search

firebase / superstatic

Superstatic: a static file server for fancy apps.
MIT License
1.1k stars 81 forks source link

Bump path-to-regexp from 1.8.0 to 7.1.0 #474

Closed dependabot[bot] closed 1 week ago

dependabot[bot] commented 2 months ago

Bumps path-to-regexp from 1.8.0 to 7.1.0.

Release notes

Sourced from path-to-regexp's releases.

Strict mode

Added

  • Adds a strict option to detect potential ReDOS issues

Fixed

  • Fixes separator to default to suffix + prefix when not specified
  • Allows separator to be undefined in TokenData
    • This is only relevant if you are building TokenData manually, previously parse filled it in automatically

Comments

  • I highly recommend enabling strict: true and I'm probably releasing a V8 with it enabled by default ASAP as a necessary security mitigation

https://github.com/pillarjs/path-to-regexp/compare/v7.0.0...v7.1.0

Wildcard, unicode, and modifier changes

Hi all! There's a few major breaking changes in this release so read carefully.

Breaking changes:

  • The function returned by compile only accepts strings as values (i.e. no numbers, use String(value) before compiling a path)
    • For repeated values, when encode !== false, it must be an array of strings
  • Parameter names can contain all unicode identifier characters (defined as regex \p{XID_Continue}).
  • Modifiers (?, *, +) must be used after a param explicitly wrapped in {}
    • No more implied prefix of / or .
  • No support for arrays or regexes as inputs
  • The wildcard (standalone *) has been added back and matches Express.js expected behavior
  • Removed endsWith option
  • Renamed strict: true to trailing: false
  • Reserved ;, ,, !, and @ for future use-cases
  • Removed tokensToRegexp, tokensToFunction and regexpToFunction in favor of simplifying exports
  • Enable a "loose" mode by default, so / can be repeated multiple times in a matched path (i.e. /foo works like //foo, etc)
  • encode and decode no longer receive the token as the second parameter
  • Removed the ESM + CommonJS dual package in favor of only one CommonJS supported export
  • Minimum JS support for ES2020 (previous ES2015)
  • Encode defaults to encodeURIComponent and decode defaults to decodeURIComponent

Added:

  • Adds encodePath to fix an issue around encode being used for both path and parameters (the path and parameter should be encoded slightly differently)
  • Adds loose as an option to support arbitrarily matching the delimiter in paths, e.g. foo/bar and foo///bar should work the same
  • Allow encode and decode to be set to false which skips all processing of the parameters input/output
  • All remaining methods support TokenData (exported, returned by parse) as input
    • This should be useful if you are programmatically building paths to match or want to avoid parsing multiple times

Requests for feedback:

  • Requiring {} is an obvious drawback but I'm seeking feedback on whether it helps make path behavior clearer

... (truncated)

Changelog

Sourced from path-to-regexp's changelog.

Moved to GitHub Releases

3.0.0 / 2019-01-13

  • Always use prefix character as delimiter token, allowing any character to be a delimiter (e.g. /:att1-:att2-:att3-:att4-:att5)
  • Remove partial support, prefer escaping the prefix delimiter explicitly (e.g. \\/(apple-)?icon-:res(\\d+).png)

2.4.0 / 2018-08-26

  • Support start option to disable anchoring from beginning of the string

2.3.0 / 2018-08-20

  • Use delimiter when processing repeated matching groups (e.g. foo/bar has no prefix, but has a delimiter)

2.2.1 / 2018-04-24

  • Allow empty string with end: false to match both relative and absolute paths

2.2.0 / 2018-03-06

  • Pass token as second argument to encode option (e.g. encode(value, token))

2.1.0 / 2017-10-20

  • Handle non-ending paths where the final character is a delimiter
    • E.g. /foo/ before required either /foo/ or /foo// to match in non-ending mode

2.0.0 / 2017-08-23

  • New option! Ability to set endsWith to match paths like /test?query=string up to the query string
  • New option! Set delimiters for specific characters to be treated as parameter prefixes (e.g. /:test)
  • Remove isarray dependency
  • Explicitly handle trailing delimiters instead of trimming them (e.g. /test/ is now treated as /test/ instead of /test when matching)
  • Remove overloaded keys argument that accepted options
  • Remove keys list attached to the RegExp output
  • Remove asterisk functionality (it's a real pain to properly encode)
  • Change tokensToFunction (e.g. compile) to accept an encode function for pretty encoding (e.g. pass your own implementation)

1.7.0 / 2016-11-08

  • Allow a delimiter option to be passed in with tokensToRegExp which will be used for "non-ending" token match situations

1.6.0 / 2016-10-03

  • Populate RegExp.keys when using the tokensToRegExp method (making it consistent with the main export)
  • Allow a delimiter option to be passed in with parse
  • Updated TypeScript definition with Keys and Options updated

1.5.3 / 2016-06-15

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 1 week ago

Superseded by #475.