maximus/simpl-liste
1
0
Fork 0
Code Issues 4 Pull requests Projects Releases 20 Packages Wiki Activity Actions

fix(security): raise shell-quote, add compression and source-map-js floors #138

Merged
maximus merged 1 commit from issue-133-134-135-shell-quote-compression-source-map-js into master 2026-10-06 23:12:32 +00:00
Conversation 1 Commits 1 Files changed 3 +81 -10
3 changed files with 81 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
package-lock.json generated
View file

@ -4861,14 +4861,15 @@
}
},
"node_modules/compression": {
"version": "1.8.1",
"resolved": "https://registry.npmjs.org/compression/-/compression-1.8.1.tgz",
"integrity": "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==",
"version": "1.8.2",
"resolved": "https://registry.npmjs.org/compression/-/compression-1.8.2.tgz",
"integrity": "sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ==",
"license": "MIT",
"dependencies": {
"bytes": "3.1.2",
"compressible": "~2.0.18",
"debug": "2.6.9",
"destroy": "1.2.0",
"negotiator": "~0.6.4",
"on-headers": "~1.1.0",
"safe-buffer": "5.2.1",
@ -4876,6 +4877,10 @@
},
"engines": {
"node": ">= 0.8.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/express"
}
},
"node_modules/compression/node_modules/debug": {
@ -11283,9 +11288,9 @@
}
},
"node_modules/shell-quote": {
"version": "1.9.0",
"resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
"integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
"version": "1.12.0",
"resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.12.0.tgz",
"integrity": "sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==",
"license": "MIT",
"engines": {
"node": ">= 0.4"
@ -11354,9 +11359,9 @@
}
},
"node_modules/source-map-js": {
"version": "1.2.1",
"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
"integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
"version": "1.2.2",
"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
"integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
"license": "BSD-3-Clause",
"engines": {
"node": ">=0.10.0"

4
package.json
View file

@ -72,6 +72,7 @@
"uuid": "^11.1.1",
"postcss": "^8.5.18",
"postcss-selector-parser@^6.0.0": "^6.1.3",
"source-map-js@^1.0.0": "^1.2.2",
"http-cache-semantics@^4.0.0": "^4.3.0",
"js-yaml@^3.0.0": "^3.15.2",
"js-yaml@^4.0.0": "^4.3.2",
@ -81,12 +82,13 @@
"@babel/core": "^7.29.6",
"browserslist": "^4.28.7",
"@expo/cli": {
"compression": "^1.8.2",
"ws": "^8.20.1",
"undici": "^6.28.1",
"tar": "^7.5.21"
},
"react-devtools-core": {
"shell-quote": "^1.8.4",
"shell-quote": "^1.11.0",
"ws": "^7.5.11"
},
"react-native": {

64
tests/smoke.test.cjs
View file

@ -335,6 +335,70 @@ check('every installed postcss-selector-parser copy is 6.x and >= 6.1.3', () =>
);
});
// --- Override floors (#133, #134, #135) ---
// shell-quote: scoped to react-devtools-core (raised from #95's ^1.8.4).
// compression: scoped to @expo/cli (dev server middleware).
// source-map-js: version-scoped to major 1 (postcss, tailwindcss pipeline).
// Each floor is paired with a call to the API its consumer actually uses.
check('every installed shell-quote copy is >= 1.11.0 and still quotes/parses', () => {
const copies = installedCopies('shell-quote');
assert.ok(copies.length > 0, 'shell-quote is not installed');
const strays = copies.filter((c) => !versionAtLeast(c.version, '1.11.0'));
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'shell-quote must be >= 1.11.0'
);
for (const c of copies) {
const { quote, parse } = require(c.dir);
const where = `shell-quote ${c.version} at ${path.relative(ROOT, c.dir)}`;
assert.equal(quote(['code', '-g', 'a b.js:1']), "code -g 'a b.js:1'", `${where}: quote`);
assert.deepEqual(parse('a "b c" d'), ['a', 'b c', 'd'], `${where}: parse`);
}
});
check('every installed compression copy is >= 1.8.2 and builds a middleware', () => {
const copies = installedCopies('compression');
assert.ok(copies.length > 0, 'compression is not installed');
const strays = copies.filter((c) => !versionAtLeast(c.version, '1.8.2'));
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'compression must be >= 1.8.2'
);
for (const c of copies) {
const middleware = require(c.dir)();
assert.equal(typeof middleware, 'function', `compression ${c.version}: middleware`);
assert.equal(middleware.length, 3, `compression ${c.version}: (req, res, next) signature`);
}
});
check('every installed source-map-js copy is 1.x >= 1.2.2 and round-trips a mapping', () => {
const copies = installedCopies('source-map-js');
assert.ok(copies.length > 0, 'source-map-js is not installed');
const strays = copies.filter(
(c) => majorOf(c.version) !== '1' || !versionAtLeast(c.version, '1.2.2')
);
assert.deepEqual(
strays.map((c) => `${c.version} at ${path.relative(ROOT, c.dir)}`),
[],
'source-map-js must be 1.x >= 1.2.2'
);
for (const c of copies) {
const { SourceMapGenerator, SourceMapConsumer } = require(c.dir);
const gen = new SourceMapGenerator({ file: 'out.css' });
gen.addMapping({
source: 'in.css',
original: { line: 3, column: 2 },
generated: { line: 1, column: 0 },
});
const pos = new SourceMapConsumer(gen.toJSON()).originalPositionFor({ line: 1, column: 0 });
const where = `source-map-js ${c.version} at ${path.relative(ROOT, c.dir)}`;
assert.deepEqual([pos.source, pos.line, pos.column], ['in.css', 3, 2], where);
}
});
// The call that broke under the blanket override: each minimatch copy must
// still expand braces through its own brace-expansion major.
check('every installed minimatch copy still matches globs and braces', () => {