Bump semver from 7.3.8 to 7.5.2 (#219)

3401fe1 · dependabot[bot] · 2023-06-24 21:20

3 files +235 -143
Message
{commit_body(@commit)}

Files changed

modified dist/index.js
+227 −135
@@ -5991,6 +5991,7 @@ class Comparator {
5991 5991 }
5992 5992 }
5993 5993
5994 + comp = comp.trim().split(/\s+/).join(' ')
5994 5995 debug('comparator', comp, options)
5995 5996 this.options = options
5996 5997 this.loose = !!options.loose
@@ -6053,13 +6054,6 @@ class Comparator {
6053 6054 throw new TypeError('a Comparator is required')
6054 6055 }
6055 6056
6056 if (!options || typeof options !== 'object') {
6057 options = {
6058 loose: !!options,
6059 includePrerelease: false,
6060 }
6061 }
6062
6063 6057 if (this.operator === '') {
6064 6058 if (this.value === '') {
6065 6059 return true
@@ -6072,39 +6066,50 @@ class Comparator {
6072 6066 return new Range(this.value, options).test(comp.semver)
6073 6067 }
6074 6068
6075 const sameDirectionIncreasing =
6076 (this.operator === '>=' || this.operator === '>') &&
6077 (comp.operator === '>=' || comp.operator === '>')
6078 const sameDirectionDecreasing =
6079 (this.operator === '<=' || this.operator === '<') &&
6080 (comp.operator === '<=' || comp.operator === '<')
6081 const sameSemVer = this.semver.version === comp.semver.version
6082 const differentDirectionsInclusive =
6083 (this.operator === '>=' || this.operator === '<=') &&
6084 (comp.operator === '>=' || comp.operator === '<=')
6085 const oppositeDirectionsLessThan =
6086 cmp(this.semver, '<', comp.semver, options) &&
6087 (this.operator === '>=' || this.operator === '>') &&
6088 (comp.operator === '<=' || comp.operator === '<')
6089 const oppositeDirectionsGreaterThan =
6090 cmp(this.semver, '>', comp.semver, options) &&
6091 (this.operator === '<=' || this.operator === '<') &&
6092 (comp.operator === '>=' || comp.operator === '>')
6069 + options = parseOptions(options)
6093 6070
6094 return (
6095 sameDirectionIncreasing ||
6096 sameDirectionDecreasing ||
6097 (sameSemVer && differentDirectionsInclusive) ||
6098 oppositeDirectionsLessThan ||
6099 oppositeDirectionsGreaterThan
6100 )
6071 + // Special cases where nothing can possibly be lower
6072 + if (options.includePrerelease &&
6073 + (this.value === '<0.0.0-0' || comp.value === '<0.0.0-0')) {
6074 + return false
6075 + }
6076 + if (!options.includePrerelease &&
6077 + (this.value.startsWith('<0.0.0') || comp.value.startsWith('<0.0.0'))) {
6078 + return false
6079 + }
6080 +
6081 + // Same direction increasing (> or >=)
6082 + if (this.operator.startsWith('>') && comp.operator.startsWith('>')) {
6083 + return true
6084 + }
6085 + // Same direction decreasing (< or <=)
6086 + if (this.operator.startsWith('<') && comp.operator.startsWith('<')) {
6087 + return true
6088 + }
6089 + // same SemVer and both sides are inclusive (<= or >=)
6090 + if (
6091 + (this.semver.version === comp.semver.version) &&
6092 + this.operator.includes('=') && comp.operator.includes('=')) {
6093 + return true
6094 + }
6095 + // opposite directions less than
6096 + if (cmp(this.semver, '<', comp.semver, options) &&
6097 + this.operator.startsWith('>') && comp.operator.startsWith('<')) {
6098 + return true
6099 + }
6100 + // opposite directions greater than
6101 + if (cmp(this.semver, '>', comp.semver, options) &&
6102 + this.operator.startsWith('<') && comp.operator.startsWith('>')) {
6103 + return true
6104 + }
6105 + return false
6101 6106 }
6102 6107 }
6103 6108
6104 6109 module.exports = Comparator
6105 6110
6106 6111 const parseOptions = __nccwpck_require__(785)
6107 const { re, t } = __nccwpck_require__(9523)
6112 +const { safeRe: re, t } = __nccwpck_require__(9523)
6108 6113 const cmp = __nccwpck_require__(5098)
6109 6114 const debug = __nccwpck_require__(427)
6110 6115 const SemVer = __nccwpck_require__(8088)
@@ -6144,19 +6149,26 @@ class Range {
6144 6149 this.loose = !!options.loose
6145 6150 this.includePrerelease = !!options.includePrerelease
6146 6151
6147 // First, split based on boolean or ||
6152 + // First reduce all whitespace as much as possible so we do not have to rely
6153 + // on potentially slow regexes like \s*. This is then stored and used for
6154 + // future error messages as well.
6148 6155 this.raw = range
6149 this.set = range
6156 + .trim()
6157 + .split(/\s+/)
6158 + .join(' ')
6159 +
6160 + // First, split on ||
6161 + this.set = this.raw
6150 6162 .split('||')
6151 6163 // map the range to a 2d array of comparators
6152 .map(r => this.parseRange(r.trim()))
6164 + .map(r => this.parseRange(r))
6153 6165 // throw out any comparator lists that are empty
6154 6166 // this generally means that it was not a valid range, which is allowed
6155 6167 // in loose mode, but will still throw if the WHOLE range is invalid.
6156 6168 .filter(c => c.length)
6157 6169
6158 6170 if (!this.set.length) {
6159 throw new TypeError(`Invalid SemVer Range: ${range}`)
6171 + throw new TypeError(`Invalid SemVer Range: ${this.raw}`)
6160 6172 }
6161 6173
6162 6174 // if we have any that are not the null set, throw out null sets.
@@ -6182,9 +6194,7 @@ class Range {
6182 6194
6183 6195 format () {
6184 6196 this.range = this.set
6185 .map((comps) => {
6186 return comps.join(' ').trim()
6187 })
6197 + .map((comps) => comps.join(' ').trim())
6188 6198 .join('||')
6189 6199 .trim()
6190 6200 return this.range
@@ -6195,12 +6205,12 @@ class Range {
6195 6205 }
6196 6206
6197 6207 parseRange (range) {
6198 range = range.trim()
6199
6200 6208 // memoize range parsing for performance.
6201 6209 // this is a very hot path, and fully deterministic.
6202 const memoOpts = Object.keys(this.options).join(',')
6203 const memoKey = `parseRange:${memoOpts}:${range}`
6210 + const memoOpts =
6211 + (this.options.includePrerelease && FLAG_INCLUDE_PRERELEASE) |
6212 + (this.options.loose && FLAG_LOOSE)
6213 + const memoKey = memoOpts + ':' + range
6204 6214 const cached = cache.get(memoKey)
6205 6215 if (cached) {
6206 6216 return cached
@@ -6221,9 +6231,6 @@ class Range {
6221 6231 // `^ 1.2.3` => `^1.2.3`
6222 6232 range = range.replace(re[t.CARETTRIM], caretTrimReplace)
6223 6233
6224 // normalize spaces
6225 range = range.split(/\s+/).join(' ')
6226
6227 6234 // At this point, the range is completely trimmed and
6228 6235 // ready to be split into comparators.
6229 6236
@@ -6308,6 +6315,7 @@ class Range {
6308 6315 return false
6309 6316 }
6310 6317 }
6318 +
6311 6319 module.exports = Range
6312 6320
6313 6321 const LRU = __nccwpck_require__(7129)
@@ -6318,12 +6326,13 @@ const Comparator = __nccwpck_require__(1532)
6318 6326 const debug = __nccwpck_require__(427)
6319 6327 const SemVer = __nccwpck_require__(8088)
6320 6328 const {
6321 re,
6329 + safeRe: re,
6322 6330 t,
6323 6331 comparatorTrimReplace,
6324 6332 tildeTrimReplace,
6325 6333 caretTrimReplace,
6326 6334 } = __nccwpck_require__(9523)
6335 +const { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = __nccwpck_require__(2293)
6327 6336
6328 6337 const isNullSet = c => c.value === '<0.0.0-0'
6329 6338 const isAny = c => c.value === ''
@@ -6371,10 +6380,13 @@ const isX = id => !id || id.toLowerCase() === 'x' || id === '*'
6371 6380 // ~1.2.3, ~>1.2.3 --> >=1.2.3 <1.3.0-0
6372 6381 // ~1.2.0, ~>1.2.0 --> >=1.2.0 <1.3.0-0
6373 6382 // ~0.0.1 --> >=0.0.1 <0.1.0-0
6374 const replaceTildes = (comp, options) =>
6375 comp.trim().split(/\s+/).map((c) => {
6376 return replaceTilde(c, options)
6377 }).join(' ')
6383 +const replaceTildes = (comp, options) => {
6384 + return comp
6385 + .trim()
6386 + .split(/\s+/)
6387 + .map((c) => replaceTilde(c, options))
6388 + .join(' ')
6389 +}
6378 6390
6379 6391 const replaceTilde = (comp, options) => {
6380 6392 const r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE]
@@ -6412,10 +6424,13 @@ const replaceTilde = (comp, options) => {
6412 6424 // ^1.2.0 --> >=1.2.0 <2.0.0-0
6413 6425 // ^0.0.1 --> >=0.0.1 <0.0.2-0
6414 6426 // ^0.1.0 --> >=0.1.0 <0.2.0-0
6415 const replaceCarets = (comp, options) =>
6416 comp.trim().split(/\s+/).map((c) => {
6417 return replaceCaret(c, options)
6418 }).join(' ')
6427 +const replaceCarets = (comp, options) => {
6428 + return comp
6429 + .trim()
6430 + .split(/\s+/)
6431 + .map((c) => replaceCaret(c, options))
6432 + .join(' ')
6433 +}
6419 6434
6420 6435 const replaceCaret = (comp, options) => {
6421 6436 debug('caret', comp, options)
@@ -6472,9 +6487,10 @@ const replaceCaret = (comp, options) => {
6472 6487
6473 6488 const replaceXRanges = (comp, options) => {
6474 6489 debug('replaceXRanges', comp, options)
6475 return comp.split(/\s+/).map((c) => {
6476 return replaceXRange(c, options)
6477 }).join(' ')
6490 + return comp
6491 + .split(/\s+/)
6492 + .map((c) => replaceXRange(c, options))
6493 + .join(' ')
6478 6494 }
6479 6495
6480 6496 const replaceXRange = (comp, options) => {
@@ -6557,12 +6573,15 @@ const replaceXRange = (comp, options) => {
6557 6573 const replaceStars = (comp, options) => {
6558 6574 debug('replaceStars', comp, options)
6559 6575 // Looseness is ignored here. star is always as loose as it gets!
6560 return comp.trim().replace(re[t.STAR], '')
6576 + return comp
6577 + .trim()
6578 + .replace(re[t.STAR], '')
6561 6579 }
6562 6580
6563 6581 const replaceGTE0 = (comp, options) => {
6564 6582 debug('replaceGTE0', comp, options)
6565 return comp.trim()
6583 + return comp
6584 + .trim()
6566 6585 .replace(re[options.includePrerelease ? t.GTE0PRE : t.GTE0], '')
6567 6586 }
6568 6587
@@ -6600,7 +6619,7 @@ const hyphenReplace = incPr => ($0,
6600 6619 to = `<=${to}`
6601 6620 }
6602 6621
6603 return (`${from} ${to}`).trim()
6622 + return `${from} ${to}`.trim()
6604 6623 }
6605 6624
6606 6625 const testSet = (set, version, options) => {
@@ -6647,7 +6666,7 @@ const testSet = (set, version, options) => {
6647 6666
6648 6667 const debug = __nccwpck_require__(427)
6649 6668 const { MAX_LENGTH, MAX_SAFE_INTEGER } = __nccwpck_require__(2293)
6650 const { re, t } = __nccwpck_require__(9523)
6669 +const { safeRe: re, t } = __nccwpck_require__(9523)
6651 6670
6652 6671 const parseOptions = __nccwpck_require__(785)
6653 6672 const { compareIdentifiers } = __nccwpck_require__(2463)
@@ -6663,7 +6682,7 @@ class SemVer {
6663 6682 version = version.version
6664 6683 }
6665 6684 } else if (typeof version !== 'string') {
6666 throw new TypeError(`Invalid Version: ${version}`)
6685 + throw new TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`)
6667 6686 }
6668 6687
6669 6688 if (version.length > MAX_LENGTH) {
@@ -6822,36 +6841,36 @@ class SemVer {
6822 6841
6823 6842 // preminor will bump the version up to the next minor release, and immediately
6824 6843 // down to pre-release. premajor and prepatch work the same way.
6825 inc (release, identifier) {
6844 + inc (release, identifier, identifierBase) {
6826 6845 switch (release) {
6827 6846 case 'premajor':
6828 6847 this.prerelease.length = 0
6829 6848 this.patch = 0
6830 6849 this.minor = 0
6831 6850 this.major++
6832 this.inc('pre', identifier)
6851 + this.inc('pre', identifier, identifierBase)
6833 6852 break
6834 6853 case 'preminor':
6835 6854 this.prerelease.length = 0
6836 6855 this.patch = 0
6837 6856 this.minor++
6838 this.inc('pre', identifier)
6857 + this.inc('pre', identifier, identifierBase)
6839 6858 break
6840 6859 case 'prepatch':
6841 6860 // If this is already a prerelease, it will bump to the next version
6842 6861 // drop any prereleases that might already exist, since they are not
6843 6862 // relevant at this point.
6844 6863 this.prerelease.length = 0
6845 this.inc('patch', identifier)
6846 this.inc('pre', identifier)
6864 + this.inc('patch', identifier, identifierBase)
6865 + this.inc('pre', identifier, identifierBase)
6847 6866 break
6848 6867 // If the input is a non-prerelease version, this acts the same as
6849 6868 // prepatch.
6850 6869 case 'prerelease':
6851 6870 if (this.prerelease.length === 0) {
6852 this.inc('patch', identifier)
6871 + this.inc('patch', identifier, identifierBase)
6853 6872 }
6854 this.inc('pre', identifier)
6873 + this.inc('pre', identifier, identifierBase)
6855 6874 break
6856 6875
6857 6876 case 'major':
@@ -6893,9 +6912,15 @@ class SemVer {
6893 6912 break
6894 6913 // This probably shouldn't be used publicly.
6895 6914 // 1.0.0 'pre' would become 1.0.0-0 which is the wrong direction.
6896 case 'pre':
6915 + case 'pre': {
6916 + const base = Number(identifierBase) ? 1 : 0
6917 +
6918 + if (!identifier && identifierBase === false) {
6919 + throw new Error('invalid increment argument: identifier is empty')
6920 + }
6921 +
6897 6922 if (this.prerelease.length === 0) {
6898 this.prerelease = [0]
6923 + this.prerelease = [base]
6899 6924 } else {
6900 6925 let i = this.prerelease.length
6901 6926 while (--i >= 0) {
@@ -6906,27 +6931,36 @@ class SemVer {
6906 6931 }
6907 6932 if (i === -1) {
6908 6933 // didn't increment anything
6909 this.prerelease.push(0)
6934 + if (identifier === this.prerelease.join('.') && identifierBase === false) {
6935 + throw new Error('invalid increment argument: identifier already exists')
6936 + }
6937 + this.prerelease.push(base)
6910 6938 }
6911 6939 }
6912 6940 if (identifier) {
6913 6941 // 1.2.0-beta.1 bumps to 1.2.0-beta.2,
6914 6942 // 1.2.0-beta.fooblz or 1.2.0-beta bumps to 1.2.0-beta.0
6943 + let prerelease = [identifier, base]
6944 + if (identifierBase === false) {
6945 + prerelease = [identifier]
6946 + }
6915 6947 if (compareIdentifiers(this.prerelease[0], identifier) === 0) {
6916 6948 if (isNaN(this.prerelease[1])) {
6917 this.prerelease = [identifier, 0]
6949 + this.prerelease = prerelease
6918 6950 }
6919 6951 } else {
6920 this.prerelease = [identifier, 0]
6952 + this.prerelease = prerelease
6921 6953 }
6922 6954 }
6923 6955 break
6924
6956 + }
6925 6957 default:
6926 6958 throw new Error(`invalid increment argument: ${release}`)
6927 6959 }
6928 this.format()
6929 this.raw = this.version
6960 + this.raw = this.format()
6961 + if (this.build.length) {
6962 + this.raw += `+${this.build.join('.')}`
6963 + }
6930 6964 return this
6931 6965 }
6932 6966 }
@@ -7013,7 +7047,7 @@ module.exports = cmp
7013 7047
7014 7048 const SemVer = __nccwpck_require__(8088)
7015 7049 const parse = __nccwpck_require__(5925)
7016 const { re, t } = __nccwpck_require__(9523)
7050 +const { safeRe: re, t } = __nccwpck_require__(9523)
7017 7051
7018 7052 const coerce = (version, options) => {
7019 7053 if (version instanceof SemVer) {
@@ -7107,27 +7141,69 @@ module.exports = compare
7107 7141 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
7108 7142
7109 7143 const parse = __nccwpck_require__(5925)
7110 const eq = __nccwpck_require__(1898)
7111 7144
7112 7145 const diff = (version1, version2) => {
7113 if (eq(version1, version2)) {
7146 + const v1 = parse(version1, null, true)
7147 + const v2 = parse(version2, null, true)
7148 + const comparison = v1.compare(v2)
7149 +
7150 + if (comparison === 0) {
7114 7151 return null
7115 } else {
7116 const v1 = parse(version1)
7117 const v2 = parse(version2)
7118 const hasPre = v1.prerelease.length || v2.prerelease.length
7119 const prefix = hasPre ? 'pre' : ''
7120 const defaultResult = hasPre ? 'prerelease' : ''
7121 for (const key in v1) {
7122 if (key === 'major' || key === 'minor' || key === 'patch') {
7123 if (v1[key] !== v2[key]) {
7124 return prefix + key
7125 }
7126 }
7152 + }
7153 +
7154 + const v1Higher = comparison > 0
7155 + const highVersion = v1Higher ? v1 : v2
7156 + const lowVersion = v1Higher ? v2 : v1
7157 + const highHasPre = !!highVersion.prerelease.length
7158 + const lowHasPre = !!lowVersion.prerelease.length
7159 +
7160 + if (lowHasPre && !highHasPre) {
7161 + // Going from prerelease -> no prerelease requires some special casing
7162 +
7163 + // If the low version has only a major, then it will always be a major
7164 + // Some examples:
7165 + // 1.0.0-1 -> 1.0.0
7166 + // 1.0.0-1 -> 1.1.1
7167 + // 1.0.0-1 -> 2.0.0
7168 + if (!lowVersion.patch && !lowVersion.minor) {
7169 + return 'major'
7127 7170 }
7128 return defaultResult // may be undefined
7171 +
7172 + // Otherwise it can be determined by checking the high version
7173 +
7174 + if (highVersion.patch) {
7175 + // anything higher than a patch bump would result in the wrong version
7176 + return 'patch'
7177 + }
7178 +
7179 + if (highVersion.minor) {
7180 + // anything higher than a minor bump would result in the wrong version
7181 + return 'minor'
7182 + }
7183 +
7184 + // bumping major/minor/patch all have same result
7185 + return 'major'
7186 + }
7187 +
7188 + // add the `pre` prefix if we are going to a prerelease version
7189 + const prefix = highHasPre ? 'pre' : ''
7190 +
7191 + if (v1.major !== v2.major) {
7192 + return prefix + 'major'
7193 + }
7194 +
7195 + if (v1.minor !== v2.minor) {
7196 + return prefix + 'minor'
7197 + }
7198 +
7199 + if (v1.patch !== v2.patch) {
7200 + return prefix + 'patch'
7129 7201 }
7202 +
7203 + // high and low are preleases
7204 + return 'prerelease'
7130 7205 }
7206 +
7131 7207 module.exports = diff
7132 7208
7133 7209
@@ -7168,8 +7244,9 @@ module.exports = gte
7168 7244
7169 7245 const SemVer = __nccwpck_require__(8088)
7170 7246
7171 const inc = (version, release, options, identifier) => {
7247 +const inc = (version, release, options, identifier, identifierBase) => {
7172 7248 if (typeof (options) === 'string') {
7249 + identifierBase = identifier
7173 7250 identifier = options
7174 7251 options = undefined
7175 7252 }
@@ -7178,7 +7255,7 @@ const inc = (version, release, options, identifier) => {
7178 7255 return new SemVer(
7179 7256 version instanceof SemVer ? version.version : version,
7180 7257 options
7181 ).inc(release, identifier).version
7258 + ).inc(release, identifier, identifierBase).version
7182 7259 } catch (er) {
7183 7260 return null
7184 7261 }
@@ -7241,35 +7318,18 @@ module.exports = neq
7241 7318 /***/ 5925:
7242 7319 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
7243 7320
7244 const { MAX_LENGTH } = __nccwpck_require__(2293)
7245 const { re, t } = __nccwpck_require__(9523)
7246 7321 const SemVer = __nccwpck_require__(8088)
7247
7248 const parseOptions = __nccwpck_require__(785)
7249 const parse = (version, options) => {
7250 options = parseOptions(options)
7251
7322 +const parse = (version, options, throwErrors = false) => {
7252 7323 if (version instanceof SemVer) {
7253 7324 return version
7254 7325 }
7255
7256 if (typeof version !== 'string') {
7257 return null
7258 }
7259
7260 if (version.length > MAX_LENGTH) {
7261 return null
7262 }
7263
7264 const r = options.loose ? re[t.LOOSE] : re[t.FULL]
7265 if (!r.test(version)) {
7266 return null
7267 }
7268
7269 7326 try {
7270 7327 return new SemVer(version, options)
7271 7328 } catch (er) {
7272 return null
7329 + if (!throwErrors) {
7330 + return null
7331 + }
7332 + throw er
7273 7333 }
7274 7334 }
7275 7335
@@ -7449,6 +7509,7 @@ module.exports = {
7449 7509 src: internalRe.src,
7450 7510 tokens: internalRe.t,
7451 7511 SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
7512 + RELEASE_TYPES: constants.RELEASE_TYPES,
7452 7513 compareIdentifiers: identifiers.compareIdentifiers,
7453 7514 rcompareIdentifiers: identifiers.rcompareIdentifiers,
7454 7515 }
@@ -7470,11 +7531,24 @@ const MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER ||
7470 7531 // Max safe segment length for coercion.
7471 7532 const MAX_SAFE_COMPONENT_LENGTH = 16
7472 7533
7534 +const RELEASE_TYPES = [
7535 + 'major',
7536 + 'premajor',
7537 + 'minor',
7538 + 'preminor',
7539 + 'patch',
7540 + 'prepatch',
7541 + 'prerelease',
7542 +]
7543 +
7473 7544 module.exports = {
7474 SEMVER_SPEC_VERSION,
7475 7545 MAX_LENGTH,
7476 MAX_SAFE_INTEGER,
7477 7546 MAX_SAFE_COMPONENT_LENGTH,
7547 + MAX_SAFE_INTEGER,
7548 + RELEASE_TYPES,
7549 + SEMVER_SPEC_VERSION,
7550 + FLAG_INCLUDE_PRERELEASE: 0b001,
7551 + FLAG_LOOSE: 0b010,
7478 7552 }
7479 7553
7480 7554
@@ -7529,16 +7603,20 @@ module.exports = {
7529 7603 /***/ 785:
7530 7604 /***/ ((module) => {
7531 7605
7532 // parse out just the options we care about so we always get a consistent
7533 // obj with keys in a consistent order.
7534 const opts = ['includePrerelease', 'loose', 'rtl']
7535 const parseOptions = options =>
7536 !options ? {}
7537 : typeof options !== 'object' ? { loose: true }
7538 : opts.filter(k => options[k]).reduce((o, k) => {
7539 o[k] = true
7540 return o
7541 }, {})
7606 +// parse out just the options we care about
7607 +const looseOption = Object.freeze({ loose: true })
7608 +const emptyOpts = Object.freeze({ })
7609 +const parseOptions = options => {
7610 + if (!options) {
7611 + return emptyOpts
7612 + }
7613 +
7614 + if (typeof options !== 'object') {
7615 + return looseOption
7616 + }
7617 +
7618 + return options
7619 +}
7542 7620 module.exports = parseOptions
7543 7621
7544 7622
@@ -7553,16 +7631,27 @@ exports = module.exports = {}
7553 7631
7554 7632 // The actual regexps go on exports.re
7555 7633 const re = exports.re = []
7634 +const safeRe = exports.safeRe = []
7556 7635 const src = exports.src = []
7557 7636 const t = exports.t = {}
7558 7637 let R = 0
7559 7638
7560 7639 const createToken = (name, value, isGlobal) => {
7640 + // Replace all greedy whitespace to prevent regex dos issues. These regex are
7641 + // used internally via the safeRe object since all inputs in this library get
7642 + // normalized first to trim and collapse all extra whitespace. The original
7643 + // regexes are exported for userland consumption and lower level usage. A
7644 + // future breaking change could export the safer regex only with a note that
7645 + // all input should have extra whitespace removed.
7646 + const safe = value
7647 + .split('\\s*').join('\\s{0,1}')
7648 + .split('\\s+').join('\\s')
7561 7649 const index = R++
7562 7650 debug(name, index, value)
7563 7651 t[name] = index
7564 7652 src[index] = value
7565 7653 re[index] = new RegExp(value, isGlobal ? 'g' : undefined)
7654 + safeRe[index] = new RegExp(safe, isGlobal ? 'g' : undefined)
7566 7655 }
7567 7656
7568 7657 // The following Regular Expressions can be used for tokenizing,
@@ -7751,7 +7840,7 @@ const Range = __nccwpck_require__(9828)
7751 7840 const intersects = (r1, r2, options) => {
7752 7841 r1 = new Range(r1, options)
7753 7842 r2 = new Range(r2, options)
7754 return r1.intersects(r2)
7843 + return r1.intersects(r2, options)
7755 7844 }
7756 7845 module.exports = intersects
7757 7846
@@ -8114,6 +8203,9 @@ const subset = (sub, dom, options = {}) => {
8114 8203 return true
8115 8204 }
8116 8205
8206 +const minimumVersionWithPreRelease = [new Comparator('>=0.0.0-0')]
8207 +const minimumVersion = [new Comparator('>=0.0.0')]
8208 +
8117 8209 const simpleSubset = (sub, dom, options) => {
8118 8210 if (sub === dom) {
8119 8211 return true
@@ -8123,9 +8215,9 @@ const simpleSubset = (sub, dom, options) => {
8123 8215 if (dom.length === 1 && dom[0].semver === ANY) {
8124 8216 return true
8125 8217 } else if (options.includePrerelease) {
8126 sub = [new Comparator('>=0.0.0-0')]
8218 + sub = minimumVersionWithPreRelease
8127 8219 } else {
8128 sub = [new Comparator('>=0.0.0')]
8220 + sub = minimumVersion
8129 8221 }
8130 8222 }
8131 8223
@@ -8133,7 +8225,7 @@ const simpleSubset = (sub, dom, options) => {
8133 8225 if (options.includePrerelease) {
8134 8226 return true
8135 8227 } else {
8136 dom = [new Comparator('>=0.0.0')]
8228 + dom = minimumVersion
8137 8229 }
8138 8230 }
8139 8231
modified package-lock.json
+7 −7
@@ -11,7 +11,7 @@
11 11 "@actions/exec": "1.1.1",
12 12 "@actions/http-client": "2.1.0",
13 13 "@actions/tool-cache": "^2.0.1",
14 "semver": "7.3.8"
14 + "semver": "7.5.2"
15 15 },
16 16 "devDependencies": {
17 17 "@vercel/ncc": "0.34.0",
@@ -2548,9 +2548,9 @@
2548 2548 "dev": true
2549 2549 },
2550 2550 "node_modules/semver": {
2551 "version": "7.3.8",
2552 "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
2553 "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
2551 + "version": "7.5.2",
2552 + "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.2.tgz",
2553 + "integrity": "sha512-SoftuTROv/cRjCze/scjGyiDtcUyxw1rgYQSZY7XTmtR5hX+dm76iDbTH8TkLPHCQmlbQVSSbNZCPM2hb0knnQ==",
2554 2554 "dependencies": {
2555 2555 "lru-cache": "^6.0.0"
2556 2556 },
@@ -4894,9 +4894,9 @@
4894 4894 "dev": true
4895 4895 },
4896 4896 "semver": {
4897 "version": "7.3.8",
4898 "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
4899 "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
4897 + "version": "7.5.2",
4898 + "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.2.tgz",
4899 + "integrity": "sha512-SoftuTROv/cRjCze/scjGyiDtcUyxw1rgYQSZY7XTmtR5hX+dm76iDbTH8TkLPHCQmlbQVSSbNZCPM2hb0knnQ==",
4900 4900 "requires": {
4901 4901 "lru-cache": "^6.0.0"
4902 4902 }
modified package.json
+1 −1
@@ -23,7 +23,7 @@
23 23 "@actions/exec": "1.1.1",
24 24 "@actions/http-client": "2.1.0",
25 25 "@actions/tool-cache": "^2.0.1",
26 "semver": "7.3.8"
26 + "semver": "7.5.2"
27 27 },
28 28 "devDependencies": {
29 29 "@vercel/ncc": "0.34.0",

Parents: 145c80c