8000 Bump @babel/traverse from 7.9.0 to 7.23.2 (#743) · sean-j/actions-setup-python@e8111ce · GitHub
[go: up one dir, main page]
Skip to content

Commit e8111ce

Browse files
dependabot[bot]dependabot[bot]
authored
Bump @babel/traverse from 7.9.0 to 7.23.2 (actions#743)
1 parent a00ea43 commit e8111ce

File tree

6 files changed

+5058
-7319
lines changed

6 files changed

+5058
-7319
lines changed

‎.github/workflows/e2e-tests.yml

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -93,10 +93,3 @@ jobs:
9393
python-version: '<3.11'
9494
- name: Verify <3.11
9595
run: python __tests__/verify-python.py 3.10
96-
97-
- name: Run with setup-python >3.8
98-
uses: ./
99-
with:
100-
python-version: '>3.8'
101-
- name: Verify >3.8
102-
run: python __tests__/verify-python.py 3.11

‎.licenses/npm/semver-6.3.0.dep.yml renamed to ‎.licenses/npm/semver-6.3.1.dep.yml

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/cache-save/index.js

Lines changed: 81 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3300,8 +3300,11 @@ var MAX_SAFE_INTEGER = Number.MAX_SAFE_INTEGER ||
33003300
// Max safe segment length for coercion.
33013301
var MAX_SAFE_COMPONENT_LENGTH = 16
33023302

3303+
var MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6
3304+
33033305
// The actual regexps go on exports.re
33043306
var re = exports.re = []
3307+
var safeRe = exports.safeRe = []
33053308
var src = exports.src = []
33063309
var t = exports.tokens = {}
33073310
var R = 0
@@ -3310,6 +3313,31 @@ function tok (n) {
33103313
t[n] = R++
33113314
}
33123315

3316+
var LETTERDASHNUMBER = '[a-zA-Z0-9-]'
3317+
3318+
// Replace some greedy regex tokens to prevent regex dos issues. These regex are
3319+
// used internally via the safeRe object since all inputs in this library get
3320+
// normalized first to trim and collapse all extra whitespace. The original
3321+
// regexes are exported for userland consumption and lower level usage. A
3322+
// future breaking change could export the safer regex only with a note that
3323+
// all input should have extra whitespace removed.
3324+
var safeRegexReplacements = [
3325+
['\\s', 1],
3326+
['\\d', MAX_LENGTH],
3327+
[LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH],
3328+
]
3329+
3330+
function makeSafeRe (value) {
3331+
for (var i = 0; i < safeRegexReplacements.length; i++) {
3332+
var token = safeRegexReplacements[i][0]
3333+
var max = safeRegexReplacements[i][1]
3334+
value = value
3335+
.split(token + '*').join(token + '{0,' + max + '}')
3336+
.split(token + '+').join(token + '{1,' + max + '}')
3337+
}
3338+
return value
3339+
}
3340+
33133341
// The following Regular Expressions can be used for tokenizing,
33143342
// validating, and parsing SemVer version strings.
33153343

@@ -3319,14 +3347,14 @@ function tok (n) {
33193347
tok('NUMERICIDENTIFIER')
33203348
src[t.NUMERICIDENTIFIER] = '0|[1-9]\\d*'
33213349
tok('NUMERICIDENTIFIERLOOSE')
3322-
src[t.NUMERICIDENTIFIERLOOSE] = '[0-9]+'
3350+
src[t.NUMERICIDENTIFIERLOOSE] = '\\d+'
33233351

33243352
// ## Non-numeric Identifier
33253353
// Zero or more digits, followed by a letter or hyphen, and then zero or
33263354
// more letters, digits, or hyphens.
33273355

33283356
tok('NONNUMERICIDENTIFIER')
3329-
src[t.NONNUMERICIDENTIFIER] = '\\d*[a-zA-Z-][a-zA-Z0-9-]*'
3357+
src[t.NONNUMERICIDENTIFIER] = '\\d*[a-zA-Z-]' + LETTERDASHNUMBER + '*'
33303358

33313359
// ## Main Version
33323360
// Three dot-separated numeric identifiers.
@@ -3368,7 +3396,7 @@ src[t.PRERELEASELOOSE] = '(?:-?(' + src[t.PRERELEASEIDENTIFIERLOOSE] +
33683396
// Any combination of digits, letters, or hyphens.
33693397

33703398
tok('BUILDIDENTIFIER')
3371-
src[t.BUILDIDENTIFIER] = '[0-9A-Za-z-]+'
3399+
src[t.BUILDIDENTIFIER] = LETTERDASHNUMBER + '+'
33723400

33733401
// ## Build Metadata
33743402
// Plus sign, followed by one or more period-separated build metadata
@@ -3448,6 +3476,7 @@ src[t.COERCE] = '(^|[^\\d])' +
34483476
'(?:$|[^\\d])'
34493477
tok('COERCERTL')
34503478
re[t.COERCERTL] = new RegExp(src[t.COERCE], 'g')
3479+
safeRe[t.COERCERTL] = new RegExp(makeSafeRe(src[t.COERCE]), 'g')
3451 9E88 3480

34523481
// Tilde ranges.
34533482
// Meaning is "reasonably at or greater than"
@@ -3457,6 +3486,7 @@ src[t.LONETILDE] = '(?:~>?)'
34573486
tok('TILDETRIM')
34583487
src[t.TILDETRIM] = '(\\s*)' + src[t.LONETILDE] + '\\s+'
34593488
re[t.TILDETRIM] = new RegExp(src[t.TILDETRIM], 'g')
3489+
safeRe[t.TILDETRIM] = new RegExp(makeSafeRe(src[t.TILDETRIM]), 'g')
34603490
var tildeTrimReplace = '$1~'
34613491

34623492
tok('TILDE')
@@ -3472,6 +3502,7 @@ src[t.LONECARET] = '(?:\\^)'
34723502
tok('CARETTRIM')
34733503
src[t.CARETTRIM] = '(\\s*)' + src[t.LONECARET] + '\\s+'
34743504
re[t.CARETTRIM] = new RegExp(src[t.CARETTRIM], 'g')
3505+
safeRe[t.CARETTRIM] = new RegExp(makeSafeRe(src[t.CARETTRIM]), 'g')
34753506
var caretTrimReplace = '$1^'
34763507

34773508
tok('CARET')
@@ -3493,6 +3524,7 @@ src[t.COMPARATORTRIM] = '(\\s*)' + src[t.GTLT] +
34933524

34943525
// this one has to use the /g flag
34953526
re[t.COMPARATORTRIM] = new RegExp(src[t.COMPARATORTRIM], 'g')
3527+
safeRe[t.COMPARATORTRIM] = new RegExp(makeSafeRe(src[t.COMPARATORTRIM]), 'g')
34963528
var comparatorTrimReplace = '$1$2$3'
34973529

34983530
// Something like `1.2.3 - 1.2.4`
@@ -3521,6 +3553,14 @@ for (var i = 0; i < R; i++) {
35213553
debug(i, src[i])
35223554
if (!re[i]) {
35233555
re[i] = new RegExp(src[i])
3556+
3557+
// Replace all greedy whitespace to prevent regex dos issues. These regex are
3558+
// used internally via the safeRe object since all inputs in this library get
3559+
// normalized first to trim and collapse all extra whitespace. The original
3560+
// regexes are exported for userland consumption and lower level usage. A
3561+
// future breaking change could export the safer regex only with a note that
3562+
// all input should have extra whitespace removed.
3563+
safeRe[i] = new RegExp(makeSafeRe(src[i]))
35243564
}
35253565
}
35263566

@@ -3545,7 +3585,7 @@ function parse (version, options) {
35453585
return null
35463586
}
35473587

3548-
var r = options.loose ? re[t.LOOSE] : re[t.FULL]
3588+
var r = options.loose ? safeRe[t.LOOSE] : safeRe[t.FULL]
35493589
if (!r.test(version)) {
35503590
return null
35513591
}
@@ -3600,7 +3640,7 @@ function SemVer (version, options) {
36003640
this.options = options
36013641
this.loose = !!options.loose
36023642

3603-
var m = version.trim().match(options.loose ? re[t.LOOSE] : re[t.FULL])
3643+
var m = version.trim().match(options.loose ? safeRe[t.LOOSE] : safeRe[t.FULL])
36043644

36053645
if (!m) {
36063646
throw new TypeError('Invalid Version: ' + version)
@@ -4045,6 +4085,7 @@ function Comparator (comp, options) {
40454085
return new Comparator(comp, options)
40464086
}
40474087

4088+
comp = comp.trim().split(/\s+/).join(' ')
40484089
debug('comparator', comp, options)
40494090
this.options = options
40504091
this.loose = !!options.loose
@@ -4061,7 +4102,7 @@ function Comparator (comp, options) {
40614102

40624103
var ANY = {}
40634104
Comparator.prototype.parse = function (comp) {
4064-
var r = this.options.loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR]
4105+
var r = this.options.loose ? safeRe[t.COMPARATORLOOSE] : safeRe[t.COMPARATOR]
40654106
var m = comp.match(r)
40664107

40674108
if (!m) {
@@ -4185,17 +4226,24 @@ function Range (range, options) {
41854226
this.loose = !!options.loose
41864227
this.includePrerelease = !!options.includePrerelease
41874228

4188-
// First, split based on boolean or ||
4229+
// First reduce all whitespace as much as possible so we do not have to rely
4230+
// on potentially slow regexes like \s*. This is then stored and used for
4231+
// future error messages as well.
41894232
this.raw = range
4190-
this.set = range.split(/\s*\|\|\s*/).map(function (range) {
4233+
.trim()
4234+
.split(/\s+/)
4235+
.join(' ')
4236+
4237+
// First, split based on boolean or ||
4238+
this.set = this.raw.split('||').map(function (range) {
41914239
return this.parseRange(range.trim())
41924240
}, this).filter(function (c) {
41934241
// throw out any that are not relevant for whatever reason
41944242
return c.length
41954243
})
41964244

41974245
if (!this.set.length) {
4198-
throw new TypeError('Invalid SemVer Range: ' + range)
4246+
throw new TypeError('Invalid SemVer Range: ' + this.raw)
41994247
}
42004248

42014249
this.format()
@@ -4214,28 +4262,27 @@ Range.prototype.toString = function () {
42144262

42154263
Range.prototype.parseRange = function (range) {
42164264
var loose = this.options.loose
4217-
range = range.trim()
42184265
// `1.2.3 - 1.2.4` => `>=1.2.3 <=1.2.4`
4219-
var hr = loose ? re[t.HYPHENRANGELOOSE] : re[t.HYPHENRANGE]
4266+
var hr = loose ? safeRe[t.HYPHENRANGELOOSE] : safeRe[t.HYPHENRANGE]
42204267
range = range.replace(hr, hyphenReplace)
42214268
debug('hyphen replace', range)
42224269
// `> 1.2.3 < 1.2.5` => `>1.2.3 <1.2.5`
4223-
range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace)
4224-
debug('comparator trim', range, re[t.COMPARATORTRIM])
4270+
range = range.replace(safeRe[t.COMPARATORTRIM], comparatorTrimReplace)
4271+
debug('comparator trim', range, safeRe[t.COMPARATORTRIM])
42254272

42264273
// `~ 1.2.3` => `~1.2.3`
4227-
range = range.replace(re[t.TILDETRIM], tildeTrimReplace)
4274+
range = range.replace(safeRe[t.TILDETRIM], tildeTrimReplace)
42284275

42294276
// `^ 1.2.3` => `^1.2.3`
4230-
range = range.replace(re[t.CARETTRIM], caretTrimReplace)
4277+
range = range.replace(safeRe[t.CARETTRIM], caretTrimReplace)
42314278

42324279
// normalize spaces
42334280
range = range.split(/\s+/).join(' ')
42344281

42354282
// At this point, the range is completely trimmed and
42364283
// ready to be split into comparators.
42374284

4238-
var compRe = loose ? re[t.COMPARATORLOOSE] : re[t.COMPARATOR]
4285+
var compRe = loose ? safeRe[t.COMPARATORLOOSE] : safeRe[t.COMPARATOR]
42394286
var set = range.split(' ').map(function (comp) {
42404287
return parseComparator(comp, this.options)
42414288
}, this).join(' ').split(/\s+/)
@@ -4335,7 +4382,7 @@ function replaceTildes (comp, options) {
43354382
}
43364383

43374384
function replaceTilde (comp, options) {
4338-
var r = options.loose ? re[t.TILDELOOSE] : re[t.TILDE]
4385+
var r = options.loose ? safeRe[t.TILDELOOSE] : safeRe[t.TILDE]
43394386
return comp.replace(r, function (_, M, m, p, pr) {
43404387
debug('tilde', comp, _, M, m, p, pr)
43414388
var ret
@@ -4376,7 +4423,7 @@ function replaceCarets (comp, options) {
43764423

43774424
function replaceCaret (comp, options) {
43784425
debug('caret', comp, options)
4379-
var r = options.loose ? re[t.CARETLOOSE] : re[t.CARET]
4426+
var r = options.loose ? safeRe[t.CARETLOOSE] : safeRe[t.CARET]
43804427
return comp.replace(r, function (_, M, m, p, pr) {
43814428
debug('caret', comp, _, M, m, p, pr)
43824429
var ret
@@ -4435,7 +4482,7 @@ function replaceXRanges (comp, options) {
44354482

44364483
function replaceXRange (comp, options) {
44374484
comp = comp.trim()
4438-
var r = options.loose ? re[t.XRANGELOOSE] : re[t.XRANGE]
4485+
var r = options.loose ? safeRe[t.XRANGELOOSE] : safeRe[t.XRANGE]
44394486
return comp.replace(r, function (ret, gtlt, M, m, p, pr) {
44404487
debug('xRange', comp, ret, gtlt, M, m, p, pr)
44414488
var xM = isX(M)
@@ -4510,7 +4557,7 @@ function replaceXRange (comp, options) {
45104557
function replaceStars (comp, options) {
45114558
debug('replaceStars', comp, options)
45124559
// Looseness is ignored here. star is always as loose as it gets!
4513-
return comp.trim().replace(re[t.STAR], '')
4560+
return comp.trim().replace(safeRe[t.STAR], '')
45144561
}
45154562

45164563
// This function is passed to string.replace(re[t.HYPHENRANGE])
@@ -4836,7 +4883,7 @@ function coerce (version, options) {
48364883

48374884
var match = null
48384885
if (!options.rtl) {
4839-
match = version.match(re[t.COERCE])
4886+
match = version.match(safeRe[t.COERCE])
48404887
} else {
48414888
// Find the right-most coercible string that does not share
48424889
// a terminus with a more left-ward coercible string.
@@ -4847,17 +4894,17 @@ function coerce (version, options) {
48474894
// Stop when we get a match that ends at the string end, since no
48484895
// coercible string can be more right-ward without the same terminus.
48494896
var next
4850-
while ((next = re[t.COERCERTL].exec(version)) &&
4897+
while ((next = safeRe[t.COERCERTL].exec(version)) &&
48514898
(!match || match.index + match[0].length !== version.length)
48524899
) {
48534900
if (!match ||
48544901
next.index + next[0].length !== match.index + match[0].length) {
48554902
match = next
48564903
}
4857-
re[t.COERCERTL].lastIndex = next.index + next[1].length + next[2].length
4904+
safeRe[t.COERCERTL].lastIndex = next.index + next[1].length + next[2].length
48584905
}
48594906
// leave it in a clean state
4860-
re[t.COERCERTL].lastIndex = -1
4907+
safeRe[t.COERCERTL].lastIndex = -1
48614908
}
48624909

48634910
if (match === null) {
@@ -59042,7 +59089,11 @@ module.exports = v4;
5904259089

5904359090
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
5904459091
if (k2 === undefined) k2 = k;
59045-
Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
59092+
var desc = Object.getOwnPropertyDescriptor(m, k);
59093+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
59094+
desc = { enumerable: true, get: function() { return m[k]; } };
59095+
}
59096+
Object.defineProperty(o, k2, desc);
5904659097
}) : (function(o, m, k, k2) {
5904759098
if (k2 === undefined) k2 = k;
5904859099
o[k2] = m[k];
@@ -59151,7 +59202,11 @@ exports.CACHE_DEPENDENCY_BACKUP_PATH = '**/pyproject.toml';
5915159202

5915259203
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
5915359204
if (k2 === undefined) k2 = k;
59154-
Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
59205+
var desc = Object.getOwnPropertyDescriptor(m, k);
59206+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
59207+
desc = { enumerable: true, get: function() { return m[k]; } };
59208+
}
59209+
Object.defineProperty(o, k2, desc);
5915559210
}) : (function(o, m, k, k2) {
5915659211
if (k2 === undefined) k2 = k;
5915759212
o[k2] = m[k];

0 commit comments

Comments
 (0)
0