object-super' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-optional-catch-binding' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-optional-chaining' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-parameters' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-private-methods' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-private-property-in-object' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-property-literals' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-regenerator' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-regexp-modifiers' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-reserved-words' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-shorthand-properties' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-spread' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
'@babel/plugin-transform-sticky-regex' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-template-literals' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-typeof-symbol' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-unicode-escapes' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-unicode-property-regex' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-unicode-regex' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/plugin-transform-unicode-sets-regex' : 7.29 .7 (@babel/core@7.29.7(supports-color@7.2.0))
'@babel/preset-modules' : 0.1 .6 -no -external-plugins(@babel/core@7.29.7(supports-color@7.2.0))
babel-plugin-polyfill-corejs2 : 0.4 .17 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
babel-plugin-polyfill-corejs3 : 0.14 .2 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
babel-plugin-polyfill-regenerator : 0.6 .8 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
core-js-compat : 3.49 .0
semver : 6.3 .1
transitivePeerDependencies :
- supports-color
'@babel/preset-modules@0.1.6-no-external-plugins(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-plugin-utils' : 7.29 .7
'@babel/types' : 7.29 .7
esutils : 2.0 .3
'@babel/register@7.29.7(@babel/core@7.29.7(supports-color@7.2.0))' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
clone-deep : 4.0 .1
find-cache-dir : 2.1 .0
make-dir : 2.1 .0
pirates : 4.0 .7
source-map-support : 0.5 .21
'@babel/template@7.29.7' :
dependencies :
'@babel/code-frame' : 7.29 .7
'@babel/parser' : 7.29 .7
'@babel/types' : 7.29 .7
'@babel/traverse@7.29.7(supports-color@7.2.0)' :
dependencies :
'@babel/code-frame' : 7.29 .7
'@babel/generator' : 7.29 .7
'@babel/helper-globals' : 7.29 .7
'@babel/parser' : 7.29 .7
'@babel/template' : 7.29 .7
'@babel/types' : 7.29 .7
debug : 4.4 .3 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
'@babel/types@7.29.7' :
dependencies :
'@babel/helper-string-parser' : 7.29 .7
'@babel/helper-validator-identifier' : 7.29 .7
'@braidai/lang@1.1.2' : {}
'@colors/colors@1.5.0' :
optional : true
'@concordance/react@2.0.0' :
dependencies :
arrify : 1.0 .1
'@emnapi/core@1.10.0' :
dependencies :
'@emnapi/wasi-threads' : 1.2 .1
tslib : 2.8 .1
optional : true
'@emnapi/core@1.11.2' :
dependencies :
'@emnapi/wasi-threads' : 1.2 .2
tslib : 2.8 .1
optional : true
'@emnapi/runtime@1.10.0' :
dependencies :
tslib : 2.8 .1
optional : true
'@emnapi/runtime@1.11.2' :
dependencies :
tslib : 2.8 .1
optional : true
'@emnapi/wasi-threads@1.2.1' :
dependencies :
tslib : 2.8 .1
optional : true
'@emnapi/wasi-threads@1.2.2' :
dependencies :
tslib : 2.8 .1
optional : true
'@eslint-community/eslint-utils@4.9.1(eslint@10.8.0(supports-color@7.2.0))' :
dependencies :
eslint : 10.8 .0 (supports-color@7.2.0)
eslint-visitor-keys : 3.4 .3
'@eslint-community/regexpp@4.12.2' : {}
'@eslint/config-array@0.23.5(supports-color@7.2.0)' :
dependencies :
'@eslint/object-schema' : 3.0 .5
debug : 4.4 .3 (supports-color@7.2.0)
minimatch : 10.2 .5
transitivePeerDependencies :
- supports-color
'@eslint/config-helpers@0.7.0' :
dependencies :
'@eslint/core' : 1.2 .1
'@eslint/core@1.2.1' :
dependencies :
'@types/json-schema' : 7.0 .15
'@eslint/js@10.0.1(eslint@10.8.0(supports-color@7.2.0))' :
optionalDependencies :
eslint : 10.8 .0 (supports-color@7.2.0)
'@eslint/json@2.0.0' :
dependencies :
'@eslint/core' : 1.2 .1
'@eslint/plugin-kit' : 0.7 .2
'@humanwhocodes/momoa' : 3.3 .10
natural-compare : 1.4 .0
'@eslint/object-schema@3.0.5' : {}
'@eslint/plugin-kit@0.7.2' :
dependencies :
'@eslint/core' : 1.2 .1
levn : 0.4 .1
'@humanfs/core@0.19.2' :
dependencies :
'@humanfs/types' : 0.15 .0
'@humanfs/node@0.16.8' :
dependencies :
'@humanfs/core' : 0.19 .2
'@humanfs/types' : 0.15 .0
'@humanwhocodes/retry' : 0.4 .3
'@humanfs/types@0.15.0' : {}
'@humanwhocodes/module-importer@1.0.1' : {}
'@humanwhocodes/momoa@3.3.10' : {}
'@humanwhocodes/retry@0.4.3' : {}
'@isaacs/cliui@8.0.2' :
dependencies :
string-width : 5.1 .2
string-width-cjs : string-width@4.2.3
strip-ansi : 7.2 .0
strip-ansi-cjs : strip-ansi@6.0.1
wrap-ansi : 8.1 .0
wrap-ansi-cjs : wrap-ansi@7.0.0
'@istanbuljs/load-nyc-config@1.1.0' :
dependencies :
camelcase : 5.3 .1
find-up : 4.1 .0
get-package-type : 0.1 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
js-yaml : 3.15 .2
2026-08-30 00:10:11 +03:00
resolve-from : 5.0 .0
'@istanbuljs/schema@0.1.6' : {}
'@jridgewell/gen-mapping@0.3.13' :
dependencies :
'@jridgewell/sourcemap-codec' : 1.5 .5
'@jridgewell/trace-mapping' : 0.3 .31
'@jridgewell/remapping@2.3.5' :
dependencies :
'@jridgewell/gen-mapping' : 0.3 .13
'@jridgewell/trace-mapping' : 0.3 .31
'@jridgewell/resolve-uri@3.1.2' : {}
'@jridgewell/source-map@0.3.11' :
dependencies :
'@jridgewell/gen-mapping' : 0.3 .13
'@jridgewell/trace-mapping' : 0.3 .31
'@jridgewell/sourcemap-codec@1.5.5' : {}
'@jridgewell/trace-mapping@0.3.31' :
dependencies :
'@jridgewell/resolve-uri' : 3.1 .2
'@jridgewell/sourcemap-codec' : 1.5 .5
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@jsdoc/salty@0.2.12' :
dependencies :
lodash : 4.18 .1
2026-08-30 00:10:11 +03:00
'@loaderkit/resolve@1.0.6' :
dependencies :
'@braidai/lang' : 1.1 .2
'@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)' :
dependencies :
'@emnapi/core' : 1.10 .0
'@emnapi/runtime' : 1.10 .0
'@tybys/wasm-util' : 0.10 .3
optional : true
'@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)' :
dependencies :
'@emnapi/core' : 1.11 .2
'@emnapi/runtime' : 1.11 .2
'@tybys/wasm-util' : 0.10 .3
optional : true
'@next/eslint-plugin-next@16.2.9' :
dependencies :
fast-glob : 3.3 .1
'@nicolo-ribaudo/chokidar-2@2.1.8-no-fsevents.3' :
optional : true
'@nodelib/fs.scandir@2.1.5' :
dependencies :
'@nodelib/fs.stat' : 2.0 .5
run-parallel : 1.2 .0
'@nodelib/fs.stat@2.0.5' : {}
'@nodelib/fs.walk@1.2.8' :
dependencies :
'@nodelib/fs.scandir' : 2.1 .5
fastq : 1.20 .1
'@oxc-project/types@0.140.0' : {}
'@package-json/types@0.0.12' : {}
'@pkgjs/parseargs@0.11.0' :
optional : true
'@publint/pack@0.1.6' :
dependencies :
tinyexec : 1.2 .4
'@quansync/fs@1.0.0' :
dependencies :
quansync : 1.0 .0
'@rolldown/binding-android-arm64@1.2.0' :
optional : true
'@rolldown/binding-darwin-arm64@1.2.0' :
optional : true
'@rolldown/binding-darwin-x64@1.2.0' :
optional : true
'@rolldown/binding-freebsd-x64@1.2.0' :
optional : true
'@rolldown/binding-linux-arm-gnueabihf@1.2.0' :
optional : true
'@rolldown/binding-linux-arm64-gnu@1.2.0' :
optional : true
'@rolldown/binding-linux-arm64-musl@1.2.0' :
optional : true
'@rolldown/binding-linux-ppc64-gnu@1.2.0' :
optional : true
'@rolldown/binding-linux-s390x-gnu@1.2.0' :
optional : true
'@rolldown/binding-linux-x64-gnu@1.2.0' :
optional : true
'@rolldown/binding-linux-x64-musl@1.2.0' :
optional : true
'@rolldown/binding-openharmony-arm64@1.2.0' :
optional : true
'@rolldown/binding-wasm32-wasi@1.2.0' :
dependencies :
'@emnapi/core' : 1.11 .2
'@emnapi/runtime' : 1.11 .2
'@napi-rs/wasm-runtime' : 1.1 .6 (@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)
optional : true
'@rolldown/binding-win32-arm64-msvc@1.2.0' :
optional : true
'@rolldown/binding-win32-x64-msvc@1.2.0' :
optional : true
'@rolldown/plugin-babel@0.2.3(@babel/core@7.29.7(supports-color@7.2.0))(rolldown@1.2.0)' :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
picomatch : 4.0 .5
rolldown : 1.2 .0
'@rolldown/pluginutils@1.0.1' : {}
'@rtsao/scc@1.1.0' : {}
'@sec-ant/readable-stream@0.4.1' : {}
'@sindresorhus/is@4.6.0' : {}
'@sindresorhus/merge-streams@4.0.0' : {}
'@sinonjs/commons@3.0.1' :
dependencies :
type-detect : 4.0 .8
'@sinonjs/fake-timers@15.4.0' :
dependencies :
'@sinonjs/commons' : 3.0 .1
'@sinonjs/samsam@10.0.2' :
dependencies :
'@sinonjs/commons' : 3.0 .1
type-detect : 4.1 .0
'@socket.io/component-emitter@3.1.2' : {}
'@stylistic/eslint-plugin@5.10.0(eslint@10.8.0(supports-color@7.2.0))' :
dependencies :
'@eslint-community/eslint-utils' : 4.9 .1 (eslint@10.8.0(supports-color@7.2.0))
'@typescript-eslint/types' : 8.61 .0
eslint : 10.8 .0 (supports-color@7.2.0)
eslint-visitor-keys : 4.2 .1
espree : 10.4 .0
estraverse : 5.3 .0
picomatch : 4.0 .5
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@szmarczak/http-timer@4.0.6' :
2026-08-30 00:10:11 +03:00
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
defer-to-connect : 2.0 .1
2026-08-30 00:10:11 +03:00
'@tybys/wasm-util@0.10.3' :
dependencies :
tslib : 2.8 .1
optional : true
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@types/cacheable-request@6.0.3' :
dependencies :
'@types/http-cache-semantics' : 4.2 .0
'@types/keyv' : 3.1 .4
'@types/node' : 25.9 .3
'@types/responselike' : 1.0 .3
2026-08-30 00:10:11 +03:00
'@types/cors@2.8.19' :
dependencies :
'@types/node' : 25.9 .3
'@types/esrecurse@4.3.1' : {}
'@types/estree@1.0.9' : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@types/http-cache-semantics@4.2.0' : {}
2026-08-30 00:10:11 +03:00
'@types/json-schema@7.0.15' : {}
'@types/json5@0.0.29' : {}
'@types/keyv@3.1.4' :
dependencies :
'@types/node' : 25.9 .3
'@types/linkify-it@5.0.0' : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@types/markdown-it@14.2.0' :
2026-08-30 00:10:11 +03:00
dependencies :
'@types/linkify-it' : 5.0 .0
'@types/mdurl' : 2.0 .0
'@types/mdurl@2.0.0' : {}
'@types/node@25.9.3' :
dependencies :
undici-types : 7.24 .6
'@types/normalize-package-data@2.4.4' : {}
'@types/responselike@1.0.3' :
dependencies :
'@types/node' : 25.9 .3
'@types/ws@8.18.1' :
dependencies :
'@types/node' : 25.9 .3
'@typescript-eslint/eslint-plugin@8.61.0(@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)' :
dependencies :
'@eslint-community/regexpp' : 4.12 .2
'@typescript-eslint/parser' : 8.61 .0 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
'@typescript-eslint/scope-manager' : 8.61 .0
'@typescript-eslint/type-utils' : 8.61 .0 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
'@typescript-eslint/utils' : 8.61 .0 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
'@typescript-eslint/visitor-keys' : 8.61 .0
eslint : 10.8 .0 (supports-color@7.2.0)
ignore : 7.0 .5
natural-compare : 1.4 .0
ts-api-utils : 2.5 .0 (typescript@5.9.3)
typescript : 5.9 .3
transitivePeerDependencies :
- supports-color
'@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)' :
dependencies :
'@typescript-eslint/scope-manager' : 8.61 .0
'@typescript-eslint/types' : 8.61 .0
'@typescript-eslint/typescript-estree' : 8.61 .0 (supports-color@7.2.0)(typescript@5.9.3)
'@typescript-eslint/visitor-keys' : 8.61 .0
debug : 4.4 .3 (supports-color@7.2.0)
eslint : 10.8 .0 (supports-color@7.2.0)
typescript : 5.9 .3
transitivePeerDependencies :
- supports-color
'@typescript-eslint/project-service@8.61.0(supports-color@7.2.0)(typescript@5.9.3)' :
dependencies :
'@typescript-eslint/tsconfig-utils' : 8.61 .0 (typescript@5.9.3)
'@typescript-eslint/types' : 8.61 .0
debug : 4.4 .3 (supports-color@7.2.0)
typescript : 5.9 .3
transitivePeerDependencies :
- supports-color
'@typescript-eslint/scope-manager@8.61.0' :
dependencies :
'@typescript-eslint/types' : 8.61 .0
'@typescript-eslint/visitor-keys' : 8.61 .0
'@typescript-eslint/tsconfig-utils@8.61.0(typescript@5.9.3)' :
dependencies :
typescript : 5.9 .3
'@typescript-eslint/type-utils@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)' :
dependencies :
'@typescript-eslint/types' : 8.61 .0
'@typescript-eslint/typescript-estree' : 8.61 .0 (supports-color@7.2.0)(typescript@5.9.3)
'@typescript-eslint/utils' : 8.61 .0 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
debug : 4.4 .3 (supports-color@7.2.0)
eslint : 10.8 .0 (supports-color@7.2.0)
ts-api-utils : 2.5 .0 (typescript@5.9.3)
typescript : 5.9 .3
transitivePeerDependencies :
- supports-color
'@typescript-eslint/types@8.61.0' : {}
'@typescript-eslint/typescript-estree@8.61.0(supports-color@7.2.0)(typescript@5.9.3)' :
dependencies :
'@typescript-eslint/project-service' : 8.61 .0 (supports-color@7.2.0)(typescript@5.9.3)
'@typescript-eslint/tsconfig-utils' : 8.61 .0 (typescript@5.9.3)
'@typescript-eslint/types' : 8.61 .0
'@typescript-eslint/visitor-keys' : 8.61 .0
debug : 4.4 .3 (supports-color@7.2.0)
minimatch : 10.2 .5
semver : 7.8 .5
tinyglobby : 0.2 .17
ts-api-utils : 2.5 .0 (typescript@5.9.3)
typescript : 5.9 .3
transitivePeerDependencies :
- supports-color
'@typescript-eslint/utils@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)' :
dependencies :
'@eslint-community/eslint-utils' : 4.9 .1 (eslint@10.8.0(supports-color@7.2.0))
'@typescript-eslint/scope-manager' : 8.61 .0
'@typescript-eslint/types' : 8.61 .0
'@typescript-eslint/typescript-estree' : 8.61 .0 (supports-color@7.2.0)(typescript@5.9.3)
eslint : 10.8 .0 (supports-color@7.2.0)
typescript : 5.9 .3
transitivePeerDependencies :
- supports-color
'@typescript-eslint/visitor-keys@8.61.0' :
dependencies :
'@typescript-eslint/types' : 8.61 .0
eslint-visitor-keys : 5.0 .1
'@unrs/resolver-binding-android-arm-eabi@1.12.2' :
optional : true
'@unrs/resolver-binding-android-arm64@1.12.2' :
optional : true
'@unrs/resolver-binding-darwin-arm64@1.12.2' :
optional : true
'@unrs/resolver-binding-darwin-x64@1.12.2' :
optional : true
'@unrs/resolver-binding-freebsd-x64@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-arm-gnueabihf@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-arm-musleabihf@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-arm64-gnu@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-arm64-musl@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-loong64-gnu@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-loong64-musl@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-ppc64-gnu@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-riscv64-gnu@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-riscv64-musl@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-s390x-gnu@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-x64-gnu@1.12.2' :
optional : true
'@unrs/resolver-binding-linux-x64-musl@1.12.2' :
optional : true
'@unrs/resolver-binding-openharmony-arm64@1.12.2' :
optional : true
'@unrs/resolver-binding-wasm32-wasi@1.12.2' :
dependencies :
'@emnapi/core' : 1.10 .0
'@emnapi/runtime' : 1.10 .0
'@napi-rs/wasm-runtime' : 1.1 .6 (@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
optional : true
'@unrs/resolver-binding-win32-arm64-msvc@1.12.2' :
optional : true
'@unrs/resolver-binding-win32-ia32-msvc@1.12.2' :
optional : true
'@unrs/resolver-binding-win32-x64-msvc@1.12.2' :
optional : true
'@xmldom/xmldom@0.9.10' : {}
'@yuku-codegen/binding-darwin-arm64@0.7.3' :
optional : true
'@yuku-codegen/binding-darwin-x64@0.7.3' :
optional : true
'@yuku-codegen/binding-freebsd-x64@0.7.3' :
optional : true
'@yuku-codegen/binding-linux-arm-gnu@0.7.3' :
optional : true
'@yuku-codegen/binding-linux-arm-musl@0.7.3' :
optional : true
'@yuku-codegen/binding-linux-arm64-gnu@0.7.3' :
optional : true
'@yuku-codegen/binding-linux-arm64-musl@0.7.3' :
optional : true
'@yuku-codegen/binding-linux-x64-gnu@0.7.3' :
optional : true
'@yuku-codegen/binding-linux-x64-musl@0.7.3' :
optional : true
'@yuku-codegen/binding-win32-arm64@0.7.3' :
optional : true
'@yuku-codegen/binding-win32-x64@0.7.3' :
optional : true
'@yuku-parser/binding-darwin-arm64@0.7.3' :
optional : true
'@yuku-parser/binding-darwin-x64@0.7.3' :
optional : true
'@yuku-parser/binding-freebsd-x64@0.7.3' :
optional : true
'@yuku-parser/binding-linux-arm-gnu@0.7.3' :
optional : true
'@yuku-parser/binding-linux-arm-musl@0.7.3' :
optional : true
'@yuku-parser/binding-linux-arm64-gnu@0.7.3' :
optional : true
'@yuku-parser/binding-linux-arm64-musl@0.7.3' :
optional : true
'@yuku-parser/binding-linux-x64-gnu@0.7.3' :
optional : true
'@yuku-parser/binding-linux-x64-musl@0.7.3' :
optional : true
'@yuku-parser/binding-win32-arm64@0.7.3' :
optional : true
'@yuku-parser/binding-win32-x64@0.7.3' :
optional : true
'@yuku-toolchain/types@0.7.3' : {}
accepts@1.3.8 :
dependencies :
mime-types : 2.1 .35
negotiator : 0.6 .3
accepts@2.0.0 :
dependencies :
mime-types : 3.0 .2
negotiator : 1.0 .0
acorn-jsx@5.3.2(acorn@8.17.0) :
dependencies :
acorn : 8.17 .0
acorn-walk@8.3.5 :
dependencies :
acorn : 8.17 .0
acorn@8.17.0 : {}
aggregate-error@3.1.0 :
dependencies :
clean-stack : 2.2 .0
indent-string : 4.0 .0
ajv@6.15.0 :
dependencies :
fast-deep-equal : 3.1 .3
fast-json-stable-stringify : 2.1 .0
json-schema-traverse : 0.4 .1
uri-js : 4.4 .1
ansi-align@3.0.1 :
dependencies :
string-width : 4.2 .3
ansi-escapes@7.3.0 :
dependencies :
environment : 1.1 .0
ansi-regex@5.0.1 : {}
ansi-regex@6.2.2 : {}
ansi-styles@4.3.0 :
dependencies :
color-convert : 2.0 .1
ansi-styles@5.2.0 : {}
ansi-styles@6.2.3 : {}
ansis@4.3.1 : {}
any-promise@1.3.0 : {}
anymatch@3.1.3 :
dependencies :
normalize-path : 3.0 .0
picomatch : 2.3 .2
append-transform@2.0.0 :
dependencies :
default-require-extensions : 3.0 .1
archy@1.0.0 : {}
argparse@1.0.10 :
dependencies :
sprintf-js : 1.0 .3
argparse@2.0.1 : {}
aria-query@5.3.2 : {}
array-buffer-byte-length@1.0.2 :
dependencies :
call-bound : 1.0 .4
is-array-buffer : 3.0 .5
array-find-index@1.0.2 : {}
array-includes@3.1.9 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-object-atoms : 1.1 .2
get-intrinsic : 1.3 .0
is-string : 1.1 .1
math-intrinsics : 1.1 .0
array-union@2.1.0 : {}
array.prototype.findlast@1.2.5 :
dependencies :
call-bind : 1.0 .9
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-errors : 1.3 .0
es-object-atoms : 1.1 .2
es-shim-unscopables : 1.1 .0
array.prototype.findlastindex@1.2.6 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-errors : 1.3 .0
es-object-atoms : 1.1 .2
es-shim-unscopables : 1.1 .0
array.prototype.flat@1.3.3 :
dependencies :
call-bind : 1.0 .9
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-shim-unscopables : 1.1 .0
array.prototype.flatmap@1.3.3 :
dependencies :
call-bind : 1.0 .9
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-shim-unscopables : 1.1 .0
array.prototype.tosorted@1.1.4 :
dependencies :
call-bind : 1.0 .9
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-errors : 1.3 .0
es-shim-unscopables : 1.1 .0
arraybuffer.prototype.slice@1.0.4 :
dependencies :
array-buffer-byte-length : 1.0 .2
call-bind : 1.0 .9
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-errors : 1.3 .0
get-intrinsic : 1.3 .0
is-array-buffer : 3.0 .5
arrgv@1.0.2 : {}
arrify@1.0.1 : {}
arrify@2.0.1 : {}
ast-types-flow@0.0.8 : {}
astral-regex@2.0.0 : {}
async-function@1.0.0 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
async@3.2.6 : {}
2026-08-30 00:10:11 +03:00
ava@3.15.0(supports-color@7.2.0) :
dependencies :
'@concordance/react' : 2.0 .0
acorn : 8.17 .0
acorn-walk : 8.3 .5
ansi-styles : 5.2 .0
arrgv : 1.0 .2
arrify : 2.0 .1
callsites : 3.1 .0
chalk : 4.1 .2
chokidar : 3.6 .0
chunkd : 2.0 .1
ci-info : 2.0 .0
ci-parallel-vars : 1.0 .1
clean-yaml-object : 0.1 .0
cli-cursor : 3.1 .0
cli-truncate : 2.1 .0
code-excerpt : 3.0 .0
common-path-prefix : 3.0 .0
concordance : 5.0 .4
convert-source-map : 1.9 .0
currently-unhandled : 0.4 .1
debug : 4.4 .3 (supports-color@7.2.0)
del : 6.1 .1
emittery : 0.8 .1
equal-length : 1.0 .1
figures : 3.2 .0
globby : 11.1 .0
ignore-by-default : 2.1 .0
import-local : 3.2 .0
indent-string : 4.0 .0
is-error : 2.2 .2
is-plain-object : 5.0 .0
is-promise : 4.0 .0
lodash : 4.18 .1
matcher : 3.0 .0
md5-hex : 3.0 .1
mem : 8.1 .1
ms : 2.1 .3
ora : 5.4 .1
p-event : 4.2 .0
p-map : 4.0 .0
picomatch : 2.3 .2
pkg-conf : 3.1 .0
plur : 4.0 .0
pretty-ms : 7.0 .1
read-pkg : 5.2 .0
resolve-cwd : 3.0 .0
slash : 3.0 .0
source-map-support : 0.5 .21
stack-utils : 2.0 .6
strip-ansi : 6.0 .1
supertap : 2.0 .0
temp-dir : 2.0 .0
trim-off-newlines : 1.0 .3
update-notifier : 5.1 .0
write-file-atomic : 3.0 .3
yargs : 16.2 .0
transitivePeerDependencies :
- supports-color
available-typed-arrays@1.0.7 :
dependencies :
possible-typed-array-names : 1.1 .0
axe-core@4.12.1 : {}
axobject-query@4.1.0 : {}
babel-plugin-add-module-exports@1.0.4 : {}
babel-plugin-istanbul@8.0.0(supports-color@7.2.0) :
dependencies :
'@babel/helper-plugin-utils' : 7.29 .7
'@istanbuljs/load-nyc-config' : 1.1 .0
'@istanbuljs/schema' : 0.1 .6
istanbul-lib-instrument : 6.0 .3 (supports-color@7.2.0)
test-exclude : 7.0 .2
transitivePeerDependencies :
- supports-color
babel-plugin-polyfill-corejs2@0.4.17(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0) :
dependencies :
'@babel/compat-data' : 7.29 .7
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-define-polyfill-provider' : 0.6 .8 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
semver : 6.3 .1
transitivePeerDependencies :
- supports-color
babel-plugin-polyfill-corejs3@0.14.2(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0) :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-define-polyfill-provider' : 0.6 .8 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
core-js-compat : 3.49 .0
transitivePeerDependencies :
- supports-color
babel-plugin-polyfill-regenerator@0.6.8(@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0) :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/helper-define-polyfill-provider' : 0.6 .8 (@babel/core@7.29.7(supports-color@7.2.0))(supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
backbone@1.6.1 :
dependencies :
underscore : 1.13 .8
balanced-match@1.0.2 : {}
balanced-match@4.0.4 : {}
base64-js@1.5.1 : {}
base64id@2.0.0 : {}
baseline-browser-mapping@2.10.37 : {}
binary-extensions@2.3.0 : {}
bl@4.1.0 :
dependencies :
buffer : 5.7 .1
inherits : 2.0 .4
readable-stream : 3.6 .2
bluebird@3.7.2 : {}
blueimp-md5@2.19.0 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
body-parser@2.3.0(supports-color@7.2.0) :
2026-08-30 00:10:11 +03:00
dependencies :
bytes : 3.1 .2
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
content-type : 2.0 .0
2026-08-30 00:10:11 +03:00
debug : 4.4 .3 (supports-color@7.2.0)
http-errors : 2.0 .1
iconv-lite : 0.7 .2
on-finished : 2.4 .1
qs : 6.15 .2
raw-body : 3.0 .2
type-is : 2.1 .0
transitivePeerDependencies :
- supports-color
boxen@5.1.2 :
dependencies :
ansi-align : 3.0 .1
camelcase : 6.3 .0
chalk : 4.1 .2
cli-boxes : 2.2 .1
string-width : 4.2 .3
type-fest : 0.20 .2
widest-line : 3.1 .0
wrap-ansi : 7.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
brace-expansion@1.1.18 :
2026-08-30 00:10:11 +03:00
dependencies :
balanced-match : 1.0 .2
concat-map : 0.0 .1
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
brace-expansion@2.1.4 :
2026-08-30 00:10:11 +03:00
dependencies :
balanced-match : 1.0 .2
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
brace-expansion@5.0.9 :
2026-08-30 00:10:11 +03:00
dependencies :
balanced-match : 4.0 .4
braces@3.0.3 :
dependencies :
fill-range : 7.1 .1
browserslist@4.28.2 :
dependencies :
baseline-browser-mapping : 2.10 .37
caniuse-lite : 1.0 .30001799
electron-to-chromium : 1.5 .372
node-releases : 2.0 .47
update-browserslist-db : 1.2 .3 (browserslist@4.28.2)
buffer-from@1.1.2 : {}
buffer@5.7.1 :
dependencies :
base64-js : 1.5 .1
ieee754 : 1.2 .1
bytes@3.1.2 : {}
cac@7.0.0 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
cacheable-lookup@5.0.4 : {}
cacheable-request@7.0.4 :
2026-08-30 00:10:11 +03:00
dependencies :
clone-response : 1.0 .3
get-stream : 5.2 .0
http-cache-semantics : 4.2 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
keyv : 4.5 .4
2026-08-30 00:10:11 +03:00
lowercase-keys : 2.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
normalize-url : 6.1 .0
responselike : 2.0 .1
2026-08-30 00:10:11 +03:00
caching-transform@4.0.0 :
dependencies :
hasha : 5.2 .2
make-dir : 3.1 .0
package-hash : 4.0 .0
write-file-atomic : 3.0 .3
call-bind-apply-helpers@1.0.2 :
dependencies :
es-errors : 1.3 .0
function-bind : 1.1 .2
call-bind@1.0.9 :
dependencies :
call-bind-apply-helpers : 1.0 .2
es-define-property : 1.0 .1
get-intrinsic : 1.3 .0
set-function-length : 1.2 .2
call-bound@1.0.4 :
dependencies :
call-bind-apply-helpers : 1.0 .2
get-intrinsic : 1.3 .0
callsites@3.1.0 : {}
camelcase@5.3.1 : {}
camelcase@6.3.0 : {}
caniuse-lite@1.0.30001799 : {}
catharsis@0.9.0 :
dependencies :
lodash : 4.18 .1
chalk@4.1.2 :
dependencies :
ansi-styles : 4.3 .0
supports-color : 7.2 .0
chalk@5.6.2 : {}
char-regex@1.0.2 : {}
charm@1.0.2 :
dependencies :
inherits : 2.0 .4
chokidar@3.6.0 :
dependencies :
anymatch : 3.1 .3
braces : 3.0 .3
glob-parent : 5.1 .2
is-binary-path : 2.1 .0
is-glob : 4.0 .3
normalize-path : 3.0 .0
readdirp : 3.6 .0
optionalDependencies :
fsevents : 2.3 .3
chokidar@5.0.0 :
dependencies :
readdirp : 5.0 .0
chunkd@2.0.1 : {}
ci-info@2.0.0 : {}
ci-parallel-vars@1.0.1 : {}
cjs-module-lexer@1.4.3 : {}
clean-stack@2.2.0 : {}
clean-yaml-object@0.1.0 : {}
cli-boxes@2.2.1 : {}
cli-cursor@3.1.0 :
dependencies :
restore-cursor : 3.1 .0
cli-highlight@2.1.11 :
dependencies :
chalk : 4.1 .2
highlight.js : 10.7 .3
mz : 2.7 .0
parse5 : 5.1 .1
parse5-htmlparser2-tree-adapter : 6.0 .1
yargs : 16.2 .0
cli-spinners@2.9.2 : {}
cli-table3@0.6.5 :
dependencies :
string-width : 4.2 .3
optionalDependencies :
'@colors/colors' : 1.5 .0
cli-truncate@2.1.0 :
dependencies :
slice-ansi : 3.0 .0
string-width : 4.2 .3
cliui@6.0.0 :
dependencies :
string-width : 4.2 .3
strip-ansi : 6.0 .1
wrap-ansi : 6.2 .0
cliui@7.0.4 :
dependencies :
string-width : 4.2 .3
strip-ansi : 6.0 .1
wrap-ansi : 7.0 .0
clone-deep@4.0.1 :
dependencies :
is-plain-object : 2.0 .4
kind-of : 6.0 .3
shallow-clone : 3.0 .1
clone-response@1.0.3 :
dependencies :
mimic-response : 1.0 .1
clone@1.0.4 : {}
code-excerpt@3.0.0 :
dependencies :
convert-to-spaces : 1.0 .2
color-convert@2.0.1 :
dependencies :
color-name : 1.1 .4
color-name@1.1.4 : {}
commander@10.0.1 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
commander@13.1.0 : {}
2026-08-30 00:10:11 +03:00
commander@14.0.3 : {}
commander@2.20.3 : {}
commander@6.2.1 : {}
comment-parser@1.4.7 : {}
common-path-prefix@3.0.0 : {}
commondir@1.0.1 : {}
compressible@2.0.18 :
dependencies :
mime-db : 1.54 .0
compression@1.8.1(supports-color@7.2.0) :
dependencies :
bytes : 3.1 .2
compressible : 2.0 .18
debug : 2.6 .9 (supports-color@7.2.0)
negotiator : 0.6 .4
on-headers : 1.1 .0
safe-buffer : 5.2 .1
vary : 1.1 .2
transitivePeerDependencies :
- supports-color
concat-map@0.0.1 : {}
concordance@5.0.4 :
dependencies :
date-time : 3.1 .0
esutils : 2.0 .3
fast-diff : 1.3 .0
js-string-escape : 1.0 .1
lodash : 4.18 .1
md5-hex : 3.0 .1
semver : 7.8 .5
well-known-symbols : 2.0 .0
configstore@5.0.1 :
dependencies :
dot-prop : 5.3 .0
graceful-fs : 4.2 .11
make-dir : 3.1 .0
unique-string : 2.0 .0
write-file-atomic : 3.0 .3
xdg-basedir : 4.0 .0
confusing-browser-globals@1.0.11 : {}
consolidate@1.0.4(@babel/core@7.29.7(supports-color@7.2.0))(lodash@4.18.1)(mustache@4.2.0)(underscore@1.13.8) :
optionalDependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
lodash : 4.18 .1
mustache : 4.2 .0
underscore : 1.13 .8
content-disposition@1.1.0 : {}
content-type@1.0.5 : {}
content-type@2.0.0 : {}
convert-source-map@1.9.0 : {}
convert-source-map@2.0.0 : {}
convert-to-spaces@1.0.2 : {}
cookie-signature@1.2.2 : {}
cookie@0.7.2 : {}
core-js-compat@3.49.0 :
dependencies :
browserslist : 4.28 .2
core-js@3.49.0 : {}
cors@2.8.6 :
dependencies :
object-assign : 4.1 .1
vary : 1.1 .2
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
coveralls-next@6.0.2 :
2026-08-30 00:10:11 +03:00
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
js-yaml : 4.3 .2
2026-08-30 00:10:11 +03:00
lcov-parse : 1.0 .0
cross-spawn@7.0.6 :
dependencies :
path-key : 3.1 .1
shebang-command : 2.0 .0
which : 2.0 .2
crypto-random-string@2.0.0 : {}
currently-unhandled@0.4.1 :
dependencies :
array-find-index : 1.0 .2
damerau-levenshtein@1.0.8 : {}
data-view-buffer@1.0.2 :
dependencies :
call-bound : 1.0 .4
es-errors : 1.3 .0
is-data-view : 1.0 .2
data-view-byte-length@1.0.2 :
dependencies :
call-bound : 1.0 .4
es-errors : 1.3 .0
is-data-view : 1.0 .2
data-view-byte-offset@1.0.1 :
dependencies :
call-bound : 1.0 .4
es-errors : 1.3 .0
is-data-view : 1.0 .2
date-time@3.1.0 :
dependencies :
time-zone : 1.0 .0
debug@2.6.9(supports-color@7.2.0) :
dependencies :
ms : 2.0 .0
optionalDependencies :
supports-color : 7.2 .0
debug@3.2.7(supports-color@7.2.0) :
dependencies :
ms : 2.1 .3
optionalDependencies :
supports-color : 7.2 .0
debug@4.4.3(supports-color@7.2.0) :
dependencies :
ms : 2.1 .3
optionalDependencies :
supports-color : 7.2 .0
decamelize@1.2.0 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
decompress-response@6.0.0 :
2026-08-30 00:10:11 +03:00
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
mimic-response : 3.1 .0
2026-08-30 00:10:11 +03:00
deep-extend@0.6.0 : {}
deep-is@0.1.4 : {}
default-require-extensions@3.0.1 :
dependencies :
strip-bom : 4.0 .0
defaults@1.0.4 :
dependencies :
clone : 1.0 .4
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
defer-to-connect@2.0.1 : {}
2026-08-30 00:10:11 +03:00
define-data-property@1.1.4 :
dependencies :
es-define-property : 1.0 .1
es-errors : 1.3 .0
gopd : 1.2 .0
define-properties@1.2.1 :
dependencies :
define-data-property : 1.1 .4
has-property-descriptors : 1.0 .2
object-keys : 1.1 .1
defu@6.1.7 : {}
del@6.1.1 :
dependencies :
globby : 11.1 .0
graceful-fs : 4.2 .11
is-glob : 4.0 .3
is-path-cwd : 2.2 .0
is-path-inside : 3.0 .3
p-map : 4.0 .0
rimraf : 3.0 .2
slash : 3.0 .0
depd@2.0.0 : {}
diff@9.0.0 : {}
dir-glob@3.0.1 :
dependencies :
path-type : 4.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
docdash@2.0.2 :
dependencies :
'@jsdoc/salty' : 0.2 .12
2026-08-30 00:10:11 +03:00
doctrine@2.1.0 :
dependencies :
esutils : 2.0 .3
dot-prop@5.3.0 :
dependencies :
is-obj : 2.0 .0
dts-resolver@3.0.0 : {}
dunder-proto@1.0.1 :
dependencies :
call-bind-apply-helpers : 1.0 .2
es-errors : 1.3 .0
gopd : 1.2 .0
eastasianwidth@0.2.0 : {}
ee-first@1.1.1 : {}
electron-to-chromium@1.5.372 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
email-addresses@5.0.0 : {}
2026-08-30 00:10:11 +03:00
emittery@0.8.1 : {}
emoji-regex@8.0.0 : {}
emoji-regex@9.2.2 : {}
emojilib@2.4.0 : {}
empathic@2.0.1 : {}
encodeurl@2.0.0 : {}
end-of-stream@1.4.5 :
dependencies :
once : 1.4 .0
engine.io-parser@5.2.3 : {}
engine.io@6.6.8(supports-color@7.2.0) :
dependencies :
'@types/cors' : 2.8 .19
'@types/node' : 25.9 .3
'@types/ws' : 8.18 .1
accepts : 1.3 .8
base64id : 2.0 .0
cookie : 0.7 .2
cors : 2.8 .6
debug : 4.4 .3 (supports-color@7.2.0)
engine.io-parser : 5.2 .3
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
ws : 8.21 .3
2026-08-30 00:10:11 +03:00
transitivePeerDependencies :
- bufferutil
- supports-color
- utf-8-validate
enhanced-resolve@5.24.0 :
dependencies :
graceful-fs : 4.2 .11
tapable : 2.3 .3
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
entities@4.5.0 : {}
2026-08-30 00:10:11 +03:00
environment@1.1.0 : {}
equal-length@1.0.1 : {}
error-ex@1.3.4 :
dependencies :
is-arrayish : 0.2 .1
es-abstract@1.24.2 :
dependencies :
array-buffer-byte-length : 1.0 .2
arraybuffer.prototype.slice : 1.0 .4
available-typed-arrays : 1.0 .7
call-bind : 1.0 .9
call-bound : 1.0 .4
data-view-buffer : 1.0 .2
data-view-byte-length : 1.0 .2
data-view-byte-offset : 1.0 .1
es-define-property : 1.0 .1
es-errors : 1.3 .0
es-object-atoms : 1.1 .2
es-set-tostringtag : 2.1 .0
es-to-primitive : 1.3 .0
function.prototype.name : 1.2 .0
get-intrinsic : 1.3 .0
get-proto : 1.0 .1
get-symbol-description : 1.1 .0
globalthis : 1.0 .4
gopd : 1.2 .0
has-property-descriptors : 1.0 .2
has-proto : 1.2 .0
has-symbols : 1.1 .0
hasown : 2.0 .4
internal-slot : 1.1 .0
is-array-buffer : 3.0 .5
is-callable : 1.2 .7
is-data-view : 1.0 .2
is-negative-zero : 2.0 .3
is-regex : 1.2 .1
is-set : 2.0 .3
is-shared-array-buffer : 1.0 .4
is-string : 1.1 .1
is-typed-array : 1.1 .15
is-weakref : 1.1 .1
math-intrinsics : 1.1 .0
object-inspect : 1.13 .4
object-keys : 1.1 .1
object.assign : 4.1 .7
own-keys : 1.0 .1
regexp.prototype.flags : 1.5 .4
safe-array-concat : 1.1 .4
safe-push-apply : 1.0 .0
safe-regex-test : 1.1 .0
set-proto : 1.0 .0
stop-iteration-iterator : 1.1 .0
string.prototype.trim : 1.2 .11
string.prototype.trimend : 1.0 .10
string.prototype.trimstart : 1.0 .8
typed-array-buffer : 1.0 .3
typed-array-byte-length : 1.0 .3
typed-array-byte-offset : 1.0 .4
typed-array-length : 1.0 .8
unbox-primitive : 1.1 .0
which-typed-array : 1.1 .22
es-define-property@1.0.1 : {}
es-errors@1.3.0 : {}
es-iterator-helpers@1.3.3 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-errors : 1.3 .0
es-set-tostringtag : 2.1 .0
function-bind : 1.1 .2
get-intrinsic : 1.3 .0
globalthis : 1.0 .4
gopd : 1.2 .0
has-property-descriptors : 1.0 .2
has-proto : 1.2 .0
has-symbols : 1.1 .0
internal-slot : 1.1 .0
iterator.prototype : 1.1 .5
math-intrinsics : 1.1 .0
es-object-atoms@1.1.2 :
dependencies :
es-errors : 1.3 .0
es-set-tostringtag@2.1.0 :
dependencies :
es-errors : 1.3 .0
get-intrinsic : 1.3 .0
has-tostringtag : 1.0 .2
hasown : 2.0 .4
es-shim-unscopables@1.1.0 :
dependencies :
hasown : 2.0 .4
es-to-primitive@1.3.0 :
dependencies :
is-callable : 1.2 .7
is-date-object : 1.1 .0
is-symbol : 1.1 .1
es6-error@4.1.1 : {}
escalade@3.2.0 : {}
escape-goat@2.1.1 : {}
escape-html@1.0.3 : {}
escape-string-regexp@1.0.5 : {}
escape-string-regexp@2.0.0 : {}
escape-string-regexp@4.0.0 : {}
eslint-compat-utils@0.5.1(eslint@10.8.0(supports-color@7.2.0)) :
dependencies :
eslint : 10.8 .0 (supports-color@7.2.0)
semver : 7.8 .5
eslint-config-airbnb-extended@3.1.0(@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(@typescript-eslint/utils@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10(supports-color@7.2.0))(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3) :
dependencies :
'@next/eslint-plugin-next' : 16.2 .9
'@stylistic/eslint-plugin' : 5.10 .0 (eslint@10.8.0(supports-color@7.2.0))
confusing-browser-globals : 1.0 .11
eslint : 10.8 .0 (supports-color@7.2.0)
eslint-import-resolver-typescript : 4.4 .5 (eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10(supports-color@7.2.0))(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0))(eslint-plugin-import@2.32.0)(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)
eslint-plugin-import : 2.32 .0 (@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)
eslint-plugin-import-x : 4.16 .2 (@typescript-eslint/utils@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10(supports-color@7.2.0))(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)
eslint-plugin-jsx-a11y : 6.10 .2 (eslint@10.8.0(supports-color@7.2.0))
eslint-plugin-n : 17.24 .0 (eslint@10.8.0(supports-color@7.2.0))(typescript@5.9.3)
eslint-plugin-react : 7.37 .5 (eslint@10.8.0(supports-color@7.2.0))
eslint-plugin-react-hooks : 7.1 .1 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)
globals : 17.6 .0
typescript-eslint : 8.61 .0 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
transitivePeerDependencies :
- '@typescript-eslint/parser'
- '@typescript-eslint/utils'
- eslint-import-resolver-node
- eslint-import-resolver-webpack
- supports-color
- typescript
eslint-import-context@0.1.9(unrs-resolver@1.12.2) :
dependencies :
get-tsconfig : 4.14 .0
stable-hash-x : 0.2 .0
optionalDependencies :
unrs-resolver : 1.12 .2
eslint-import-resolver-node@0.3.10(supports-color@7.2.0) :
dependencies :
debug : 3.2 .7 (supports-color@7.2.0)
is-core-module : 2.16 .2
resolve : 2.0 .0 -next.7
transitivePeerDependencies :
- supports-color
eslint-import-resolver-typescript@4.4.5(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10(supports-color@7.2.0))(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0))(eslint-plugin-import@2.32.0)(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0) :
dependencies :
debug : 4.4 .3 (supports-color@7.2.0)
eslint : 10.8 .0 (supports-color@7.2.0)
eslint-import-context : 0.1 .9 (unrs-resolver@1.12.2)
get-tsconfig : 4.14 .0
is-bun-module : 2.0 .0
stable-hash-x : 0.2 .0
tinyglobby : 0.2 .17
unrs-resolver : 1.12 .2
optionalDependencies :
eslint-plugin-import : 2.32 .0 (@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)
eslint-plugin-import-x : 4.16 .2 (@typescript-eslint/utils@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10(supports-color@7.2.0))(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
eslint-module-utils@2.13.0(@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10(supports-color@7.2.0))(eslint-import-resolver-typescript@4.4.5)(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0) :
dependencies :
debug : 3.2 .7 (supports-color@7.2.0)
optionalDependencies :
'@typescript-eslint/parser' : 8.61 .0 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
eslint : 10.8 .0 (supports-color@7.2.0)
eslint-import-resolver-node : 0.3 .10 (supports-color@7.2.0)
eslint-import-resolver-typescript : 4.4 .5 (eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10(supports-color@7.2.0))(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0))(eslint-plugin-import@2.32.0)(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
eslint-plugin-ava@17.0.1(eslint@10.8.0(supports-color@7.2.0)) :
dependencies :
'@eslint-community/eslint-utils' : 4.9 .1 (eslint@10.8.0(supports-color@7.2.0))
'@eslint/json' : 2.0 .0
eslint : 10.8 .0 (supports-color@7.2.0)
espree : 11.2 .0
espurify : 3.2 .0
micro-spelling-correcter : 1.1 .1
resolve-from : 5.0 .0
eslint-plugin-es-x@7.8.0(eslint@10.8.0(supports-color@7.2.0)) :
dependencies :
'@eslint-community/eslint-utils' : 4.9 .1 (eslint@10.8.0(supports-color@7.2.0))
'@eslint-community/regexpp' : 4.12 .2
eslint : 10.8 .0 (supports-color@7.2.0)
eslint-compat-utils : 0.5 .1 (eslint@10.8.0(supports-color@7.2.0))
eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10(supports-color@7.2.0))(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0) :
dependencies :
'@package-json/types' : 0.0 .12
'@typescript-eslint/types' : 8.61 .0
comment-parser : 1.4 .7
debug : 4.4 .3 (supports-color@7.2.0)
eslint : 10.8 .0 (supports-color@7.2.0)
eslint-import-context : 0.1 .9 (unrs-resolver@1.12.2)
is-glob : 4.0 .3
minimatch : 10.2 .5
semver : 7.8 .5
stable-hash-x : 0.2 .0
unrs-resolver : 1.12 .2
optionalDependencies :
'@typescript-eslint/utils' : 8.61 .0 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
eslint-import-resolver-node : 0.3 .10 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0) :
dependencies :
'@rtsao/scc' : 1.1 .0
array-includes : 3.1 .9
array.prototype.findlastindex : 1.2 .6
array.prototype.flat : 1.3 .3
array.prototype.flatmap : 1.3 .3
debug : 3.2 .7 (supports-color@7.2.0)
doctrine : 2.1 .0
eslint : 10.8 .0 (supports-color@7.2.0)
eslint-import-resolver-node : 0.3 .10 (supports-color@7.2.0)
eslint-module-utils : 2.13 .0 (@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint-import-resolver-node@0.3.10(supports-color@7.2.0))(eslint-import-resolver-typescript@4.4.5)(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)
hasown : 2.0 .4
is-core-module : 2.16 .2
is-glob : 4.0 .3
minimatch : 3.1 .5
object.fromentries : 2.0 .8
object.groupby : 1.0 .3
object.values : 1.2 .1
semver : 6.3 .1
string.prototype.trimend : 1.0 .10
tsconfig-paths : 3.15 .0
optionalDependencies :
'@typescript-eslint/parser' : 8.61 .0 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
transitivePeerDependencies :
- eslint-import-resolver-typescript
- eslint-import-resolver-webpack
- supports-color
eslint-plugin-jsx-a11y@6.10.2(eslint@10.8.0(supports-color@7.2.0)) :
dependencies :
aria-query : 5.3 .2
array-includes : 3.1 .9
array.prototype.flatmap : 1.3 .3
ast-types-flow : 0.0 .8
axe-core : 4.12 .1
axobject-query : 4.1 .0
damerau-levenshtein : 1.0 .8
emoji-regex : 9.2 .2
eslint : 10.8 .0 (supports-color@7.2.0)
hasown : 2.0 .4
jsx-ast-utils : 3.3 .5
language-tags : 1.0 .9
minimatch : 3.1 .5
object.fromentries : 2.0 .8
safe-regex-test : 1.1 .0
string.prototype.includes : 2.0 .1
eslint-plugin-n@17.24.0(eslint@10.8.0(supports-color@7.2.0))(typescript@5.9.3) :
dependencies :
'@eslint-community/eslint-utils' : 4.9 .1 (eslint@10.8.0(supports-color@7.2.0))
enhanced-resolve : 5.24 .0
eslint : 10.8 .0 (supports-color@7.2.0)
eslint-plugin-es-x : 7.8 .0 (eslint@10.8.0(supports-color@7.2.0))
get-tsconfig : 4.14 .0
globals : 15.15 .0
globrex : 0.1 .2
ignore : 5.3 .2
semver : 7.8 .5
ts-declaration-location : 1.0 .7 (typescript@5.9.3)
transitivePeerDependencies :
- typescript
eslint-plugin-react-hooks@7.1.1(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0) :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/parser' : 7.29 .7
eslint : 10.8 .0 (supports-color@7.2.0)
hermes-parser : 0.25 .1
zod : 4.4 .3
zod-validation-error : 4.0 .2 (zod@4.4.3)
transitivePeerDependencies :
- supports-color
eslint-plugin-react@7.37.5(eslint@10.8.0(supports-color@7.2.0)) :
dependencies :
array-includes : 3.1 .9
array.prototype.findlast : 1.2 .5
array.prototype.flatmap : 1.3 .3
array.prototype.tosorted : 1.1 .4
doctrine : 2.1 .0
es-iterator-helpers : 1.3 .3
eslint : 10.8 .0 (supports-color@7.2.0)
estraverse : 5.3 .0
hasown : 2.0 .4
jsx-ast-utils : 3.3 .5
minimatch : 3.1 .5
object.entries : 1.1 .9
object.fromentries : 2.0 .8
object.values : 1.2 .1
prop-types : 15.8 .1
resolve : 2.0 .0 -next.7
semver : 6.3 .1
string.prototype.matchall : 4.0 .12
string.prototype.repeat : 1.0 .0
eslint-scope@9.1.2 :
dependencies :
'@types/esrecurse' : 4.3 .1
'@types/estree' : 1.0 .9
esrecurse : 4.3 .0
estraverse : 5.3 .0
eslint-visitor-keys@3.4.3 : {}
eslint-visitor-keys@4.2.1 : {}
eslint-visitor-keys@5.0.1 : {}
eslint@10.8.0(supports-color@7.2.0) :
dependencies :
'@eslint-community/eslint-utils' : 4.9 .1 (eslint@10.8.0(supports-color@7.2.0))
'@eslint-community/regexpp' : 4.12 .2
'@eslint/config-array' : 0.23 .5 (supports-color@7.2.0)
'@eslint/config-helpers' : 0.7 .0
'@eslint/core' : 1.2 .1
'@eslint/plugin-kit' : 0.7 .2
'@humanfs/node' : 0.16 .8
'@humanwhocodes/module-importer' : 1.0 .1
'@humanwhocodes/retry' : 0.4 .3
'@types/estree' : 1.0 .9
ajv : 6.15 .0
cross-spawn : 7.0 .6
debug : 4.4 .3 (supports-color@7.2.0)
escape-string-regexp : 4.0 .0
eslint-scope : 9.1 .2
eslint-visitor-keys : 5.0 .1
espree : 11.2 .0
esquery : 1.7 .0
esutils : 2.0 .3
fast-deep-equal : 3.1 .3
file-entry-cache : 8.0 .0
find-up : 5.0 .0
glob-parent : 6.0 .2
ignore : 5.3 .2
imurmurhash : 0.1 .4
is-glob : 4.0 .3
json-stable-stringify-without-jsonify : 1.0 .1
minimatch : 10.2 .5
natural-compare : 1.4 .0
optionator : 0.9 .4
transitivePeerDependencies :
- supports-color
espree@10.4.0 :
dependencies :
acorn : 8.17 .0
acorn-jsx : 5.3 .2 (acorn@8.17.0)
eslint-visitor-keys : 4.2 .1
espree@11.2.0 :
dependencies :
acorn : 8.17 .0
acorn-jsx : 5.3 .2 (acorn@8.17.0)
eslint-visitor-keys : 5.0 .1
esprima@4.0.1 : {}
espurify@3.2.0 : {}
esquery@1.7.0 :
dependencies :
estraverse : 5.3 .0
esrecurse@4.3.0 :
dependencies :
estraverse : 5.3 .0
estraverse@5.3.0 : {}
esutils@2.0.3 : {}
etag@1.8.1 : {}
eventemitter3@4.0.7 : {}
events-to-array@2.0.3 : {}
execa@9.6.1 :
dependencies :
'@sindresorhus/merge-streams' : 4.0 .0
cross-spawn : 7.0 .6
figures : 6.1 .0
get-stream : 9.0 .1
human-signals : 8.0 .1
is-plain-obj : 4.1 .0
is-stream : 4.0 .1
npm-run-path : 6.0 .0
pretty-ms : 9.3 .0
signal-exit : 4.1 .0
strip-final-newline : 4.0 .0
yoctocolors : 2.1 .2
express@5.2.1(supports-color@7.2.0) :
dependencies :
accepts : 2.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
body-parser : 2.3 .0 (supports-color@7.2.0)
2026-08-30 00:10:11 +03:00
content-disposition : 1.1 .0
content-type : 1.0 .5
cookie : 0.7 .2
cookie-signature : 1.2 .2
debug : 4.4 .3 (supports-color@7.2.0)
depd : 2.0 .0
encodeurl : 2.0 .0
escape-html : 1.0 .3
etag : 1.8 .1
finalhandler : 2.1 .1 (supports-color@7.2.0)
fresh : 2.0 .0
http-errors : 2.0 .1
merge-descriptors : 2.0 .0
mime-types : 3.0 .2
on-finished : 2.4 .1
once : 1.4 .0
parseurl : 1.3 .3
proxy-addr : 2.0 .7
qs : 6.15 .2
range-parser : 1.2 .1
router : 2.2 .0 (supports-color@7.2.0)
send : 1.2 .1 (supports-color@7.2.0)
serve-static : 2.2 .1 (supports-color@7.2.0)
statuses : 2.0 .2
type-is : 2.1 .0
vary : 1.1 .2
transitivePeerDependencies :
- supports-color
fast-deep-equal@3.1.3 : {}
fast-diff@1.3.0 : {}
fast-glob@3.3.1 :
dependencies :
'@nodelib/fs.stat' : 2.0 .5
'@nodelib/fs.walk' : 1.2 .8
glob-parent : 5.1 .2
merge2 : 1.4 .1
micromatch : 4.0 .8
fast-glob@3.3.3 :
dependencies :
'@nodelib/fs.stat' : 2.0 .5
'@nodelib/fs.walk' : 1.2 .8
glob-parent : 5.1 .2
merge2 : 1.4 .1
micromatch : 4.0 .8
fast-json-stable-stringify@2.1.0 : {}
fast-levenshtein@2.0.6 : {}
fastq@1.20.1 :
dependencies :
reusify : 1.1 .0
fdir@6.5.0(picomatch@4.0.5) :
optionalDependencies :
picomatch : 4.0 .5
fflate@0.8.3 : {}
figures@3.2.0 :
dependencies :
escape-string-regexp : 1.0 .5
figures@6.1.0 :
dependencies :
is-unicode-supported : 2.1 .0
file-entry-cache@8.0.0 :
dependencies :
flat-cache : 4.0 .1
filename-reserved-regex@2.0.0 : {}
filenamify@4.3.0 :
dependencies :
filename-reserved-regex : 2.0 .0
strip-outer : 1.0 .1
trim-repeated : 1.0 .0
fill-range@7.1.1 :
dependencies :
to-regex-range : 5.0 .1
finalhandler@2.1.1(supports-color@7.2.0) :
dependencies :
debug : 4.4 .3 (supports-color@7.2.0)
encodeurl : 2.0 .0
escape-html : 1.0 .3
on-finished : 2.4 .1
parseurl : 1.3 .3
statuses : 2.0 .2
transitivePeerDependencies :
- supports-color
find-cache-dir@2.1.0 :
dependencies :
commondir : 1.0 .1
make-dir : 2.1 .0
pkg-dir : 3.0 .0
find-cache-dir@3.3.2 :
dependencies :
commondir : 1.0 .1
make-dir : 3.1 .0
pkg-dir : 4.2 .0
find-up@3.0.0 :
dependencies :
locate-path : 3.0 .0
find-up@4.1.0 :
dependencies :
locate-path : 5.0 .0
path-exists : 4.0 .0
find-up@5.0.0 :
dependencies :
locate-path : 6.0 .0
path-exists : 4.0 .0
flat-cache@4.0.1 :
dependencies :
flatted : 3.4 .2
keyv : 4.5 .4
flatted@3.4.2 : {}
follow-redirects@1.16.0(debug@4.4.3(supports-color@7.2.0)) :
optionalDependencies :
debug : 4.4 .3 (supports-color@7.2.0)
for-each@0.3.5 :
dependencies :
is-callable : 1.2 .7
foreground-child@2.0.0 :
dependencies :
cross-spawn : 7.0 .6
signal-exit : 3.0 .7
foreground-child@3.3.1 :
dependencies :
cross-spawn : 7.0 .6
signal-exit : 4.1 .0
forwarded@0.2.0 : {}
fresh@2.0.0 : {}
fromentries@1.3.2 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
fs-extra@11.4.0 :
2026-08-30 00:10:11 +03:00
dependencies :
graceful-fs : 4.2 .11
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
jsonfile : 6.2 .1
universalify : 2.0 .1
2026-08-30 00:10:11 +03:00
fs-readdir-recursive@1.1.0 : {}
fs.realpath@1.0.0 : {}
fsevents@2.3.3 :
optional : true
function-bind@1.1.2 : {}
function.prototype.name@1.2.0 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
es-define-property : 1.0 .1
es-errors : 1.3 .0
functions-have-names : 1.2 .3
has-property-descriptors : 1.0 .2
hasown : 2.0 .4
is-callable : 1.2 .7
is-document.all : 1.0 .0
functions-have-names@1.2.3 : {}
generator-function@2.0.1 : {}
gensync@1.0.0-beta.2 : {}
get-caller-file@2.0.5 : {}
get-intrinsic@1.3.0 :
dependencies :
call-bind-apply-helpers : 1.0 .2
es-define-property : 1.0 .1
es-errors : 1.3 .0
es-object-atoms : 1.1 .2
function-bind : 1.1 .2
get-proto : 1.0 .1
gopd : 1.2 .0
has-symbols : 1.1 .0
hasown : 2.0 .4
math-intrinsics : 1.1 .0
get-package-type@0.1.0 : {}
get-proto@1.0.1 :
dependencies :
dunder-proto : 1.0 .1
es-object-atoms : 1.1 .2
get-stream@5.2.0 :
dependencies :
pump : 3.0 .4
get-stream@9.0.1 :
dependencies :
'@sec-ant/readable-stream' : 0.4 .1
is-stream : 4.0 .1
get-symbol-description@1.1.0 :
dependencies :
call-bound : 1.0 .4
es-errors : 1.3 .0
get-intrinsic : 1.3 .0
get-tsconfig@4.14.0 :
dependencies :
resolve-pkg-maps : 1.0 .0
get-tsconfig@5.0.0-beta.5 :
dependencies :
resolve-pkg-maps : 1.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
gh-pages@6.3.0 :
2026-08-30 00:10:11 +03:00
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
async : 3.2 .6
commander : 13.1 .0
email-addresses : 5.0 .0
2026-08-30 00:10:11 +03:00
filenamify : 4.3 .0
find-cache-dir : 3.3 .2
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
fs-extra : 11.4 .0
globby : 11.1 .0
2026-08-30 00:10:11 +03:00
glob-parent@5.1.2 :
dependencies :
is-glob : 4.0 .3
glob-parent@6.0.2 :
dependencies :
is-glob : 4.0 .3
glob@10.5.0 :
dependencies :
foreground-child : 3.3 .1
jackspeak : 3.4 .3
minimatch : 9.0 .9
minipass : 7.1 .3
package-json-from-dist : 1.0 .1
path-scurry : 1.11 .1
glob@13.0.6 :
dependencies :
minimatch : 10.2 .5
minipass : 7.1 .3
path-scurry : 2.0 .2
glob@7.2.3 :
dependencies :
fs.realpath : 1.0 .0
inflight : 1.0 .6
inherits : 2.0 .4
minimatch : 3.1 .5
once : 1.4 .0
path-is-absolute : 1.0 .1
global-dirs@3.0.1 :
dependencies :
ini : 2.0 .0
globals@15.15.0 : {}
globals@17.6.0 : {}
globalthis@1.0.4 :
dependencies :
define-properties : 1.2 .1
gopd : 1.2 .0
globby@11.1.0 :
dependencies :
array-union : 2.1 .0
dir-glob : 3.0 .1
fast-glob : 3.3 .3
ignore : 5.3 .2
merge2 : 1.4 .1
slash : 3.0 .0
globrex@0.1.2 : {}
gopd@1.2.0 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
got@11.8.6 :
2026-08-30 00:10:11 +03:00
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@sindresorhus/is' : 4.6 .0
'@szmarczak/http-timer' : 4.0 .6
'@types/cacheable-request' : 6.0 .3
2026-08-30 00:10:11 +03:00
'@types/responselike' : 1.0 .3
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
cacheable-lookup : 5.0 .4
cacheable-request : 7.0 .4
decompress-response : 6.0 .0
http2-wrapper : 1.0 .3
lowercase-keys : 2.0 .0
p-cancelable : 2.1 .1
responselike : 2.0 .1
2026-08-30 00:10:11 +03:00
graceful-fs@4.2.11 : {}
growly@1.3.0 : {}
has-bigints@1.1.0 : {}
has-flag@4.0.0 : {}
has-property-descriptors@1.0.2 :
dependencies :
es-define-property : 1.0 .1
has-proto@1.2.0 :
dependencies :
dunder-proto : 1.0 .1
has-symbols@1.1.0 : {}
has-tostringtag@1.0.2 :
dependencies :
has-symbols : 1.1 .0
has-yarn@2.1.0 : {}
hasha@5.2.2 :
dependencies :
is-stream : 2.0 .1
type-fest : 0.8 .1
hasown@2.0.4 :
dependencies :
function-bind : 1.1 .2
hermes-estree@0.25.1 : {}
hermes-parser@0.25.1 :
dependencies :
hermes-estree : 0.25 .1
highlight.js@10.7.3 : {}
hookable@6.1.1 : {}
hosted-git-info@2.8.9 : {}
html-escaper@2.0.2 : {}
http-cache-semantics@4.2.0 : {}
http-errors@2.0.1 :
dependencies :
depd : 2.0 .0
inherits : 2.0 .4
setprototypeof : 1.2 .0
statuses : 2.0 .2
toidentifier : 1.0 .1
http-proxy@1.18.1(debug@4.4.3(supports-color@7.2.0)) :
dependencies :
eventemitter3 : 4.0 .7
follow-redirects : 1.16 .0 (debug@4.4.3(supports-color@7.2.0))
requires-port : 1.0 .0
transitivePeerDependencies :
- debug
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
http2-wrapper@1.0.3 :
2026-08-30 00:10:11 +03:00
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
quick-lru : 5.1 .1
resolve-alpn : 1.2 .1
2026-08-30 00:10:11 +03:00
human-signals@8.0.1 : {}
iconv-lite@0.7.2 :
dependencies :
safer-buffer : 2.1 .2
ieee754@1.2.1 : {}
ignore-by-default@2.1.0 : {}
ignore@5.3.2 : {}
ignore@7.0.5 : {}
import-lazy@2.1.0 : {}
import-local@3.2.0 :
dependencies :
pkg-dir : 4.2 .0
resolve-cwd : 3.0 .0
import-without-cache@0.4.0 : {}
imurmurhash@0.1.4 : {}
indent-string@4.0.0 : {}
inflight@1.0.6 :
dependencies :
once : 1.4 .0
wrappy : 1.0 .2
inherits@2.0.4 : {}
ini@1.3.8 : {}
ini@2.0.0 : {}
internal-slot@1.1.0 :
dependencies :
es-errors : 1.3 .0
hasown : 2.0 .4
side-channel : 1.1 .1
ipaddr.js@1.9.1 : {}
irregular-plurals@3.5.0 : {}
is-array-buffer@3.0.5 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
get-intrinsic : 1.3 .0
is-arrayish@0.2.1 : {}
is-async-function@2.1.1 :
dependencies :
async-function : 1.0 .0
call-bound : 1.0 .4
get-proto : 1.0 .1
has-tostringtag : 1.0 .2
safe-regex-test : 1.1 .0
is-bigint@1.1.0 :
dependencies :
has-bigints : 1.1 .0
is-binary-path@2.1.0 :
dependencies :
binary-extensions : 2.3 .0
is-boolean-object@1.2.2 :
dependencies :
call-bound : 1.0 .4
has-tostringtag : 1.0 .2
is-bun-module@2.0.0 :
dependencies :
semver : 7.8 .5
is-callable@1.2.7 : {}
is-ci@2.0.0 :
dependencies :
ci-info : 2.0 .0
is-core-module@2.16.2 :
dependencies :
hasown : 2.0 .4
is-data-view@1.0.2 :
dependencies :
call-bound : 1.0 .4
get-intrinsic : 1.3 .0
is-typed-array : 1.1 .15
is-date-object@1.1.0 :
dependencies :
call-bound : 1.0 .4
has-tostringtag : 1.0 .2
is-docker@2.2.1 : {}
is-document.all@1.0.0 :
dependencies :
call-bound : 1.0 .4
is-error@2.2.2 : {}
is-extglob@2.1.1 : {}
is-finalizationregistry@1.1.1 :
dependencies :
call-bound : 1.0 .4
is-fullwidth-code-point@3.0.0 : {}
is-generator-function@1.1.2 :
dependencies :
call-bound : 1.0 .4
generator-function : 2.0 .1
get-proto : 1.0 .1
has-tostringtag : 1.0 .2
safe-regex-test : 1.1 .0
is-glob@4.0.3 :
dependencies :
is-extglob : 2.1 .1
is-installed-globally@0.4.0 :
dependencies :
global-dirs : 3.0 .1
is-path-inside : 3.0 .3
is-interactive@1.0.0 : {}
is-map@2.0.3 : {}
is-negative-zero@2.0.3 : {}
is-npm@5.0.0 : {}
is-number-object@1.1.1 :
dependencies :
call-bound : 1.0 .4
has-tostringtag : 1.0 .2
is-number@7.0.0 : {}
is-obj@2.0.0 : {}
is-path-cwd@2.2.0 : {}
is-path-inside@3.0.3 : {}
is-plain-obj@4.1.0 : {}
is-plain-object@2.0.4 :
dependencies :
isobject : 3.0 .1
is-plain-object@5.0.0 : {}
is-promise@4.0.0 : {}
is-regex@1.2.1 :
dependencies :
call-bound : 1.0 .4
gopd : 1.2 .0
has-tostringtag : 1.0 .2
hasown : 2.0 .4
is-set@2.0.3 : {}
is-shared-array-buffer@1.0.4 :
dependencies :
call-bound : 1.0 .4
is-stream@2.0.1 : {}
is-stream@4.0.1 : {}
is-string@1.1.1 :
dependencies :
call-bound : 1.0 .4
has-tostringtag : 1.0 .2
is-symbol@1.1.1 :
dependencies :
call-bound : 1.0 .4
has-symbols : 1.1 .0
safe-regex-test : 1.1 .0
is-typed-array@1.1.15 :
dependencies :
which-typed-array : 1.1 .22
is-typedarray@1.0.0 : {}
is-unicode-supported@0.1.0 : {}
is-unicode-supported@2.1.0 : {}
is-weakmap@2.0.2 : {}
is-weakref@1.1.1 :
dependencies :
call-bound : 1.0 .4
is-weakset@2.0.4 :
dependencies :
call-bound : 1.0 .4
get-intrinsic : 1.3 .0
is-windows@1.0.2 : {}
is-wsl@2.2.0 :
dependencies :
is-docker : 2.2 .1
is-yarn-global@0.3.0 : {}
isarray@2.0.5 : {}
isexe@2.0.0 : {}
isobject@3.0.1 : {}
istanbul-lib-coverage@3.2.2 : {}
istanbul-lib-hook@3.0.0 :
dependencies :
append-transform : 2.0 .0
istanbul-lib-instrument@6.0.3(supports-color@7.2.0) :
dependencies :
'@babel/core' : 7.29 .7 (supports-color@7.2.0)
'@babel/parser' : 7.29 .7
'@istanbuljs/schema' : 0.1 .6
istanbul-lib-coverage : 3.2 .2
semver : 7.8 .5
transitivePeerDependencies :
- supports-color
istanbul-lib-processinfo@3.0.1 :
dependencies :
archy : 1.0 .0
cross-spawn : 7.0 .6
istanbul-lib-coverage : 3.2 .2
p-map : 3.0 .0
rimraf : 6.1 .3
istanbul-lib-report@3.0.1 :
dependencies :
istanbul-lib-coverage : 3.2 .2
make-dir : 4.0 .0
supports-color : 7.2 .0
istanbul-lib-source-maps@4.0.1(supports-color@7.2.0) :
dependencies :
debug : 4.4 .3 (supports-color@7.2.0)
istanbul-lib-coverage : 3.2 .2
source-map : 0.6 .1
transitivePeerDependencies :
- supports-color
istanbul-reports@3.2.0 :
dependencies :
html-escaper : 2.0 .2
istanbul-lib-report : 3.0 .1
iterator.prototype@1.1.5 :
dependencies :
define-data-property : 1.1 .4
es-object-atoms : 1.1 .2
get-intrinsic : 1.3 .0
get-proto : 1.0 .1
has-symbols : 1.1 .0
set-function-name : 2.0 .2
jackspeak@3.4.3 :
dependencies :
'@isaacs/cliui' : 8.0 .2
optionalDependencies :
'@pkgjs/parseargs' : 0.11 .0
js-string-escape@1.0.1 : {}
js-tokens@4.0.0 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
js-yaml@3.15.2 :
2026-08-30 00:10:11 +03:00
dependencies :
argparse : 1.0 .10
esprima : 4.0 .1
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
js-yaml@4.3.2 :
2026-08-30 00:10:11 +03:00
dependencies :
argparse : 2.0 .1
js2xmlparser@4.0.2 :
dependencies :
xmlcreate : 2.0 .4
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
jsdoc@4.0.5 :
2026-08-30 00:10:11 +03:00
dependencies :
'@babel/parser' : 7.29 .7
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@jsdoc/salty' : 0.2 .12
'@types/markdown-it' : 14.2 .0
2026-08-30 00:10:11 +03:00
bluebird : 3.7 .2
catharsis : 0.9 .0
escape-string-regexp : 2.0 .0
js2xmlparser : 4.0 .2
klaw : 3.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
markdown-it : 14.3 .1
markdown-it-anchor : 8.6 .7 (@types/markdown-it@14.2.0)(markdown-it@14.3.1)
2026-08-30 00:10:11 +03:00
marked : 4.3 .0
mkdirp : 1.0 .4
requizzle : 0.2 .4
strip-json-comments : 3.1 .1
underscore : 1.13 .8
jsesc@3.1.0 : {}
json-buffer@3.0.1 : {}
json-parse-better-errors@1.0.2 : {}
json-parse-even-better-errors@2.3.1 : {}
json-schema-traverse@0.4.1 : {}
json-stable-stringify-without-jsonify@1.0.1 : {}
json5@1.0.2 :
dependencies :
minimist : 1.2 .8
json5@2.2.3 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
jsonfile@6.2.1 :
dependencies :
universalify : 2.0 .1
2026-08-30 00:10:11 +03:00
optionalDependencies :
graceful-fs : 4.2 .11
jsx-ast-utils@3.3.5 :
dependencies :
array-includes : 3.1 .9
array.prototype.flat : 1.3 .3
object.assign : 4.1 .7
object.values : 1.2 .1
keyv@4.5.4 :
dependencies :
json-buffer : 3.0 .1
kind-of@6.0.3 : {}
klaw@3.0.0 :
dependencies :
graceful-fs : 4.2 .11
language-subtag-registry@0.3.23 : {}
language-tags@1.0.9 :
dependencies :
language-subtag-registry : 0.3 .23
latest-version@5.1.0 :
dependencies :
package-json : 6.5 .0
lcov-parse@1.0.0 : {}
levn@0.4.1 :
dependencies :
prelude-ls : 1.2 .1
type-check : 0.4 .0
lines-and-columns@1.2.4 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
linkify-it@5.0.2 :
2026-08-30 00:10:11 +03:00
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
uc.micro : 2.1 .0
2026-08-30 00:10:11 +03:00
load-json-file@5.3.0 :
dependencies :
graceful-fs : 4.2 .11
parse-json : 4.0 .0
pify : 4.0 .1
strip-bom : 3.0 .0
type-fest : 0.3 .1
locate-path@3.0.0 :
dependencies :
p-locate : 3.0 .0
path-exists : 3.0 .0
locate-path@5.0.0 :
dependencies :
p-locate : 4.1 .0
locate-path@6.0.0 :
dependencies :
p-locate : 5.0 .0
lodash.debounce@4.0.8 : {}
lodash.flattendeep@4.4.0 : {}
lodash@4.18.1 : {}
log-symbols@4.1.0 :
dependencies :
chalk : 4.1 .2
is-unicode-supported : 0.1 .0
loose-envify@1.4.0 :
dependencies :
js-tokens : 4.0 .0
lowercase-keys@2.0.0 : {}
lru-cache@10.4.3 : {}
lru-cache@11.5.1 : {}
lru-cache@5.1.1 :
dependencies :
yallist : 3.1 .1
make-dir@2.1.0 :
dependencies :
pify : 4.0 .1
semver : 5.7 .2
make-dir@3.1.0 :
dependencies :
semver : 6.3 .1
make-dir@4.0.0 :
dependencies :
semver : 7.8 .5
map-age-cleaner@0.1.3 :
dependencies :
p-defer : 1.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
markdown-it-anchor@8.6.7(@types/markdown-it@14.2.0)(markdown-it@14.3.1) :
2026-08-30 00:10:11 +03:00
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
'@types/markdown-it' : 14.2 .0
markdown-it : 14.3 .1
2026-08-30 00:10:11 +03:00
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
markdown-it@14.3.1 :
2026-08-30 00:10:11 +03:00
dependencies :
argparse : 2.0 .1
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
entities : 4.5 .0
linkify-it : 5.0 .2
mdurl : 2.1 .0
punycode.js : 2.3 .1
uc.micro : 2.1 .0
2026-08-30 00:10:11 +03:00
marked-terminal@7.3.0(marked@9.1.6) :
dependencies :
ansi-escapes : 7.3 .0
ansi-regex : 6.2 .2
chalk : 5.6 .2
cli-highlight : 2.1 .11
cli-table3 : 0.6 .5
marked : 9.1 .6
node-emoji : 2.2 .0
supports-hyperlinks : 3.2 .0
marked@4.3.0 : {}
marked@9.1.6 : {}
matcher@3.0.0 :
dependencies :
escape-string-regexp : 4.0 .0
math-intrinsics@1.1.0 : {}
md5-hex@3.0.1 :
dependencies :
blueimp-md5 : 2.19 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
mdurl@2.1.0 : {}
2026-08-30 00:10:11 +03:00
media-typer@1.1.0 : {}
mem@8.1.1 :
dependencies :
map-age-cleaner : 0.1 .3
mimic-fn : 3.1 .0
merge-descriptors@2.0.0 : {}
merge2@1.4.1 : {}
micro-spelling-correcter@1.1.1 : {}
micromatch@4.0.8 :
dependencies :
braces : 3.0 .3
picomatch : 2.3 .2
mime-db@1.52.0 : {}
mime-db@1.54.0 : {}
mime-types@2.1.35 :
dependencies :
mime-db : 1.52 .0
mime-types@3.0.2 :
dependencies :
mime-db : 1.54 .0
mimic-fn@2.1.0 : {}
mimic-fn@3.1.0 : {}
mimic-response@1.0.1 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
mimic-response@3.1.0 : {}
2026-08-30 00:10:11 +03:00
minimatch@10.2.5 :
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
brace-expansion : 5.0 .9
2026-08-30 00:10:11 +03:00
minimatch@3.1.5 :
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
brace-expansion : 1.1 .18
2026-08-30 00:10:11 +03:00
minimatch@9.0.9 :
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
brace-expansion : 2.1 .4
2026-08-30 00:10:11 +03:00
minimist@1.2.8 : {}
minipass@7.1.3 : {}
mkdirp@1.0.4 : {}
mkdirp@3.0.1 : {}
mri@1.2.0 : {}
ms@2.0.0 : {}
ms@2.1.3 : {}
mustache@4.2.0 : {}
mz@2.7.0 :
dependencies :
any-promise : 1.3 .0
object-assign : 4.1 .1
thenify-all : 1.6 .0
napi-postinstall@0.3.4 : {}
natural-compare@1.4.0 : {}
negotiator@0.6.3 : {}
negotiator@0.6.4 : {}
negotiator@1.0.0 : {}
node-emoji@2.2.0 :
dependencies :
'@sindresorhus/is' : 4.6 .0
char-regex : 1.0 .2
emojilib : 2.4 .0
skin-tone : 2.0 .0
node-exports-info@1.6.0 :
dependencies :
array.prototype.flatmap : 1.3 .3
es-errors : 1.3 .0
object.entries : 1.1 .9
semver : 6.3 .1
node-preload@0.2.1 :
dependencies :
process-on-spawn : 1.1 .0
node-releases@2.0.47 : {}
normalize-package-data@2.5.0 :
dependencies :
hosted-git-info : 2.8 .9
resolve : 1.22 .12
semver : 5.7 .2
validate-npm-package-license : 3.0 .4
normalize-path@3.0.0 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
normalize-url@6.1.0 : {}
2026-08-30 00:10:11 +03:00
npm-run-path@6.0.0 :
dependencies :
path-key : 4.0 .0
unicorn-magic : 0.3 .0
nyc@18.0.0(supports-color@7.2.0) :
dependencies :
'@istanbuljs/load-nyc-config' : 1.1 .0
'@istanbuljs/schema' : 0.1 .6
caching-transform : 4.0 .0
convert-source-map : 1.9 .0
decamelize : 1.2 .0
find-cache-dir : 3.3 .2
find-up : 4.1 .0
foreground-child : 3.3 .1
get-package-type : 0.1 .0
glob : 13.0 .6
istanbul-lib-coverage : 3.2 .2
istanbul-lib-hook : 3.0 .0
istanbul-lib-instrument : 6.0 .3 (supports-color@7.2.0)
istanbul-lib-processinfo : 3.0 .1
istanbul-lib-report : 3.0 .1
istanbul-lib-source-maps : 4.0 .1 (supports-color@7.2.0)
istanbul-reports : 3.2 .0
make-dir : 3.1 .0
node-preload : 0.2 .1
p-map : 3.0 .0
process-on-spawn : 1.1 .0
resolve-from : 5.0 .0
rimraf : 6.1 .3
signal-exit : 3.0 .7
spawn-wrap : 3.0 .0
test-exclude : 8.0 .0
yargs : 15.4 .1
transitivePeerDependencies :
- supports-color
object-assign@4.1.1 : {}
object-inspect@1.13.4 : {}
object-keys@1.1.1 : {}
object.assign@4.1.7 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
define-properties : 1.2 .1
es-object-atoms : 1.1 .2
has-symbols : 1.1 .0
object-keys : 1.1 .1
object.entries@1.1.9 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
define-properties : 1.2 .1
es-object-atoms : 1.1 .2
object.fromentries@2.0.8 :
dependencies :
call-bind : 1.0 .9
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-object-atoms : 1.1 .2
object.groupby@1.0.3 :
dependencies :
call-bind : 1.0 .9
define-properties : 1.2 .1
es-abstract : 1.24 .2
object.values@1.2.1 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
define-properties : 1.2 .1
es-object-atoms : 1.1 .2
obug@2.1.4 : {}
on-finished@2.4.1 :
dependencies :
ee-first : 1.1 .1
on-headers@1.1.0 : {}
once@1.4.0 :
dependencies :
wrappy : 1.0 .2
onetime@5.1.2 :
dependencies :
mimic-fn : 2.1 .0
optionator@0.9.4 :
dependencies :
deep-is : 0.1 .4
fast-levenshtein : 2.0 .6
levn : 0.4 .1
prelude-ls : 1.2 .1
type-check : 0.4 .0
word-wrap : 1.2 .5
ora@5.4.1 :
dependencies :
bl : 4.1 .0
chalk : 4.1 .2
cli-cursor : 3.1 .0
cli-spinners : 2.9 .2
is-interactive : 1.0 .0
is-unicode-supported : 0.1 .0
log-symbols : 4.1 .0
strip-ansi : 6.0 .1
wcwidth : 1.0 .1
own-keys@1.0.1 :
dependencies :
get-intrinsic : 1.3 .0
object-keys : 1.1 .1
safe-push-apply : 1.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
p-cancelable@2.1.1 : {}
2026-08-30 00:10:11 +03:00
p-defer@1.0.0 : {}
p-event@4.2.0 :
dependencies :
p-timeout : 3.2 .0
p-finally@1.0.0 : {}
p-limit@2.3.0 :
dependencies :
p-try : 2.2 .0
p-limit@3.1.0 :
dependencies :
yocto-queue : 0.1 .0
p-locate@3.0.0 :
dependencies :
p-limit : 2.3 .0
p-locate@4.1.0 :
dependencies :
p-limit : 2.3 .0
p-locate@5.0.0 :
dependencies :
p-limit : 3.1 .0
p-map@3.0.0 :
dependencies :
aggregate-error : 3.1 .0
p-map@4.0.0 :
dependencies :
aggregate-error : 3.1 .0
p-timeout@3.2.0 :
dependencies :
p-finally : 1.0 .0
p-try@2.2.0 : {}
package-hash@4.0.0 :
dependencies :
graceful-fs : 4.2 .11
hasha : 5.2 .2
lodash.flattendeep : 4.4 .0
release-zalgo : 1.0 .0
package-json-from-dist@1.0.1 : {}
package-json@6.5.0 :
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
got : 11.8 .6
2026-08-30 00:10:11 +03:00
registry-auth-token : 4.2 .2
registry-url : 5.1 .0
semver : 6.3 .1
package-manager-detector@1.8.0 : {}
parse-json@4.0.0 :
dependencies :
error-ex : 1.3 .4
json-parse-better-errors : 1.0 .2
parse-json@5.2.0 :
dependencies :
'@babel/code-frame' : 7.29 .7
error-ex : 1.3 .4
json-parse-even-better-errors : 2.3 .1
lines-and-columns : 1.2 .4
parse-ms@2.1.0 : {}
parse-ms@4.0.0 : {}
parse5-htmlparser2-tree-adapter@6.0.1 :
dependencies :
parse5 : 6.0 .1
parse5@5.1.1 : {}
parse5@6.0.1 : {}
parseurl@1.3.3 : {}
path-exists@3.0.0 : {}
path-exists@4.0.0 : {}
path-is-absolute@1.0.1 : {}
path-key@3.1.1 : {}
path-key@4.0.0 : {}
path-parse@1.0.7 : {}
path-scurry@1.11.1 :
dependencies :
lru-cache : 10.4 .3
minipass : 7.1 .3
path-scurry@2.0.2 :
dependencies :
lru-cache : 11.5 .1
minipass : 7.1 .3
path-to-regexp@8.4.2 : {}
path-type@4.0.0 : {}
picocolors@1.1.1 : {}
picomatch@2.3.2 : {}
picomatch@4.0.5 : {}
pify@4.0.1 : {}
pirates@4.0.7 : {}
pkg-conf@3.1.0 :
dependencies :
find-up : 3.0 .0
load-json-file : 5.3 .0
pkg-dir@3.0.0 :
dependencies :
find-up : 3.0 .0
pkg-dir@4.2.0 :
dependencies :
find-up : 4.1 .0
plur@4.0.0 :
dependencies :
irregular-plurals : 3.5 .0
possible-typed-array-names@1.1.0 : {}
prelude-ls@1.2.1 : {}
pretty-ms@7.0.1 :
dependencies :
parse-ms : 2.1 .0
pretty-ms@9.3.0 :
dependencies :
parse-ms : 4.0 .0
printf@0.6.1 : {}
proc-log@6.1.0 : {}
process-on-spawn@1.1.0 :
dependencies :
fromentries : 1.3 .2
prop-types@15.8.1 :
dependencies :
loose-envify : 1.4 .0
object-assign : 4.1 .1
react-is : 16.13 .1
proxy-addr@2.0.7 :
dependencies :
forwarded : 0.2 .0
ipaddr.js : 1.9 .1
publint@0.3.22 :
dependencies :
'@publint/pack' : 0.1 .6
package-manager-detector : 1.8 .0
picocolors : 1.1 .1
sade : 1.8 .1
pump@3.0.4 :
dependencies :
end-of-stream : 1.4 .5
once : 1.4 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
punycode.js@2.3.1 : {}
2026-08-30 00:10:11 +03:00
punycode@2.3.1 : {}
pupa@2.1.1 :
dependencies :
escape-goat : 2.1 .1
qs@6.15.2 :
dependencies :
side-channel : 1.1 .1
quansync@1.0.0 : {}
queue-microtask@1.2.3 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
quick-lru@5.1.1 : {}
2026-08-30 00:10:11 +03:00
range-parser@1.2.1 : {}
raw-body@3.0.2 :
dependencies :
bytes : 3.1 .2
http-errors : 2.0 .1
iconv-lite : 0.7 .2
unpipe : 1.0 .0
rc@1.2.8 :
dependencies :
deep-extend : 0.6 .0
ini : 1.3 .8
minimist : 1.2 .8
strip-json-comments : 2.0 .1
react-is@16.13.1 : {}
read-pkg@5.2.0 :
dependencies :
'@types/normalize-package-data' : 2.4 .4
normalize-package-data : 2.5 .0
parse-json : 5.2 .0
type-fest : 0.6 .0
readable-stream@3.6.2 :
dependencies :
inherits : 2.0 .4
string_decoder : 1.3 .0
util-deprecate : 1.0 .2
readdirp@3.6.0 :
dependencies :
picomatch : 2.3 .2
readdirp@5.0.0 : {}
reflect.getprototypeof@1.0.10 :
dependencies :
call-bind : 1.0 .9
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-errors : 1.3 .0
es-object-atoms : 1.1 .2
get-intrinsic : 1.3 .0
get-proto : 1.0 .1
which-builtin-type : 1.2 .1
regenerate-unicode-properties@10.2.2 :
dependencies :
regenerate : 1.4 .2
regenerate@1.4.2 : {}
regenerator-runtime@0.14.1 : {}
regexp.prototype.flags@1.5.4 :
dependencies :
call-bind : 1.0 .9
define-properties : 1.2 .1
es-errors : 1.3 .0
get-proto : 1.0 .1
gopd : 1.2 .0
set-function-name : 2.0 .2
regexpu-core@6.4.0 :
dependencies :
regenerate : 1.4 .2
regenerate-unicode-properties : 10.2 .2
regjsgen : 0.8 .0
regjsparser : 0.13 .1
unicode-match-property-ecmascript : 2.0 .0
unicode-match-property-value-ecmascript : 2.2 .1
registry-auth-token@4.2.2 :
dependencies :
rc : 1.2 .8
registry-url@5.1.0 :
dependencies :
rc : 1.2 .8
regjsgen@0.8.0 : {}
regjsparser@0.13.1 :
dependencies :
jsesc : 3.1 .0
release-zalgo@1.0.0 :
dependencies :
es6-error : 4.1 .1
require-directory@2.1.1 : {}
require-main-filename@2.0.0 : {}
requires-port@1.0.0 : {}
requizzle@0.2.4 :
dependencies :
lodash : 4.18 .1
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
resolve-alpn@1.2.1 : {}
2026-08-30 00:10:11 +03:00
resolve-cwd@3.0.0 :
dependencies :
resolve-from : 5.0 .0
resolve-from@5.0.0 : {}
resolve-pkg-maps@1.0.0 : {}
resolve@1.22.12 :
dependencies :
es-errors : 1.3 .0
is-core-module : 2.16 .2
path-parse : 1.0 .7
supports-preserve-symlinks-flag : 1.0 .0
resolve@2.0.0-next.7 :
dependencies :
es-errors : 1.3 .0
is-core-module : 2.16 .2
node-exports-info : 1.6 .0
object-keys : 1.1 .1
path-parse : 1.0 .7
supports-preserve-symlinks-flag : 1.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
responselike@2.0.1 :
2026-08-30 00:10:11 +03:00
dependencies :
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
lowercase-keys : 2.0 .0
2026-08-30 00:10:11 +03:00
restore-cursor@3.1.0 :
dependencies :
onetime : 5.1 .2
signal-exit : 3.0 .7
reusify@1.1.0 : {}
rimraf@3.0.2 :
dependencies :
glob : 7.2 .3
rimraf@6.1.3 :
dependencies :
glob : 13.0 .6
package-json-from-dist : 1.0 .1
rolldown-plugin-dts@0.27.13(rolldown@1.2.0)(typescript@5.9.3) :
dependencies :
dts-resolver : 3.0 .0
get-tsconfig : 5.0 .0 -beta.5
obug : 2.1 .4
rolldown : 1.2 .0
yuku-ast : 0.7 .3
yuku-codegen : 0.7 .3
yuku-parser : 0.7 .3
optionalDependencies :
typescript : 5.9 .3
transitivePeerDependencies :
- oxc-resolver
rolldown@1.2.0 :
dependencies :
'@oxc-project/types' : 0.140 .0
'@rolldown/pluginutils' : 1.0 .1
optionalDependencies :
'@rolldown/binding-android-arm64' : 1.2 .0
'@rolldown/binding-darwin-arm64' : 1.2 .0
'@rolldown/binding-darwin-x64' : 1.2 .0
'@rolldown/binding-freebsd-x64' : 1.2 .0
'@rolldown/binding-linux-arm-gnueabihf' : 1.2 .0
'@rolldown/binding-linux-arm64-gnu' : 1.2 .0
'@rolldown/binding-linux-arm64-musl' : 1.2 .0
'@rolldown/binding-linux-ppc64-gnu' : 1.2 .0
'@rolldown/binding-linux-s390x-gnu' : 1.2 .0
'@rolldown/binding-linux-x64-gnu' : 1.2 .0
'@rolldown/binding-linux-x64-musl' : 1.2 .0
'@rolldown/binding-openharmony-arm64' : 1.2 .0
'@rolldown/binding-wasm32-wasi' : 1.2 .0
'@rolldown/binding-win32-arm64-msvc' : 1.2 .0
'@rolldown/binding-win32-x64-msvc' : 1.2 .0
router@2.2.0(supports-color@7.2.0) :
dependencies :
debug : 4.4 .3 (supports-color@7.2.0)
depd : 2.0 .0
is-promise : 4.0 .0
parseurl : 1.3 .3
path-to-regexp : 8.4 .2
transitivePeerDependencies :
- supports-color
run-parallel@1.2.0 :
dependencies :
queue-microtask : 1.2 .3
sade@1.8.1 :
dependencies :
mri : 1.2 .0
safe-array-concat@1.1.4 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
get-intrinsic : 1.3 .0
has-symbols : 1.1 .0
isarray : 2.0 .5
safe-buffer@5.2.1 : {}
safe-push-apply@1.0.0 :
dependencies :
es-errors : 1.3 .0
isarray : 2.0 .5
safe-regex-test@1.1.0 :
dependencies :
call-bound : 1.0 .4
es-errors : 1.3 .0
is-regex : 1.2 .1
safer-buffer@2.1.2 : {}
semver-diff@3.1.1 :
dependencies :
semver : 6.3 .1
semver@5.7.2 : {}
semver@6.3.1 : {}
semver@7.8.5 : {}
send@1.2.1(supports-color@7.2.0) :
dependencies :
debug : 4.4 .3 (supports-color@7.2.0)
encodeurl : 2.0 .0
escape-html : 1.0 .3
etag : 1.8 .1
fresh : 2.0 .0
http-errors : 2.0 .1
mime-types : 3.0 .2
ms : 2.1 .3
on-finished : 2.4 .1
range-parser : 1.2 .1
statuses : 2.0 .2
transitivePeerDependencies :
- supports-color
serialize-error@7.0.1 :
dependencies :
type-fest : 0.13 .1
serve-static@2.2.1(supports-color@7.2.0) :
dependencies :
encodeurl : 2.0 .0
escape-html : 1.0 .3
parseurl : 1.3 .3
send : 1.2 .1 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
set-blocking@2.0.0 : {}
set-function-length@1.2.2 :
dependencies :
define-data-property : 1.1 .4
es-errors : 1.3 .0
function-bind : 1.1 .2
get-intrinsic : 1.3 .0
gopd : 1.2 .0
has-property-descriptors : 1.0 .2
set-function-name@2.0.2 :
dependencies :
define-data-property : 1.1 .4
es-errors : 1.3 .0
functions-have-names : 1.2 .3
has-property-descriptors : 1.0 .2
set-proto@1.0.0 :
dependencies :
dunder-proto : 1.0 .1
es-errors : 1.3 .0
es-object-atoms : 1.1 .2
setprototypeof@1.2.0 : {}
shallow-clone@3.0.1 :
dependencies :
kind-of : 6.0 .3
shebang-command@2.0.0 :
dependencies :
shebang-regex : 3.0 .0
shebang-regex@3.0.0 : {}
shellwords@0.1.1 : {}
side-channel-list@1.0.1 :
dependencies :
es-errors : 1.3 .0
object-inspect : 1.13 .4
side-channel-map@1.0.1 :
dependencies :
call-bound : 1.0 .4
es-errors : 1.3 .0
get-intrinsic : 1.3 .0
object-inspect : 1.13 .4
side-channel-weakmap@1.0.2 :
dependencies :
call-bound : 1.0 .4
es-errors : 1.3 .0
get-intrinsic : 1.3 .0
object-inspect : 1.13 .4
side-channel-map : 1.0 .1
side-channel@1.1.1 :
dependencies :
es-errors : 1.3 .0
object-inspect : 1.13 .4
side-channel-list : 1.0 .1
side-channel-map : 1.0 .1
side-channel-weakmap : 1.0 .2
signal-exit@3.0.7 : {}
signal-exit@4.1.0 : {}
sinon@22.0.0 :
dependencies :
'@sinonjs/commons' : 3.0 .1
'@sinonjs/fake-timers' : 15.4 .0
'@sinonjs/samsam' : 10.0 .2
diff : 9.0 .0
skin-tone@2.0.0 :
dependencies :
unicode-emoji-modifier-base : 1.0 .0
slash@2.0.0 : {}
slash@3.0.0 : {}
slice-ansi@3.0.0 :
dependencies :
ansi-styles : 4.3 .0
astral-regex : 2.0 .0
is-fullwidth-code-point : 3.0 .0
socket.io-adapter@2.5.7(supports-color@7.2.0) :
dependencies :
debug : 4.4 .3 (supports-color@7.2.0)
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
ws : 8.21 .3
2026-08-30 00:10:11 +03:00
transitivePeerDependencies :
- bufferutil
- supports-color
- utf-8-validate
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
socket.io-parser@4.2.7(supports-color@7.2.0) :
2026-08-30 00:10:11 +03:00
dependencies :
'@socket.io/component-emitter' : 3.1 .2
debug : 4.4 .3 (supports-color@7.2.0)
transitivePeerDependencies :
- supports-color
socket.io@4.8.3(supports-color@7.2.0) :
dependencies :
accepts : 1.3 .8
base64id : 2.0 .0
cors : 2.8 .6
debug : 4.4 .3 (supports-color@7.2.0)
engine.io : 6.6 .8 (supports-color@7.2.0)
socket.io-adapter : 2.5 .7 (supports-color@7.2.0)
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
socket.io-parser : 4.2 .7 (supports-color@7.2.0)
2026-08-30 00:10:11 +03:00
transitivePeerDependencies :
- bufferutil
- supports-color
- utf-8-validate
source-map-support@0.5.21 :
dependencies :
buffer-from : 1.1 .2
source-map : 0.6 .1
source-map@0.6.1 : {}
spawn-args@0.2.0 : {}
spawn-wrap@3.0.0 :
dependencies :
cross-spawn : 7.0 .6
foreground-child : 2.0 .0
is-windows : 1.0 .2
make-dir : 3.1 .0
rimraf : 6.1 .3
signal-exit : 3.0 .7
which : 2.0 .2
spdx-correct@3.2.0 :
dependencies :
spdx-expression-parse : 3.0 .1
spdx-license-ids : 3.0 .23
spdx-exceptions@2.5.0 : {}
spdx-expression-parse@3.0.1 :
dependencies :
spdx-exceptions : 2.5 .0
spdx-license-ids : 3.0 .23
spdx-license-ids@3.0.23 : {}
sprintf-js@1.0.3 : {}
stable-hash-x@0.2.0 : {}
stack-utils@2.0.6 :
dependencies :
escape-string-regexp : 2.0 .0
statuses@2.0.2 : {}
stop-iteration-iterator@1.1.0 :
dependencies :
es-errors : 1.3 .0
internal-slot : 1.1 .0
string-width@4.2.3 :
dependencies :
emoji-regex : 8.0 .0
is-fullwidth-code-point : 3.0 .0
strip-ansi : 6.0 .1
string-width@5.1.2 :
dependencies :
eastasianwidth : 0.2 .0
emoji-regex : 9.2 .2
strip-ansi : 7.2 .0
string.prototype.includes@2.0.1 :
dependencies :
call-bind : 1.0 .9
define-properties : 1.2 .1
es-abstract : 1.24 .2
string.prototype.matchall@4.0.12 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-errors : 1.3 .0
es-object-atoms : 1.1 .2
get-intrinsic : 1.3 .0
gopd : 1.2 .0
has-symbols : 1.1 .0
internal-slot : 1.1 .0
regexp.prototype.flags : 1.5 .4
set-function-name : 2.0 .2
side-channel : 1.1 .1
string.prototype.repeat@1.0.0 :
dependencies :
define-properties : 1.2 .1
es-abstract : 1.24 .2
string.prototype.trim@1.2.11 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
define-data-property : 1.1 .4
define-properties : 1.2 .1
es-abstract : 1.24 .2
es-object-atoms : 1.1 .2
has-property-descriptors : 1.0 .2
safe-regex-test : 1.1 .0
string.prototype.trimend@1.0.10 :
dependencies :
call-bind : 1.0 .9
call-bound : 1.0 .4
define-properties : 1.2 .1
es-object-atoms : 1.1 .2
string.prototype.trimstart@1.0.8 :
dependencies :
call-bind : 1.0 .9
define-properties : 1.2 .1
es-object-atoms : 1.1 .2
string_decoder@1.3.0 :
dependencies :
safe-buffer : 5.2 .1
strip-ansi@6.0.1 :
dependencies :
ansi-regex : 5.0 .1
strip-ansi@7.2.0 :
dependencies :
ansi-regex : 6.2 .2
strip-bom@3.0.0 : {}
strip-bom@4.0.0 : {}
strip-final-newline@4.0.0 : {}
strip-json-comments@2.0.1 : {}
strip-json-comments@3.1.1 : {}
strip-outer@1.0.1 :
dependencies :
escape-string-regexp : 1.0 .5
styled_string@0.0.1 : {}
supertap@2.0.0 :
dependencies :
arrify : 2.0 .1
indent-string : 4.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
js-yaml : 3.15 .2
2026-08-30 00:10:11 +03:00
serialize-error : 7.0 .1
strip-ansi : 6.0 .1
supports-color@7.2.0 :
dependencies :
has-flag : 4.0 .0
supports-hyperlinks@3.2.0 :
dependencies :
has-flag : 4.0 .0
supports-color : 7.2 .0
supports-preserve-symlinks-flag@1.0.0 : {}
tap-parser@18.3.4 :
dependencies :
events-to-array : 2.0 .3
tap-yaml : 4.4 .2
tap-yaml@4.4.2 :
dependencies :
yaml : 2.9 .0
yaml-types : 0.4 .0 (yaml@2.9.0)
tapable@2.3.3 : {}
temp-dir@2.0.0 : {}
terser@5.49.0 :
dependencies :
'@jridgewell/source-map' : 0.3 .11
acorn : 8.17 .0
commander : 2.20 .3
source-map-support : 0.5 .21
test-exclude@7.0.2 :
dependencies :
'@istanbuljs/schema' : 0.1 .6
glob : 10.5 .0
minimatch : 10.2 .5
test-exclude@8.0.0 :
dependencies :
'@istanbuljs/schema' : 0.1 .6
glob : 13.0 .6
minimatch : 10.2 .5
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
testem@3.20.2(@babel/core@7.29.7(supports-color@7.2.0))(debug@4.4.3(supports-color@7.2.0))(supports-color@7.2.0)(underscore@1.13.8) :
2026-08-30 00:10:11 +03:00
dependencies :
'@xmldom/xmldom' : 0.9 .10
backbone : 1.6 .1
charm : 1.0 .2
chokidar : 5.0 .0
commander : 14.0 .3
compression : 1.8 .1 (supports-color@7.2.0)
consolidate : 1.0 .4 (@babel/core@7.29.7(supports-color@7.2.0))(lodash@4.18.1)(mustache@4.2.0)(underscore@1.13.8)
execa : 9.6 .1
express : 5.2 .1 (supports-color@7.2.0)
glob : 13.0 .6
http-proxy : 1.18 .1 (debug@4.4.3(supports-color@7.2.0))
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
js-yaml : 4.3 .2
2026-08-30 00:10:11 +03:00
lodash : 4.18 .1
minimatch : 10.2 .5
mkdirp : 3.0 .1
mustache : 4.2 .0
printf : 0.6 .1
proc-log : 6.1 .0
rimraf : 6.1 .3
socket.io : 4.8 .3 (supports-color@7.2.0)
spawn-args : 0.2 .0
styled_string : 0.0 .1
tap-parser : 18.3 .4
toasted-notifier : 10.1 .0
transitivePeerDependencies :
- '@babel/core'
- arc-templates
- atpl
- bracket-template
- bufferutil
- coffee-script
- debug
- dot
- dust
- dustjs-helpers
- dustjs-linkedin
- eco
- ect
- ejs
- haml-coffee
- hamlet
- hamljs
- handlebars
- hogan.js
- htmling
- jazz
- jqtpl
- just
- liquid-node
- liquor
- mote
- nunjucks
- plates
- pug
- qejs
- ractive
- react
- react-dom
- slm
- supports-color
- swig
- swig-templates
- teacup
- templayed
- then-pug
- tinyliquid
- toffee
- twig
- twing
- underscore
- utf-8-validate
- vash
- velocityjs
- walrus
- whiskers
thenify-all@1.6.0 :
dependencies :
thenify : 3.3 .1
thenify@3.3.1 :
dependencies :
any-promise : 1.3 .0
time-zone@1.0.0 : {}
tinyexec@1.2.4 : {}
tinyglobby@0.2.17 :
dependencies :
fdir : 6.5 .0 (picomatch@4.0.5)
picomatch : 4.0 .5
to-regex-range@5.0.1 :
dependencies :
is-number : 7.0 .0
toasted-notifier@10.1.0 :
dependencies :
growly : 1.3 .0
is-wsl : 2.2 .0
semver : 7.8 .5
shellwords : 0.1 .1
which : 2.0 .2
toidentifier@1.0.1 : {}
tree-kill@1.2.2 : {}
trim-off-newlines@1.0.3 : {}
trim-repeated@1.0.0 :
dependencies :
escape-string-regexp : 1.0 .5
ts-api-utils@2.5.0(typescript@5.9.3) :
dependencies :
typescript : 5.9 .3
ts-declaration-location@1.0.7(typescript@5.9.3) :
dependencies :
picomatch : 4.0 .5
typescript : 5.9 .3
tsconfig-paths@3.15.0 :
dependencies :
'@types/json5' : 0.0 .29
json5 : 1.0 .2
minimist : 1.2 .8
strip-bom : 3.0 .0
tsdown@0.22.14(@arethetypeswrong/core@0.18.5)(publint@0.3.22)(typescript@5.9.3) :
dependencies :
ansis : 4.3 .1
cac : 7.0 .0
defu : 6.1 .7
empathic : 2.0 .1
hookable : 6.1 .1
import-without-cache : 0.4 .0
obug : 2.1 .4
picomatch : 4.0 .5
rolldown : 1.2 .0
rolldown-plugin-dts : 0.27 .13 (rolldown@1.2.0)(typescript@5.9.3)
tinyexec : 1.2 .4
tinyglobby : 0.2 .17
tree-kill : 1.2 .2
unconfig-core : 7.5 .0
verkit : 0.3 .0
optionalDependencies :
'@arethetypeswrong/core' : 0.18 .5
publint : 0.3 .22
typescript : 5.9 .3
transitivePeerDependencies :
- '@typescript/native-preview'
- '@volar/typescript'
- oxc-resolver
- vue-tsc
tslib@2.8.1 :
optional : true
type-check@0.4.0 :
dependencies :
prelude-ls : 1.2 .1
type-detect@4.0.8 : {}
type-detect@4.1.0 : {}
type-fest@0.13.1 : {}
type-fest@0.20.2 : {}
type-fest@0.3.1 : {}
type-fest@0.6.0 : {}
type-fest@0.8.1 : {}
type-is@2.1.0 :
dependencies :
content-type : 2.0 .0
media-typer : 1.1 .0
mime-types : 3.0 .2
typed-array-buffer@1.0.3 :
dependencies :
call-bound : 1.0 .4
es-errors : 1.3 .0
is-typed-array : 1.1 .15
typed-array-byte-length@1.0.3 :
dependencies :
call-bind : 1.0 .9
for-each : 0.3 .5
gopd : 1.2 .0
has-proto : 1.2 .0
is-typed-array : 1.1 .15
typed-array-byte-offset@1.0.4 :
dependencies :
available-typed-arrays : 1.0 .7
call-bind : 1.0 .9
for-each : 0.3 .5
gopd : 1.2 .0
has-proto : 1.2 .0
is-typed-array : 1.1 .15
reflect.getprototypeof : 1.0 .10
typed-array-length@1.0.8 :
dependencies :
call-bind : 1.0 .9
for-each : 0.3 .5
gopd : 1.2 .0
is-typed-array : 1.1 .15
possible-typed-array-names : 1.1 .0
reflect.getprototypeof : 1.0 .10
typedarray-to-buffer@3.1.5 :
dependencies :
is-typedarray : 1.0 .0
typescript-eslint@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3) :
dependencies :
'@typescript-eslint/eslint-plugin' : 8.61 .0 (@typescript-eslint/parser@8.61.0(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3))(eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
'@typescript-eslint/parser' : 8.61 .0 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
'@typescript-eslint/typescript-estree' : 8.61 .0 (supports-color@7.2.0)(typescript@5.9.3)
'@typescript-eslint/utils' : 8.61 .0 (eslint@10.8.0(supports-color@7.2.0))(supports-color@7.2.0)(typescript@5.9.3)
eslint : 10.8 .0 (supports-color@7.2.0)
typescript : 5.9 .3
transitivePeerDependencies :
- supports-color
typescript@5.6.1-rc : {}
typescript@5.9.3 : {}
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
uc.micro@2.1.0 : {}
2026-08-30 00:10:11 +03:00
unbox-primitive@1.1.0 :
dependencies :
call-bound : 1.0 .4
has-bigints : 1.1 .0
has-symbols : 1.1 .0
which-boxed-primitive : 1.1 .1
unconfig-core@7.5.0 :
dependencies :
'@quansync/fs' : 1.0 .0
quansync : 1.0 .0
underscore@1.13.8 : {}
undici-types@7.24.6 : {}
unicode-canonical-property-names-ecmascript@2.0.1 : {}
unicode-emoji-modifier-base@1.0.0 : {}
unicode-match-property-ecmascript@2.0.0 :
dependencies :
unicode-canonical-property-names-ecmascript : 2.0 .1
unicode-property-aliases-ecmascript : 2.2 .0
unicode-match-property-value-ecmascript@2.2.1 : {}
unicode-property-aliases-ecmascript@2.2.0 : {}
unicorn-magic@0.3.0 : {}
unique-string@2.0.0 :
dependencies :
crypto-random-string : 2.0 .0
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
universalify@2.0.1 : {}
2026-08-30 00:10:11 +03:00
unpipe@1.0.0 : {}
unrs-resolver@1.12.2 :
dependencies :
napi-postinstall : 0.3 .4
optionalDependencies :
'@unrs/resolver-binding-android-arm-eabi' : 1.12 .2
'@unrs/resolver-binding-android-arm64' : 1.12 .2
'@unrs/resolver-binding-darwin-arm64' : 1.12 .2
'@unrs/resolver-binding-darwin-x64' : 1.12 .2
'@unrs/resolver-binding-freebsd-x64' : 1.12 .2
'@unrs/resolver-binding-linux-arm-gnueabihf' : 1.12 .2
'@unrs/resolver-binding-linux-arm-musleabihf' : 1.12 .2
'@unrs/resolver-binding-linux-arm64-gnu' : 1.12 .2
'@unrs/resolver-binding-linux-arm64-musl' : 1.12 .2
'@unrs/resolver-binding-linux-loong64-gnu' : 1.12 .2
'@unrs/resolver-binding-linux-loong64-musl' : 1.12 .2
'@unrs/resolver-binding-linux-ppc64-gnu' : 1.12 .2
'@unrs/resolver-binding-linux-riscv64-gnu' : 1.12 .2
'@unrs/resolver-binding-linux-riscv64-musl' : 1.12 .2
'@unrs/resolver-binding-linux-s390x-gnu' : 1.12 .2
'@unrs/resolver-binding-linux-x64-gnu' : 1.12 .2
'@unrs/resolver-binding-linux-x64-musl' : 1.12 .2
'@unrs/resolver-binding-openharmony-arm64' : 1.12 .2
'@unrs/resolver-binding-wasm32-wasi' : 1.12 .2
'@unrs/resolver-binding-win32-arm64-msvc' : 1.12 .2
'@unrs/resolver-binding-win32-ia32-msvc' : 1.12 .2
'@unrs/resolver-binding-win32-x64-msvc' : 1.12 .2
update-browserslist-db@1.2.3(browserslist@4.28.2) :
dependencies :
browserslist : 4.28 .2
escalade : 3.2 .0
picocolors : 1.1 .1
update-notifier@5.1.0 :
dependencies :
boxen : 5.1 .2
chalk : 4.1 .2
configstore : 5.0 .1
has-yarn : 2.1 .0
import-lazy : 2.1 .0
is-ci : 2.0 .0
is-installed-globally : 0.4 .0
is-npm : 5.0 .0
is-yarn-global : 0.3 .0
latest-version : 5.1 .0
pupa : 2.1 .1
semver : 7.8 .5
semver-diff : 3.1 .1
xdg-basedir : 4.0 .0
uri-js@4.4.1 :
dependencies :
punycode : 2.3 .1
util-deprecate@1.0.2 : {}
validate-npm-package-license@3.0.4 :
dependencies :
spdx-correct : 3.2 .0
spdx-expression-parse : 3.0 .1
validate-npm-package-name@5.0.1 : {}
vary@1.1.2 : {}
verkit@0.3.0 : {}
wcwidth@1.0.1 :
dependencies :
defaults : 1.0 .4
well-known-symbols@2.0.0 : {}
which-boxed-primitive@1.1.1 :
dependencies :
is-bigint : 1.1 .0
is-boolean-object : 1.2 .2
is-number-object : 1.1 .1
is-string : 1.1 .1
is-symbol : 1.1 .1
which-builtin-type@1.2.1 :
dependencies :
call-bound : 1.0 .4
function.prototype.name : 1.2 .0
has-tostringtag : 1.0 .2
is-async-function : 2.1 .1
is-date-object : 1.1 .0
is-finalizationregistry : 1.1 .1
is-generator-function : 1.1 .2
is-regex : 1.2 .1
is-weakref : 1.1 .1
isarray : 2.0 .5
which-boxed-primitive : 1.1 .1
which-collection : 1.0 .2
which-typed-array : 1.1 .22
which-collection@1.0.2 :
dependencies :
is-map : 2.0 .3
is-set : 2.0 .3
is-weakmap : 2.0 .2
is-weakset : 2.0 .4
which-module@2.0.1 : {}
which-typed-array@1.1.22 :
dependencies :
available-typed-arrays : 1.0 .7
call-bind : 1.0 .9
call-bound : 1.0 .4
for-each : 0.3 .5
get-proto : 1.0 .1
gopd : 1.2 .0
has-tostringtag : 1.0 .2
which@2.0.2 :
dependencies :
isexe : 2.0 .0
widest-line@3.1.0 :
dependencies :
string-width : 4.2 .3
word-wrap@1.2.5 : {}
wrap-ansi@6.2.0 :
dependencies :
ansi-styles : 4.3 .0
string-width : 4.2 .3
strip-ansi : 6.0 .1
wrap-ansi@7.0.0 :
dependencies :
ansi-styles : 4.3 .0
string-width : 4.2 .3
strip-ansi : 6.0 .1
wrap-ansi@8.1.0 :
dependencies :
ansi-styles : 6.2 .3
string-width : 5.1 .2
strip-ansi : 7.2 .0
wrappy@1.0.2 : {}
write-file-atomic@3.0.3 :
dependencies :
imurmurhash : 0.1 .4
is-typedarray : 1.0 .0
signal-exit : 3.0 .7
typedarray-to-buffer : 3.1 .5
fix: resolve open GitHub security findings
Code scanning (js/polynomial-redos, alerts #16 and #17)
-------------------------------------------------------
bowser applies these regexps to attacker-controlled User-Agent strings, and
four of them ran in quadratic time:
* The "Something else" fallback used /^(.*)\/(.*) / and
/^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal
make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2).
Greedy `(.*)` always picks the last `/` that still has the delimiter
after it, so the second group can never span a `/` -- narrowing it to
`[^/]*` is exactly equivalent and removes the ambiguity. Verified
identical on 1,000,000 fuzzed inputs and on the full acceptance corpus.
* The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a
required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking
is pure waste, but the engine still walks it once per start position, so
"linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes
it linear; no real bot-name suffix approaches 64 characters.
A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling,
with the four pre-fix patterns used to confirm the detector works) reports no
remaining superlinear regexps. test/unit/redos.js locks this in.
Actions (actions/missing-workflow-permissions, alerts #5 and #15)
-----------------------------------------------------------------
merge-to-master.yml and draft-or-update-next-release.yml had no `permissions`
block and so inherited the default token. Both now declare least privilege,
matching publish.yml and pull-request.yml.
Dependabot (22 open alerts, all development scope)
--------------------------------------------------
bowser ships no runtime dependencies, so none of these reached consumers, but
they were live in CI. `pnpm audit` goes from 29 advisories to 0:
* jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched
release, and picks up current markdown-it/linkify-it.
* coveralls -> coveralls-next 6 drops `request`, which is deprecated with no
patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2.
Same `coveralls` bin and same stdin contract; lcov conversion verified.
* gh-pages 3 -> 6 clears the critical prototype pollution advisory.
* pnpm overrides pin the remaining transitive-only advisories to the lowest
patched release on each existing major.
Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus
runs against both src/ and the built es5.js), build, package smoke test, and
doc generation.
2026-08-30 20:37:19 +03:00
ws@8.21.3 : {}
2026-08-30 00:10:11 +03:00
xdg-basedir@4.0.0 : {}
xmlcreate@2.0.4 : {}
y18n@4.0.3 : {}
y18n@5.0.8 : {}
yallist@3.1.1 : {}
yaml-types@0.4.0(yaml@2.9.0) :
dependencies :
yaml : 2.9 .0
yaml@2.9.0 : {}
yamljs@0.3.0 :
dependencies :
argparse : 1.0 .10
glob : 7.2 .3
yargs-parser@18.1.3 :
dependencies :
camelcase : 5.3 .1
decamelize : 1.2 .0
yargs-parser@20.2.9 : {}
yargs@15.4.1 :
dependencies :
cliui : 6.0 .0
decamelize : 1.2 .0
find-up : 4.1 .0
get-caller-file : 2.0 .5
require-directory : 2.1 .1
require-main-filename : 2.0 .0
set-blocking : 2.0 .0
string-width : 4.2 .3
which-module : 2.0 .1
y18n : 4.0 .3
yargs-parser : 18.1 .3
yargs@16.2.0 :
dependencies :
cliui : 7.0 .4
escalade : 3.2 .0
get-caller-file : 2.0 .5
require-directory : 2.1 .1
string-width : 4.2 .3
y18n : 5.0 .8
yargs-parser : 20.2 .9
yocto-queue@0.1.0 : {}
yoctocolors@2.1.2 : {}
yuku-ast@0.7.3 :
dependencies :
'@yuku-toolchain/types' : 0.7 .3
yuku-codegen@0.7.3 :
dependencies :
'@yuku-toolchain/types' : 0.7 .3
optionalDependencies :
'@yuku-codegen/binding-darwin-arm64' : 0.7 .3
'@yuku-codegen/binding-darwin-x64' : 0.7 .3
'@yuku-codegen/binding-freebsd-x64' : 0.7 .3
'@yuku-codegen/binding-linux-arm-gnu' : 0.7 .3
'@yuku-codegen/binding-linux-arm-musl' : 0.7 .3
'@yuku-codegen/binding-linux-arm64-gnu' : 0.7 .3
'@yuku-codegen/binding-linux-arm64-musl' : 0.7 .3
'@yuku-codegen/binding-linux-x64-gnu' : 0.7 .3
'@yuku-codegen/binding-linux-x64-musl' : 0.7 .3
'@yuku-codegen/binding-win32-arm64' : 0.7 .3
'@yuku-codegen/binding-win32-x64' : 0.7 .3
yuku-parser@0.7.3 :
dependencies :
'@yuku-toolchain/types' : 0.7 .3
yuku-ast : 0.7 .3
optionalDependencies :
'@yuku-parser/binding-darwin-arm64' : 0.7 .3
'@yuku-parser/binding-darwin-x64' : 0.7 .3
'@yuku-parser/binding-freebsd-x64' : 0.7 .3
'@yuku-parser/binding-linux-arm-gnu' : 0.7 .3
'@yuku-parser/binding-linux-arm-musl' : 0.7 .3
'@yuku-parser/binding-linux-arm64-gnu' : 0.7 .3
'@yuku-parser/binding-linux-arm64-musl' : 0.7 .3
'@yuku-parser/binding-linux-x64-gnu' : 0.7 .3
'@yuku-parser/binding-linux-x64-musl' : 0.7 .3
'@yuku-parser/binding-win32-arm64' : 0.7 .3
'@yuku-parser/binding-win32-x64' : 0.7 .3
zod-validation-error@4.0.2(zod@4.4.3) :
dependencies :
zod : 4.4 .3
zod@4.4.3 : {}
