From f8e4ffa1d99feacb91bee7e1825b0f0e1bfdd39f Mon Sep 17 00:00:00 2001 From: Santiago Gimeno Date: Mon, 8 Dec 2025 17:11:49 +0100 Subject: [PATCH 1/3] deps: update to glob@10.5.0 in npm Fixes: https://nvd.nist.gov/vuln/detail/CVE-2025-64756 --- .../node_modules/glob/dist/commonjs/index.js | 12 +- deps/npm/node_modules/glob/dist/esm/bin.mjs | 146 +++++++++++++----- deps/npm/node_modules/glob/package.json | 9 +- deps/npm/package.json | 2 +- 4 files changed, 123 insertions(+), 46 deletions(-) diff --git a/deps/npm/node_modules/glob/dist/commonjs/index.js b/deps/npm/node_modules/glob/dist/commonjs/index.js index 31da9dfd53c..151495d170e 100644 --- a/deps/npm/node_modules/glob/dist/commonjs/index.js +++ b/deps/npm/node_modules/glob/dist/commonjs/index.js @@ -1,6 +1,11 @@ "use strict"; Object.defineProperty(exports, "__esModule", { value: true }); -exports.glob = exports.sync = exports.iterate = exports.iterateSync = exports.stream = exports.streamSync = exports.globIterate = exports.globIterateSync = exports.globSync = exports.globStream = exports.globStreamSync = exports.Ignore = exports.hasMagic = exports.Glob = exports.unescape = exports.escape = void 0; +exports.glob = exports.sync = exports.iterate = exports.iterateSync = exports.stream = exports.streamSync = exports.Ignore = exports.hasMagic = exports.Glob = exports.unescape = exports.escape = void 0; +exports.globStreamSync = globStreamSync; +exports.globStream = globStream; +exports.globSync = globSync; +exports.globIterateSync = globIterateSync; +exports.globIterate = globIterate; const minimatch_1 = require("minimatch"); const glob_js_1 = require("./glob.js"); const has_magic_js_1 = require("./has-magic.js"); @@ -16,26 +21,21 @@ Object.defineProperty(exports, "Ignore", { enumerable: true, get: function () { function globStreamSync(pattern, options = {}) { return new glob_js_1.Glob(pattern, options).streamSync(); } -exports.globStreamSync = globStreamSync; function globStream(pattern, options = {}) { return new glob_js_1.Glob(pattern, options).stream(); } -exports.globStream = globStream; function globSync(pattern, options = {}) { return new glob_js_1.Glob(pattern, options).walkSync(); } -exports.globSync = globSync; async function glob_(pattern, options = {}) { return new glob_js_1.Glob(pattern, options).walk(); } function globIterateSync(pattern, options = {}) { return new glob_js_1.Glob(pattern, options).iterateSync(); } -exports.globIterateSync = globIterateSync; function globIterate(pattern, options = {}) { return new glob_js_1.Glob(pattern, options).iterate(); } -exports.globIterate = globIterate; // aliases: glob.sync.stream() glob.stream.sync() glob.sync() etc exports.streamSync = globStreamSync; exports.stream = Object.assign(globStream, { sync: globStreamSync }); diff --git a/deps/npm/node_modules/glob/dist/esm/bin.mjs b/deps/npm/node_modules/glob/dist/esm/bin.mjs index 5c7bf1e9256..d4511ae0c3c 100755 --- a/deps/npm/node_modules/glob/dist/esm/bin.mjs +++ b/deps/npm/node_modules/glob/dist/esm/bin.mjs @@ -3,7 +3,7 @@ import { foregroundChild } from 'foreground-child'; import { existsSync } from 'fs'; import { jack } from 'jackspeak'; import { loadPackageJson } from 'package-json-from-dist'; -import { join } from 'path'; +import { basename, join } from 'path'; import { globStream } from './index.js'; const { version } = loadPackageJson(import.meta.url, '../package.json'); const j = jack({ @@ -30,6 +30,50 @@ const j = jack({ description: `If no positional arguments are provided, glob will use this pattern`, }, +}) + .flag({ + shell: { + default: false, + description: `Interpret the command as a shell command by passing it + to the shell, with all matched filesystem paths appended, + **even if this cannot be done safely**. + + This is **not** unsafe (and usually unnecessary) when using + the known Unix shells sh, bash, zsh, and fish, as these can + all be executed in such a way as to pass positional + arguments safely. + + **Note**: THIS IS UNSAFE IF THE FILE PATHS ARE UNTRUSTED, + because a path like \`'some/path/\\$\\(cmd)'\` will be + executed by the shell. + + If you do have positional arguments that you wish to pass to + the command ahead of the glob pattern matches, use the + \`--cmd-arg\`/\`-g\` option instead. + + The next major release of glob will fully remove the ability + to use this option unsafely.`, + }, +}) + .optList({ + 'cmd-arg': { + short: 'g', + hint: 'arg', + default: [], + description: `Pass the provided values to the supplied command, ahead of + the glob matches. + + For example, the command: + + glob -c echo -g"hello" -g"world" *.txt + + might output: + + hello world a.txt b.txt + + This is a safer (and future-proof) alternative than putting + positional arguments in the \`-c\`/\`--cmd\` option.`, + }, }) .flag({ all: { @@ -74,7 +118,7 @@ const j = jack({ description: `Always resolve to posix style paths, using '/' as the directory separator, even on Windows. Drive letter absolute matches on Windows will be expanded to their - full resolved UNC maths, eg instead of 'C:\\foo\\bar', + full resolved UNC paths, eg instead of 'C:\\foo\\bar', it will expand to '//?/C:/foo/bar'. `, }, @@ -209,8 +253,10 @@ const j = jack({ description: `Output a huge amount of noisy debug information about patterns as they are parsed and used to match files.`, }, -}) - .flag({ + version: { + short: 'V', + description: `Output the version (${version})`, + }, help: { short: 'h', description: 'Show this usage information', @@ -218,48 +264,78 @@ const j = jack({ }); try { const { positionals, values } = j.parse(); - if (values.help) { + const { cmd, shell, all, default: def, version: showVersion, help, absolute, cwd, dot, 'dot-relative': dotRelative, follow, ignore, 'match-base': matchBase, 'max-depth': maxDepth, mark, nobrace, nocase, nodir, noext, noglobstar, platform, realpath, root, stat, debug, posix, 'cmd-arg': cmdArg, } = values; + if (showVersion) { + console.log(version); + process.exit(0); + } + if (help) { console.log(j.usage()); process.exit(0); } - if (positionals.length === 0 && !values.default) + //const { shell, help } = values + if (positionals.length === 0 && !def) throw 'No patterns provided'; - if (positionals.length === 0 && values.default) - positionals.push(values.default); - const patterns = values.all ? positionals : positionals.filter(p => !existsSync(p)); - const matches = values.all ? - [] - : positionals.filter(p => existsSync(p)).map(p => join(p)); + if (positionals.length === 0 && def) + positionals.push(def); + const patterns = all ? positionals : positionals.filter(p => !existsSync(p)); + const matches = all ? [] : positionals.filter(p => existsSync(p)).map(p => join(p)); const stream = globStream(patterns, { - absolute: values.absolute, - cwd: values.cwd, - dot: values.dot, - dotRelative: values['dot-relative'], - follow: values.follow, - ignore: values.ignore, - mark: values.mark, - matchBase: values['match-base'], - maxDepth: values['max-depth'], - nobrace: values.nobrace, - nocase: values.nocase, - nodir: values.nodir, - noext: values.noext, - noglobstar: values.noglobstar, - platform: values.platform, - realpath: values.realpath, - root: values.root, - stat: values.stat, - debug: values.debug, - posix: values.posix, + absolute, + cwd, + dot, + dotRelative, + follow, + ignore, + mark, + matchBase, + maxDepth, + nobrace, + nocase, + nodir, + noext, + noglobstar, + platform: platform, + realpath, + root, + stat, + debug, + posix, }); - const cmd = values.cmd; if (!cmd) { matches.forEach(m => console.log(m)); stream.on('data', f => console.log(f)); } else { - stream.on('data', f => matches.push(f)); - stream.on('end', () => foregroundChild(cmd, matches, { shell: true })); + cmdArg.push(...matches); + stream.on('data', f => cmdArg.push(f)); + // Attempt to support commands that contain spaces and otherwise require + // shell interpretation, but do NOT shell-interpret the arguments, to avoid + // injections via filenames. This affordance can only be done on known Unix + // shells, unfortunately. + // + // 'bash', ['-c', cmd + ' "$@"', 'bash', ...matches] + // 'zsh', ['-c', cmd + ' "$@"', 'zsh', ...matches] + // 'fish', ['-c', cmd + ' "$argv"', ...matches] + const { SHELL = 'unknown' } = process.env; + const shellBase = basename(SHELL); + const knownShells = ['sh', 'ksh', 'zsh', 'bash', 'fish']; + if ((shell || /[ "']/.test(cmd)) && + knownShells.includes(shellBase)) { + const cmdWithArgs = `${cmd} "\$${shellBase === 'fish' ? 'argv' : '@'}"`; + if (shellBase !== 'fish') { + cmdArg.unshift(SHELL); + } + cmdArg.unshift('-c', cmdWithArgs); + stream.on('end', () => foregroundChild(SHELL, cmdArg)); + } + else { + if (shell) { + process.emitWarning('The --shell option is unsafe, and will be removed. To pass ' + + 'positional arguments to the subprocess, use -g/--cmd-arg instead.', 'DeprecationWarning', 'GLOB_SHELL'); + } + stream.on('end', () => foregroundChild(cmd, cmdArg, { shell })); + } } } catch (e) { diff --git a/deps/npm/node_modules/glob/package.json b/deps/npm/node_modules/glob/package.json index 4838947dfc1..644aece15b3 100644 --- a/deps/npm/node_modules/glob/package.json +++ b/deps/npm/node_modules/glob/package.json @@ -1,8 +1,11 @@ { "author": "Isaac Z. Schlueter (https://blog.izs.me/)", + "publishConfig": { + "tag": "legacy-v10" + }, "name": "glob", "description": "the most correct and second fastest glob implementation in JavaScript", - "version": "10.4.2", + "version": "10.5.0", "type": "module", "tshy": { "main": true, @@ -92,7 +95,5 @@ "funding": { "url": "https://github.com/sponsors/isaacs" }, - "engines": { - "node": ">=16 || 14 >=14.18" - } + "module": "./dist/esm/index.js" } diff --git a/deps/npm/package.json b/deps/npm/package.json index 02e2de7f2d6..875dcef4da1 100644 --- a/deps/npm/package.json +++ b/deps/npm/package.json @@ -69,7 +69,7 @@ "cli-columns": "^4.0.0", "fastest-levenshtein": "^1.0.16", "fs-minipass": "^3.0.3", - "glob": "^10.4.2", + "glob": "^10.5.0", "graceful-fs": "^4.2.11", "hosted-git-info": "^7.0.2", "ini": "^4.1.3", From cd131603071fcb87156b2d3e8c489f645e2ac1e0 Mon Sep 17 00:00:00 2001 From: Santiago Gimeno Date: Mon, 8 Dec 2025 18:42:01 +0100 Subject: [PATCH 2/3] deps: update to cross-spawn@7.0.6 in npm Fixes: https://nvd.nist.gov/vuln/detail/CVE-2024-21538 --- deps/npm/node_modules/cross-spawn/lib/enoent.js | 2 +- deps/npm/node_modules/cross-spawn/lib/util/escape.js | 6 ++++-- deps/npm/node_modules/cross-spawn/package.json | 4 ++-- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/deps/npm/node_modules/cross-spawn/lib/enoent.js b/deps/npm/node_modules/cross-spawn/lib/enoent.js index 14df9b623d0..da33471369c 100644 --- a/deps/npm/node_modules/cross-spawn/lib/enoent.js +++ b/deps/npm/node_modules/cross-spawn/lib/enoent.js @@ -24,7 +24,7 @@ function hookChildProcess(cp, parsed) { // the command exists and emit an "error" instead // See https://github.com/IndigoUnited/node-cross-spawn/issues/16 if (name === 'exit') { - const err = verifyENOENT(arg1, parsed, 'spawn'); + const err = verifyENOENT(arg1, parsed); if (err) { return originalEmit.call(cp, 'error', err); diff --git a/deps/npm/node_modules/cross-spawn/lib/util/escape.js b/deps/npm/node_modules/cross-spawn/lib/util/escape.js index b0bb84c3a14..7bf2905cd03 100644 --- a/deps/npm/node_modules/cross-spawn/lib/util/escape.js +++ b/deps/npm/node_modules/cross-spawn/lib/util/escape.js @@ -15,15 +15,17 @@ function escapeArgument(arg, doubleEscapeMetaChars) { arg = `${arg}`; // Algorithm below is based on https://qntm.org/cmd + // It's slightly altered to disable JS backtracking to avoid hanging on specially crafted input + // Please see https://github.com/moxystudio/node-cross-spawn/pull/160 for more information // Sequence of backslashes followed by a double quote: // double up all the backslashes and escape the double quote - arg = arg.replace(/(\\*)"/g, '$1$1\\"'); + arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"'); // Sequence of backslashes followed by the end of the string // (which will become a double quote later): // double up all the backslashes - arg = arg.replace(/(\\*)$/, '$1$1'); + arg = arg.replace(/(?=(\\+?)?)\1$/, '$1$1'); // All other backslashes occur literally diff --git a/deps/npm/node_modules/cross-spawn/package.json b/deps/npm/node_modules/cross-spawn/package.json index 232ff97e04b..24b2eb4c990 100644 --- a/deps/npm/node_modules/cross-spawn/package.json +++ b/deps/npm/node_modules/cross-spawn/package.json @@ -1,6 +1,6 @@ { "name": "cross-spawn", - "version": "7.0.3", + "version": "7.0.6", "description": "Cross platform child_process#spawn and child_process#spawnSync", "keywords": [ "spawn", @@ -65,7 +65,7 @@ "lint-staged": "^9.2.5", "mkdirp": "^0.5.1", "rimraf": "^3.0.0", - "standard-version": "^7.0.0" + "standard-version": "^9.5.0" }, "engines": { "node": ">= 8" From 29f48a23e6566d90a605e83d2928df46226f1a85 Mon Sep 17 00:00:00 2001 From: Santiago Gimeno Date: Mon, 8 Dec 2025 18:48:23 +0100 Subject: [PATCH 3/3] 2025-12-08, Version 20.19.6-nsolid-v6.1.1 'Iron' --- doc/changelogs/NSOLID_CHANGELOG_V6_NODE_V20.md | 7 +++++++ src/node_version.h | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/doc/changelogs/NSOLID_CHANGELOG_V6_NODE_V20.md b/doc/changelogs/NSOLID_CHANGELOG_V6_NODE_V20.md index 68e724ff44e..14e032948af 100644 --- a/doc/changelogs/NSOLID_CHANGELOG_V6_NODE_V20.md +++ b/doc/changelogs/NSOLID_CHANGELOG_V6_NODE_V20.md @@ -2,6 +2,13 @@ +## 2025-12-08, Version 20.19.6-nsolid-v6.1.1 'Iron' + +### Commits + +* \[[`cd13160307`](https://github.com/nodesource/nsolid/commit/cd13160307)] - **deps**: update to cross-spawn\@7.0.6 in npm (Santiago Gimeno) +* \[[`f8e4ffa1d9`](https://github.com/nodesource/nsolid/commit/f8e4ffa1d9)] - **deps**: update to glob\@10.5.0 in npm (Santiago Gimeno) + ## 2025-12-02, Version 20.19.6-nsolid-v6.1.0 'Iron' ### Commits diff --git a/src/node_version.h b/src/node_version.h index 3cd15596630..f95bdd0b6c2 100644 --- a/src/node_version.h +++ b/src/node_version.h @@ -36,7 +36,7 @@ #define NSOLID_MINOR_VERSION 1 #define NSOLID_PATCH_VERSION 1 -#define NSOLID_VERSION_IS_RELEASE 0 +#define NSOLID_VERSION_IS_RELEASE 1 #ifndef NODE_STRINGIFY #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)