chore(deps): update dependency glob to v11.1.0

node_modules/glob/dist/commonjs/has-magic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"has-magic.d.ts","sourceRoot":"","sources":["../../src/has-magic.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEvC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,YACV,MAAM,GAAG,MAAM,EAAE,YACjB,WAAW,KACnB,OAQF,CAAA"}
+{"version":3,"file":"has-magic.d.ts","sourceRoot":"","sources":["../../src/has-magic.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEvC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,GACnB,SAAS,MAAM,GAAG,MAAM,EAAE,EAC1B,UAAS,WAAgB,KACxB,OAQF,CAAA"}

node_modules/glob/dist/commonjs/index.d.ts

@@ -91,7 +91,7 @@ export declare const glob: typeof glob_ & {
     iterateSync: typeof globIterateSync;
     Glob: typeof Glob;
     hasMagic: (pattern: string | string[], options?: GlobOptions) => boolean;
-    escape: (s: string, { windowsPathsNoEscape, }?: Pick<import("minimatch").MinimatchOptions, "windowsPathsNoEscape">) => string;
-    unescape: (s: string, { windowsPathsNoEscape, }?: Pick<import("minimatch").MinimatchOptions, "windowsPathsNoEscape">) => string;
+    escape: (s: string, { windowsPathsNoEscape, magicalBraces, }?: Pick<import("minimatch").MinimatchOptions, "windowsPathsNoEscape" | "magicalBraces">) => string;
+    unescape: (s: string, { windowsPathsNoEscape, magicalBraces, }?: Pick<import("minimatch").MinimatchOptions, "windowsPathsNoEscape" | "magicalBraces">) => string;
 };
 //# sourceMappingURL=index.d.ts.map

node_modules/glob/dist/esm/bin.mjs

@@ -3,7 +3,7 @@ import { foregroundChild } from 'foreground-child';
 import { existsSync } from 'fs';
 import { jack } from 'jackspeak';
 import { loadPackageJson } from 'package-json-from-dist';
-import { join } from 'path';
+import { basename, join } from 'path';
 import { globStream } from './index.js';
 const { version } = loadPackageJson(import.meta.url, '../package.json');
 const j = jack({
@@ -30,6 +30,50 @@ const j = jack({
         description: `If no positional arguments are provided, glob will use
                     this pattern`,
     },
+})
+    .flag({
+    shell: {
+        default: false,
+        description: `Interpret the command as a shell command by passing it
+                    to the shell, with all matched filesystem paths appended,
+                    **even if this cannot be done safely**.
+
+                    This is **not** unsafe (and usually unnecessary) when using
+                    the known Unix shells sh, bash, zsh, and fish, as these can
+                    all be executed in such a way as to pass positional
+                    arguments safely.
+
+                    **Note**: THIS IS UNSAFE IF THE FILE PATHS ARE UNTRUSTED,
+                    because a path like \`'some/path/\\$\\(cmd)'\` will be
+                    executed by the shell.
+
+                    If you do have positional arguments that you wish to pass to
+                    the command ahead of the glob pattern matches, use the
+                    \`--cmd-arg\`/\`-g\` option instead.
+
+                    The next major release of glob will fully remove the ability
+                    to use this option unsafely.`,
+    },
+})
+    .optList({
+    'cmd-arg': {
+        short: 'g',
+        hint: 'arg',
+        default: [],
+        description: `Pass the provided values to the supplied command, ahead of
+                    the glob matches.
+
+                    For example, the command:
+
+                        glob -c echo -g"hello" -g"world" *.txt
+
+                    might output:
+
+                        hello world a.txt b.txt
+
+                    This is a safer (and future-proof) alternative than putting
+                    positional arguments in the \`-c\`/\`--cmd\` option.`,
+    },
 })
     .flag({
     all: {
@@ -74,7 +118,7 @@ const j = jack({
         description: `Always resolve to posix style paths, using '/' as the
                     directory separator, even on Windows. Drive letter
                     absolute matches on Windows will be expanded to their
-                    full resolved UNC maths, eg instead of 'C:\\foo\\bar',
+                    full resolved UNC paths, eg instead of 'C:\\foo\\bar',
                     it will expand to '//?/C:/foo/bar'.
       `,
     },
@@ -220,52 +264,78 @@ const j = jack({
 });
 try {
     const { positionals, values } = j.parse();
-    if (values.version) {
+    const { cmd, shell, all, default: def, version: showVersion, help, absolute, cwd, dot, 'dot-relative': dotRelative, follow, ignore, 'match-base': matchBase, 'max-depth': maxDepth, mark, nobrace, nocase, nodir, noext, noglobstar, platform, realpath, root, stat, debug, posix, 'cmd-arg': cmdArg, } = values;
+    if (showVersion) {
         console.log(version);
         process.exit(0);
     }
-    if (values.help) {
+    if (help) {
         console.log(j.usage());
         process.exit(0);
     }
-    if (positionals.length === 0 && !values.default)
+    //const { shell, help } = values
+    if (positionals.length === 0 && !def)
         throw 'No patterns provided';
-    if (positionals.length === 0 && values.default)
-        positionals.push(values.default);
-    const patterns = values.all ? positionals : positionals.filter(p => !existsSync(p));
-    const matches = values.all ?
-        []
-        : positionals.filter(p => existsSync(p)).map(p => join(p));
+    if (positionals.length === 0 && def)
+        positionals.push(def);
+    const patterns = all ? positionals : positionals.filter(p => !existsSync(p));
+    const matches = all ? [] : positionals.filter(p => existsSync(p)).map(p => join(p));
     const stream = globStream(patterns, {
-        absolute: values.absolute,
-        cwd: values.cwd,
-        dot: values.dot,
-        dotRelative: values['dot-relative'],
-        follow: values.follow,
-        ignore: values.ignore,
-        mark: values.mark,
-        matchBase: values['match-base'],
-        maxDepth: values['max-depth'],
-        nobrace: values.nobrace,
-        nocase: values.nocase,
-        nodir: values.nodir,
-        noext: values.noext,
-        noglobstar: values.noglobstar,
-        platform: values.platform,
-        realpath: values.realpath,
-        root: values.root,
-        stat: values.stat,
-        debug: values.debug,
-        posix: values.posix,
+        absolute,
+        cwd,
+        dot,
+        dotRelative,
+        follow,
+        ignore,
+        mark,
+        matchBase,
+        maxDepth,
+        nobrace,
+        nocase,
+        nodir,
+        noext,
+        noglobstar,
+        platform: platform,
+        realpath,
+        root,
+        stat,
+        debug,
+        posix,
     });
-    const cmd = values.cmd;
     if (!cmd) {
         matches.forEach(m => console.log(m));
         stream.on('data', f => console.log(f));
     }
     else {
-        stream.on('data', f => matches.push(f));
-        stream.on('end', () => foregroundChild(cmd, matches, { shell: true }));
+        cmdArg.push(...matches);
+        stream.on('data', f => cmdArg.push(f));
+        // Attempt to support commands that contain spaces and otherwise require
+        // shell interpretation, but do NOT shell-interpret the arguments, to avoid
+        // injections via filenames. This affordance can only be done on known Unix
+        // shells, unfortunately.
+        //
+        // 'bash', ['-c', cmd + ' "$@"', 'bash', ...matches]
+        // 'zsh', ['-c', cmd + ' "$@"', 'zsh', ...matches]
+        // 'fish', ['-c', cmd + ' "$argv"', ...matches]
+        const { SHELL = 'unknown' } = process.env;
+        const shellBase = basename(SHELL);
+        const knownShells = ['sh', 'ksh', 'zsh', 'bash', 'fish'];
+        if ((shell || /[ "']/.test(cmd)) &&
+            knownShells.includes(shellBase)) {
+            const cmdWithArgs = `${cmd} "\$${shellBase === 'fish' ? 'argv' : '@'}"`;
+            if (shellBase !== 'fish') {
+                cmdArg.unshift(SHELL);
+            }
+            cmdArg.unshift('-c', cmdWithArgs);
+            stream.on('end', () => foregroundChild(SHELL, cmdArg));
+        }
+        else {
+            if (shell) {
+                process.emitWarning('The --shell option is unsafe, and will be removed. To pass ' +
+                    'positional arguments to the subprocess, use -g/--cmd-arg instead.', 'DeprecationWarning', 'GLOB_SHELL');
+            }
+            stream.on('end', () => foregroundChild(cmd, cmdArg, { shell }));
+        }
     }
 }
 catch (e) {

node_modules/glob/dist/esm/has-magic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"has-magic.d.ts","sourceRoot":"","sources":["../../src/has-magic.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEvC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,YACV,MAAM,GAAG,MAAM,EAAE,YACjB,WAAW,KACnB,OAQF,CAAA"}
+{"version":3,"file":"has-magic.d.ts","sourceRoot":"","sources":["../../src/has-magic.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEvC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,GACnB,SAAS,MAAM,GAAG,MAAM,EAAE,EAC1B,UAAS,WAAgB,KACxB,OAQF,CAAA"}

node_modules/glob/dist/esm/index.d.ts

@@ -91,7 +91,7 @@ export declare const glob: typeof glob_ & {
     iterateSync: typeof globIterateSync;
     Glob: typeof Glob;
     hasMagic: (pattern: string | string[], options?: GlobOptions) => boolean;
-    escape: (s: string, { windowsPathsNoEscape, }?: Pick<import("minimatch").MinimatchOptions, "windowsPathsNoEscape">) => string;
-    unescape: (s: string, { windowsPathsNoEscape, }?: Pick<import("minimatch").MinimatchOptions, "windowsPathsNoEscape">) => string;
+    escape: (s: string, { windowsPathsNoEscape, magicalBraces, }?: Pick<import("minimatch").MinimatchOptions, "windowsPathsNoEscape" | "magicalBraces">) => string;
+    unescape: (s: string, { windowsPathsNoEscape, magicalBraces, }?: Pick<import("minimatch").MinimatchOptions, "windowsPathsNoEscape" | "magicalBraces">) => string;
 };
 //# sourceMappingURL=index.d.ts.map