diff --git a/dist/index.js b/dist/index.js index 05f5b45..9e29ff1 100644 --- a/dist/index.js +++ b/dist/index.js @@ -15879,7 +15879,7 @@ function requireFollowRedirects () { return followRedirects.exports; } -/*! Axios v1.20.0 Copyright (c) 2026 Matt Zabriskie and contributors */ +/*! Axios v1.21.0 Copyright (c) 2026 Matt Zabriskie and contributors */ var axios_1; var hasRequiredAxios; @@ -16193,11 +16193,17 @@ function requireAxios () { return false; } const prototype = getPrototypeOf(val); - return (prototype === null || prototype === Object.prototype || getPrototypeOf(prototype) === null) && - // Treat safe own/inherited Symbol.toStringTag or Symbol.iterator members as - // evidence the value is tagged/iterable, while ignoring members reachable - // only through shared or terminal prototype boundaries. - !hasOwnInPrototypeChain(val, toStringTag) && !hasOwnInPrototypeChain(val, iterator); + return (prototype === null || prototype === Object.prototype || getPrototypeOf(prototype) === null) && ( + // Treat own Symbol.toStringTag or Symbol.iterator members as evidence the + // value is tagged/iterable, ignoring members reachable only through shared + // or terminal prototype boundaries. This is exactly what + // hasOwnInPrototypeChain(val, prop) computes here: every prototype admitted + // above (null, Object.prototype, or a terminal null-prototype template) is + // a boundary, so the walk never inspects anything but `val`'s own members, + // and stops before even those when `val` is itself the boundary + // Object.prototype. Checking that inline avoids allocating the walker's + // `seen` list twice per call on the mergeConfig / merge hot path. + isPrototypeBoundary(val, prototype, true) || !hasOwnProperty(val, toStringTag) && !hasOwnProperty(val, iterator)); }; /** @@ -16448,15 +16454,29 @@ function requireAxios () { skipUndefined } = isContextDefined(this) && this || {}; const result = {}; + // Caseless lookup only applies to string keys — symbol keys are + // identity-matched. Every string key that reaches `result` passes through + // this index first, so it can never hold two case variants of one key and a + // lowercase -> key map is exactly what findKey(result, key) would rescan + // Object.keys(result) for on each assignment. + const lowerCaseKeys = caseless ? Object.create(null) : null; const assignValue = (val, key) => { // Skip dangerous property names to prevent prototype pollution if (key === '__proto__' || key === 'constructor' || key === 'prototype') { return; } - - // findKey lowercases the key, so caseless lookup only applies to strings — - // symbol keys are identity-matched. - const targetKey = caseless && typeof key === 'string' && findKey(result, key) || key; + let targetKey = key; + if (lowerCaseKeys && typeof key === 'string') { + const lowerKey = key.toLowerCase(); + const knownKey = lowerCaseKeys[lowerKey]; + // A key recorded but absent from `result` was skipped by skipUndefined; + // the later spelling wins then, as it does for findKey. + if (knownKey !== undefined && hasOwnProperty(result, knownKey)) { + targetKey = knownKey; + } else { + lowerCaseKeys[lowerKey] = key; + } + } // Read via own-prop only — a bare `result[targetKey]` walks the prototype // chain, so a polluted Object.prototype value could surface here and get // copied into the merged result. @@ -16477,7 +16497,7 @@ function requireAxios () { continue; } forEach(source, assignValue); - if (typeof source !== 'object' || isArray(source)) { + if (typeof source !== 'object' || isArray(source) || !Object.getOwnPropertySymbols) { continue; } const symbols = Object.getOwnPropertySymbols(source); @@ -16632,7 +16652,27 @@ function requireAxios () { if (!thing) return null; if (isArray(thing)) return thing; let i = thing.length; - if (!isNumber(i)) return null; + if (!Number.isSafeInteger(i) || i < 0 || i > 0xffffffff) return null; + + // Bound the copy by actual indexed properties, including hidden and inherited + // members of array-like collections, rather than by the declared length alone. + const indexes = new Set(); + const seen = new Set(); + let source = thing; + while (source != null && indexes.size < i) { + if (seen.has(source)) return null; + seen.add(source); + const prototype = getPrototypeOf(source); + if (isPrototypeBoundary(source, prototype, source === thing)) break; + Object.getOwnPropertyNames(source).forEach(key => { + const index = +key; + if (Number.isInteger(index) && index >= 0 && index < i && String(index) === key && hasOwnProperty(source, key)) { + indexes.add(index); + } + }); + source = prototype; + } + if (indexes.size !== i) return null; const arr = new Array(i); while (i-- > 0) { arr[i] = thing[i]; @@ -16983,7 +17023,8 @@ function requireAxios () { * @returns {Object} Headers parsed into an object */ var parseHeaders = rawHeaders => { - const parsed = {}; + // Header names are data, including __proto__; avoid inherited setters. + const parsed = Object.create(null); let key; let val; let i; @@ -17153,9 +17194,21 @@ function requireAxios () { return parameters; } const isValidHeaderName = str => /^[-_a-zA-Z0-9^`|~,!#$%&'*+.]+$/.test(str.trim()); + + // `__proto__` is a valid field name, and the one name the uppercase mapping at + // the bottom of this file cannot reach: it is inherited from Object.prototype + // instead of being declared on AxiosHeaders.prototype, so `self.__proto__ = v` + // runs the inherited setter. That silently discards the header, and an array + // value replaces the instance prototype, taking every method with it. + // Store it under the same kind of case variant that mapping uses for `set` and + // `constructor`. Header lookup is caseless, so it reads back under either + // spelling, and no own `__proto__` slot is ever created for a later + // `Object.assign` to copy onto a plain object through the same setter. + const PROTO_HEADER_SLOT = '__Proto__'; + const headerSlot = name => name === '__proto__' ? PROTO_HEADER_SLOT : name; function matchHeaderValue(context, value, header, filter, isHeaderNameFilter) { if (utils$1.isFunction(filter)) { - return filter.call(this, value, header); + return filter.call(context, value, header); } if (isHeaderNameFilter) { value = header; @@ -17200,7 +17253,7 @@ function requireAxios () { } const key = utils$1.findKey(self, lHeader); if (!key || self[key] === undefined || _rewrite === true || _rewrite === undefined && self[key] !== false) { - self[key || _header] = normalizeValue(_value); + self[headerSlot(key || _header)] = normalizeValue(_value); } } const setHeaders = (headers, _rewrite) => utils$1.forEach(headers, (_value, _header) => setHeader(_value, _header, _rewrite)); @@ -17295,7 +17348,7 @@ function requireAxios () { } normalize(format) { const self = this; - const headers = {}; + const headers = Object.create(null); utils$1.forEach(this, (value, header) => { const key = utils$1.findKey(headers, header); if (key) { @@ -17303,7 +17356,7 @@ function requireAxios () { delete self[header]; return; } - const normalized = format ? formatHeader(header) : String(header).trim(); + const normalized = headerSlot(format ? formatHeader(header) : String(header).trim()); if (normalized !== header) { delete self[header]; } @@ -17452,6 +17505,60 @@ function requireAxios () { }).filter(Boolean).join('; '); return message || error.name || 'AggregateError'; } + + // Shared with `Axios.prototype.request`, which splices the reconstructed + // caller frames in ahead of this marker. + const CAUSED_BY_SEPARATOR = '\nCaused by: '; + const $causeStack = Symbol('causeStack'); + + // Match the section we appended, not marker-like text in an error message or + // a replacement stack supplied by the caller. Do not re-read the cause's stack. + function getCauseStackIndex(error, stack) { + const causeStack = utils$1.hasOwnProp(error, $causeStack) && error[$causeStack]; + return causeStack && stack.endsWith(causeStack) ? stack.length - causeStack.length : -1; + } + + /** + * Append the stack of a wrapped error to `target.stack`. + * + * `cause` already exposes the original error for tooling that walks the standard + * cause chain, but many error reporters read `stack` and nothing else. Inlining + * the wrapped stack there means those reporters surface the underlying failure + * instead of the axios frames that normalized it (see #6670). + * + * Every read is defensive: a custom `Error.prepareStackTrace` hook, a runtime + * without stack support, or a replaced `stack` property can leave the value + * missing, non-string, or read-only, and normalizing an error must not throw + * because of that. + * + * @param {Error} target The AxiosError being built. + * @param {Error} source The error being wrapped. + * + * @returns {void} + */ + function appendCauseStack(target, source) { + try { + const sourceStack = source && source.stack; + if (typeof sourceStack !== 'string' || !sourceStack) { + return; + } + const targetStack = target.stack; + if (typeof targetStack !== 'string' || !targetStack) { + return; + } + + // Each call to `from()` creates a fresh target. Re-wrapping includes the + // previous stack verbatim, adding one cause section per wrap. + const causeStack = CAUSED_BY_SEPARATOR + sourceStack; + target.stack = targetStack + causeStack; + Object.defineProperty(target, $causeStack, { + __proto__: null, + value: causeStack + }); + } catch (e) { + // Ignore failures from custom stack hooks or un-writable stack properties. + } + } class AxiosError extends Error { static from(error, code, config, request, response, customProps) { // `AggregateError` (thrown by Node on dual-stack/Happy-Eyeballs connection @@ -17477,6 +17584,10 @@ function requireAxios () { }); axiosError.name = error.name; + // Inline the wrapped stack for reporters that read only `stack`; the `cause` + // property above already covers cause-aware tooling. + appendCauseStack(axiosError, error); + // Preserve status from the original error if not already set from response if (error.status != null && axiosError.status == null) { axiosError.status = error.status; @@ -17901,6 +18012,15 @@ function requireAxios () { handlers.pop(); } } + + // Preserve the array-key coercion used before IDs were stored in a Map, without + // treating null, empty strings, or noncanonical numeric strings as ID zero. + function normalizeHandlerId(id) { + if (typeof id === 'string' && id !== '' && String(Number(id)) === id) { + return Number(id); + } + return id; + } function syncHandlerEntries(manager, internals) { const handlers = manager.handlers; const length = countHandlers(handlers); @@ -17973,9 +18093,10 @@ function requireAxios () { eject(id) { const internals = this[$internals]; syncHandlerEntries(this, internals); - const entry = internals.handlerEntries.get(id); + const handlerId = normalizeHandlerId(id); + const entry = internals.handlerEntries.get(handlerId); if (entry) { - internals.handlerEntries.delete(id); + internals.handlerEntries.delete(handlerId); // Ignore IDs invalidated by clear or direct replacement of handlers. if (this.handlers[entry.index] !== entry.handler) { @@ -18039,7 +18160,8 @@ function requireAxios () { clarifyTimeoutError: false, legacyInterceptorReqResOrdering: true, advertiseZstdAcceptEncoding: false, - validateStatusUndefinedResolves: true + validateStatusUndefinedResolves: true, + encodeBasicAuthUsername: false }; var URLSearchParams = url.URLSearchParams; @@ -18194,6 +18316,24 @@ function requireAxios () { } return obj; } + function normalizeArray(value) { + if (!utils$1.isArray(value)) return value; + const keys = Object.keys(value); + return keys.length !== value.length || keys.some((key, index) => key !== String(index)) ? arrayToObject(value) : value; + } + function normalizeArrays(obj) { + const pending = [obj]; + while (pending.length) { + const target = pending.pop(); + Object.keys(target).forEach(key => { + const value = target[key] = normalizeArray(target[key]); + if (utils$1.isArray(value) || utils$1.isPlainObject(value)) { + pending.push(value); + } + }); + } + return obj; + } /** * It takes a FormData object and returns a JavaScript object @@ -18212,6 +18352,7 @@ function requireAxios () { name = !name && utils$1.isArray(target) ? target.length : name; if (isLast) { if (utils$1.hasOwnProp(target, name)) { + target[name] = normalizeArray(target[name]); target[name] = utils$1.isArray(target[name]) ? target[name].concat(value) : [target[name], value]; } else { target[name] = value; @@ -18232,7 +18373,7 @@ function requireAxios () { utils$1.forEachEntry(formData, (name, value) => { buildPath(parsePropPath(name), value, obj, 0); }); - return obj; + return normalizeArrays(obj); } return null; } @@ -18627,16 +18768,19 @@ function requireAxios () { return process.env[key.toLowerCase()] || process.env[key.toUpperCase()] || ''; } - const VERSION = "1.20.0"; + const VERSION = "1.21.0"; function parseProtocol(url) { const match = /^([-+\w]{1,25}):(?:\/\/)?/.exec(url); - return match && match[1] || ''; + return match && match[1].toLowerCase() || ''; } // RFC 2397: data:[][;base64], // mediatype = type/subtype followed by optional ;name=value parameters - const DATA_URL_PATTERN = /^([^,;/]+\/[^,;/]+)?((?:;[^,;=]+=[^,;]+)*)(;base64)?,([\s\S]*)$/; + // The `i` flag makes the `;base64` token case-insensitive, matching the WHATWG + // URL/Fetch data URL processor (and therefore the fetch adapter and browsers). + // The remaining character classes do not depend on letter case. + const DATA_URL_PATTERN = /^([^,;/]+\/[^,;/]+)?((?:;[^,;=]+=[^,;]+)*)(;base64)?,([\s\S]*)$/i; /** * Parse data uri to a Buffer or Blob @@ -18673,7 +18817,7 @@ function requireAxios () { } else if (params) { mime = 'text/plain' + params; } - const buffer = encoding === 'base64' ? Buffer.from(body, 'base64') : Buffer.from(decodeURIComponent(body), encoding); + const buffer = encoding === 'base64' ? Buffer.from(body.replace(/%([\da-f]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16))), 'base64') : Buffer.from(decodeURIComponent(body), encoding); if (asBlob) { if (!_Blob) { throw new AxiosError('Blob is not supported', AxiosError.ERR_NOT_SUPPORT); @@ -18762,7 +18906,10 @@ function requireAxios () { const timeWindow = internals.timeWindow; const divider = 1000 / timeWindow; const bytesThreshold = maxRate / divider; - const minChunkSize = internals.minChunkSize !== false ? Math.max(internals.minChunkSize, bytesThreshold * 0.01) : 0; + let minChunkSize = internals.minChunkSize !== false ? Math.max(internals.minChunkSize, bytesThreshold * 0.01) : 0; + if (maxRate) { + minChunkSize = Math.min(bytesThreshold, minChunkSize); + } const pushChunk = (_chunk, _callback) => { const bytes = Buffer.byteLength(_chunk); internals.bytesSeen += bytes; @@ -18778,6 +18925,9 @@ function requireAxios () { } }; const transformChunk = (_chunk, _callback) => { + if (this.destroyed) { + return _callback(); + } const chunkSize = Buffer.byteLength(_chunk); let chunkRemainder = null; let maxChunkSize = readableHighWaterMark; @@ -18801,7 +18951,9 @@ function requireAxios () { }, timeWindow - passed); } if (bytesLeft < maxChunkSize) { - maxChunkSize = bytesLeft; + // A buffer boundary must consume at least one byte. Carry any + // fractional allowance forward in the next accounting window. + maxChunkSize = Math.max(1, Math.floor(bytesLeft)); } } if (maxChunkSize && chunkSize > maxChunkSize && chunkSize - maxChunkSize > minChunkSize) { @@ -18842,8 +18994,8 @@ function requireAxios () { const BOUNDARY_ALPHABET = platform.ALPHABET.ALPHA_DIGIT + '-_'; const textEncoder = typeof TextEncoder === 'function' ? new TextEncoder() : new util.TextEncoder(); - const CRLF = '\r\n'; - const CRLF_BYTES = textEncoder.encode(CRLF); + const CRLF$1 = '\r\n'; + const CRLF_BYTES = textEncoder.encode(CRLF$1); const CRLF_BYTES_COUNT = 2; class FormDataPart { constructor(name, value) { @@ -18851,14 +19003,14 @@ function requireAxios () { escapeName } = this.constructor; const isStringValue = utils$1.isString(value); - let headers = `Content-Disposition: form-data; name="${escapeName(name)}"${!isStringValue && value.name ? `; filename="${escapeName(value.name)}"` : ''}${CRLF}`; + let headers = `Content-Disposition: form-data; name="${escapeName(name)}"${!isStringValue && value.name ? `; filename="${escapeName(value.name)}"` : ''}${CRLF$1}`; if (isStringValue) { - value = textEncoder.encode(String(value).replace(/\r?\n|\r\n?/g, CRLF)); + value = textEncoder.encode(String(value).replace(/\r?\n|\r\n?/g, CRLF$1)); } else { const safeType = String(value.type || 'application/octet-stream').replace(/[\r\n]/g, ''); - headers += `Content-Type: ${safeType}${CRLF}`; + headers += `Content-Type: ${safeType}${CRLF$1}`; } - this.headers = textEncoder.encode(headers + CRLF); + this.headers = textEncoder.encode(headers + CRLF$1); this.contentLength = isStringValue ? value.byteLength : value.size; this.size = this.headers.byteLength + this.contentLength + CRLF_BYTES_COUNT; this.name = name; @@ -18896,8 +19048,8 @@ function requireAxios () { if (boundary.length < 1 || boundary.length > 70) { throw new Error('boundary must be 1-70 characters long'); } - const boundaryBytes = textEncoder.encode('--' + boundary + CRLF); - const footerBytes = textEncoder.encode('--' + boundary + '--' + CRLF); + const boundaryBytes = textEncoder.encode('--' + boundary + CRLF$1); + const footerBytes = textEncoder.encode('--' + boundary + '--' + CRLF$1); let contentLength = footerBytes.byteLength; const parts = Array.from(form.entries()).map(([name, value]) => { const part = new FormDataPart(name, value); @@ -19005,7 +19157,7 @@ function requireAxios () { timer = null; } stream.once('close', () => { - if (! --streamsCount) { + if (! --streamsCount && !removed) { timer = setTimeout(() => { timer = null; removeSession(); @@ -19017,6 +19169,7 @@ function requireAxios () { } session.once('close', removeSession); session.once('error', removeSession); + session.once('goaway', removeSession); let entry = [session, options]; authoritySessions ? authoritySessions.push(entry) : authoritySessions = this.sessions[authority] = [entry]; return session; @@ -19295,7 +19448,20 @@ function requireAxios () { if (hostname.charAt(0) === '[' && hostname.charAt(hostname.length - 1) === ']') { hostname = hostname.slice(1, -1); } - const trimmed = trimTrailingDots(hostname); + let trimmed = trimTrailingDots(hostname); + if (trimmed.indexOf(':') !== -1) { + try { + trimmed = new URL('http://[' + trimmed + ']/').hostname.slice(1, -1); + } catch (_err) { + return trimmed; + } + } else if (/[\u0080-\uffff]/.test(trimmed)) { + const prefix = /^[*.]+/.exec(trimmed); + const start = prefix ? prefix[0] : ''; + const ascii = url.domainToASCII(trimmed.slice(start.length)); + if (!ascii) return ''; + trimmed = start + trimTrailingDots(ascii); + } // IPv4 shorthand/octal/hex → dotted-decimal; helper is a no-op for inputs // containing ':' (IPv6 and IPv4-mapped IPv6) so we fall through to unmap. @@ -19558,7 +19724,7 @@ function requireAxios () { * Estimate data: URL byte lengths *without* allocating large buffers. * - Fetch percent-decodes a base64 body before decoding it. * - Node's Buffer.from(body, 'base64') sizes its backing allocation from the - * raw body, including ignored characters and content after padding. + * percent-decoded body, including ignored characters and content after padding. * - Non-base64 data is percent-decoded and then encoded as UTF-8. */ const isHexDigit = charCode => charCode >= 48 && charCode <= 57 || charCode >= 65 && charCode <= 70 || charCode >= 97 && charCode <= 102; @@ -19598,6 +19764,27 @@ function requireAxios () { } return Math.floor((len - padding) * 3 / 4); }; + const estimatePercentDecodedBase64BufferAllocation = body => { + // Ordinary Base64 needs only its length and trailing padding. + if (body.indexOf('%') === -1) { + return estimateBase64BufferAllocation(body); + } + let length = 0; + let previous = 0; + let last = 0; + for (let i = 0, len = body.length; i < len; i++) { + let code = body.charCodeAt(i); + if (code === 37 /* '%' */ && isPercentEncodedByte(body, i, len)) { + code = hexValue(body.charCodeAt(i + 1)) * 16 + hexValue(body.charCodeAt(i + 2)); + i += 2; + } + length++; + previous = last; + last = code; + } + const padding = last === 61 ? previous === 61 ? 2 : 1 : 0; + return Math.floor((length - padding) * 3 / 4); + }; const estimatePercentDecodedBase64Bytes = body => { const len = body.length; let significant = 0; @@ -19630,14 +19817,14 @@ function requireAxios () { } return base64Bytes(significant); }; - const estimateDataURLBytes = (url, estimateBase64) => { + const estimateDataURLBytes = (url, estimateBase64, base64Pattern) => { if (!url || typeof url !== 'string') return 0; - if (!url.startsWith('data:')) return 0; + if (!/^data:/i.test(url)) return 0; const comma = url.indexOf(','); if (comma < 0) return 0; const meta = url.slice(5, comma); const body = url.slice(comma + 1); - const isBase64 = /;base64/i.test(meta); + const isBase64 = base64Pattern.test(meta); if (isBase64) { return estimateBase64(body); } @@ -19680,17 +19867,18 @@ function requireAxios () { function estimateDataURLDecodedBytes(url) { // Fetch removes URL fragments before processing a data: URL. const fragmentIndex = typeof url === 'string' ? url.indexOf('#') : -1; - return estimateDataURLBytes(fragmentIndex === -1 ? url : url.slice(0, fragmentIndex), estimatePercentDecodedBase64Bytes); + return estimateDataURLBytes(fragmentIndex === -1 ? url : url.slice(0, fragmentIndex), estimatePercentDecodedBase64Bytes, /; *base64[\t\n\f\r ]*$/i); } /** - * Estimate the Buffer backing allocation used by Node's raw base64 decoder. + * Estimate the Buffer backing allocation used after Node's percent-decoding step. * * @param {string} url * @returns {number} */ function estimateDataURLBufferAllocation(url) { - return estimateDataURLBytes(url, estimateBase64BufferAllocation); + // Match fromDataURI's case-insensitive protocol and encoding suffix. + return estimateDataURLBytes(url, estimatePercentDecodedBase64BufferAllocation, /;base64$/i); } const zlibOptions = { @@ -19741,6 +19929,9 @@ function requireAxios () { // so unbounded growth is not a concern in practice. const tunnelingAgentCache = new Map(); const tunnelingAgentCacheUser = new WeakMap(); + const directAgents = new WeakMap(); + const directAgentHooks = ['createConnection', 'getName']; + const nativeAgentPoolHooks = ['addRequest', 'createSocket', 'removeSocket', 'keepSocketAlive', 'reuseSocket', '_getSession', '_cacheSession', '_evictSession']; // Minimum minor versions where Node's HTTP Agent supports native proxyEnv // handling. Checking the selected agent below also covers startup modes such // as NODE_OPTIONS=--use-env-proxy and --no-use-env-proxy precedence. @@ -19771,32 +19962,88 @@ function requireAxios () { function getProxyEnvAgent(options, configHttpAgent, configHttpsAgent) { return isHttps.test(options.protocol) ? configHttpsAgent || https$1.globalAgent : configHttpAgent || http$1.globalAgent; } + function getDirectAgent(configuredAgent, transport) { + if (!process.allowedNodeEnvironmentFlags || !process.allowedNodeEnvironmentFlags.has('--use-env-proxy')) { + return configuredAgent; + } + const agent = configuredAgent || transport.globalAgent; + const options = agent && agent.options; + if (!(agent instanceof transport.Agent) || agent.protocol !== transport.globalAgent.protocol || !options || !utils$1.hasOwnProp(options, 'proxyEnv') || typeof options.proxyEnv !== 'object' || options.proxyEnv === null) { + return configuredAgent; + } + + // These hooks own pool queues or TLS session state. Neither binding them to + // the source agent nor copying them without subclass state preserves their + // behavior on a separate direct pool. + for (const hook of nativeAgentPoolHooks) { + if (utils$1.isFunction(transport.Agent.prototype[hook]) && agent[hook] !== transport.Agent.prototype[hook]) { + throw new AxiosError('proxy: false cannot adapt an agent overriding ' + hook + '; use an agent constructed without proxyEnv', AxiosError.ERR_BAD_OPTION_VALUE); + } + } + + // Node snapshots proxyEnv when constructing the agent. Keep this check + // conservative even when the caller later removes protocol-specific entries. + let direct = directAgents.get(agent); + if (!direct) { + direct = new transport.Agent({ + ...options, + proxyEnv: undefined + }); + + // Agent.destroy() does not emit an event. Keep the associated pool under + // the configured agent's lifetime, including agents reused after destroy(). + const destroy = agent.destroy; + agent.destroy = function destroyWithDirectAgent() { + try { + return destroy.apply(this, arguments); + } finally { + direct.destroy(); + } + }; + directAgents.set(agent, direct); + } + + // Connections and pool keys do not own the direct pool's queues. Preserve + // their configured receiver and refresh hooks that change between requests. + for (const hook of directAgentHooks) { + direct[hook] = agent[hook] === transport.Agent.prototype[hook] ? transport.Agent.prototype[hook] : bind(agent[hook], agent); + } + return direct; + } + function setDirectAgent(options, configHttpAgent, configHttpsAgent) { + const secure = isHttps.test(options.protocol); + const agent = getDirectAgent(secure ? configHttpsAgent : configHttpAgent, secure ? https$1 : http$1); + options.agent = agent; + if (options.agents) { + options.agents[secure ? 'https' : 'http'] = agent; + } + } function getTunnelingAgent(agentOptions, userHttpsAgent) { const key = agentOptions.protocol + '//' + agentOptions.hostname + ':' + (agentOptions.port || '') + '#' + (agentOptions.auth || ''); const cache = userHttpsAgent ? tunnelingAgentCacheUser.get(userHttpsAgent) || tunnelingAgentCacheUser.set(userHttpsAgent, new Map()).get(userHttpsAgent) : tunnelingAgentCache; let agent = cache.get(key); if (agent) return agent; - // Forward the user's TLS options (custom CA, rejectUnauthorized, client cert, - // etc.) into the tunneling agent so they apply to the origin TLS upgrade - // performed after CONNECT. Our proxy fields take precedence on conflict. + // Preserve per-request TLS options for the proxy connection, with our proxy + // fields taking precedence. Global-agent options belong only to the origin + // TLS upgrade in the callback below. const merged = userHttpsAgent && userHttpsAgent.options ? { ...userHttpsAgent.options, ...agentOptions } : agentOptions; agent = new HttpsProxyAgent(merged); - if (userHttpsAgent && userHttpsAgent.options) { - const originTLSOptions = { - ...userHttpsAgent.options - }; - const callback = agent.callback; - agent.callback = function axiosTunnelingAgentCallback(req, opts) { - // HttpsProxyAgent v5 reads callback opts for the post-CONNECT origin TLS upgrade. - return callback.call(this, req, { - ...originTLSOptions, - ...opts - }); - }; - } + const callback = agent.callback; + agent.callback = function axiosTunnelingAgentCallback(req, opts) { + // Without a proxy the origin TLS connection would be made by https.globalAgent, + // so its options have to reach the tunneled origin too. Resolved per request + // because the tunneling agent outlives any one of them. + const originTLSAgent = userHttpsAgent || https$1.globalAgent; + const originTLSOptions = originTLSAgent && originTLSAgent.options; + // HttpsProxyAgent v5 reads callback opts for the post-CONNECT origin TLS upgrade. + return callback.call(this, req, { + ...originTLSOptions, + ...opts + }); + }; agent[kAxiosInstalledTunnel] = true; cache.set(key, agent); return agent; @@ -19834,6 +20081,10 @@ function requireAxios () { * @returns {Object} */ function dispatchBeforeRedirect(options, responseDetails, requestDetails) { + if (!isSameOriginRedirect(options, requestDetails)) { + stripMatchingHeaders(options.headers, new Set(['authorization', 'cookie'])); + delete options.auth; + } if (options.beforeRedirects.proxy) { options.beforeRedirects.proxy(options); } @@ -19843,6 +20094,9 @@ function requireAxios () { if (options.beforeRedirects.sensitiveHeaders) { options.beforeRedirects.sensitiveHeaders(options, requestDetails); } + if (options.beforeRedirects.direct) { + options.beforeRedirects.direct(options); + } if (options.beforeRedirects.config) { options.beforeRedirects.config(options, responseDetails, requestDetails); } @@ -19908,6 +20162,9 @@ function requireAxios () { if (isRedirect && options.agent && options.agent[kAxiosInstalledTunnel]) { options.agent = undefined; } + if (isRedirect && options.agents && options.agents.https && options.agents.https[kAxiosInstalledTunnel]) { + options.agents.https = configHttpsAgent; + } if (proxy) { // Read proxy fields without traversing the prototype chain. URL instances expose // username/password/hostname/host/port/protocol via getters on URL.prototype (so @@ -20141,9 +20398,9 @@ function requireAxios () { if (httpVersion === undefined) httpVersion = 1; const rawHttpVersion = httpVersion; let http2Options = own('http2Options'); + const configProxy = own('proxy'); const httpAgent = own('httpAgent'); const httpsAgent = own('httpsAgent'); - const configProxy = own('proxy'); const responseType = own('responseType'); const responseEncoding = own('responseEncoding'); const socketPath = own('socketPath'); @@ -20267,6 +20524,11 @@ function requireAxios () { } catch (err) { throw AxiosError.from(err, AxiosError.ERR_BAD_REQUEST, config); } + + // Check bytes before converting the result to text or a stream. + if (maxContentLength > -1 && (responseType === 'blob' ? convertedData.size : convertedData.length) > maxContentLength) { + return reject(new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config)); + } if (responseType === 'text') { convertedData = convertedData.toString(responseEncoding); if (!responseEncoding || responseEncoding === 'utf8') { @@ -20435,15 +20697,15 @@ function requireAxios () { } let transport; let isNativeTransport = false; - // True only for the follow-redirects transport, which applies - // options.maxBodyLength itself. Every other transport (http2, native - // http/https, a user-supplied custom transport) needs the explicit - // byte-counting pipeline below to enforce maxBodyLength on streamed uploads. - let transportEnforcesMaxBodyLength = false; const isHttpsRequest = isHttps.test(options.protocol); // Don't clobber a CONNECT-tunneling agent installed by setProxy() for an // HTTPS target. - if (options.agent == null) { + if (!isHttp2 && configProxy === false) { + setDirectAgent(options, httpAgent, httpsAgent); + options.beforeRedirects.direct = redirectOptions => { + setDirectAgent(redirectOptions, httpAgent, httpsAgent); + }; + } else if (options.agent == null) { options.agent = isHttpsRequest ? httpsAgent : httpAgent; } if (isHttp2) { @@ -20459,7 +20721,6 @@ function requireAxios () { transport = isHttpsRequest ? https$1 : http$1; isNativeTransport = true; } else { - transportEnforcesMaxBodyLength = true; options.sensitiveHeaders = []; if (maxRedirects) { options.maxRedirects = maxRedirects; @@ -20763,12 +21024,10 @@ function requireAxios () { } }); - // Enforce maxBodyLength for streamed uploads on every transport that - // does not apply options.maxBodyLength itself (native http/https, http2, - // and user-supplied custom transports). The follow-redirects transport - // enforces it on the redirected HTTP/1 path. + // Transform decodes string chunks to Buffers before counting, so every + // transport receives at most maxBodyLength encoded bytes. let uploadStream = data; - if (maxBodyLength > -1 && !transportEnforcesMaxBodyLength) { + if (maxBodyLength > -1) { const limit = maxBodyLength; let bytesSent = 0; uploadStream = stream.pipeline([data, new stream.Transform({ @@ -20792,11 +21051,13 @@ function requireAxios () { }); }; - var isURLSameOrigin = platform.hasStandardBrowserEnv ? ((origin, isMSIE) => url => { - url = new URL(url, platform.origin); - return origin.protocol === url.protocol && origin.host === url.host && (isMSIE || origin.port === url.port); - })(new URL(platform.origin), platform.navigator && /(msie|trident)/i.test(platform.navigator.userAgent)) : () => true; - + const decodeCookieValue = value => { + try { + return decodeURIComponent(value); + } catch (e) { + return value; + } + }; var cookies = platform.hasStandardBrowserEnv ? // Standard browser envs support document.cookie { @@ -20822,25 +21083,36 @@ function requireAxios () { }, read(name) { if (typeof document === 'undefined') return null; + const cookieString = document.cookie; + if (!cookieString) return null; // Match name=value by splitting on the semicolon separator instead of building a // RegExp from `name` — interpolating an unescaped string into a RegExp would let // metacharacters (e.g. `.+?` in an attacker-influenced cookie name) cause ReDoS or // match the wrong cookie. Browsers may serialize cookie pairs as either ";" or // "; ", so ignore optional whitespace before each cookie name. - const cookies = document.cookie.split(';'); + const cookies = cookieString.split(';'); for (let i = 0; i < cookies.length; i++) { const cookie = cookies[i].replace(/^\s+/, ''); const eq = cookie.indexOf('='); if (eq !== -1 && cookie.slice(0, eq) === name) { - try { - return decodeURIComponent(cookie.slice(eq + 1)); - } catch (e) { - return cookie.slice(eq + 1); - } + return decodeCookieValue(cookie.slice(eq + 1)); } } return null; }, + async readAsync(name) { + try { + const store = typeof window !== 'undefined' && window.cookieStore; + if (store && utils$1.isFunction(store.get)) { + const cookie = await store.get(name); + // Both APIs expose stored bytes; preserve Axios's existing URI decoding. + return cookie ? decodeCookieValue(cookie.value) : null; + } + } catch (e) { + // Restricted or unavailable storage retains the synchronous fallback. + } + return this.read(name); + }, remove(name) { this.write(name, '', Date.now() - 86400000, '/'); } @@ -20851,19 +21123,242 @@ function requireAxios () { read() { return null; }, + async readAsync() { + return null; + }, remove() {} }; + var isURLSameOrigin = platform.hasStandardBrowserEnv ? (origin => url => { + url = new URL(url, document.baseURI || platform.origin); + return origin.protocol === url.protocol && origin.host === url.host && origin.port === url.port; + })(new URL(platform.origin)) : () => true; + + function assertParamsAcyclic(params) { + const pending = [{ + value: params + }]; + const active = new WeakSet(); + const visited = new WeakSet(); + while (pending.length) { + const { + value, + done + } = pending.pop(); + if (!utils$1.isPlainObject(value) && !utils$1.isArray(value)) continue; + if (done) { + active.delete(value); + continue; + } + if (active.has(value)) { + throw new AxiosError('Circular reference detected in params', AxiosError.ERR_BAD_OPTION_VALUE); + } + if (visited.has(value)) continue; + visited.add(value); + active.add(value); + pending.push({ + value, + done: true + }); + const keys = Object.keys(value); + if (Object.getOwnPropertySymbols && Object.getOwnPropertyDescriptor) { + Object.getOwnPropertySymbols(value).forEach(key => { + const descriptor = Object.getOwnPropertyDescriptor(value, key); + if (descriptor && descriptor.enumerable) keys.push(key); + }); + } + // Shallow array elements retain fields filtered during plain-object merges. + // Inspect reserved data properties without evaluating their accessors. + keys.forEach(key => { + if (key === '__proto__' || key === 'constructor' || key === 'prototype') { + const descriptor = Object.getOwnPropertyDescriptor(value, key); + if (descriptor && utils$1.hasOwnProp(descriptor, 'value')) { + pending.push({ + value: descriptor.value + }); + } + } else { + pending.push({ + value: value[key] + }); + } + }); + } + } + const headersToObject = thing => thing instanceof AxiosHeaders ? { ...thing } : thing; const ownEnumerableKeys = thing => { if (Object.getOwnPropertySymbols && Object.getOwnPropertyDescriptor) { - return Object.keys(thing).concat(Object.getOwnPropertySymbols(thing).filter(symbol => Object.getOwnPropertyDescriptor(thing, symbol).enumerable)); + return Object.keys(thing).concat(Object.getOwnPropertySymbols(thing).filter(symbol => { + const descriptor = Object.getOwnPropertyDescriptor(thing, symbol); + return descriptor && descriptor.enumerable; + })); } return Object.keys(thing); }; + // Copy params without recursive merges so the serializer remains responsible + // for its depth policy. Only visit defaults that contribute to the result. + function mergeParams(a, b) { + const pending = []; + const copies = new WeakMap(); + const empty = {}; + function copy(target, source) { + if (!utils$1.isPlainObject(source)) { + return utils$1.isArray(source) ? source.slice() : source; + } + const base = utils$1.isPlainObject(target) ? target : empty; + let bases = copies.get(source); + if (!bases) { + bases = new WeakMap(); + copies.set(source, bases); + } + if (bases.has(base)) return bases.get(base); + const result = {}; + bases.set(base, result); + pending.push({ + base, + source, + result + }); + return result; + } + const result = utils$1.isUndefined(b) ? copy(undefined, a) : copy(a, b); + while (pending.length) { + const { + base, + source, + result: target + } = pending.pop(); + const baseKeys = new Set(ownEnumerableKeys(base)); + const sourceKeys = new Set(ownEnumerableKeys(source)); + const keys = new Set([...baseKeys, ...sourceKeys]); + keys.forEach(key => { + if (key === '__proto__' || key === 'constructor' || key === 'prototype') return; + const hasSource = sourceKeys.has(key); + const value = hasSource ? source[key] : undefined; + const previous = (!hasSource || utils$1.isPlainObject(value)) && baseKeys.has(key) ? base[key] : undefined; + target[key] = hasSource ? copy(previous, value) : copy(undefined, previous); + }); + } + assertParamsAcyclic(result); + return result; + } + function getMergedValue(target, source, prop, caseless) { + if (utils$1.isPlainObject(target) && utils$1.isPlainObject(source)) { + return utils$1.merge.call({ + caseless + }, target, source); + } else if (utils$1.isPlainObject(source)) { + return utils$1.merge({}, source); + } else if (utils$1.isArray(source)) { + return source.slice(); + } + return source; + } + function mergeDeepProperties(a, b, prop, caseless) { + if (!utils$1.isUndefined(b)) { + return getMergedValue(a, b, prop, caseless); + } else if (!utils$1.isUndefined(a)) { + return getMergedValue(undefined, a, prop, caseless); + } + } + + // eslint-disable-next-line consistent-return + function valueFromConfig2(a, b) { + if (!utils$1.isUndefined(b)) { + return getMergedValue(undefined, b); + } + } + + // eslint-disable-next-line consistent-return + function defaultToConfig2(a, b) { + if (!utils$1.isUndefined(b)) { + return getMergedValue(undefined, b); + } else if (!utils$1.isUndefined(a)) { + return getMergedValue(undefined, a); + } + } + function getMergedTransitionalOption(config1, config2, prop) { + const transitional2 = utils$1.hasOwnProp(config2, 'transitional') ? config2.transitional : undefined; + if (!utils$1.isUndefined(transitional2)) { + if (utils$1.isPlainObject(transitional2)) { + if (utils$1.hasOwnProp(transitional2, prop)) { + return transitional2[prop]; + } + } else { + return undefined; + } + } + const transitional1 = utils$1.hasOwnProp(config1, 'transitional') ? config1.transitional : undefined; + if (utils$1.isPlainObject(transitional1) && utils$1.hasOwnProp(transitional1, prop)) { + return transitional1[prop]; + } + return undefined; + } + + // eslint-disable-next-line consistent-return + function mergeDirectKeys(a, b, prop, config1, config2) { + if (utils$1.hasOwnProp(config2, prop)) { + return getMergedValue(a, b); + } else if (utils$1.hasOwnProp(config1, prop)) { + return getMergedValue(undefined, a); + } + } + function mergeHeaders(a, b, prop) { + return mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true); + } + + // Null-proto, frozen descriptor so a polluted Object.prototype.get cannot turn + // this data descriptor into an accessor descriptor on the way in. + // defineProperty only reads it, so one shared instance serves every call. + const hasOwnPropertyDescriptor = Object.freeze({ + __proto__: null, + value: Object.prototype.hasOwnProperty, + enumerable: false, + writable: true, + configurable: true + }); + + // The strategy table and the strategies above are stateless, so they are + // built once at module load instead of on every call: mergeConfig runs at + // most twice per request (once from a method alias, once from `_request`). + const mergeMap = { + url: valueFromConfig2, + method: valueFromConfig2, + data: valueFromConfig2, + baseURL: defaultToConfig2, + transformRequest: defaultToConfig2, + transformResponse: defaultToConfig2, + params: mergeParams, + paramsSerializer: defaultToConfig2, + timeout: defaultToConfig2, + timeoutErrorMessage: defaultToConfig2, + withCredentials: defaultToConfig2, + withXSRFToken: defaultToConfig2, + adapter: defaultToConfig2, + responseType: defaultToConfig2, + xsrfCookieName: defaultToConfig2, + xsrfHeaderName: defaultToConfig2, + onUploadProgress: defaultToConfig2, + onDownloadProgress: defaultToConfig2, + decompress: defaultToConfig2, + maxContentLength: defaultToConfig2, + maxBodyLength: defaultToConfig2, + beforeRedirect: defaultToConfig2, + transport: defaultToConfig2, + httpAgent: defaultToConfig2, + httpsAgent: defaultToConfig2, + cancelToken: defaultToConfig2, + socketPath: defaultToConfig2, + allowedSocketPaths: defaultToConfig2, + responseEncoding: defaultToConfig2, + validateStatus: mergeDirectKeys, + headers: mergeHeaders + }; + /** * Config-specific merge-function which creates a new config-object * by merging two configuration objects together. @@ -20883,120 +21378,21 @@ function requireAxios () { // `hasOwnProperty` is restored as a non-enumerable own slot to preserve // ergonomics for user code that relies on it. const config = Object.create(null); - Object.defineProperty(config, 'hasOwnProperty', { - // Null-proto descriptor so a polluted Object.prototype.get cannot turn - // this data descriptor into an accessor descriptor on the way in. - __proto__: null, - value: Object.prototype.hasOwnProperty, - enumerable: false, - writable: true, - configurable: true - }); - function getMergedValue(target, source, prop, caseless) { - if (utils$1.isPlainObject(target) && utils$1.isPlainObject(source)) { - return utils$1.merge.call({ - caseless - }, target, source); - } else if (utils$1.isPlainObject(source)) { - return utils$1.merge({}, source); - } else if (utils$1.isArray(source)) { - return source.slice(); - } - return source; - } - function mergeDeepProperties(a, b, prop, caseless) { - if (!utils$1.isUndefined(b)) { - return getMergedValue(a, b, prop, caseless); - } else if (!utils$1.isUndefined(a)) { - return getMergedValue(undefined, a, prop, caseless); - } - } - - // eslint-disable-next-line consistent-return - function valueFromConfig2(a, b) { - if (!utils$1.isUndefined(b)) { - return getMergedValue(undefined, b); - } - } - - // eslint-disable-next-line consistent-return - function defaultToConfig2(a, b) { - if (!utils$1.isUndefined(b)) { - return getMergedValue(undefined, b); - } else if (!utils$1.isUndefined(a)) { - return getMergedValue(undefined, a); - } - } - function getMergedTransitionalOption(prop) { - const transitional2 = utils$1.hasOwnProp(config2, 'transitional') ? config2.transitional : undefined; - if (!utils$1.isUndefined(transitional2)) { - if (utils$1.isPlainObject(transitional2)) { - if (utils$1.hasOwnProp(transitional2, prop)) { - return transitional2[prop]; - } - } else { - return undefined; - } - } - const transitional1 = utils$1.hasOwnProp(config1, 'transitional') ? config1.transitional : undefined; - if (utils$1.isPlainObject(transitional1) && utils$1.hasOwnProp(transitional1, prop)) { - return transitional1[prop]; - } - return undefined; - } - - // eslint-disable-next-line consistent-return - function mergeDirectKeys(a, b, prop) { - if (utils$1.hasOwnProp(config2, prop)) { - return getMergedValue(a, b); - } else if (utils$1.hasOwnProp(config1, prop)) { - return getMergedValue(undefined, a); - } - } - const mergeMap = { - url: valueFromConfig2, - method: valueFromConfig2, - data: valueFromConfig2, - baseURL: defaultToConfig2, - transformRequest: defaultToConfig2, - transformResponse: defaultToConfig2, - paramsSerializer: defaultToConfig2, - timeout: defaultToConfig2, - timeoutErrorMessage: defaultToConfig2, - withCredentials: defaultToConfig2, - withXSRFToken: defaultToConfig2, - adapter: defaultToConfig2, - responseType: defaultToConfig2, - xsrfCookieName: defaultToConfig2, - xsrfHeaderName: defaultToConfig2, - onUploadProgress: defaultToConfig2, - onDownloadProgress: defaultToConfig2, - decompress: defaultToConfig2, - maxContentLength: defaultToConfig2, - maxBodyLength: defaultToConfig2, - beforeRedirect: defaultToConfig2, - transport: defaultToConfig2, - httpAgent: defaultToConfig2, - httpsAgent: defaultToConfig2, - cancelToken: defaultToConfig2, - socketPath: defaultToConfig2, - allowedSocketPaths: defaultToConfig2, - responseEncoding: defaultToConfig2, - validateStatus: mergeDirectKeys, - headers: (a, b, prop) => mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true) - }; - utils$1.forEach(ownEnumerableKeys({ + Object.defineProperty(config, 'hasOwnProperty', hasOwnPropertyDescriptor); + const keys = ownEnumerableKeys({ ...config1, ...config2 - }), function computeConfigValue(prop) { - if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') return; + }); + for (let i = 0, len = keys.length; i < len; i++) { + const prop = keys[i]; + if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') continue; const merge = utils$1.hasOwnProp(mergeMap, prop) ? mergeMap[prop] : mergeDeepProperties; const a = utils$1.hasOwnProp(config1, prop) ? config1[prop] : undefined; const b = utils$1.hasOwnProp(config2, prop) ? config2[prop] : undefined; - const configValue = merge(a, b, prop); + const configValue = merge === mergeDirectKeys ? merge(a, b, prop, config1, config2) : merge(a, b, prop); utils$1.isUndefined(configValue) && merge !== mergeDirectKeys || (config[prop] = configValue); - }); - if (utils$1.hasOwnProp(config2, 'validateStatus') && utils$1.isUndefined(config2.validateStatus) && getMergedTransitionalOption('validateStatusUndefinedResolves') === false) { + } + if (utils$1.hasOwnProp(config2, 'validateStatus') && utils$1.isUndefined(config2.validateStatus) && getMergedTransitionalOption(config1, config2, 'validateStatusUndefinedResolves') === false) { if (utils$1.hasOwnProp(config1, 'validateStatus')) { config.validateStatus = getMergedValue(undefined, config1.validateStatus); } else { @@ -21015,7 +21411,8 @@ function requireAxios () { * @returns {string} UTF-8 bytes as a Latin-1 string */ const encodeUTF8$1 = str => encodeURIComponent(str).replace(/%([0-9A-F]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16))); - function resolveConfig(config) { + const readCookie = name => cookies.read(name); + function resolveConfig(config, readXsrfCookie = readCookie) { const newConfig = mergeConfig({}, config); // Read only own properties to prevent prototype pollution gadgets @@ -21037,8 +21434,12 @@ function requireAxios () { if (auth) { const username = utils$1.getSafeProp(auth, 'username') || ''; const password = utils$1.getSafeProp(auth, 'password') || ''; + const transitional = own('transitional'); + const encodeUsername = transitional && utils$1.hasOwnProp(transitional, 'encodeBasicAuthUsername') && transitional.encodeBasicAuthUsername === true; try { - headers.set('Authorization', 'Basic ' + btoa(username + ':' + (password ? encodeUTF8$1(password) : ''))); + headers.set('Authorization', + // Preserve legacy username bytes unless the caller opts in to UTF-8. + 'Basic ' + btoa((encodeUsername ? encodeUTF8$1(username) : username) + ':' + (password ? encodeUTF8$1(password) : ''))); } catch (e) { throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config); } @@ -21067,7 +21468,7 @@ function requireAxios () { // the XSRF token cross-origin. const shouldSendXSRF = withXSRFToken === true || withXSRFToken == null && isURLSameOrigin(newConfig.url); if (shouldSendXSRF) { - const xsrfValue = xsrfHeaderName && xsrfCookieName && cookies.read(xsrfCookieName); + const xsrfValue = xsrfHeaderName && xsrfCookieName && readXsrfCookie(xsrfCookieName); if (xsrfValue) { headers.set(xsrfHeaderName, xsrfValue); } @@ -21079,7 +21480,18 @@ function requireAxios () { const isXHRAdapterSupported = typeof XMLHttpRequest !== 'undefined'; var xhrAdapter = isXHRAdapterSupported && function (config) { return new Promise(function dispatchXhrRequest(resolve, reject) { - const _config = resolveConfig(config); + let useAsyncXsrf; + try { + const store = platform.hasStandardBrowserEnv && typeof window !== 'undefined' && window.cookieStore; + useAsyncXsrf = store && utils$1.isFunction(store.get); + } catch (e) { + // A restricted Cookie Store getter must retain the synchronous fallback. + } + let xsrfCookieName; + const _config = resolveConfig(config, useAsyncXsrf ? name => { + xsrfCookieName = name; + return null; + } : undefined); let requestData = _config.data; const requestHeaders = AxiosHeaders.from(_config.headers).normalize(); let { @@ -21088,12 +21500,37 @@ function requireAxios () { onDownloadProgress } = _config; let onCanceled; + let timeoutId; let uploadThrottled, downloadThrottled; let flushUpload, flushDownload, flushDownloadWithEvent; function done() { - flushUpload && flushUpload(); // flush events - flushDownload && flushDownload(); // flush events + clearTimeout(timeoutId); + // A final progress callback must not prevent the remaining cleanup. + // Report errors asynchronously, as onloadend and the throttle timer do. + try { + flushUpload && flushUpload(); // flush events + } catch (err) { + setTimeout(() => { + throw err; + }); + } + try { + flushDownload && flushDownload(); // flush events + } catch (err) { + setTimeout(() => { + throw err; + }); + } + // A flush can synchronously cancel the request and reenter done(). + // In that case the inner call has already detached these listeners. + if (request) { + downloadThrottled && request.removeEventListener('progress', downloadThrottled); + if (request.upload) { + uploadThrottled && request.upload.removeEventListener('progress', uploadThrottled); + flushUpload && request.upload.removeEventListener('loadend', flushUpload); + } + } _config.cancelToken && _config.cancelToken.unsubscribe(onCanceled); _config.signal && _config.signal.removeEventListener('abort', onCanceled); } @@ -21219,6 +21656,7 @@ function requireAxios () { // Handle timeout request.ontimeout = function handleTimeout() { + if (!request) return; let timeoutErrorMessage = _config.timeout ? 'timeout of ' + _config.timeout + 'ms exceeded' : 'timeout exceeded'; const transitional = _config.transitional || transitionalDefaults; if (_config.timeoutErrorMessage) { @@ -21234,13 +21672,6 @@ function requireAxios () { // Remove Content-Type if data is undefined requestData === undefined && requestHeaders.setContentType(null); - // Add headers to the request - if ('setRequestHeader' in request) { - utils$1.forEach(toByteStringHeaderObject(requestHeaders), function setRequestHeader(val, key) { - request.setRequestHeader(key, val); - }); - } - // Add withCredentials to request if needed if (!utils$1.isUndefined(_config.withCredentials)) { request.withCredentials = !!_config.withCredentials; @@ -21271,24 +21702,79 @@ function requireAxios () { return; } reject(!cancel || cancel.type ? new CanceledError(null, config, request) : cancel); - request.abort(); + const xhr = request; done(); request = null; + xhr.abort(); }; _config.cancelToken && _config.cancelToken.subscribe(onCanceled); + if (!request) return; if (_config.signal) { _config.signal.aborted ? onCanceled() : _config.signal.addEventListener('abort', onCanceled); } } + if (!request) return; const protocol = parseProtocol(_config.url); if (protocol && !platform.protocols.includes(protocol)) { reject(new AxiosError('Unsupported protocol ' + protocol + ':', AxiosError.ERR_BAD_REQUEST, config)); done(); return; } - - // Send the request - request.send(requestData || null); + const sendRequest = () => { + if (!request) return; + // Apply headers after an asynchronous XSRF read so existing headers are + // replaced through AxiosHeaders rather than appended by the native XHR. + if ('setRequestHeader' in request) { + utils$1.forEach(toByteStringHeaderObject(requestHeaders), function setRequestHeader(val, key) { + request.setRequestHeader(key, val); + }); + } + request.send(requestData || null); + }; + if (xsrfCookieName) { + // Native XHR timeout starts at send(). Cover cookie preparation and the + // subsequent request with the same budget and existing timeout handler. + const now = typeof performance !== 'undefined' && utils$1.isFunction(performance.now) ? () => performance.now() : Date.now; + const deadline = request.timeout > 0 ? now() + Number(request.timeout) : undefined; + const abortOnTimeout = () => { + if (!request) return; + const xhr = request; + xhr.ontimeout(); + xhr.abort(); + }; + if (deadline !== undefined) { + const scheduleTimeout = () => { + const remaining = deadline - now(); + if (remaining > 0) { + // Browser timers overflow above the signed 32-bit delay limit. + timeoutId = setTimeout(scheduleTimeout, Math.min(remaining, 0x7fffffff)); + } else { + abortOnTimeout(); + } + }; + scheduleTimeout(); + } + cookies.readAsync(xsrfCookieName).then(value => { + if (!request) return; + // Promise callbacks may run before an overdue timer after a busy task. + if (deadline !== undefined && now() >= deadline) { + abortOnTimeout(); + return; + } + if (value) { + const headerName = utils$1.hasOwnProp(_config, 'xsrfHeaderName') && _config.xsrfHeaderName; + requestHeaders.set(headerName, value); + } + sendRequest(); + }).catch(error => { + if (!request) return; + reject(AxiosError.from(error, null, config, request)); + done(); + request = null; + }); + } else { + sendRequest(); + } }); }; @@ -21318,7 +21804,8 @@ function requireAxios () { timer && clearTimeout(timer); timer = null; signals.forEach(signal => { - signal.unsubscribe ? signal.unsubscribe(onabort) : signal.removeEventListener('abort', onabort); + const unsubscribeSignal = utils$1.getSafeProp(signal, 'unsubscribe'); + utils$1.isFunction(unsubscribeSignal) ? unsubscribeSignal.call(signal, onabort) : signal.removeEventListener('abort', onabort); }); signals = null; }; @@ -21423,6 +21910,121 @@ function requireAxios () { }); }; + const CRLF = '\r\n'; + const normalizeLines = value => String(value).replace(/\r\n|\r|\n/g, CRLF); + const escapeName = value => String(value).replace(/[\r\n"]/g, char => char === '\r' ? '%0D' : char === '\n' ? '%0A' : '%22'); + + // Count UTF-8 bytes without allocating an encoded copy of a field. FormData + // string values normalize line endings; Blob/File contents remain unchanged. + const stringBytes = (value, normalize) => { + let length = 0; + for (let i = 0; i < value.length; i++) { + const code = value.charCodeAt(i); + if (normalize && (code === 13 || code === 10)) { + if (code === 13 && value.charCodeAt(i + 1) === 10) i++; + length += 2; + } else if (code < 0x80) { + length++; + } else if (code < 0x800) { + length += 2; + } else if (code >= 0xd800 && code <= 0xdbff && value.charCodeAt(i + 1) >= 0xdc00 && value.charCodeAt(i + 1) <= 0xdfff) { + length += 4; + i++; + } else { + length += 3; + } + } + return length; + }; + + // Describe serialization failures independently of any request library. + class FormDataError extends TypeError { + constructor(message, reason) { + super(message); + this.name = 'FormDataError'; + this.reason = reason; + } + } + + // The caller supplies the boundary, Blob implementation, and limit error. + function formDataToBlob(form, Blob, limit, limitError, boundary) { + if (!utils$1.isFunction(Blob)) { + throw new FormDataError('Blob is not supported', 'blob'); + } + if (!utils$1.isString(boundary) || !/^[A-Za-z0-9'()+_,./:=? -]{1,70}$/.test(boundary) || / $/.test(boundary)) { + throw new FormDataError('Invalid multipart boundary', 'boundary'); + } + const footer = '--' + boundary + '--' + CRLF; + let length = footer.length; + const parts = []; + const checkLength = extra => { + if (length + extra > limit) throw limitError(); + }; + checkLength(0); + for (const [name, value] of form) { + const isString = utils$1.isString(value); + const valueLength = isString ? stringBytes(value, true) : value.size; + if (!Number.isFinite(valueLength) || valueLength < 0) { + throw new FormDataError('Unsupported FormData part size', 'part'); + } + // Reject large values and names before building normalized header strings. + checkLength(valueLength + stringBytes(name, true) + (!isString && value.name ? stringBytes(value.name, false) : 0) + (!isString && value.type ? stringBytes(value.type, false) : 0)); + let header = '--' + boundary + CRLF + 'Content-Disposition: form-data; name="' + escapeName(normalizeLines(name)) + '"'; + if (!isString) { + header += '; filename="' + escapeName(utils$1.isString(value.name) ? value.name : 'blob') + '"' + CRLF + 'Content-Type: ' + String(value.type || 'application/octet-stream').replace(/[\r\n]/g, ''); + } + header += CRLF + CRLF; + const partLength = stringBytes(header, false) + valueLength + CRLF.length; + checkLength(partLength); + length += partLength; + parts.push({ + header, + value, + isString + }); + } + + // Native Blob composition retains existing Blob/File data. No file is read + // and no complete multipart ArrayBuffer is created to determine its length. + const blobParts = []; + for (const part of parts) { + blobParts.push(part.header, part.isString ? normalizeLines(part.value) : part.value, CRLF); + } + blobParts.push(footer); + return new Blob(blobParts, { + type: 'multipart/form-data; boundary=' + boundary + }); + } + + function createMultipartBody(form, Blob, limit, limitError, boundary) { + // Report missing Blob support before trying to select a random source. + if (!utils$1.isFunction(Blob)) { + throw new AxiosError('Blob is not supported', AxiosError.ERR_NOT_SUPPORT); + } + if (boundary === undefined) { + if (utils$1.isFunction(platform.generateString)) { + boundary = 'axios-' + platform.generateString(36, '0123456789abcdef'); + } else { + const crypto = utils$1.global.crypto; + if (!crypto || !utils$1.isFunction(crypto.getRandomValues)) { + throw new AxiosError('Random byte generation is not supported', AxiosError.ERR_NOT_SUPPORT); + } + const random = new Uint8Array(18); + crypto.getRandomValues(random); + boundary = 'axios-' + Array.from(random, value => ('0' + value.toString(16)).slice(-2)).join(''); + } + } + try { + return formDataToBlob(form, Blob, limit, limitError, boundary); + } catch (error) { + if (error instanceof FormDataError) { + const code = error.reason === 'boundary' ? AxiosError.ERR_BAD_OPTION_VALUE : AxiosError.ERR_BAD_REQUEST; + throw new AxiosError(error.message, code); + } + throw error; + } + } + const DEFAULT_CHUNK_SIZE = 64 * 1024; const DEFAULT_REQUEST_OPTIONS = { cache: 'default', @@ -21488,12 +22090,14 @@ function requireAxios () { skipUndefined: true }, { Request: globalObject.Request, - Response: globalObject.Response + Response: globalObject.Response, + Blob: globalObject.Blob }, env); + const envFetch = utils$1.hasOwnProp(env, 'fetch') ? env.fetch : undefined; const { - fetch: envFetch, Request, - Response + Response, + Blob } = env; const isFetchSupported = envFetch ? isFunction(envFetch) : typeof fetch === 'function'; const isRequestSupported = isFunction(Request); @@ -21520,6 +22124,19 @@ function requireAxios () { return duplexAccessed && !hasContentType; }); const supportsResponseStream = isResponseSupported && isReadableStreamSupported && test(() => utils$1.isReadableStream(new Response('').body)); + + // Some runtimes reject every explicit cache mode. Use own defaults for both + // probes so unrelated polluted options cannot affect cache-mode detection. + const requestDefaults = Object.assign(Object.create(null), DEFAULT_REQUEST_OPTIONS); + if (isRequestSupported && !test(() => new Request(platform.origin, requestDefaults))) { + delete requestDefaults.cache; + + // Only omit cache when that makes Request construction succeed. Otherwise + // retain the explicit default that protects supporting runtimes from pollution. + if (!test(() => new Request(platform.origin, requestDefaults))) { + requestDefaults.cache = DEFAULT_REQUEST_OPTIONS.cache; + } + } const resolvers = { stream: supportsResponseStream && (res => res.body) }; @@ -21541,13 +22158,6 @@ function requireAxios () { if (utils$1.isBlob(body)) { return body.size; } - if (utils$1.isSpecCompliantForm(body)) { - const _request = new Request(platform.origin, { - method: 'POST', - body - }); - return (await _request.arrayBuffer()).byteLength; - } if (utils$1.isArrayBufferView(body) || utils$1.isArrayBuffer(body)) { return body.byteLength; } @@ -21592,11 +22202,12 @@ function requireAxios () { }); let requestContentLength; - // AxiosError we raise while the request body is being streamed. Captured + // AxiosErrors we raise while request or response bodies are being streamed. Captured // by identity so the catch block can surface it directly, regardless of // how the runtime wraps the resulting fetch rejection (undici exposes it // as `err.cause`; some browsers drop the original error entirely). let pendingBodyError = null; + let pendingResponseError = null; const maxBodyLengthError = () => new AxiosError('Request body larger than maxBodyLength limit', AxiosError.ERR_BAD_REQUEST, config, request); try { // HTTP basic authentication @@ -21610,8 +22221,9 @@ function requireAxios () { password }; } + let parsedURL; if (maybeWithAuthCredentials(url)) { - const parsedURL = new URL(url, platform.origin); + parsedURL = new URL(url, platform.origin); if (!auth && (parsedURL.username || parsedURL.password)) { const urlUsername = decodeURIComponentSafe(parsedURL.username); const urlPassword = decodeURIComponentSafe(parsedURL.password); @@ -21634,12 +22246,25 @@ function requireAxios () { // Enforce maxContentLength for data: URLs up-front so we never materialize // an oversized payload. The HTTP adapter applies the same check (see http.js // "if (protocol === 'data:')" branch). - if (hasMaxContentLength && typeof url === 'string' && url.startsWith('data:')) { - const estimated = estimateDataURLDecodedBytes(url); + if (hasMaxContentLength && parsedURL && parsedURL.protocol === 'data:') { + const estimated = estimateDataURLDecodedBytes(parsedURL.href); if (estimated > maxContentLength) { throw new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config, request); } } + const formContentType = utils$1.isSpecCompliantForm(data) && AxiosHeaders.from(own('headers')).getContentType(); + let formBoundary; + if (utils$1.isString(formContentType) && /^multipart\/form-data(?:\s*;|$)/i.test(formContentType.trim())) { + const parameters = AxiosHeaders.parseParameters(formContentType); + if (utils$1.hasOwnProp(parameters, 'boundary')) formBoundary = parameters.boundary; + } + if (utils$1.isSpecCompliantForm(data) && method !== 'get' && method !== 'head' && (hasMaxBodyLength || onUploadProgress && supportsRequestStream || formBoundary !== undefined)) { + data = createMultipartBody(data, Blob, hasMaxBodyLength ? maxBodyLength : Infinity, maxBodyLengthError, formBoundary); + // Blob.type lowercases its value, including a case-sensitive boundary. + // Retain the caller's header when an explicit boundary was serialized. + headers.setContentType(formBoundary === undefined ? data.type : formContentType); + requestContentLength = data.size; + } // Enforce maxBodyLength against known-size bodies before dispatch using // the body's *actual* size — never a caller-declared Content-Length, @@ -21729,7 +22354,7 @@ function requireAxios () { credentials: isCredentialsSupported ? withCredentials : undefined }); if (isRequestSupported) { - utils$1.forEach(DEFAULT_REQUEST_OPTIONS, (value, key) => { + utils$1.forEach(requestDefaults, (value, key) => { if (resolvedOptions[key] === undefined) { resolvedOptions[key] = value; } @@ -21772,7 +22397,7 @@ function requireAxios () { if (hasMaxContentLength) { bytesRead = loadedBytes; if (bytesRead > maxContentLength) { - throw new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config, request); + throw pendingResponseError = new AxiosError('maxContentLength size of ' + maxContentLength + ' exceeded', AxiosError.ERR_BAD_RESPONSE, config, request); } } onProgress && onProgress(loadedBytes); @@ -21839,7 +22464,7 @@ function requireAxios () { } // Surface a maxBodyLength violation we raised while the request body was - // being streamed. Matching by identity (rather than reading + // being streamed. Keeping the original error (rather than reading // `err.cause.isAxiosError`) keeps the error deterministic across runtimes // and avoids both prototype-pollution reads and mis-attributing a foreign // AxiosError that merely happened to land in `err.cause`. @@ -21847,6 +22472,9 @@ function requireAxios () { request && !pendingBodyError.request && (pendingBodyError.request = request); throw pendingBodyError; } + if (pendingResponseError) { + throw pendingResponseError; + } // Re-throw AxiosErrors we raised synchronously (data: URL / content-length // pre-checks, response size enforcement) without re-wrapping them. @@ -21873,13 +22501,20 @@ function requireAxios () { }; const seedCache = new Map(); const getFetch = config => { - let env = config && config.env || {}; + const env = Object.create(null); + const configuredEnv = config && utils$1.hasOwnProp(config, 'env') && config.env; + ['fetch', 'Request', 'Response', 'Blob'].forEach(key => { + if (configuredEnv && utils$1.hasOwnProp(configuredEnv, key)) { + env[key] = configuredEnv[key]; + } + }); const { fetch, Request, - Response + Response, + Blob } = env; - const seeds = [Request, Response, fetch]; + const seeds = [Request, Response, fetch, Blob]; let len = seeds.length, i = len, seed, @@ -22021,6 +22656,21 @@ function requireAxios () { } } + /** + * Milliseconds elapsed since `start`, floored at zero. + * + * Wall-clock, to match the rest of the codebase (speedometer, throttle, + * AxiosTransformStream). A backwards clock adjustment mid-request would + * otherwise produce a negative duration, so the result is clamped. + * + * @param {number} start Timestamp from `Date.now()` + * + * @returns {number} Non-negative elapsed milliseconds + */ + function elapsedSince(start) { + return Math.max(0, Date.now() - start); + } + /** * Dispatch a request to the server using the configured adapter. * @@ -22042,8 +22692,10 @@ function requireAxios () { config.headers.setContentType('application/x-www-form-urlencoded', false); } const adapter = adapters.getAdapter(config.adapter || defaults.adapter, config); + const start = Date.now(); return adapter(config).then(function onAdapterResolution(response) { throwIfCancellationRequested(config); + response.duration = elapsedSince(start); // Expose the current response on config so that transformResponse can // attach it to any AxiosError it throws (e.g. on JSON parse failure). @@ -22062,6 +22714,7 @@ function requireAxios () { // Transform response data if (reason && reason.response) { + reason.response.duration = elapsedSince(start); config.response = reason.response; try { reason.response.data = transformData.call(config, config.transformResponse, reason.response); @@ -22161,6 +22814,21 @@ function requireAxios () { const validators = validator.validators; + // Recognize header maps without consuming objects intended as literal values. + // AxiosHeaders from other builds share a brand and header-container interface, + // but not constructor identity. A tag and toJSON alone can describe a literal. + const isHeadersBucket = value => { + if (value == null || utils$1.isPlainObject(value) || value instanceof AxiosHeaders) { + return true; + } + try { + return utils$1.isObject(value) && utils$1.getSafeProp(value, Symbol.toStringTag) === 'AxiosHeaders' && ['toJSON', 'set', 'get', 'has', 'delete', 'clear', 'normalize', 'concat', 'toString', Symbol.iterator].every(method => utils$1.isFunction(utils$1.getSafeProp(value, method))); + } catch (e) { + // A failed optional brand probe must not prevent literal header serialization. + return false; + } + }; + /** * Create a new instance of Axios * @@ -22203,13 +22871,23 @@ function requireAxios () { } if (!err.stack) { err.stack = stack; - // match without the 2 top stack lines } else if (stack) { + // Match a common suffix after the 2 top frames when available, + // otherwise compare the full reconstructed stack. const firstNewlineIndex = stack.indexOf('\n'); const secondNewlineIndex = firstNewlineIndex === -1 ? -1 : stack.indexOf('\n', firstNewlineIndex + 1); - const stackWithoutTwoTopLines = secondNewlineIndex === -1 ? '' : stack.slice(secondNewlineIndex + 1); - if (!String(err.stack).endsWith(stackWithoutTwoTopLines)) { - err.stack += '\n' + stack; + const duplicateCheckSuffix = secondNewlineIndex === -1 ? stack : stack.slice(secondNewlineIndex + 1); + + // `AxiosError.from()` may have already inlined the wrapped error's + // stack under a `Caused by:` marker. Keep the reconstructed caller + // frames ahead of that marker so stack-only reporters do not read + // them as part of the low-level cause. + const currentStack = String(err.stack); + const causeIndex = getCauseStackIndex(err, currentStack); + const stackHead = causeIndex === -1 ? currentStack : currentStack.slice(0, causeIndex); + const causeSection = causeIndex === -1 ? '' : currentStack.slice(causeIndex); + if (!stackHead.endsWith(duplicateCheckSuffix)) { + err.stack = stackHead + '\n' + stack + causeSection; } } } catch (e) { @@ -22241,7 +22919,8 @@ function requireAxios () { clarifyTimeoutError: validators.transitional(validators.boolean), legacyInterceptorReqResOrdering: validators.transitional(validators.boolean), advertiseZstdAcceptEncoding: validators.transitional(validators.boolean), - validateStatusUndefinedResolves: validators.transitional(validators.boolean) + validateStatusUndefinedResolves: validators.transitional(validators.boolean), + encodeBasicAuthUsername: validators.transitional(validators.boolean) }, false); } if (paramsSerializer != null) { @@ -22258,7 +22937,7 @@ function requireAxios () { } // Set config.allowAbsoluteUrls - if (config.allowAbsoluteUrls !== undefined) ; else if (this.defaults.allowAbsoluteUrls !== undefined) { + if (config.allowAbsoluteUrls !== undefined) ; else if (utils$1.hasOwnProp(this.defaults, 'allowAbsoluteUrls') && this.defaults.allowAbsoluteUrls !== undefined) { config.allowAbsoluteUrls = this.defaults.allowAbsoluteUrls; } else { config.allowAbsoluteUrls = true; @@ -22271,10 +22950,14 @@ function requireAxios () { // Set config.method config.method = (utils$1.getSafeProp(config, 'method') || utils$1.getSafeProp(this.defaults, 'method') || 'get').toLowerCase(); - // Flatten headers - let contextHeaders = headers && utils$1.merge(headers.common, headers[config.method]); + // Flatten header defaults without consuming literal method-named headers. + const commonHeaders = utils$1.getSafeProp(headers, 'common'); + const methodHeaders = utils$1.getSafeProp(headers, config.method); + const contextHeaders = headers && utils$1.merge(isHeadersBucket(commonHeaders) ? commonHeaders : undefined, isHeadersBucket(methodHeaders) ? methodHeaders : undefined); headers && utils$1.forEach(methodList.concat('common'), method => { - delete headers[method]; + if (isHeadersBucket(utils$1.getSafeProp(headers, method))) { + delete headers[method]; + } }); config.headers = AxiosHeaders.concat(contextHeaders, headers); @@ -22359,7 +23042,7 @@ function requireAxios () { // Provide aliases for supported request methods utils$1.forEach(['delete', 'get', 'head', 'options'], function forEachMethodNoData(method) { /*eslint func-names:0*/ - Axios.prototype[method] = function (url, config) { + Axios.prototype[method] = async function (url, config) { return this.request(mergeConfig(config || {}, { method, url, @@ -22369,7 +23052,7 @@ function requireAxios () { }); utils$1.forEach(['post', 'put', 'patch', 'query'], function forEachMethodWithData(method) { function generateHTTPMethod(isForm) { - return function httpMethod(url, data, config) { + return async function httpMethod(url, data, config) { return this.request(mergeConfig(config || {}, { method, headers: isForm ? { diff --git a/package-lock.json b/package-lock.json index 0a5068a..3fb5fa9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11,10 +11,10 @@ "dependencies": { "@actions/core": "^3.0.1", "@actions/github": "^9.1.1", - "axios": "^1.20.0" + "axios": "^1.21.0" }, "devDependencies": { - "@babel/core": "^8.0.7", + "@babel/core": "^8.0.9", "@babel/preset-env": "^8.0.7", "@eslint/js": "^10.0.1", "@resvg/resvg-js": "^2.6.2", @@ -29,7 +29,7 @@ "make-coverage-badge": "^1.2.0", "prettier": "^3.9.10", "rimraf": "^6.0.1", - "rollup": "^4.64.12" + "rollup": "^4.65.1" }, "engines": { "node": ">=24" @@ -121,20 +121,20 @@ } }, "node_modules/@babel/core": { - "version": "8.0.7", - "resolved": "https://registry.npmjs.org/@babel/core/-/core-8.0.7.tgz", - "integrity": "sha512-ZIsZWBG6Y1oa+8fkQVp0xeCdjCHBkXFCCIWrmg9SvejVvfcVQgKKRmGrBDWfM7rilhvnRoEuaqa5dkK7KB3pHA==", + "version": "8.0.9", + "resolved": "https://registry.npmjs.org/@babel/core/-/core-8.0.9.tgz", + "integrity": "sha512-wXtyKlpR/pXf/u0vmib+OBakQaIzLglLcRoKpWxCHW/whqq7YfQYPD0IAAl9H/evi40MyLIjYYdvb6N+9DI2yA==", "dev": true, "license": "MIT", "dependencies": { "@babel/code-frame": "^8.0.6", "@babel/generator": "^8.0.6", "@babel/helper-compilation-targets": "^8.0.7", - "@babel/helpers": "^8.0.7", - "@babel/parser": "^8.0.7", + "@babel/helpers": "^8.0.8", + "@babel/parser": "^8.0.8", "@babel/template": "^8.0.0", "@babel/traverse": "^8.0.7", - "@babel/types": "^8.0.6", + "@babel/types": "^8.0.8", "@types/gensync": "^1.0.5", "convert-source-map": "^2.0.0", "empathic": "^2.0.1", @@ -185,9 +185,9 @@ } }, "node_modules/@babel/core/node_modules/@babel/helper-string-parser": { - "version": "8.0.6", - "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.6.tgz", - "integrity": "sha512-+6HYEBnsDRZHJtUTAEfMQd0zMDqdFHS7C+5vAsEZqBUr3vEMWOWlHJ0Jz1gS8jJIlCvLsuA6ivmeoqzH936YcA==", + "version": "8.0.8", + "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.8.tgz", + "integrity": "sha512-fVM+gSuKbdv9cpmyRNh5EvsDHUZCdxQH3FdnFKSkNYHpbsn95bbrxm+ES3MVeQjcqwi2O5ur/DjLfmTQaO60ng==", "dev": true, "license": "MIT", "engines": { @@ -205,13 +205,13 @@ } }, "node_modules/@babel/core/node_modules/@babel/parser": { - "version": "8.0.7", - "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.7.tgz", - "integrity": "sha512-UkDwEbPO1px2JQSrdh4qIgaH1JgG7GO/pFeJkpxhDxIETkT/QvGpnigXIw75ViHYPtIgKITmVUJqLjiO+JuWjA==", + "version": "8.0.8", + "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.8.tgz", + "integrity": "sha512-Gq65JogAr0S2p0BzvfSJboyuiRnxDQApyOqHkKmkrvm+VlLK4gC3pKsiOKEdnhFBemrFbSnOu90mZZWDpiJnmQ==", "dev": true, "license": "MIT", "dependencies": { - "@babel/types": "^8.0.6" + "@babel/types": "^8.0.8" }, "bin": { "parser": "bin/babel-parser.js" @@ -221,13 +221,13 @@ } }, "node_modules/@babel/core/node_modules/@babel/types": { - "version": "8.0.6", - "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.6.tgz", - "integrity": "sha512-c+xgSWboV2pdwXP67BUWDVRHi2BO5Q3KwxyFVs7taVTY+fsK47/L51ZXQoV9rozHJDNHvJ4v4WEsI/IlxV2l2A==", + "version": "8.0.8", + "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.8.tgz", + "integrity": "sha512-iXSSZAKQWmaeAwGtFw10v9fg5hUiUs0L+w+Z2K11kym3pDNK+SF0VcAQPsEFvWcTSZ7LMgClMXDBvTbH0IlICg==", "dev": true, "license": "MIT", "dependencies": { - "@babel/helper-string-parser": "^8.0.6", + "@babel/helper-string-parser": "^8.0.8", "@babel/helper-validator-identifier": "^8.0.6" }, "engines": { @@ -785,23 +785,23 @@ } }, "node_modules/@babel/helpers": { - "version": "8.0.7", - "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-8.0.7.tgz", - "integrity": "sha512-5dMj5kFwS2AY7Dt4PZp4px3c5ThMbbEa7tZfuHTncCGSFYq8uoA1ufDE1IS/lYpQedE+3+GQ3cPZUiplIu195w==", + "version": "8.0.8", + "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-8.0.8.tgz", + "integrity": "sha512-FBmhiDWs625wHg03OKiLQDeT6LOc2lWBbW97Yqs2iI1tZcucjpmYnO29NHsQ83XxKvredcvUymW/AAn2UtnakA==", "dev": true, "license": "MIT", "dependencies": { "@babel/template": "^8.0.0", - "@babel/types": "^8.0.6" + "@babel/types": "^8.0.8" }, "engines": { "node": "^22.18.0 || >=24.11.0" } }, "node_modules/@babel/helpers/node_modules/@babel/helper-string-parser": { - "version": "8.0.6", - "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.6.tgz", - "integrity": "sha512-+6HYEBnsDRZHJtUTAEfMQd0zMDqdFHS7C+5vAsEZqBUr3vEMWOWlHJ0Jz1gS8jJIlCvLsuA6ivmeoqzH936YcA==", + "version": "8.0.8", + "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-8.0.8.tgz", + "integrity": "sha512-fVM+gSuKbdv9cpmyRNh5EvsDHUZCdxQH3FdnFKSkNYHpbsn95bbrxm+ES3MVeQjcqwi2O5ur/DjLfmTQaO60ng==", "dev": true, "license": "MIT", "engines": { @@ -819,13 +819,13 @@ } }, "node_modules/@babel/helpers/node_modules/@babel/types": { - "version": "8.0.6", - "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.6.tgz", - "integrity": "sha512-c+xgSWboV2pdwXP67BUWDVRHi2BO5Q3KwxyFVs7taVTY+fsK47/L51ZXQoV9rozHJDNHvJ4v4WEsI/IlxV2l2A==", + "version": "8.0.8", + "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.8.tgz", + "integrity": "sha512-iXSSZAKQWmaeAwGtFw10v9fg5hUiUs0L+w+Z2K11kym3pDNK+SF0VcAQPsEFvWcTSZ7LMgClMXDBvTbH0IlICg==", "dev": true, "license": "MIT", "dependencies": { - "@babel/helper-string-parser": "^8.0.6", + "@babel/helper-string-parser": "^8.0.8", "@babel/helper-validator-identifier": "^8.0.6" }, "engines": { @@ -4809,9 +4809,9 @@ } }, "node_modules/@rollup/rollup-android-arm-eabi": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.64.12.tgz", - "integrity": "sha512-Z8lz+5UOiCJLonjeqwJlhUtHA/Sr6R1AidkccQxdWF0nigNzP81aLoU+udgOaGfL5s1uzFXzcux/pCwGAMu0lw==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.65.1.tgz", + "integrity": "sha512-5coxNSjqOI2J3NkVhlp3u+zGcyjnowQFsU9sg7MMz4UPXY4Dv63kFGLt7ConXz9CNq2i0yuOJZAF/2RMrgI2OA==", "cpu": [ "arm" ], @@ -4823,9 +4823,9 @@ ] }, "node_modules/@rollup/rollup-android-arm64": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.64.12.tgz", - "integrity": "sha512-+tKxNa2psFmiTb0KfXlXs4Yj7vkEhzAvZ0DrQ5+0gWHQJM10jSleQ3l1FIVm5uvD53YM8lHfM4mgCLDDN9f1Gg==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.65.1.tgz", + "integrity": "sha512-K0HFf6XMB3IYs+jDZ1/RRhZaVOwxNXrl0n4MDEyGDjuK7+B6K/nDJp8DCBitO3S1sK/fzNxAf9QZAny4AIUPtg==", "cpu": [ "arm64" ], @@ -4837,9 +4837,9 @@ ] }, "node_modules/@rollup/rollup-darwin-arm64": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.64.12.tgz", - "integrity": "sha512-iiripdfvyRBugV55/Dk7GplNXQtN/PG85OcKeveU1z2UkTg0MofbBF1qk//qgPWiqJbVvQcXAVCfE56oDGO4EQ==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.65.1.tgz", + "integrity": "sha512-zkZrXYwNlIcSUmcwY2DpsaDHr0XjVUeQHCuSunG3eQD7/5Wn/DvI7OMUE8NRRweK87yG8ebJ1xGOzmwpMsbZQA==", "cpu": [ "arm64" ], @@ -4851,9 +4851,9 @@ ] }, "node_modules/@rollup/rollup-darwin-x64": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.64.12.tgz", - "integrity": "sha512-BmATib8swSMAagWNIfDZMnb+k34RXR4bbGOUfZgK8lLlniuMyVoSDDXCOGkdhtUmBXL4aygDh7bhjQ+TmhTvIw==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.65.1.tgz", + "integrity": "sha512-Zaed+R3cpkkA3aiNd7NO0GV5KFh/LVf8j6bGcoRdpoXkSm/mWH8M0oX2/3u/nyGcx/bHEovD9CzX+w9/gcpI4A==", "cpu": [ "x64" ], @@ -4865,9 +4865,9 @@ ] }, "node_modules/@rollup/rollup-freebsd-arm64": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.64.12.tgz", - "integrity": "sha512-GzrO0CiUq8vcAI/hYJuIcp6wNm3T3YhOpumYtf9Z3Fz+cfN1VESCVfy7EPcM3/m2K8l+Gn2U+4XtNZjwhUXctQ==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.65.1.tgz", + "integrity": "sha512-h12p3WJWhyJ9kir0zqAPr0rKNmBzOWIjoaOMT9OULs9KZQZCeOMKd+mGSvERjd9VxJYShd3zIxtrVxkYz6BEVA==", "cpu": [ "arm64" ], @@ -4879,9 +4879,9 @@ ] }, "node_modules/@rollup/rollup-freebsd-x64": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.64.12.tgz", - "integrity": "sha512-Dpta6gigm4o6SYioXtTkZBlGLA/Sl6OpzgLqY+51uafJE2blPejAtR1w82CVLPN+F9cvo1+/em92x/zcOgY0uQ==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.65.1.tgz", + "integrity": "sha512-yRBwh/5imKY4DydDulVtrjy8Jf7h7NQJUqZbgmZ3zFsCD9QqlnWvZ7RtEF+ecO1b+IukKjXlu5Bb9fehV3tIbg==", "cpu": [ "x64" ], @@ -4893,9 +4893,9 @@ ] }, "node_modules/@rollup/rollup-linux-arm-gnueabihf": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.64.12.tgz", - "integrity": "sha512-YpeDwQ5uFaogRvytNC8RK0keDO65kI5wNEhGSs+4GiJc3KHhxj4j5cnQh2nCu9ybJj6RP0/ycB6bkN0yFJ9I+w==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.65.1.tgz", + "integrity": "sha512-1XuPiWYYaLE1UDOqhbKVOfsqxvfmFS/lYPSk92U1hEX1qRfSYH0hNeAlbxFIgjp4d6+YQmL95EPRgdvjbZEddA==", "cpu": [ "arm" ], @@ -4910,9 +4910,9 @@ ] }, "node_modules/@rollup/rollup-linux-arm-musleabihf": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.64.12.tgz", - "integrity": "sha512-LQrB3/sImIr1ycrlEyaApOLH1rAy8JV4/dH4eoK817aWATdcs4fESXz53/w72NwDnwPM5zEUpoL7socH4ZDnwA==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.65.1.tgz", + "integrity": "sha512-Y3C5e55Yrf6p2r5rBcc4P9hFWVNi6oqWy/53I/AyCJJGlp3KRSpTP8eoUmVntchTbEnhgBgAgLO9flj9AvOdUw==", "cpu": [ "arm" ], @@ -4927,9 +4927,9 @@ ] }, "node_modules/@rollup/rollup-linux-arm64-gnu": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.64.12.tgz", - "integrity": "sha512-iAF2iYu9S4SBfNsb4k0ewNBjO83WxHEltIuKQBGMzEKFgrYfmJn+gatBDXR2t/0zJN0UW0kzR4rfvQ1UHzkZ1A==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.65.1.tgz", + "integrity": "sha512-Itj6coSswkYPIcVLczObXmwdplHNQQxyfnK1ppBg4czDaX8RiEzLKqU7EMc64BiBuiDZEUS+M93ktM18rv5llw==", "cpu": [ "arm64" ], @@ -4944,9 +4944,9 @@ ] }, "node_modules/@rollup/rollup-linux-arm64-musl": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.64.12.tgz", - "integrity": "sha512-0MQdRtdbirJCXPIVeW/hd/LXLR8Qz96pc+2EBptuuV5q/zSGOzND7SZt8gBTE58NC9cUG/8UxcUXQiKRZ2WzzA==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.65.1.tgz", + "integrity": "sha512-KeO8jTEqdrnhvcahufbimyMoI44vedRUp1bVz2QUnRX2vDm/hxzCPt5F8fERVD5fsHyTW/vXmCElT054VOSVOA==", "cpu": [ "arm64" ], @@ -4961,9 +4961,9 @@ ] }, "node_modules/@rollup/rollup-linux-loong64-gnu": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.64.12.tgz", - "integrity": "sha512-yGDEwn0AGnrY/KCz2oY8R9KKNiQnTcwNuCWXeSXF0VLxXzlqoCgaS5QHsf1lbQvKWwPuN2Czkjk1wXRCBONTOQ==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.65.1.tgz", + "integrity": "sha512-dDOz5VZZ+ZGnglpmET6VJefamWXFsgaVtuhSClf2/URZBp048jprD6z1hddsIMN6n1w+oUzGZEBp9u6Mlszsfg==", "cpu": [ "loong64" ], @@ -4978,9 +4978,9 @@ ] }, "node_modules/@rollup/rollup-linux-loong64-musl": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.64.12.tgz", - "integrity": "sha512-AjlbD0efZEhHaJ3bsNjxSFDoguNq6VZvC+FKGJGBCA+ZN7BrZq2TuuSWFa6AI8IpOeuvhp2LoYcP7jiZwmtU0Q==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.65.1.tgz", + "integrity": "sha512-JbfRKz8nJCuo8gn1Dqx8lQWEHw4qhZ3uRaHphw5vrSjnSptJTKTRC/bLKHh8QQMsEnhL4uq+bdg3tkiXbJ2q/A==", "cpu": [ "loong64" ], @@ -4995,9 +4995,9 @@ ] }, "node_modules/@rollup/rollup-linux-ppc64-gnu": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.64.12.tgz", - "integrity": "sha512-sDW0CiPoUCEEUV25uBG5sJ2gKe75DJqLpj91m1eK1vKffywyY7v4i6q1450ZuR6QW4NArXg7JpbMGgKU8di3HQ==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.65.1.tgz", + "integrity": "sha512-3oQpe1q0emSeCAssVHMQdOz5fz3PBH5my/Fr0ZekV2UMNL4ZiRa1ciikYlGQXyDkeqseYYv1InwOY8YPqY7RIQ==", "cpu": [ "ppc64" ], @@ -5012,9 +5012,9 @@ ] }, "node_modules/@rollup/rollup-linux-ppc64-musl": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.64.12.tgz", - "integrity": "sha512-VTQYUhMjl8kv999VuYqScgv7P9cR9KuxI/6bkUsEa3bsswqG0+otFjuLZmJ1U+ffEP4IAz0jxOeV0DX6NRBhjg==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.65.1.tgz", + "integrity": "sha512-nNV3HHi23o1LtpGGwH+Bav4hqnc4+klQtC96tSvCfvql8bLlNFTnTFiGl/jai2nve3eEr/vT2ocuyf+h+eMnYQ==", "cpu": [ "ppc64" ], @@ -5029,9 +5029,9 @@ ] }, "node_modules/@rollup/rollup-linux-riscv64-gnu": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.64.12.tgz", - "integrity": "sha512-ppsKwpSjNrzJ8hge3Z3uiCcoRgAAQk2tU7auy3MFF348ffWRldFPnWIT/a/enK7huijlTfnwn4DYpDoapEb45A==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.65.1.tgz", + "integrity": "sha512-b5zab0FryBxuocuDeqOsYGAg2EzjKw4mKA6LjQXCyewXjGv/BXqACBsY2cO45xM4hV2weYtdjGThP2VB2ByAYg==", "cpu": [ "riscv64" ], @@ -5046,9 +5046,9 @@ ] }, "node_modules/@rollup/rollup-linux-riscv64-musl": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.64.12.tgz", - "integrity": "sha512-Gc3cVRC1trFH+GFWWTsJz6YuD4u75fzr/q99jqQGimonN/zvN6Wecck5WGzllOHj+XYXHcq0Ibor0tanGjfI6A==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.65.1.tgz", + "integrity": "sha512-Rh08xZakiUxKNgI3hbgH9mivlx478lSqckS9s+Oc3/TX1VrAH3W8z/5wpJXR/v5VjqcJ/jJNVBg64PU1+iQsTQ==", "cpu": [ "riscv64" ], @@ -5063,9 +5063,9 @@ ] }, "node_modules/@rollup/rollup-linux-s390x-gnu": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.64.12.tgz", - "integrity": "sha512-pjmDTFStvwFE3shTeUDvSDiSp8/qAf5bQXejcEUDDavWz4jEhTIpCdpS06G0PEwSCSNK0Lngjz2v9l4hk3Z74A==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.65.1.tgz", + "integrity": "sha512-qDgtS6juN3/k97y4kcD6XLFpXEo4f6CnG8lTOGYwlhrUYTrMyhN0WHdZCPAW5rqS0MqQG7qI7dxnjugt6QB39Q==", "cpu": [ "s390x" ], @@ -5080,9 +5080,9 @@ ] }, "node_modules/@rollup/rollup-linux-x64-gnu": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.64.12.tgz", - "integrity": "sha512-mkbjxPqpR91u1JD7xY4aLZhr/Mqka4/RqGcG4WNGgN/lC1o7TzyCyqJoSJXp9qVVxMwpJGFlEF1VlERb+Ghw1Q==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.65.1.tgz", + "integrity": "sha512-44IKzBPqXXVm0kt1O+F5eW4juR5FyIxGNlFkpP8qwIDzucBsjM1HCbdYUQrQw8rU/g6HRl/tfBm0+Qq4H4Ro3w==", "cpu": [ "x64" ], @@ -5097,9 +5097,9 @@ ] }, "node_modules/@rollup/rollup-linux-x64-musl": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.64.12.tgz", - "integrity": "sha512-vIeut2LkuVc3gcsawLJPahNAzvzBcFRhu2O+yVb//BuQKz7PIItMF0piXRbN/lIDO3d68TSDd368Vg6YwgTybw==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.65.1.tgz", + "integrity": "sha512-tvYWZ/h2PCHs558Xu7B6LptuRCV8lXV2xI75ONMcldII1m2zlFwuI4BJZi9M6rSMkYqcPLLtPUPrjyqfbzLOdg==", "cpu": [ "x64" ], @@ -5114,9 +5114,9 @@ ] }, "node_modules/@rollup/rollup-openbsd-x64": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.64.12.tgz", - "integrity": "sha512-3Sx+D3r9oPkTdNUcPrIRM2Am+vzEV6VGWoImHG4ZVK2jJeOW+eDjLeTm6nvu/z/m0fiX2YmGLXIypblc336MXg==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.65.1.tgz", + "integrity": "sha512-gdyeucgZCnei3pXwadKVTEAOgRx0B+c847DUPR/PdOMmp3olhfkYo6r0J4PzRFZB5ZICZQTxntyvgmWH5xT7rg==", "cpu": [ "x64" ], @@ -5128,9 +5128,9 @@ ] }, "node_modules/@rollup/rollup-openharmony-arm64": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.64.12.tgz", - "integrity": "sha512-Nn2xh0teFnl71EiiUrKvECWcdGXtWF8q0uGclYwXGVw6QClGAcME0/bJSGdK+xIvd6MLEKYmjkTUvCBV+7m5Kw==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.65.1.tgz", + "integrity": "sha512-Wf/NEKdn2SAL4Nvt8HyDtdkseWTwiLbZEOoNYnEaHkbso0B9eHO42vKnZh+OYsn+IMhAMcWcuIwPlBOgOXsUzg==", "cpu": [ "arm64" ], @@ -5142,9 +5142,9 @@ ] }, "node_modules/@rollup/rollup-win32-arm64-msvc": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.64.12.tgz", - "integrity": "sha512-n1/0H9TS+kBa4xp6n9aV7yiynBNfmerjkj2nAMIfY0ZHv1zShWRXnsAuAPAH0sfEK4ZSMK+z24q2RjAPFLCN1w==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.65.1.tgz", + "integrity": "sha512-x9VSsDmsMsEWy4cr/mFeaEsXnVJ6Kc4NCAU/lCnwml3s7LQbZoa9+/qwc9etWHbuuDT5mYxdyyKUwo76njtjZw==", "cpu": [ "arm64" ], @@ -5156,9 +5156,9 @@ ] }, "node_modules/@rollup/rollup-win32-ia32-msvc": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.64.12.tgz", - "integrity": "sha512-AdlDbQpsLfGlsHr1NfLZFtdnvxCKNp9TwlYVYExs8JJLWjLafUQEKJk0r9zUbmU57mw9nglMEvzqPHuLWYmaKw==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.65.1.tgz", + "integrity": "sha512-RIDbiVvvLkN45mOFpbo6eYMgnuiBEB62BGR/0s4QJgGg2AvVxucDDNn67kpAcUoYyfmY8iX8/RifMcmxmmnejA==", "cpu": [ "ia32" ], @@ -5170,9 +5170,9 @@ ] }, "node_modules/@rollup/rollup-win32-x64-gnu": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.64.12.tgz", - "integrity": "sha512-u5SSUJBHod51UamjkigSr+JPre6xMy5vaWTTV2K0SnFG4RuKyYpf66dTSLFKX2cwaldpwyBurXPUCxq8riQMEg==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.65.1.tgz", + "integrity": "sha512-+KN8HIr88vN59JNxlrM2fMimzY43Y0lQB7+0xdVsFbvFCAA74CLKCdfzIHzzvndJryBc94Pm+MvwtukKjaS2ug==", "cpu": [ "x64" ], @@ -5184,9 +5184,9 @@ ] }, "node_modules/@rollup/rollup-win32-x64-msvc": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.64.12.tgz", - "integrity": "sha512-j5rXD4R/4DM5+V991AA9xOnG2Rwu2g3p5TPgu1Eu7apju0NUrLl+Bn/KpWc6wYJtlXqzwz1r+LNV1JeBU4VGvw==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.65.1.tgz", + "integrity": "sha512-+Y1Sd49cSDq60UOl8/U2HI0ebUvnSl/hDhMHQn+ouw17yb8fYwMWIazzJ4JFpSkjPE7sj5NTNSX9IoyEqcFfyQ==", "cpu": [ "x64" ], @@ -6026,9 +6026,9 @@ "license": "MIT" }, "node_modules/axios": { - "version": "1.20.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz", - "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==", + "version": "1.21.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.21.0.tgz", + "integrity": "sha512-YCzXMB53Q9PZBsh7yN7wtapit4WepwcHS2fP8QhGsBxSz5YtgYobV7GGlWlAJi+RxfU77GQTQi2DSLUma42EYA==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", @@ -9887,9 +9887,9 @@ } }, "node_modules/rollup": { - "version": "4.64.12", - "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.64.12.tgz", - "integrity": "sha512-GhAu8ZglZ61VWSX/ZW3K/qkazgURBIQL0/Yy51QsS8DPyebR5Cf/Z2PANJFpTU0aVZ9byJcyqR6xvBbkXhdGYQ==", + "version": "4.65.1", + "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.65.1.tgz", + "integrity": "sha512-HzD4IdphaPMvuAacnL/vtoq5B8FwqewKvxTtqYibWvP6VDyZ+UsTtlw5F8HIOIIpLQAkN2NOP/0sM3puo9xN/A==", "dev": true, "license": "MIT", "dependencies": { @@ -9904,31 +9904,31 @@ }, "optionalDependencies": { "@napi-rs/lzma-linux-x64-gnu": "1.5.1", - "@rollup/rollup-android-arm-eabi": "4.64.12", - "@rollup/rollup-android-arm64": "4.64.12", - "@rollup/rollup-darwin-arm64": "4.64.12", - "@rollup/rollup-darwin-x64": "4.64.12", - "@rollup/rollup-freebsd-arm64": "4.64.12", - "@rollup/rollup-freebsd-x64": "4.64.12", - "@rollup/rollup-linux-arm-gnueabihf": "4.64.12", - "@rollup/rollup-linux-arm-musleabihf": "4.64.12", - "@rollup/rollup-linux-arm64-gnu": "4.64.12", - "@rollup/rollup-linux-arm64-musl": "4.64.12", - "@rollup/rollup-linux-loong64-gnu": "4.64.12", - "@rollup/rollup-linux-loong64-musl": "4.64.12", - "@rollup/rollup-linux-ppc64-gnu": "4.64.12", - "@rollup/rollup-linux-ppc64-musl": "4.64.12", - "@rollup/rollup-linux-riscv64-gnu": "4.64.12", - "@rollup/rollup-linux-riscv64-musl": "4.64.12", - "@rollup/rollup-linux-s390x-gnu": "4.64.12", - "@rollup/rollup-linux-x64-gnu": "4.64.12", - "@rollup/rollup-linux-x64-musl": "4.64.12", - "@rollup/rollup-openbsd-x64": "4.64.12", - "@rollup/rollup-openharmony-arm64": "4.64.12", - "@rollup/rollup-win32-arm64-msvc": "4.64.12", - "@rollup/rollup-win32-ia32-msvc": "4.64.12", - "@rollup/rollup-win32-x64-gnu": "4.64.12", - "@rollup/rollup-win32-x64-msvc": "4.64.12", + "@rollup/rollup-android-arm-eabi": "4.65.1", + "@rollup/rollup-android-arm64": "4.65.1", + "@rollup/rollup-darwin-arm64": "4.65.1", + "@rollup/rollup-darwin-x64": "4.65.1", + "@rollup/rollup-freebsd-arm64": "4.65.1", + "@rollup/rollup-freebsd-x64": "4.65.1", + "@rollup/rollup-linux-arm-gnueabihf": "4.65.1", + "@rollup/rollup-linux-arm-musleabihf": "4.65.1", + "@rollup/rollup-linux-arm64-gnu": "4.65.1", + "@rollup/rollup-linux-arm64-musl": "4.65.1", + "@rollup/rollup-linux-loong64-gnu": "4.65.1", + "@rollup/rollup-linux-loong64-musl": "4.65.1", + "@rollup/rollup-linux-ppc64-gnu": "4.65.1", + "@rollup/rollup-linux-ppc64-musl": "4.65.1", + "@rollup/rollup-linux-riscv64-gnu": "4.65.1", + "@rollup/rollup-linux-riscv64-musl": "4.65.1", + "@rollup/rollup-linux-s390x-gnu": "4.65.1", + "@rollup/rollup-linux-x64-gnu": "4.65.1", + "@rollup/rollup-linux-x64-musl": "4.65.1", + "@rollup/rollup-openbsd-x64": "4.65.1", + "@rollup/rollup-openharmony-arm64": "4.65.1", + "@rollup/rollup-win32-arm64-msvc": "4.65.1", + "@rollup/rollup-win32-ia32-msvc": "4.65.1", + "@rollup/rollup-win32-x64-gnu": "4.65.1", + "@rollup/rollup-win32-x64-msvc": "4.65.1", "fsevents": "~2.3.2" } }, diff --git a/package.json b/package.json index 92e5323..c04b332 100644 --- a/package.json +++ b/package.json @@ -26,10 +26,10 @@ "dependencies": { "@actions/core": "^3.0.1", "@actions/github": "^9.1.1", - "axios": "^1.20.0" + "axios": "^1.21.0" }, "devDependencies": { - "@babel/core": "^8.0.7", + "@babel/core": "^8.0.9", "@babel/preset-env": "^8.0.7", "@eslint/js": "^10.0.1", "@resvg/resvg-js": "^2.6.2", @@ -44,7 +44,7 @@ "make-coverage-badge": "^1.2.0", "prettier": "^3.9.10", "rimraf": "^6.0.1", - "rollup": "^4.64.12" + "rollup": "^4.65.1" }, "jest": { "verbose": true,