From e33a41f53e47784f051df197b5cc4f30cc9c131c Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 9 Nov 2026 10:54:55 +0000 Subject: [PATCH] chore(deps): patch deepmerge 4.3.2 for alert #88 Upstream deepmerge has no release after 4.3.1, which is still inside GHSA-gcqx-w48m-w2h4. Ship that release with __proto__ keys dropped and point the lockfile at it. Co-authored-by: Vatsal Sanjay | CoMPhy Lab --- package-lock.json | 19 +++-- package.json | 2 + packages/deepmerge/dist/cjs.js | 136 ++++++++++++++++++++++++++++++ packages/deepmerge/dist/umd.js | 142 ++++++++++++++++++++++++++++++++ packages/deepmerge/index.d.ts | 20 +++++ packages/deepmerge/index.js | 109 ++++++++++++++++++++++++ packages/deepmerge/license.txt | 21 +++++ packages/deepmerge/package.json | 11 +++ 8 files changed, 452 insertions(+), 8 deletions(-) create mode 100644 packages/deepmerge/dist/cjs.js create mode 100644 packages/deepmerge/dist/umd.js create mode 100644 packages/deepmerge/index.d.ts create mode 100644 packages/deepmerge/index.js create mode 100644 packages/deepmerge/license.txt create mode 100644 packages/deepmerge/package.json diff --git a/package-lock.json b/package-lock.json index 8b910c14..cbd7bc18 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,6 +9,7 @@ "version": "1.0.0", "license": "MIT", "devDependencies": { + "deepmerge": "file:packages/deepmerge", "eslint": "^9.39.2", "globals": "^16.2.0", "husky": "^9.1.7", @@ -3883,14 +3884,8 @@ "license": "MIT" }, "node_modules/deepmerge": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz", - "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } + "resolved": "packages/deepmerge", + "link": true }, "node_modules/dequal": { "version": "2.0.3", @@ -11433,6 +11428,14 @@ "funding": { "url": "https://github.com/sponsors/sindresorhus" } + }, + "packages/deepmerge": { + "version": "4.3.2", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } } } } diff --git a/package.json b/package.json index 822601da..6c6325d9 100644 --- a/package.json +++ b/package.json @@ -37,6 +37,7 @@ "homepage": "https://comphy-lab.org/vatsalsy", "overrides": { "brace-expansion": "1.1.21", + "deepmerge": "file:packages/deepmerge", "fast-uri": "4.2.3", "form-data": "4.0.4", "js-yaml": "4.3.2", @@ -47,6 +48,7 @@ "postcss": ">=8.5.23" }, "devDependencies": { + "deepmerge": "file:packages/deepmerge", "eslint": "^9.39.2", "globals": "^16.2.0", "husky": "^9.1.7", diff --git a/packages/deepmerge/dist/cjs.js b/packages/deepmerge/dist/cjs.js new file mode 100644 index 00000000..72ee17c5 --- /dev/null +++ b/packages/deepmerge/dist/cjs.js @@ -0,0 +1,136 @@ +'use strict'; + +var isMergeableObject = function isMergeableObject(value) { + return isNonNullObject(value) + && !isSpecial(value) +}; + +function isNonNullObject(value) { + return !!value && typeof value === 'object' +} + +function isSpecial(value) { + var stringValue = Object.prototype.toString.call(value); + + return stringValue === '[object RegExp]' + || stringValue === '[object Date]' + || isReactElement(value) +} + +// see https://github.com/facebook/react/blob/b5ac963fb791d1298e7f396236383bc955f916c1/src/isomorphic/classic/element/ReactElement.js#L21-L25 +var canUseSymbol = typeof Symbol === 'function' && Symbol.for; +var REACT_ELEMENT_TYPE = canUseSymbol ? Symbol.for('react.element') : 0xeac7; + +function isReactElement(value) { + return value.$$typeof === REACT_ELEMENT_TYPE +} + +function emptyTarget(val) { + return Array.isArray(val) ? [] : {} +} + +function cloneUnlessOtherwiseSpecified(value, options) { + return (options.clone !== false && options.isMergeableObject(value)) + ? deepmerge(emptyTarget(value), value, options) + : value +} + +function defaultArrayMerge(target, source, options) { + return target.concat(source).map(function(element) { + return cloneUnlessOtherwiseSpecified(element, options) + }) +} + +function getMergeFunction(key, options) { + if (!options.customMerge) { + return deepmerge + } + var customMerge = options.customMerge(key); + return typeof customMerge === 'function' ? customMerge : deepmerge +} + +function getEnumerableOwnPropertySymbols(target) { + return Object.getOwnPropertySymbols + ? Object.getOwnPropertySymbols(target).filter(function(symbol) { + return Object.propertyIsEnumerable.call(target, symbol) + }) + : [] +} + +function getKeys(target) { + return Object.keys(target).filter(function(key) { + // GHSA-gcqx-w48m-w2h4: assignment of __proto__ sets the destination's prototype. + return key !== '__proto__' + }).concat(getEnumerableOwnPropertySymbols(target)) +} + +function propertyIsOnObject(object, property) { + try { + return property in object + } catch(_) { + return false + } +} + +// Protects from prototype poisoning and unexpected merging up the prototype chain. +function propertyIsUnsafe(target, key) { + return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet, + && !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain, + && Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable. +} + +function mergeObject(target, source, options) { + var destination = {}; + if (options.isMergeableObject(target)) { + getKeys(target).forEach(function(key) { + destination[key] = cloneUnlessOtherwiseSpecified(target[key], options); + }); + } + getKeys(source).forEach(function(key) { + if (propertyIsUnsafe(target, key)) { + return + } + + if (propertyIsOnObject(target, key) && options.isMergeableObject(source[key])) { + destination[key] = getMergeFunction(key, options)(target[key], source[key], options); + } else { + destination[key] = cloneUnlessOtherwiseSpecified(source[key], options); + } + }); + return destination +} + +function deepmerge(target, source, options) { + options = options || {}; + options.arrayMerge = options.arrayMerge || defaultArrayMerge; + options.isMergeableObject = options.isMergeableObject || isMergeableObject; + // cloneUnlessOtherwiseSpecified is added to `options` so that custom arrayMerge() + // implementations can use it. The caller may not replace it. + options.cloneUnlessOtherwiseSpecified = cloneUnlessOtherwiseSpecified; + + var sourceIsArray = Array.isArray(source); + var targetIsArray = Array.isArray(target); + var sourceAndTargetTypesMatch = sourceIsArray === targetIsArray; + + if (!sourceAndTargetTypesMatch) { + return cloneUnlessOtherwiseSpecified(source, options) + } else if (sourceIsArray) { + return options.arrayMerge(target, source, options) + } else { + return mergeObject(target, source, options) + } +} + +deepmerge.all = function deepmergeAll(array, options) { + if (!Array.isArray(array)) { + throw new Error('first argument should be an array') + } + + return array.reduce(function(prev, next) { + return deepmerge(prev, next, options) + }, {}) +}; + +var deepmerge_1 = deepmerge; + +module.exports = deepmerge_1; diff --git a/packages/deepmerge/dist/umd.js b/packages/deepmerge/dist/umd.js new file mode 100644 index 00000000..bd0ba37b --- /dev/null +++ b/packages/deepmerge/dist/umd.js @@ -0,0 +1,142 @@ +(function (global, factory) { + typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() : + typeof define === 'function' && define.amd ? define(factory) : + (global = global || self, global.deepmerge = factory()); +}(this, function () { 'use strict'; + + var isMergeableObject = function isMergeableObject(value) { + return isNonNullObject(value) + && !isSpecial(value) + }; + + function isNonNullObject(value) { + return !!value && typeof value === 'object' + } + + function isSpecial(value) { + var stringValue = Object.prototype.toString.call(value); + + return stringValue === '[object RegExp]' + || stringValue === '[object Date]' + || isReactElement(value) + } + + // see https://github.com/facebook/react/blob/b5ac963fb791d1298e7f396236383bc955f916c1/src/isomorphic/classic/element/ReactElement.js#L21-L25 + var canUseSymbol = typeof Symbol === 'function' && Symbol.for; + var REACT_ELEMENT_TYPE = canUseSymbol ? Symbol.for('react.element') : 0xeac7; + + function isReactElement(value) { + return value.$$typeof === REACT_ELEMENT_TYPE + } + + function emptyTarget(val) { + return Array.isArray(val) ? [] : {} + } + + function cloneUnlessOtherwiseSpecified(value, options) { + return (options.clone !== false && options.isMergeableObject(value)) + ? deepmerge(emptyTarget(value), value, options) + : value + } + + function defaultArrayMerge(target, source, options) { + return target.concat(source).map(function(element) { + return cloneUnlessOtherwiseSpecified(element, options) + }) + } + + function getMergeFunction(key, options) { + if (!options.customMerge) { + return deepmerge + } + var customMerge = options.customMerge(key); + return typeof customMerge === 'function' ? customMerge : deepmerge + } + + function getEnumerableOwnPropertySymbols(target) { + return Object.getOwnPropertySymbols + ? Object.getOwnPropertySymbols(target).filter(function(symbol) { + return Object.propertyIsEnumerable.call(target, symbol) + }) + : [] + } + + function getKeys(target) { + return Object.keys(target).filter(function(key) { + // GHSA-gcqx-w48m-w2h4: assignment of __proto__ sets the destination's prototype. + return key !== '__proto__' + }).concat(getEnumerableOwnPropertySymbols(target)) + } + + function propertyIsOnObject(object, property) { + try { + return property in object + } catch(_) { + return false + } + } + + // Protects from prototype poisoning and unexpected merging up the prototype chain. + function propertyIsUnsafe(target, key) { + return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet, + && !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain, + && Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable. + } + + function mergeObject(target, source, options) { + var destination = {}; + if (options.isMergeableObject(target)) { + getKeys(target).forEach(function(key) { + destination[key] = cloneUnlessOtherwiseSpecified(target[key], options); + }); + } + getKeys(source).forEach(function(key) { + if (propertyIsUnsafe(target, key)) { + return + } + + if (propertyIsOnObject(target, key) && options.isMergeableObject(source[key])) { + destination[key] = getMergeFunction(key, options)(target[key], source[key], options); + } else { + destination[key] = cloneUnlessOtherwiseSpecified(source[key], options); + } + }); + return destination + } + + function deepmerge(target, source, options) { + options = options || {}; + options.arrayMerge = options.arrayMerge || defaultArrayMerge; + options.isMergeableObject = options.isMergeableObject || isMergeableObject; + // cloneUnlessOtherwiseSpecified is added to `options` so that custom arrayMerge() + // implementations can use it. The caller may not replace it. + options.cloneUnlessOtherwiseSpecified = cloneUnlessOtherwiseSpecified; + + var sourceIsArray = Array.isArray(source); + var targetIsArray = Array.isArray(target); + var sourceAndTargetTypesMatch = sourceIsArray === targetIsArray; + + if (!sourceAndTargetTypesMatch) { + return cloneUnlessOtherwiseSpecified(source, options) + } else if (sourceIsArray) { + return options.arrayMerge(target, source, options) + } else { + return mergeObject(target, source, options) + } + } + + deepmerge.all = function deepmergeAll(array, options) { + if (!Array.isArray(array)) { + throw new Error('first argument should be an array') + } + + return array.reduce(function(prev, next) { + return deepmerge(prev, next, options) + }, {}) + }; + + var deepmerge_1 = deepmerge; + + return deepmerge_1; + +})); diff --git a/packages/deepmerge/index.d.ts b/packages/deepmerge/index.d.ts new file mode 100644 index 00000000..46784de5 --- /dev/null +++ b/packages/deepmerge/index.d.ts @@ -0,0 +1,20 @@ +declare function deepmerge(x: Partial, y: Partial, options?: deepmerge.Options): T; +declare function deepmerge(x: Partial, y: Partial, options?: deepmerge.Options): T1 & T2; + +declare namespace deepmerge { + export interface Options { + arrayMerge?(target: any[], source: any[], options?: ArrayMergeOptions): any[]; + clone?: boolean; + customMerge?: (key: string, options?: Options) => ((x: any, y: any) => any) | undefined; + isMergeableObject?(value: object): boolean; + } + export interface ArrayMergeOptions { + isMergeableObject(value: object): boolean; + cloneUnlessOtherwiseSpecified(value: object, options?: Options): object; + } + + export function all (objects: object[], options?: Options): object; + export function all (objects: Partial[], options?: Options): T; +} + +export = deepmerge; diff --git a/packages/deepmerge/index.js b/packages/deepmerge/index.js new file mode 100644 index 00000000..761adc4a --- /dev/null +++ b/packages/deepmerge/index.js @@ -0,0 +1,109 @@ +var defaultIsMergeableObject = require('is-mergeable-object') + +function emptyTarget(val) { + return Array.isArray(val) ? [] : {} +} + +function cloneUnlessOtherwiseSpecified(value, options) { + return (options.clone !== false && options.isMergeableObject(value)) + ? deepmerge(emptyTarget(value), value, options) + : value +} + +function defaultArrayMerge(target, source, options) { + return target.concat(source).map(function(element) { + return cloneUnlessOtherwiseSpecified(element, options) + }) +} + +function getMergeFunction(key, options) { + if (!options.customMerge) { + return deepmerge + } + var customMerge = options.customMerge(key) + return typeof customMerge === 'function' ? customMerge : deepmerge +} + +function getEnumerableOwnPropertySymbols(target) { + return Object.getOwnPropertySymbols + ? Object.getOwnPropertySymbols(target).filter(function(symbol) { + return Object.propertyIsEnumerable.call(target, symbol) + }) + : [] +} + +function getKeys(target) { + return Object.keys(target).filter(function(key) { + // GHSA-gcqx-w48m-w2h4: assignment of __proto__ sets the destination's prototype. + return key !== '__proto__' + }).concat(getEnumerableOwnPropertySymbols(target)) +} + +function propertyIsOnObject(object, property) { + try { + return property in object + } catch(_) { + return false + } +} + +// Protects from prototype poisoning and unexpected merging up the prototype chain. +function propertyIsUnsafe(target, key) { + return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet, + && !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain, + && Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable. +} + +function mergeObject(target, source, options) { + var destination = {} + if (options.isMergeableObject(target)) { + getKeys(target).forEach(function(key) { + destination[key] = cloneUnlessOtherwiseSpecified(target[key], options) + }) + } + getKeys(source).forEach(function(key) { + if (propertyIsUnsafe(target, key)) { + return + } + + if (propertyIsOnObject(target, key) && options.isMergeableObject(source[key])) { + destination[key] = getMergeFunction(key, options)(target[key], source[key], options) + } else { + destination[key] = cloneUnlessOtherwiseSpecified(source[key], options) + } + }) + return destination +} + +function deepmerge(target, source, options) { + options = options || {} + options.arrayMerge = options.arrayMerge || defaultArrayMerge + options.isMergeableObject = options.isMergeableObject || defaultIsMergeableObject + // cloneUnlessOtherwiseSpecified is added to `options` so that custom arrayMerge() + // implementations can use it. The caller may not replace it. + options.cloneUnlessOtherwiseSpecified = cloneUnlessOtherwiseSpecified + + var sourceIsArray = Array.isArray(source) + var targetIsArray = Array.isArray(target) + var sourceAndTargetTypesMatch = sourceIsArray === targetIsArray + + if (!sourceAndTargetTypesMatch) { + return cloneUnlessOtherwiseSpecified(source, options) + } else if (sourceIsArray) { + return options.arrayMerge(target, source, options) + } else { + return mergeObject(target, source, options) + } +} + +deepmerge.all = function deepmergeAll(array, options) { + if (!Array.isArray(array)) { + throw new Error('first argument should be an array') + } + + return array.reduce(function(prev, next) { + return deepmerge(prev, next, options) + }, {}) +} + +module.exports = deepmerge diff --git a/packages/deepmerge/license.txt b/packages/deepmerge/license.txt new file mode 100644 index 00000000..50030787 --- /dev/null +++ b/packages/deepmerge/license.txt @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2012 James Halliday, Josh Duff, and other contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/packages/deepmerge/package.json b/packages/deepmerge/package.json new file mode 100644 index 00000000..cdf19bad --- /dev/null +++ b/packages/deepmerge/package.json @@ -0,0 +1,11 @@ +{ + "name": "deepmerge", + "version": "4.3.2", + "description": "deepmerge 4.3.1 with __proto__ keys dropped (GHSA-gcqx-w48m-w2h4). Upstream has no patched release.", + "main": "dist/cjs.js", + "types": "index.d.ts", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } +}