github/codeql-action
0
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-05-21 21:08:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bump brace-expansion

Browse Source 
Address https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2
This commit is contained in:
Henry Mercer
2026-05-20 15:17:16 +01:00
parent f4d0a7abf7
commit a134948b87
2 changed files with 21 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/entry-points.js
Generated
+12 -10
View File
@@ -31025,13 +31025,15 @@ var require_brace_expansion = __commonJS({
parts.push.apply(parts, p);
return parts;
}
function expandTop(str2) {
function expandTop(str2, options) {
if (!str2)
return [];
options = options || {};
var max = options.max == null ? Infinity : options.max;
if (str2.substr(0, 2) === "{}") {
str2 = "\\{\\}" + str2.substr(2);
}
return expand2(escapeBraces(str2), true).map(unescapeBraces);
return expand2(escapeBraces(str2), max, true).map(unescapeBraces);
}
function embrace(str2) {
return "{" + str2 + "}";
@@ -31045,7 +31047,7 @@ var require_brace_expansion = __commonJS({
function gte6(i, y) {
return i >= y;
}
function expand2(str2, isTop) {
function expand2(str2, max, isTop) {
var expansions = [];
var m = balanced("{", "}", str2);
if (!m || /\$$/.test(m.pre)) return [str2];
@@ -31056,7 +31058,7 @@ var require_brace_expansion = __commonJS({
if (!isSequence && !isOptions) {
if (m.post.match(/,(?!,).*\}/)) {
str2 = m.pre + "{" + m.body + escClose + m.post;
return expand2(str2);
return expand2(str2, max, true);
}
return [str2];
}
@@ -31066,9 +31068,9 @@ var require_brace_expansion = __commonJS({
} else {
n = parseCommaParts(m.body);
if (n.length === 1) {
n = expand2(n[0], false).map(embrace);
n = expand2(n[0], max, false).map(embrace);
if (n.length === 1) {
var post = m.post.length ? expand2(m.post, false) : [""];
var post = m.post.length ? expand2(m.post, max, false) : [""];
return post.map(function(p) {
return m.pre + n[0] + p;
});
@@ -31076,7 +31078,7 @@ var require_brace_expansion = __commonJS({
}
}
var pre = m.pre;
var post = m.post.length ? expand2(m.post, false) : [""];
var post = m.post.length ? expand2(m.post, max, false) : [""];
var N;
if (isSequence) {
var x = numeric(n[0]);
@@ -31114,11 +31116,11 @@ var require_brace_expansion = __commonJS({
}
} else {
N = concatMap(n, function(el) {
return expand2(el, false);
return expand2(el, max, false);
});
}
for (var j = 0; j < N.length; j++) {
for (var k = 0; k < post.length; k++) {
for (var k = 0; k < post.length && expansions.length < max; k++) {
var expansion = pre + N[j] + post[k];
if (!isTop || isSequence || expansion)
expansions.push(expansion);
@@ -102244,7 +102246,7 @@ var require_commonjs19 = __commonJS({
}
const pad = n.some(isPadded);
N = [];
for (let i = x; test(i, y); i += incr) {
for (let i = x; test(i, y) && N.length < max; i += incr) {
let c;
if (isAlphaSequence) {
c = String.fromCharCode(i);