Skip to content

Commit ada8800

Browse files
Bump semver from 6.3.0 to 6.3.1 (#443)
1 parent e174912 commit ada8800

File tree

5 files changed

+176
-56
lines changed

5 files changed

+176
-56
lines changed

.licenses/npm/semver-6.3.1.dep.yml

Lines changed: 26 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

dist/cache-save/index.js

Lines changed: 71 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -50967,8 +50967,11 @@ var MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER ||
5096750967
// Max safe segment length for coercion.
5096850968
var MAX_SAFE_COMPONENT_LENGTH = 16
5096950969

50970+
var MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6
50971+
5097050972
// The actual regexps go on exports.re
5097150973
var re = exports.re = []
50974+
var safeRe = exports.safeRe = []
5097250975
var src = exports.src = []
5097350976
var t = exports.tokens = {}
5097450977
var R = 0
@@ -50977,6 +50980,31 @@ function tok (n) {
5097750980
t[n] = R++
5097850981
}
5097950982

50983+
var LETTERDASHNUMBER = '[a-zA-Z0-9-]'
50984+
50985+
// Replace some greedy regex tokens to prevent regex dos issues. These regex are
50986+
// used internally via the safeRe object since all inputs in this library get
50987+
// normalized first to trim and collapse all extra whitespace. The original
50988+
// regexes are exported for userland consumption and lower level usage. A
50989+
// future breaking change could export the safer regex only with a note that
50990+
// all input should have extra whitespace removed.
50991+
var safeRegexReplacements = [
50992+
['\\s', 1],
50993+
['\\d', MAX_LENGTH],
50994+
[LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH],
50995+
]
50996+
50997+
function makeSafeRe (value) {
50998+
for (var i = 0; i < safeRegexReplacements.length; i++) {
50999+
var token = safeRegexReplacements[i][0]
51000+
var max = safeRegexReplacements[i][1]
51001+
value = value
51002+
.split(token + '*').join(token + '{0,' + max + '}')
51003+
.split(token + '+').join(token + '{1,' + max + '}')
51004+
}
51005+
return value
51006+
}
51007+
5098051008
// The following Regular Expressions can be used for tokenizing,
5098151009
// validating, and parsing SemVer version strings.
5098251010

@@ -50986,14 +51014,14 @@ function tok (n) {
5098651014
tok('NUMERICIDENTIFIER')
5098751015
src[t.NUMERICIDENTIFIER] = '0|[1-9]\\d*'
5098851016
tok('NUMERICIDENTIFIERLOOSE')
50989-
src[t.NUMERICIDENTIFIERLOOSE] = '[0-9]+'
51017+
src[t.NUMERICIDENTIFIERLOOSE] = '\\d+'
5099051018

5099151019
// ## Non-numeric Identifier
5099251020
// Zero or more digits, followed by a letter or hyphen, and then zero or
5099351021
// more letters, digits, or hyphens.
5099451022

5099551023
tok('NONNUMERICIDENTIFIER')
50996-
src[t.NONNUMERICIDENTIFIER] = '\\d*[a-zA-Z-][a-zA-Z0-9-]*'
51024+
src[t.NONNUMERICIDENTIFIER] = '\\d*[a-zA-Z-]' + LETTERDASHNUMBER + '*'
5099751025

5099851026
// ## Main Version
5099951027
// Three dot-separated numeric identifiers.
@@ -51035,7 +51063,7 @@ src[t.PRERELEASELOOSE] = '(?:-?(' + src[t.PRERELEASEIDENTIFIERLOOSE] +
5103551063
// Any combination of digits, letters, or hyphens.
5103651064

5103751065
tok('BUILDIDENTIFIER')
51038-
src[t.BUILDIDENTIFIER] = '[0-9A-Za-z-]+'
51066+
src[t.BUILDIDENTIFIER] = LETTERDASHNUMBER + '+'
5103951067

5104051068
// ## Build Metadata
5104151069
// Plus sign, followed by one or more period-separated build metadata
@@ -51115,6 +51143,7 @@ src[t.COERCE] = '(^|[^\\d])' +
5111551143
'(?:$|[^\\d])'
5111651144
tok('COERCERTL')
5111751145
re[t.COERCERTL] = new RegExp(src[t.COERCE], 'g')
51146+
safeRe[t.COERCERTL] = new RegExp(makeSafeRe(src[t.COERCE]), 'g')
5111851147

5111951148
// Tilde ranges.
5112051149
// Meaning is "reasonably at or greater than"
@@ -51124,6 +51153,7 @@ src[t.LONETILDE] = '(?:~>?)'
5112451153
tok('TILDETRIM')
5112551154
src[t.TILDETRIM] = '(\\s*)' + src[t.LONETILDE] + '\\s+'
5112651155
re[t.TILDETRIM] = new RegExp(src[t.TILDETRIM], 'g')
51156+
safeRe[t.TILDETRIM] = new RegExp(makeSafeRe(src[t.TILDETRIM]), 'g')
5112751157
var tildeTrimReplace = '$1~'
5112851158

5112951159
tok('TILDE')
@@ -51139,6 +51169,7 @@ src[t.LONECARET] = '(?:\\^)'
5113951169
tok('CARETTRIM')
5114051170
src[t.CARETTRIM] = '(\\s*)' + src[t.LONECARET] + '\\s+'
5114151171
re[t.CARETTRIM] = new RegExp(src[t.CARETTRIM], 'g')
51172+
safeRe[t.CARETTRIM] = new RegExp(makeSafeRe(src[t.CARETTRIM]), 'g')
5114251173
var caretTrimReplace = '$1^'
5114351174

5114451175
tok('CARET')
@@ -51160,6 +51191,7 @@ src[t.COMPARATORTRIM] = '(\\s*)' + src[t.GTLT] +
5116051191

5116151192
// this one has to use the /g flag
5116251193
re[t.COMPARATORTRIM] = new RegExp(src[t.COMPARATORTRIM], 'g')
51194+
safeRe[t.COMPARATORTRIM] = new RegExp(makeSafeRe(src[t.COMPARATORTRIM]), 'g')
5116351195
var comparatorTrimReplace = '$1$2$3'
5116451196

5116551197
// Something like `1.2.3 - 1.2.4`
@@ -51188,6 +51220,14 @@ for (var i = 0; i < R; i++) {
5118851220
debug(i, src[i])
5118951221
if (!re[i]) {
5119051222
re[i] = new RegExp(src[i])
51223+
51224+
// Replace all greedy whitespace to prevent regex dos issues. These regex are
51225+
// used internally via the safeRe object since all inputs in this library get
51226+
// normalized first to trim and collapse all extra whitespace. The original
51227+
// regexes are exported for userland consumption and lower level usage. A
51228+
// future breaking change could export the safer regex only with a note that
51229+
// all input should have extra whitespace removed.
51230+
safeRe[i] = new RegExp(makeSafeRe(src[i]))
5119151231
}
5119251232
}
5119351233

@@ -51212,7 +51252,7 @@ function parse (version, options) {
5121251252
return null
5121351253
}
5121451254

51215-
var r = options.loose ? re[t.LOOSE] : re[t.FULL]
51255+
var r = options.loose ? safeRe[t.LOOSE] : safeRe[t.FULL]
5121651256
if (!r.test(version)) {
5121751257
return null
5121851258
}
@@ -51267,7 +51307,7 @@ function SemVer (version, options) {
5126751307
this.options = options
5126851308
this.loose = !!options.loose
5126951309

51270-
var m = version.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL])
51310+
var m = version.trim().match(options.loose ? safeRe[t.LOOSE] : safeRe[t.FULL])
5127151311

5127251312
if (!m) {
5127351313
throw new TypeError('Invalid Version: ' + version)
@@ -51712,6 +51752,7 @@ function Comparator (comp, options) {
5171251752
return new Comparator(comp, options)
5171351753
}
5171451754

51755+
comp = comp.trim().split(/\s+/).join(' ')
5171551756
debug('comparator', comp, options)
5171651757
this.options = options
5171751758
this.loose = !!options.loose
@@ -51728,7 +51769,7 @@ function Comparator (comp, options) {
5172851769

5172951770
var ANY = {}
5173051771
Comparator.prototype.parse = function (comp) {
51731-
var r = this.options.loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR]
51772+
var r = this.options.loose ? safeRe[t.COMPARATORLOOSE] : safeRe[t.COMPARATOR]
5173251773
var m = comp.match(r)
5173351774

5173451775
if (!m) {
@@ -51852,17 +51893,24 @@ function Range (range, options) {
5185251893
this.loose = !!options.loose
5185351894
this.includePrerelease = !!options.includePrerelease
5185451895

51855-
// First, split based on boolean or ||
51896+
// First reduce all whitespace as much as possible so we do not have to rely
51897+
// on potentially slow regexes like \s*. This is then stored and used for
51898+
// future error messages as well.
5185651899
this.raw = range
51857-
this.set = range.split(/\s*\|\|\s*/).map(function (range) {
51900+
.trim()
51901+
.split(/\s+/)
51902+
.join(' ')
51903+
51904+
// First, split based on boolean or ||
51905+
this.set = this.raw.split('||').map(function (range) {
5185851906
return this.parseRange(range.trim())
5185951907
}, this).filter(function (c) {
5186051908
// throw out any that are not relevant for whatever reason
5186151909
return c.length
5186251910
})
5186351911

5186451912
if (!this.set.length) {
51865-
throw new TypeError('Invalid SemVer Range: ' + range)
51913+
throw new TypeError('Invalid SemVer Range: ' + this.raw)
5186651914
}
5186751915

5186851916
this.format()
@@ -51881,28 +51929,27 @@ Range.prototype.toString = function () {
5188151929

5188251930
Range.prototype.parseRange = function (range) {
5188351931
var loose = this.options.loose
51884-
range = range.trim()
5188551932
// `1.2.3 - 1.2.4` => `>=1.2.3 <=1.2.4`
51886-
var hr = loose ? re[t.HYPHENRANGELOOSE] : re[t.HYPHENRANGE]
51933+
var hr = loose ? safeRe[t.HYPHENRANGELOOSE] : safeRe[t.HYPHENRANGE]
5188751934
range = range.replace(hr, hyphenReplace)
5188851935
debug('hyphen replace', range)
5188951936
// `> 1.2.3 < 1.2.5` => `>1.2.3 <1.2.5`
51890-
range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace)
51891-
debug('comparator trim', range, re[t.COMPARATORTRIM])
51937+
range = range.replace(safeRe[t.COMPARATORTRIM], comparatorTrimReplace)
51938+
debug('comparator trim', range, safeRe[t.COMPARATORTRIM])
5189251939

5189351940
// `~ 1.2.3` => `~1.2.3`
51894-
range = range.replace(re[t.TILDETRIM], tildeTrimReplace)
51941+
range = range.replace(safeRe[t.TILDETRIM], tildeTrimReplace)
5189551942

5189651943
// `^ 1.2.3` => `^1.2.3`
51897-
range = range.replace(re[t.CARETTRIM], caretTrimReplace)
51944+
range = range.replace(safeRe[t.CARETTRIM], caretTrimReplace)
5189851945

5189951946
// normalize spaces
5190051947
range = range.split(/\s+/).join(' ')
5190151948

5190251949
// At this point, the range is completely trimmed and
5190351950
// ready to be split into comparators.
5190451951

51905-
var compRe = loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR]
51952+
var compRe = loose ? safeRe[t.COMPARATORLOOSE] : safeRe[t.COMPARATOR]
5190651953
var set = range.split(' ').map(function (comp) {
5190751954
return parseComparator(comp, this.options)
5190851955
}, this).join(' ').split(/\s+/)
@@ -52002,7 +52049,7 @@ function replaceTildes (comp, options) {
5200252049
}
5200352050

5200452051
function replaceTilde (comp, options) {
52005-
var r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE]
52052+
var r = options.loose ? safeRe[t.TILDELOOSE] : safeRe[t.TILDE]
5200652053
return comp.replace(r, function (_, M, m, p, pr) {
5200752054
debug('tilde', comp, _, M, m, p, pr)
5200852055
var ret
@@ -52043,7 +52090,7 @@ function replaceCarets (comp, options) {
5204352090

5204452091
function replaceCaret (comp, options) {
5204552092
debug('caret', comp, options)
52046-
var r = options.loose ? re[t.CARETLOOSE] : re[t.CARET]
52093+
var r = options.loose ? safeRe[t.CARETLOOSE] : safeRe[t.CARET]
5204752094
return comp.replace(r, function (_, M, m, p, pr) {
5204852095
debug('caret', comp, _, M, m, p, pr)
5204952096
var ret
@@ -52102,7 +52149,7 @@ function replaceXRanges (comp, options) {
5210252149

5210352150
function replaceXRange (comp, options) {
5210452151
comp = comp.trim()
52105-
var r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE]
52152+
var r = options.loose ? safeRe[t.XRANGELOOSE] : safeRe[t.XRANGE]
5210652153
return comp.replace(r, function (ret, gtlt, M, m, p, pr) {
5210752154
debug('xRange', comp, ret, gtlt, M, m, p, pr)
5210852155
var xM = isX(M)
@@ -52177,7 +52224,7 @@ function replaceXRange (comp, options) {
5217752224
function replaceStars (comp, options) {
5217852225
debug('replaceStars', comp, options)
5217952226
// Looseness is ignored here. star is always as loose as it gets!
52180-
return comp.trim().replace(re[t.STAR], '')
52227+
return comp.trim().replace(safeRe[t.STAR], '')
5218152228
}
5218252229

5218352230
// This function is passed to string.replace(re[t.HYPHENRANGE])
@@ -52503,7 +52550,7 @@ function coerce (version, options) {
5250352550

5250452551
var match = null
5250552552
if (!options.rtl) {
52506-
match = version.match(re[t.COERCE])
52553+
match = version.match(safeRe[t.COERCE])
5250752554
} else {
5250852555
// Find the right-most coercible string that does not share
5250952556
// a terminus with a more left-ward coercible string.
@@ -52514,17 +52561,17 @@ function coerce (version, options) {
5251452561
// Stop when we get a match that ends at the string end, since no
5251552562
// coercible string can be more right-ward without the same terminus.
5251652563
var next
52517-
while ((next = re[t.COERCERTL].exec(version)) &&
52564+
while ((next = safeRe[t.COERCERTL].exec(version)) &&
5251852565
(!match || match.index + match[0].length !== version.length)
5251952566
) {
5252052567
if (!match ||
5252152568
next.index + next[0].length !== match.index + match[0].length) {
5252252569
match = next
5252352570
}
52524-
re[t.COERCERTL].lastIndex = next.index + next[1].length + next[2].length
52571+
safeRe[t.COERCERTL].lastIndex = next.index + next[1].length + next[2].length
5252552572
}
5252652573
// leave it in a clean state
52527-
re[t.COERCERTL].lastIndex = -1
52574+
safeRe[t.COERCERTL].lastIndex = -1
5252852575
}
5252952576

5253052577
if (match === null) {

0 commit comments

Comments
 (0)