@@ -8601,6 +8601,7 @@ class Comparator {
8601
8601
}
8602
8602
}
8603
8603
8604
+ comp = comp . trim ( ) . split ( / \s + / ) . join ( ' ' )
8604
8605
debug ( 'comparator' , comp , options )
8605
8606
this . options = options
8606
8607
this . loose = ! ! options . loose
@@ -8718,7 +8719,7 @@ class Comparator {
8718
8719
module . exports = Comparator
8719
8720
8720
8721
const parseOptions = __nccwpck_require__ ( 785 )
8721
- const { re, t } = __nccwpck_require__ ( 9523 )
8722
+ const { safeRe : re , t } = __nccwpck_require__ ( 9523 )
8722
8723
const cmp = __nccwpck_require__ ( 5098 )
8723
8724
const debug = __nccwpck_require__ ( 427 )
8724
8725
const SemVer = __nccwpck_require__ ( 8088 )
@@ -8758,19 +8759,26 @@ class Range {
8758
8759
this . loose = ! ! options . loose
8759
8760
this . includePrerelease = ! ! options . includePrerelease
8760
8761
8761
- // First, split based on boolean or ||
8762
+ // First reduce all whitespace as much as possible so we do not have to rely
8763
+ // on potentially slow regexes like \s*. This is then stored and used for
8764
+ // future error messages as well.
8762
8765
this . raw = range
8763
- this . set = range
8766
+ . trim ( )
8767
+ . split ( / \s + / )
8768
+ . join ( ' ' )
8769
+
8770
+ // First, split on ||
8771
+ this . set = this . raw
8764
8772
. split ( '||' )
8765
8773
// map the range to a 2d array of comparators
8766
- . map ( r => this . parseRange ( r . trim ( ) ) )
8774
+ . map ( r => this . parseRange ( r ) )
8767
8775
// throw out any comparator lists that are empty
8768
8776
// this generally means that it was not a valid range, which is allowed
8769
8777
// in loose mode, but will still throw if the WHOLE range is invalid.
8770
8778
. filter ( c => c . length )
8771
8779
8772
8780
if ( ! this . set . length ) {
8773
- throw new TypeError ( `Invalid SemVer Range: ${ range } ` )
8781
+ throw new TypeError ( `Invalid SemVer Range: ${ this . raw } ` )
8774
8782
}
8775
8783
8776
8784
// if we have any that are not the null set, throw out null sets.
@@ -8796,9 +8804,7 @@ class Range {
8796
8804
8797
8805
format ( ) {
8798
8806
this . range = this . set
8799
- . map ( ( comps ) => {
8800
- return comps . join ( ' ' ) . trim ( )
8801
- } )
8807
+ . map ( ( comps ) => comps . join ( ' ' ) . trim ( ) )
8802
8808
. join ( '||' )
8803
8809
. trim ( )
8804
8810
return this . range
@@ -8809,8 +8815,6 @@ class Range {
8809
8815
}
8810
8816
8811
8817
parseRange ( range ) {
8812
- range = range . trim ( )
8813
-
8814
8818
// memoize range parsing for performance.
8815
8819
// this is a very hot path, and fully deterministic.
8816
8820
const memoOpts =
@@ -8837,9 +8841,6 @@ class Range {
8837
8841
// `^ 1.2.3` => `^1.2.3`
8838
8842
range = range . replace ( re [ t . CARETTRIM ] , caretTrimReplace )
8839
8843
8840
- // normalize spaces
8841
- range = range . split ( / \s + / ) . join ( ' ' )
8842
-
8843
8844
// At this point, the range is completely trimmed and
8844
8845
// ready to be split into comparators.
8845
8846
@@ -8935,7 +8936,7 @@ const Comparator = __nccwpck_require__(1532)
8935
8936
const debug = __nccwpck_require__ ( 427 )
8936
8937
const SemVer = __nccwpck_require__ ( 8088 )
8937
8938
const {
8938
- re,
8939
+ safeRe : re ,
8939
8940
t,
8940
8941
comparatorTrimReplace,
8941
8942
tildeTrimReplace,
@@ -8989,10 +8990,13 @@ const isX = id => !id || id.toLowerCase() === 'x' || id === '*'
8989
8990
// ~1.2.3, ~>1.2.3 --> >=1.2.3 <1.3.0-0
8990
8991
// ~1.2.0, ~>1.2.0 --> >=1.2.0 <1.3.0-0
8991
8992
// ~0.0.1 --> >=0.0.1 <0.1.0-0
8992
- const replaceTildes = ( comp , options ) =>
8993
- comp . trim ( ) . split ( / \s + / ) . map ( ( c ) => {
8994
- return replaceTilde ( c , options )
8995
- } ) . join ( ' ' )
8993
+ const replaceTildes = ( comp , options ) => {
8994
+ return comp
8995
+ . trim ( )
8996
+ . split ( / \s + / )
8997
+ . map ( ( c ) => replaceTilde ( c , options ) )
8998
+ . join ( ' ' )
8999
+ }
8996
9000
8997
9001
const replaceTilde = ( comp , options ) => {
8998
9002
const r = options . loose ? re [ t . TILDELOOSE ] : re [ t . TILDE ]
@@ -9030,10 +9034,13 @@ const replaceTilde = (comp, options) => {
9030
9034
// ^1.2.0 --> >=1.2.0 <2.0.0-0
9031
9035
// ^0.0.1 --> >=0.0.1 <0.0.2-0
9032
9036
// ^0.1.0 --> >=0.1.0 <0.2.0-0
9033
- const replaceCarets = ( comp , options ) =>
9034
- comp . trim ( ) . split ( / \s + / ) . map ( ( c ) => {
9035
- return replaceCaret ( c , options )
9036
- } ) . join ( ' ' )
9037
+ const replaceCarets = ( comp , options ) => {
9038
+ return comp
9039
+ . trim ( )
9040
+ . split ( / \s + / )
9041
+ . map ( ( c ) => replaceCaret ( c , options ) )
9042
+ . join ( ' ' )
9043
+ }
9037
9044
9038
9045
const replaceCaret = ( comp , options ) => {
9039
9046
debug ( 'caret' , comp , options )
@@ -9090,9 +9097,10 @@ const replaceCaret = (comp, options) => {
9090
9097
9091
9098
const replaceXRanges = ( comp , options ) => {
9092
9099
debug ( 'replaceXRanges' , comp , options )
9093
- return comp . split ( / \s + / ) . map ( ( c ) => {
9094
- return replaceXRange ( c , options )
9095
- } ) . join ( ' ' )
9100
+ return comp
9101
+ . split ( / \s + / )
9102
+ . map ( ( c ) => replaceXRange ( c , options ) )
9103
+ . join ( ' ' )
9096
9104
}
9097
9105
9098
9106
const replaceXRange = ( comp , options ) => {
@@ -9175,12 +9183,15 @@ const replaceXRange = (comp, options) => {
9175
9183
const replaceStars = ( comp , options ) => {
9176
9184
debug ( 'replaceStars' , comp , options )
9177
9185
// Looseness is ignored here. star is always as loose as it gets!
9178
- return comp . trim ( ) . replace ( re [ t . STAR ] , '' )
9186
+ return comp
9187
+ . trim ( )
9188
+ . replace ( re [ t . STAR ] , '' )
9179
9189
}
9180
9190
9181
9191
const replaceGTE0 = ( comp , options ) => {
9182
9192
debug ( 'replaceGTE0' , comp , options )
9183
- return comp . trim ( )
9193
+ return comp
9194
+ . trim ( )
9184
9195
. replace ( re [ options . includePrerelease ? t . GTE0PRE : t . GTE0 ] , '' )
9185
9196
}
9186
9197
@@ -9218,7 +9229,7 @@ const hyphenReplace = incPr => ($0,
9218
9229
to = `<=${ to } `
9219
9230
}
9220
9231
9221
- return ( `${ from } ${ to } ` ) . trim ( )
9232
+ return `${ from } ${ to } ` . trim ( )
9222
9233
}
9223
9234
9224
9235
const testSet = ( set , version , options ) => {
@@ -9265,7 +9276,7 @@ const testSet = (set, version, options) => {
9265
9276
9266
9277
const debug = __nccwpck_require__ ( 427 )
9267
9278
const { MAX_LENGTH , MAX_SAFE_INTEGER } = __nccwpck_require__ ( 2293 )
9268
- const { re, t } = __nccwpck_require__ ( 9523 )
9279
+ const { safeRe : re , t } = __nccwpck_require__ ( 9523 )
9269
9280
9270
9281
const parseOptions = __nccwpck_require__ ( 785 )
9271
9282
const { compareIdentifiers } = __nccwpck_require__ ( 2463 )
@@ -9556,8 +9567,10 @@ class SemVer {
9556
9567
default :
9557
9568
throw new Error ( `invalid increment argument: ${ release } ` )
9558
9569
}
9559
- this . format ( )
9560
- this . raw = this . version
9570
+ this . raw = this . format ( )
9571
+ if ( this . build . length ) {
9572
+ this . raw += `+${ this . build . join ( '.' ) } `
9573
+ }
9561
9574
return this
9562
9575
}
9563
9576
}
@@ -9644,7 +9657,7 @@ module.exports = cmp
9644
9657
9645
9658
const SemVer = __nccwpck_require__ ( 8088 )
9646
9659
const parse = __nccwpck_require__ ( 5925 )
9647
- const { re, t } = __nccwpck_require__ ( 9523 )
9660
+ const { safeRe : re , t } = __nccwpck_require__ ( 9523 )
9648
9661
9649
9662
const coerce = ( version , options ) => {
9650
9663
if ( version instanceof SemVer ) {
@@ -9752,6 +9765,35 @@ const diff = (version1, version2) => {
9752
9765
const highVersion = v1Higher ? v1 : v2
9753
9766
const lowVersion = v1Higher ? v2 : v1
9754
9767
const highHasPre = ! ! highVersion . prerelease . length
9768
+ const lowHasPre = ! ! lowVersion . prerelease . length
9769
+
9770
+ if ( lowHasPre && ! highHasPre ) {
9771
+ // Going from prerelease -> no prerelease requires some special casing
9772
+
9773
+ // If the low version has only a major, then it will always be a major
9774
+ // Some examples:
9775
+ // 1.0.0-1 -> 1.0.0
9776
+ // 1.0.0-1 -> 1.1.1
9777
+ // 1.0.0-1 -> 2.0.0
9778
+ if ( ! lowVersion . patch && ! lowVersion . minor ) {
9779
+ return 'major'
9780
+ }
9781
+
9782
+ // Otherwise it can be determined by checking the high version
9783
+
9784
+ if ( highVersion . patch ) {
9785
+ // anything higher than a patch bump would result in the wrong version
9786
+ return 'patch'
9787
+ }
9788
+
9789
+ if ( highVersion . minor ) {
9790
+ // anything higher than a minor bump would result in the wrong version
9791
+ return 'minor'
9792
+ }
9793
+
9794
+ // bumping major/minor/patch all have same result
9795
+ return 'major'
9796
+ }
9755
9797
9756
9798
// add the `pre` prefix if we are going to a prerelease version
9757
9799
const prefix = highHasPre ? 'pre' : ''
@@ -9768,26 +9810,8 @@ const diff = (version1, version2) => {
9768
9810
return prefix + 'patch'
9769
9811
}
9770
9812
9771
- // at this point we know stable versions match but overall versions are not equal,
9772
- // so either they are both prereleases, or the lower version is a prerelease
9773
-
9774
- if ( highHasPre ) {
9775
- // high and low are preleases
9776
- return 'prerelease'
9777
- }
9778
-
9779
- if ( lowVersion . patch ) {
9780
- // anything higher than a patch bump would result in the wrong version
9781
- return 'patch'
9782
- }
9783
-
9784
- if ( lowVersion . minor ) {
9785
- // anything higher than a minor bump would result in the wrong version
9786
- return 'minor'
9787
- }
9788
-
9789
- // bumping major/minor/patch all have same result
9790
- return 'major'
9813
+ // high and low are preleases
9814
+ return 'prerelease'
9791
9815
}
9792
9816
9793
9817
module . exports = diff
@@ -10217,16 +10241,27 @@ exports = module.exports = {}
10217
10241
10218
10242
// The actual regexps go on exports.re
10219
10243
const re = exports . re = [ ]
10244
+ const safeRe = exports . safeRe = [ ]
10220
10245
const src = exports . src = [ ]
10221
10246
const t = exports . t = { }
10222
10247
let R = 0
10223
10248
10224
10249
const createToken = ( name , value , isGlobal ) => {
10250
+ // Replace all greedy whitespace to prevent regex dos issues. These regex are
10251
+ // used internally via the safeRe object since all inputs in this library get
10252
+ // normalized first to trim and collapse all extra whitespace. The original
10253
+ // regexes are exported for userland consumption and lower level usage. A
10254
+ // future breaking change could export the safer regex only with a note that
10255
+ // all input should have extra whitespace removed.
10256
+ const safe = value
10257
+ . split ( '\\s*' ) . join ( '\\s{0,1}' )
10258
+ . split ( '\\s+' ) . join ( '\\s' )
10225
10259
const index = R ++
10226
10260
debug ( name , index , value )
10227
10261
t [ name ] = index
10228
10262
src [ index ] = value
10229
10263
re [ index ] = new RegExp ( value , isGlobal ? 'g' : undefined )
10264
+ safeRe [ index ] = new RegExp ( safe , isGlobal ? 'g' : undefined )
10230
10265
}
10231
10266
10232
10267
// The following Regular Expressions can be used for tokenizing,
0 commit comments