chore(deps): update dependency path-to-regexp@>=0.2.0 <1.9.0 to v8 #1447
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
[puLL-Merge] - pillarjs/path-to-regexp@v1.9.0..v8.0.0 Diffdiff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..23c96d7
--- /dev/null
+++ .github/workflows/ci.yml
@@ -0,0 +1,31 @@
+name: CI
+on:
+ - push
+ - pull_request
+permissions:
+ contents: read
+jobs:
+ test:
+ name: Node.js ${{ matrix.node-version }}
+ runs-on: ubuntu-latest
+ strategy:
+ matrix:
+ node-version:
+ - "16"
+ - "*"
+ steps:
+ - uses: actions/checkout@v2
+ - uses: actions/setup-node@v1
+ with:
+ node-version: ${{ matrix.node-version }}
+ - uses: actions/cache@v2
+ with:
+ path: ~/.npm
+ key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+ restore-keys: |
+ ${{ runner.os }}-node-
+ - run: npm ci
+ - run: npm test
+ - uses: codecov/codecov-action@v1
+ with:
+ name: Node.js ${{ matrix.node-version }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 0000000..5fcb48c
--- /dev/null
+++ .github/workflows/scorecard.yml
@@ -0,0 +1,74 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+
+on:
+ # For Branch-Protection check. Only the default branch is supported. See
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+ branch_protection_rule:
+ # To guarantee Maintained check is occasionally updated. See
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+ schedule:
+ - cron: "16 21 * * 1"
+ push:
+ branches: ["master"]
+
+# Declare default permissions as read only.
+permissions:
+ contents: read
+
+jobs:
+ analysis:
+ name: Scorecard analysis
+ runs-on: ubuntu-latest
+ permissions:
+ # Needed to upload the results to code-scanning dashboard.
+ security-events: write
+ # Needed to publish results and get a badge (see publish_results below).
+ id-token: write
+ # Uncomment the permissions below if installing in a private repository.
+ # contents: read
+ # actions: read
+
+ steps:
+ - name: "Checkout code"
+ uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2
+ with:
+ persist-credentials: false
+
+ - name: "Run analysis"
+ uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+ with:
+ results_file: results.sarif
+ results_format: sarif
+ # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+ # - you want to enable the Branch-Protection check on a *public* repository, or
+ # - you are installing Scorecard on a *private* repository
+ # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+ # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+ # Public repositories:
+ # - Publish results to OpenSSF REST API for easy access by consumers
+ # - Allows the repository to include the Scorecard badge.
+ # - See https://github.com/ossf/scorecard-action#publishing-results.
+ # For private repositories:
+ # - `publish_results` will always be set to `false`, regardless
+ # of the value entered here.
+ publish_results: true
+
+ # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+ # format to the repository Actions tab.
+ - name: "Upload artifact"
+ uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+ with:
+ name: SARIF file
+ path: results.sarif
+ retention-days: 5
+
+ # Upload the results to GitHub's code scanning dashboard.
+ - name: "Upload to code-scanning"
+ uses: github/codeql-action/upload-sarif@2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f # v2.23.2
+ with:
+ sarif_file: results.sarif
diff --git .gitignore .gitignore
index d1c46d7..6352b21 100644
--- .gitignore
+++ .gitignore
@@ -1,4 +1,5 @@
-node_modules
-coverage
-components
-typings
\ No newline at end of file
+.vscode/
+node_modules/
+coverage/
+dist/
+dist.es2015/
diff --git .travis.yml .travis.yml
deleted file mode 100644
index 716f9d7..0000000
--- .travis.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-language: node_js
-
-node_js:
- - "0.10"
- - "0.12"
- - "4.0"
- - "4.1"
-
-after_script: "npm install coveralls@2 && cat ./coverage/lcov.info | coveralls"
diff --git History.md History.md
index abe4a65..fedbb81 100644
--- History.md
+++ History.md
@@ -1,158 +1,171 @@
-1.7.0 / 2016-11-08
-==================
+# Moved to [GitHub Releases](https://github.com/pillarjs/path-to-regexp/releases)
- * Allow a `delimiter` option to be passed in with `tokensToRegExp` which will be used for "non-ending" token match situations
+## 3.0.0 / 2019-01-13
-1.6.0 / 2016-10-03
-==================
+- Always use prefix character as delimiter token, allowing any character to be a delimiter (e.g. `/:att1-:att2-:att3-:att4-:att5`)
+- Remove `partial` support, prefer escaping the prefix delimiter explicitly (e.g. `\\/(apple-)?icon-:res(\\d+).png`)
- * Populate `RegExp.keys` when using the `tokensToRegExp` method (making it consistent with the main export)
- * Allow a `delimiter` option to be passed in with `parse`
- * Updated TypeScript definition with `Keys` and `Options` updated
+## 2.4.0 / 2018-08-26
-1.5.3 / 2016-06-15
-==================
+- Support `start` option to disable anchoring from beginning of the string
- * Add `\\` to the ignore character group to avoid backtracking on mismatched parens
+## 2.3.0 / 2018-08-20
-1.5.2 / 2016-06-15
-==================
+- Use `delimiter` when processing repeated matching groups (e.g. `foo/bar` has no prefix, but has a delimiter)
- * Escape `\\` in string segments of regexp
+## 2.2.1 / 2018-04-24
-1.5.1 / 2016-06-08
-==================
+- Allow empty string with `end: false` to match both relative and absolute paths
- * Add `index.d.ts` to NPM package
+## 2.2.0 / 2018-03-06
-1.5.0 / 2016-05-20
-==================
+- Pass `token` as second argument to `encode` option (e.g. `encode(value, token)`)
- * Handle partial token segments (better)
- * Allow compile to handle asterisk token segments
+## 2.1.0 / 2017-10-20
-1.4.0 / 2016-05-18
-==================
+- Handle non-ending paths where the final character is a delimiter
+ - E.g. `/foo/` before required either `/foo/` or `/foo//` to match in non-ending mode
- * Handle RegExp unions in path matching groups
+## 2.0.0 / 2017-08-23
-1.3.0 / 2016-05-08
-==================
+- New option! Ability to set `endsWith` to match paths like `/test?query=string` up to the query string
+- New option! Set `delimiters` for specific characters to be treated as parameter prefixes (e.g. `/:test`)
+- Remove `isarray` dependency
+- Explicitly handle trailing delimiters instead of trimming them (e.g. `/test/` is now treated as `/test/` instead of `/test` when matching)
+- Remove overloaded `keys` argument that accepted `options`
+- Remove `keys` list attached to the `RegExp` output
+- Remove asterisk functionality (it's a real pain to properly encode)
+- Change `tokensToFunction` (e.g. `compile`) to accept an `encode` function for pretty encoding (e.g. pass your own implementation)
- * Clarify README language and named parameter token support
- * Support advanced Closure Compiler with type annotations
- * Add pretty paths options to compiled function output
- * Add TypeScript definition to project
- * Improved prefix handling with non-complete segment parameters (E.g. `/:foo?-bar`)
+## 1.7.0 / 2016-11-08
-1.2.1 / 2015-08-17
-==================
+- Allow a `delimiter` option to be passed in with `tokensToRegExp` which will be used for "non-ending" token match situations
- * Encode values before validation with path compilation function
- * More examples of using compilation in README
+## 1.6.0 / 2016-10-03
-1.2.0 / 2015-05-20
-==================
+- Populate `RegExp.keys` when using the `tokensToRegExp` method (making it consistent with the main export)
+- Allow a `delimiter` option to be passed in with `parse`
+- Updated TypeScript definition with `Keys` and `Options` updated
- * Add support for matching an asterisk (`*`) as an unnamed match everything group (`(.*)`)
+## 1.5.3 / 2016-06-15
-1.1.1 / 2015-05-11
-==================
+- Add `\\` to the ignore character group to avoid backtracking on mismatched parens
- * Expose methods for working with path tokens
+## 1.5.2 / 2016-06-15
-1.1.0 / 2015-05-09
-==================
+- Escape `\\` in string segments of regexp
- * Expose the parser implementation to consumers
- * Implement a compiler function to generate valid strings
- * Huge refactor of tests to be more DRY and cover new parse and compile functions
- * Use chai in tests
- * Add .editorconfig
+## 1.5.1 / 2016-06-08
-1.0.3 / 2015-01-17
-==================
+- Add `index.d.ts` to NPM package
- * Optimised function runtime
- * Added `files` to `package.json`
+## 1.5.0 / 2016-05-20
-1.0.2 / 2014-12-17
-==================
+- Handle partial token segments (better)
+- Allow compile to handle asterisk token segments
- * Use `Array.isArray` shim
- * Remove ES5 incompatible code
- * Fixed repository path
- * Added new readme badges
+## 1.4.0 / 2016-05-18
-1.0.1 / 2014-08-27
-==================
+- Handle RegExp unions in path matching groups
- * Ensure installation works correctly on 0.8
+## 1.3.0 / 2016-05-08
-1.0.0 / 2014-08-17
-==================
+- Clarify README language and named parameter token support
+- Support advanced Closure Compiler with type annotations
+- Add pretty paths options to compiled function output
+- Add TypeScript definition to project
+- Improved prefix handling with non-complete segment parameters (E.g. `/:foo?-bar`)
- * No more API changes
+## 1.2.1 / 2015-08-17
-0.2.5 / 2014-08-07
-==================
+- Encode values before validation with path compilation function
+- More examples of using compilation in README
- * Allow keys parameter to be omitted
+## 1.2.0 / 2015-05-20
-0.2.4 / 2014-08-02
-==================
+- Add support for matching an asterisk (`*`) as an unnamed match everything group (`(.*)`)
- * Code coverage badge
- * Updated readme
- * Attach keys to the generated regexp
+## 1.1.1 / 2015-05-11
-0.2.3 / 2014-07-09
-==================
+- Expose methods for working with path tokens
- * Add MIT license
+## 1.1.0 / 2015-05-09
-0.2.2 / 2014-07-06
-==================
+- Expose the parser implementation to consumers
+- Implement a compiler function to generate valid strings
+- Huge refactor of tests to be more DRY and cover new parse and compile functions
+- Use chai in tests
+- Add .editorconfig
- * A passed in trailing slash in non-strict mode will become optional
- * In non-end mode, the optional trailing slash will only match at the end
+## 1.0.3 / 2015-01-17
-0.2.1 / 2014-06-11
-==================
+- Optimised function runtime
+- Added `files` to `package.json`
- * Fixed a major capturing group regexp regression
+## 1.0.2 / 2014-12-17
-0.2.0 / 2014-06-09
-==================
+- Use `Array.isArray` shim
+- Remove ES5 incompatible code
+- Fixed repository path
+- Added new readme badges
- * Improved support for arrays
- * Improved support for regexps
- * Better support for non-ending strict mode matches with a trailing slash
- * Travis CI support
- * Block using regexp special characters in the path
- * Removed support for the asterisk to match all
- * New support for parameter suffixes - `*`, `+` and `?`
- * Updated readme
- * Provide delimiter information with keys array
+## 1.0.1 / 2014-08-27
-0.1.2 / 2014-03-10
-==================
+- Ensure installation works correctly on 0.8
- * Move testing dependencies to `devDependencies`
+## 1.0.0 / 2014-08-17
-0.1.1 / 2014-03-10
-==================
+- No more API changes
- * Match entire substring with `options.end`
- * Properly handle ending and non-ending matches
+## 0.2.5 / 2014-08-07
-0.1.0 / 2014-03-06
-==================
+- Allow keys parameter to be omitted
- * Add `options.end`
+## 0.2.4 / 2014-08-02
-0.0.2 / 2013-02-10
-==================
+- Code coverage badge
+- Updated readme
+- Attach keys to the generated regexp
- * Update to match current express
- * Add .license property to component.json
+## 0.2.3 / 2014-07-09
+
+- Add MIT license
+
+## 0.2.2 / 2014-07-06
+
+- A passed in trailing slash in non-strict mode will become optional
+- In non-end mode, the optional trailing slash will only match at the end
+
+## 0.2.1 / 2014-06-11
+
+- Fixed a major capturing group regexp regression
+
+## 0.2.0 / 2014-06-09
+
+- Improved support for arrays
+- Improved support for regexps
+- Better support for non-ending strict mode matches with a trailing slash
+- Travis CI support
+- Block using regexp special characters in the path
+- Removed support for the asterisk to match all
+- New support for parameter suffixes - `*`, `+` and `?`
+- Updated readme
+- Provide delimiter information with keys array
+
+## 0.1.2 / 2014-03-10
+
+- Move testing dependencies to `devDependencies`
+
+## 0.1.1 / 2014-03-10
+
+- Match entire substring with `options.end`
+- Properly handle ending and non-ending matches
+
+## 0.1.0 / 2014-03-06
+
+- Add `options.end`
+
+## 0.0.2 / 2013-02-10
+
+- Update to match current express
+- Add .license property to component.json
diff --git Readme.md Readme.md
index 379ecf4..263c0f7 100644
--- Readme.md
+++ Readme.md
@@ -1,13 +1,12 @@
# Path-to-RegExp
-> Turn an Express-style path string such as `/user/:name` into a regular expression.
+> Turn a path string such as `/user/:name` into a regular expression.
[![NPM version][npm-image]][npm-url]
-[![Build status][travis-image]][travis-url]
-[![Test coverage][coveralls-image]][coveralls-url]
-[![Dependency Status][david-image]][david-url]
+[![NPM downloads][downloads-image]][downloads-url]
+[![Build status][build-image]][build-url]
+[![Build coverage][coverage-image]][coverage-url]
[![License][license-image]][license-url]
-[![Downloads][downloads-image]][downloads-url]
## Installation
@@ -17,241 +16,171 @@ npm install path-to-regexp --save
## Usage
-\`\`\`javascript
-var pathToRegexp = require('path-to-regexp')
-
-// pathToRegexp(path, keys, options)
-// pathToRegexp.parse(path)
-// pathToRegexp.compile(path)
-```
+```js
+const { match, compile, parse } = require("path-to-regexp");
-- **path** An Express-style string, an array of strings, or a regular expression.
-- **keys** An array to be populated with the keys found in the path.
-- **options**
- - **sensitive** When `true` the route will be case sensitive. (default: `false`)
- - **strict** When `false` the trailing slash is optional. (default: `false`)
- - **end** When `false` the path will match at the beginning. (default: `true`)
- - **delimiter** Set the default delimiter for repeat parameters. (default: `'/'`)
-
-```javascript
-var keys = []
-var re = pathToRegexp('/foo/:bar', keys)
-// re = /^\/foo\/([^\/]+?)\/?$/i
-// keys = [{ name: 'bar', prefix: '/', delimiter: '/', optional: false, repeat: false, pattern: '[^\\/]+?' }]
+// match(path, options?)
+// compile(path, options?)
+// parse(path, options?)-Please note: The
|
|
Closing as this will re-introduce the bug fixed by #1444. Will take another look at how to stop renovate fiddling with overrides when I get a chance - this introduces bugs and should be used to avoid vulns only. |
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^1.9.0->^8.0.0](https://renovatebot.com/diffs/npm/path-to-regexp@>=0.2.0 <1.9.0/1.9.0/8.2.0)Release Notes
pillarjs/path-to-regexp (path-to-regexp@>=0.2.0 <1.9.0)
v8.2.0: 8.2.0Compare Source
Fixed
path-to-regexpto run on older browsers by targeting ES20155969033sflag from regexp51dbd45v8.1.0Compare Source
Added
pathToRegexpmethod back for generating a regexstringifymethod for convertingTokenDatainto a path stringv8.0.0: Simpler APICompare Source
Heads up! This is a fairly large change (again) and I need to apologize in advance. If I foresaw what this version would have ended up being I would not have released version 7. A longer blog post and explanation will be incoming this week, but the pivot has been due to work on Express.js v5 and this will the finalized syntax used in Express moving forward.
Edit: The post is out - https://blakeembrey.com/posts/2024-09-web-redos/
Added
*namesyntax, aligns with:behavior but using an asterisk insteadChanged
?,+, and*- only optional exists moving forward (use wildcards for+,{*foo}for*)Added
:"foo-bar"string | TokenData | Array<string | TokenData>Removed
loosemodev7.2.0: Support array inputs (again)Compare Source
Added
matchandpathToRegexp3fdd88fv7.1.0: Strict modeCompare Source
Added
strictoption to detect potential ReDOS issuesFixed
suffix + prefixwhen not specifiedTokenDataTokenDatamanually, previouslyparsefilled it in automaticallyComments
strict: trueand I'm probably releasing a V8 with it enabled by default ASAP as a necessary security mitigationv7.0.0: Wildcard, unicode, and modifier changesCompare Source
Hi all! There's a few major breaking changes in this release so read carefully.
Breaking changes:
compileonly accepts strings as values (i.e. no numbers, useString(value)before compiling a path)encode !== false, it must be an array of strings\p{XID_Continue}).?,*,+) must be used after a param explicitly wrapped in{}/or.*) has been added back and matches Express.js expected behaviorendsWithoptionstrict: truetotrailing: false;,,,!, and@for future use-casestokensToRegexp,tokensToFunctionandregexpToFunctionin favor of simplifying exports/can be repeated multiple times in a matched path (i.e./fooworks like//foo, etc)encodeanddecodeno longer receive the token as the second parameterencodeURIComponentand decode defaults todecodeURIComponentAdded:
encodePathto fix an issue aroundencodebeing used for both path and parameters (the path and parameter should be encoded slightly differently)looseas an option to support arbitrarily matching the delimiter in paths, e.g.foo/barandfoo///barshould work the sameencodeanddecodeto be set tofalsewhich skips all processing of the parameters input/outputTokenData(exported, returned byparse) as inputRequests for feedback:
{}is an obvious drawback but I'm seeking feedback on whether it helps make path behavior clearer/and.as implicit prefixesv6.3.0: Fix backtracking in 6.xCompare Source
Fixed
f1253b4v6.2.2: Updated READMECompare Source
No API changes. Documentation only release.
Changed
c7ec332e828000v6.2.1: Fix matching:name*parameterCompare Source
Fixed
:name*parameter (#261)762bc6b86baef8Added
ae9e57677df638b39edd4v6.2.0: Named Capturing GroupsCompare Source
Added
Fixed
strictflag documentation (#227)v6.1.0: Use `/#?` as Default DelimiterCompare Source
Fixed
/#?as default delimiter to avoid matching on query or fragment parametersdelimiter: '.'v6.0.0: Custom Prefix and Suffix GroupsCompare Source
This release reverts the prefix behavior added in v3 back to the behavior seen in v2. For the most part, path matching is backward compatible with v2 with these enhancements:
/(abc(?=d))/{abc(.*)def}/test(foopreviously worked treating(as a literal character, now it expects(to be closed and is treated as a group/test\(fooChanged
prefixesoption to configure this (starts as/.which acts like every version since 0.x again){}to capture prefix/suffix explicitly, enables custom use-cases like/:attr1{-:attr2}?v5.0.0: Remove Default Encode URI ComponentCompare Source
No changes to path rules since 3.x, except support for nested RegEx parts in 4.x.
Changed
RegexpOptionsinterface toTokensToRegexpOptionsnormalizePathnamefrom library, document solution in READMEencodeURIComponentv4.0.5: Decode URICompare Source
Removed
whitelistin favor ofdecodeURI(advanced behavior can happen outsidepath-to-regexp)v4.0.4: RemoveString#normalizeCompare Source
Fixed
String.prototype.normalizeto continue supporting IEv4.0.3: Normalize Path WhitelistCompare Source
Added
/%.-)v4.0.2: AllowRegexpOptionsinmatchCompare Source
Fixed
RegexpOptionsinmatch(...)functionv4.0.1: Fix Spelling of RegexpCompare Source
Fixed
regexpspelling across 4.xv4.0.0: ES2015 Package for BundlersCompare Source
All path rules are backward compatible with 3.x, except for nested
()and other RegEx special characters that were previously ignored.Changed
matchdoes not default todecodeURIComponentAdded
normalizePathnameutility for supporting unicode paths in librariesv3.3.0: Add backtracking protectionCompare Source
Fixed
d31670av3.2.0: Match FunctionCompare Source
Added
matchfunction to libraryv3.1.0: Validate and sensitive optionsCompare Source
sensitiveoption fortokensToFunction(#191)validateoption to path functions (#178)v3.0.0Compare Source
/:att1-:att2-:att3-:att4-:att5)partialsupport, prefer escaping the prefix delimiter explicitly (e.g.\\/(apple-)?icon-:res(\\d+).png)v2.4.0Compare Source
startoption to disable anchoring from beginning of the stringv2.3.0Compare Source
delimiterwhen processing repeated matching groups (e.g.foo/barhas no prefix, but has a delimiter)v2.2.1Compare Source
end: falseto match both relative and absolute pathsv2.2.0Compare Source
tokenas second argument toencodeoption (e.g.encode(value, token))v2.1.0Compare Source
/foo/before required either/foo/or/foo//to match in non-ending modev2.0.0Compare Source
endsWithto match paths like/test?query=stringup to the query stringdelimitersfor specific characters to be treated as parameter prefixes (e.g./:test)isarraydependency/test/is now treated as/test/instead of/testwhen matching)keysargument that acceptedoptionskeyslist attached to theRegExpoutputtokensToFunction(e.g.compile) to accept anencodefunction for pretty encoding (e.g. pass your own implementation)Configuration
📅 Schedule: Branch creation - "* 0-12 * * 3" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.