Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit e8111ce

Browse filesBrowse files
Bump @babel/traverse from 7.9.0 to 7.23.2 (actions#743)
1 parent a00ea43 commit e8111ce
Copy full SHA for e8111ce

File tree

Expand file treeCollapse file tree

6 files changed

+5058
-7319
lines changed
Filter options
Expand file treeCollapse file tree

6 files changed

+5058
-7319
lines changed

‎.github/workflows/e2e-tests.yml

Copy file name to clipboardExpand all lines: .github/workflows/e2e-tests.yml
-7Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -93,10 +93,3 @@ jobs:
9393
python-version: '<3.11'
9494
- name: Verify <3.11
9595
run: python __tests__/verify-python.py 3.10
96-
97-
- name: Run with setup-python >3.8
98-
uses: ./
99-
with:
100-
python-version: '>3.8'
101-
- name: Verify >3.8
102-
run: python __tests__/verify-python.py 3.11

‎.licenses/npm/semver-6.3.0.dep.yml renamed to ‎.licenses/npm/semver-6.3.1.dep.yml

Copy file name to clipboardExpand all lines: .licenses/npm/semver-6.3.1.dep.yml
+2-2Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/cache-save/index.js

Copy file name to clipboardExpand all lines: dist/cache-save/index.js
+81-26Lines changed: 81 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3300,8 +3300,11 @@ var MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER ||
33003300
// Max safe segment length for coercion.
33013301
var MAX_SAFE_COMPONENT_LENGTH = 16
33023302

3303+
var MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6
3304+
33033305
// The actual regexps go on exports.re
33043306
var re = exports.re = []
3307+
var safeRe = exports.safeRe = []
33053308
var src = exports.src = []
33063309
var t = exports.tokens = {}
33073310
var R = 0
@@ -3310,6 +3313,31 @@ function tok (n) {
33103313
t[n] = R++
33113314
}
33123315

3316+
var LETTERDASHNUMBER = '[a-zA-Z0-9-]'
3317+
3318+
// Replace some greedy regex tokens to prevent regex dos issues. These regex are
3319+
// used internally via the safeRe object since all inputs in this library get
3320+
// normalized first to trim and collapse all extra whitespace. The original
3321+
// regexes are exported for userland consumption and lower level usage. A
3322+
// future breaking change could export the safer regex only with a note that
3323+
// all input should have extra whitespace removed.
3324+
var safeRegexReplacements = [
3325+
['\\s', 1],
3326+
['\\d', MAX_LENGTH],
3327+
[LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH],
3328+
]
3329+
3330+
function makeSafeRe (value) {
3331+
for (var i = 0; i < safeRegexReplacements.length; i++) {
3332+
var token = safeRegexReplacements[i][0]
3333+
var max = safeRegexReplacements[i][1]
3334+
value = value
3335+
.split(token + '*').join(token + '{0,' + max + '}')
3336+
.split(token + '+').join(token + '{1,' + max + '}')
3337+
}
3338+
return value
3339+
}
3340+
33133341
// The following Regular Expressions can be used for tokenizing,
33143342
// validating, and parsing SemVer version strings.
33153343

@@ -3319,14 +3347,14 @@ function tok (n) {
33193347
tok('NUMERICIDENTIFIER')
33203348
src[t.NUMERICIDENTIFIER] = '0|[1-9]\\d*'
33213349
tok('NUMERICIDENTIFIERLOOSE')
3322-
src[t.NUMERICIDENTIFIERLOOSE] = '[0-9]+'
3350+
src[t.NUMERICIDENTIFIERLOOSE] = '\\d+'
33233351

33243352
// ## Non-numeric Identifier
33253353
// Zero or more digits, followed by a letter or hyphen, and then zero or
33263354
// more letters, digits, or hyphens.
33273355

33283356
tok('NONNUMERICIDENTIFIER')
3329-
src[t.NONNUMERICIDENTIFIER] = '\\d*[a-zA-Z-][a-zA-Z0-9-]*'
3357+
src[t.NONNUMERICIDENTIFIER] = '\\d*[a-zA-Z-]' + LETTERDASHNUMBER + '*'
33303358

33313359
// ## Main Version
33323360
// Three dot-separated numeric identifiers.
@@ -3368,7 +3396,7 @@ src[t.PRERELEASELOOSE] = '(?:-?(' + src[t.PRERELEASEIDENTIFIERLOOSE] +
33683396
// Any combination of digits, letters, or hyphens.
33693397

33703398
tok('BUILDIDENTIFIER')
3371-
src[t.BUILDIDENTIFIER] = '[0-9A-Za-z-]+'
3399+
src[t.BUILDIDENTIFIER] = LETTERDASHNUMBER + '+'
33723400

33733401
// ## Build Metadata
33743402
// Plus sign, followed by one or more period-separated build metadata
@@ -3448,6 +3476,7 @@ src[t.COERCE] = '(^|[^\\d])' +
34483476
'(?:$|[^\\d])'
34493477
tok('COERCERTL')
34503478
re[t.COERCERTL] = new RegExp(src[t.COERCE], 'g')
3479+
safeRe[t.COERCERTL] = new RegExp(makeSafeRe(src[t.COERCE]), 'g')
34513480

34523481
// Tilde ranges.
34533482
// Meaning is "reasonably at or greater than"
@@ -3457,6 +3486,7 @@ src[t.LONETILDE] = '(?:~>?)'
34573486
tok('TILDETRIM')
34583487
src[t.TILDETRIM] = '(\\s*)' + src[t.LONETILDE] + '\\s+'
34593488
re[t.TILDETRIM] = new RegExp(src[t.TILDETRIM], 'g')
3489+
safeRe[t.TILDETRIM] = new RegExp(makeSafeRe(src[t.TILDETRIM]), 'g')
34603490
var tildeTrimReplace = '$1~'
34613491

34623492
tok('TILDE')
@@ -3472,6 +3502,7 @@ src[t.LONECARET] = '(?:\\^)'
34723502
tok('CARETTRIM')
34733503
src[t.CARETTRIM] = '(\\s*)' + src[t.LONECARET] + '\\s+'
34743504
re[t.CARETTRIM] = new RegExp(src[t.CARETTRIM], 'g')
3505+
safeRe[t.CARETTRIM] = new RegExp(makeSafeRe(src[t.CARETTRIM]), 'g')
34753506
var caretTrimReplace = '$1^'
34763507

34773508
tok('CARET')
@@ -3493,6 +3524,7 @@ src[t.COMPARATORTRIM] = '(\\s*)' + src[t.GTLT] +
34933524

34943525
// this one has to use the /g flag
34953526
re[t.COMPARATORTRIM] = new RegExp(src[t.COMPARATORTRIM], 'g')
3527+
safeRe[t.COMPARATORTRIM] = new RegExp(makeSafeRe(src[t.COMPARATORTRIM]), 'g')
34963528
var comparatorTrimReplace = '$1$2$3'
34973529

34983530
// Something like `1.2.3 - 1.2.4`
@@ -3521,6 +3553,14 @@ for (var i = 0; i < R; i++) {
35213553
debug(i, src[i])
35223554
if (!re[i]) {
35233555
re[i] = new RegExp(src[i])
3556+
3557+
// Replace all greedy whitespace to prevent regex dos issues. These regex are
3558+
// used internally via the safeRe object since all inputs in this library get
3559+
// normalized first to trim and collapse all extra whitespace. The original
3560+
// regexes are exported for userland consumption and lower level usage. A
3561+
// future breaking change could export the safer regex only with a note that
3562+
// all input should have extra whitespace removed.
3563+
safeRe[i] = new RegExp(makeSafeRe(src[i]))
35243564
}
35253565
}
35263566

@@ -3545,7 +3585,7 @@ function parse (version, options) {
35453585
return null
35463586
}
35473587

3548-
var r = options.loose ? re[t.LOOSE] : re[t.FULL]
3588+
var r = options.loose ? safeRe[t.LOOSE] : safeRe[t.FULL]
35493589
if (!r.test(version)) {
35503590
return null
35513591
}
@@ -3600,7 +3640,7 @@ function SemVer (version, options) {
36003640
this.options = options
36013641
this.loose = !!options.loose
36023642

3603-
var m = version.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL])
3643+
var m = version.trim().match(options.loose ? safeRe[t.LOOSE] : safeRe[t.FULL])
36043644

36053645
if (!m) {
36063646
throw new TypeError('Invalid Version: ' + version)
@@ -4045,6 +4085,7 @@ function Comparator (comp, options) {
40454085
return new Comparator(comp, options)
40464086
}
40474087

4088+
comp = comp.trim().split(/\s+/).join(' ')
40484089
debug('comparator', comp, options)
40494090
this.options = options
40504091
this.loose = !!options.loose
@@ -4061,7 +4102,7 @@ function Comparator (comp, options) {
40614102

40624103
var ANY = {}
40634104
Comparator.prototype.parse = function (comp) {
4064-
var r = this.options.loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR]
4105+
var r = this.options.loose ? safeRe[t.COMPARATORLOOSE] : safeRe[t.COMPARATOR]
40654106
var m = comp.match(r)
40664107

40674108
if (!m) {
@@ -4185,17 +4226,24 @@ function Range (range, options) {
41854226
this.loose = !!options.loose
41864227
this.includePrerelease = !!options.includePrerelease
41874228

4188-
// First, split based on boolean or ||
4229+
// First reduce all whitespace as much as possible so we do not have to rely
4230+
// on potentially slow regexes like \s*. This is then stored and used for
4231+
// future error messages as well.
41894232
this.raw = range
4190-
this.set = range.split(/\s*\|\|\s*/).map(function (range) {
4233+
.trim()
4234+
.split(/\s+/)
4235+
.join(' ')
4236+
4237+
// First, split based on boolean or ||
4238+
this.set = this.raw.split('||').map(function (range) {
41914239
return this.parseRange(range.trim())
41924240
}, this).filter(function (c) {
41934241
// throw out any that are not relevant for whatever reason
41944242
return c.length
41954243
})
41964244

41974245
if (!this.set.length) {
4198-
throw new TypeError('Invalid SemVer Range: ' + range)
4246+
throw new TypeError('Invalid SemVer Range: ' + this.raw)
41994247
}
42004248

42014249
this.format()
@@ -4214,28 +4262,27 @@ Range.prototype.toString = function () {
42144262

42154263
Range.prototype.parseRange = function (range) {
42164264
var loose = this.options.loose
4217-
range = range.trim()
42184265
// `1.2.3 - 1.2.4` => `>=1.2.3 <=1.2.4`
4219-
var hr = loose ? re[t.HYPHENRANGELOOSE] : re[t.HYPHENRANGE]
4266+
var hr = loose ? safeRe[t.HYPHENRANGELOOSE] : safeRe[t.HYPHENRANGE]
42204267
range = range.replace(hr, hyphenReplace)
42214268
debug('hyphen replace', range)
42224269
// `> 1.2.3 < 1.2.5` => `>1.2.3 <1.2.5`
4223-
range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace)
4224-
debug('comparator trim', range, re[t.COMPARATORTRIM])
4270+
range = range.replace(safeRe[t.COMPARATORTRIM], comparatorTrimReplace)
4271+
debug('comparator trim', range, safeRe[t.COMPARATORTRIM])
42254272

42264273
// `~ 1.2.3` => `~1.2.3`
4227-
range = range.replace(re[t.TILDETRIM], tildeTrimReplace)
4274+
range = range.replace(safeRe[t.TILDETRIM], tildeTrimReplace)
42284275

42294276
// `^ 1.2.3` => `^1.2.3`
4230-
range = range.replace(re[t.CARETTRIM], caretTrimReplace)
4277+
range = range.replace(safeRe[t.CARETTRIM], caretTrimReplace)
42314278

42324279
// normalize spaces
42334280
range = range.split(/\s+/).join(' ')
42344281

42354282
// At this point, the range is completely trimmed and
42364283
// ready to be split into comparators.
42374284

4238-
var compRe = loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR]
4285+
var compRe = loose ? safeRe[t.COMPARATORLOOSE] : safeRe[t.COMPARATOR]
42394286
var set = range.split(' ').map(function (comp) {
42404287
return parseComparator(comp, this.options)
42414288
}, this).join(' ').split(/\s+/)
@@ -4335,7 +4382,7 @@ function replaceTildes (comp, options) {
43354382
}
43364383

43374384
function replaceTilde (comp, options) {
4338-
var r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE]
4385+
var r = options.loose ? safeRe[t.TILDELOOSE] : safeRe[t.TILDE]
43394386
return comp.replace(r, function (_, M, m, p, pr) {
43404387
debug('tilde', comp, _, M, m, p, pr)
43414388
var ret
@@ -4376,7 +4423,7 @@ function replaceCarets (comp, options) {
43764423

43774424
function replaceCaret (comp, options) {
43784425
debug('caret', comp, options)
4379-
var r = options.loose ? re[t.CARETLOOSE] : re[t.CARET]
4426+
var r = options.loose ? safeRe[t.CARETLOOSE] : safeRe[t.CARET]
43804427
return comp.replace(r, function (_, M, m, p, pr) {
43814428
debug('caret', comp, _, M, m, p, pr)
43824429
var ret
@@ -4435,7 +4482,7 @@ function replaceXRanges (comp, options) {
44354482

44364483
function replaceXRange (comp, options) {
44374484
comp = comp.trim()
4438-
var r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE]
4485+
var r = options.loose ? safeRe[t.XRANGELOOSE] : safeRe[t.XRANGE]
44394486
return comp.replace(r, function (ret, gtlt, M, m, p, pr) {
44404487
debug('xRange', comp, ret, gtlt, M, m, p, pr)
44414488
var xM = isX(M)
@@ -4510,7 +4557,7 @@ function replaceXRange (comp, options) {
45104557
function replaceStars (comp, options) {
45114558
debug('replaceStars', comp, options)
45124559
// Looseness is ignored here. star is always as loose as it gets!
4513-
return comp.trim().replace(re[t.STAR], '')
4560+
return comp.trim().replace(safeRe[t.STAR], '')
45144561
}
45154562

45164563
// This function is passed to string.replace(re[t.HYPHENRANGE])
@@ -4836,7 +4883,7 @@ function coerce (version, options) {
48364883

48374884
var match = null
48384885
if (!options.rtl) {
4839-
match = version.match(re[t.COERCE])
4886+
match = version.match(safeRe[t.COERCE])
48404887
} else {
48414888
// Find the right-most coercible string that does not share
48424889
// a terminus with a more left-ward coercible string.
@@ -4847,17 +4894,17 @@ function coerce (version, options) {
48474894
// Stop when we get a match that ends at the string end, since no
48484895
// coercible string can be more right-ward without the same terminus.
48494896
var next
4850-
while ((next = re[t.COERCERTL].exec(version)) &&
4897+
while ((next = safeRe[t.COERCERTL].exec(version)) &&
48514898
(!match || match.index + match[0].length !== version.length)
48524899
) {
48534900
if (!match ||
48544901
next.index + next[0].length !== match.index + match[0].length) {
48554902
match = next
48564903
}
4857-
re[t.COERCERTL].lastIndex = next.index + next[1].length + next[2].length
4904+
safeRe[t.COERCERTL].lastIndex = next.index + next[1].length + next[2].length
48584905
}
48594906
// leave it in a clean state
4860-
re[t.COERCERTL].lastIndex = -1
4907+
safeRe[t.COERCERTL].lastIndex = -1
48614908
}
48624909

48634910
if (match === null) {
@@ -59042,7 +59089,11 @@ module.exports = v4;
5904259089

5904359090
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
5904459091
if (k2 === undefined) k2 = k;
59045-
Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
59092+
var desc = Object.getOwnPropertyDescriptor(m, k);
59093+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
59094+
desc = { enumerable: true, get: function() { return m[k]; } };
59095+
}
59096+
Object.defineProperty(o, k2, desc);
5904659097
}) : (function(o, m, k, k2) {
5904759098
if (k2 === undefined) k2 = k;
5904859099
o[k2] = m[k];
@@ -59151,7 +59202,11 @@ exports.CACHE_DEPENDENCY_BACKUP_PATH = '**/pyproject.toml';
5915159202

5915259203
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
5915359204
if (k2 === undefined) k2 = k;
59154-
Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
59205+
var desc = Object.getOwnPropertyDescriptor(m, k);
59206+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
59207+
desc = { enumerable: true, get: function() { return m[k]; } };
59208+
}
59209+
Object.defineProperty(o, k2, desc);
5915559210
}) : (function(o, m, k, k2) {
5915659211
if (k2 === undefined) k2 = k;
5915759212
o[k2] = m[k];

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.