Fix vulns in dev deps with npm audit fix

node_modules/uglify-js/lib/ast.js

@@ -837,11 +837,10 @@ var AST_String = DEFNODE("String", "value quote", {
     }
 }, AST_Constant);
 
-var AST_Number = DEFNODE("Number", "value literal", {
+var AST_Number = DEFNODE("Number", "value", {
     $documentation: "A number literal",
     $propdoc: {
         value: "[number] the numeric value",
-        literal: "[string] numeric value as string (optional)"
     }
 }, AST_Constant);
 
@@ -980,6 +979,15 @@ TreeWalker.prototype = {
                 || p instanceof AST_Conditional
                 || p.tail_node() === self) {
                 self = p;
+            } else if (p instanceof AST_Return) {
+                var fn;
+                do {
+                    fn = this.parent(++i);
+                    if (!fn) return false;
+                } while (!(fn instanceof AST_Lambda));
+                if (fn.name) return false;
+                self = this.parent(++i);
+                if (!self || self.TYPE != "Call" || self.expression !== fn) return false;
             } else {
                 return false;
             }

node_modules/uglify-js/lib/minify.js

@@ -1,19 +1,39 @@
 "use strict";
 
-var to_ascii = typeof atob == "undefined" ? function(b64) {
-    return new Buffer(b64, "base64").toString();
-} : atob;
-var to_base64 = typeof btoa == "undefined" ? function(str) {
-    return new Buffer(str).toString("base64");
-} : btoa;
+var to_ascii, to_base64;
+if (typeof Buffer == "undefined") {
+    to_ascii = atob;
+    to_base64 = btoa;
+} else if (typeof Buffer.alloc == "undefined") {
+    to_ascii = function(b64) {
+        return new Buffer(b64, "base64").toString();
+    };
+    to_base64 = function(str) {
+        return new Buffer(str).toString("base64");
+    };
+} else {
+    to_ascii = function(b64) {
+        return Buffer.from(b64, "base64").toString();
+    };
+    to_base64 = function(str) {
+        return Buffer.from(str).toString("base64");
+    };
+}
 
-function read_source_map(name, code) {
-    var match = /\n\/\/# sourceMappingURL=data:application\/json(;.*?)?;base64,(\S+)\s*$/.exec(code);
-    if (!match) {
-        AST_Node.warn("inline source map not found: " + name);
-        return null;
+function read_source_map(name, toplevel) {
+    var comments = toplevel.end.comments_after;
+    for (var i = comments.length; --i >= 0;) {
+        var comment = comments[i];
+        if (comment.type != "comment1") break;
+        var match = /^# ([^\s=]+)=(\S+)\s*$/.exec(comment.value);
+        if (!match) break;
+        if (match[1] == "sourceMappingURL") {
+            match = /^data:application\/json(;.*?)?;base64,(\S+)$/.exec(match[2]);
+            if (!match) break;
+            return to_ascii(match[2]);
+        }
     }
-    return to_ascii(match[2]);
+    AST_Node.warn("inline source map not found: " + name);
 }
 
 function parse_source_map(content) {
@@ -134,10 +154,10 @@ function minify(files, options) {
             source_maps = source_map_content && Object.create(null);
             for (var name in files) if (HOP(files, name)) {
                 options.parse.filename = name;
-                options.parse.toplevel = parse(files[name], options.parse);
+                options.parse.toplevel = toplevel = parse(files[name], options.parse);
                 if (source_maps) {
                     if (source_map_content == "inline") {
-                        var inlined_content = read_source_map(name, files[name]);
+                        var inlined_content = read_source_map(name, toplevel);
                         if (inlined_content) {
                             source_maps[name] = parse_source_map(inlined_content);
                         }
@@ -146,7 +166,6 @@ function minify(files, options) {
                     }
                 }
             }
-            toplevel = options.parse.toplevel;
         }
         if (quoted_props) {
             reserve_quoted_keys(toplevel, quoted_props);

node_modules/uglify-js/lib/mozilla-ast.js

@@ -403,7 +403,7 @@
         var def = M.definition();
         return {
             type: "Identifier",
-            name: def ? def.mangled_name || def.name : M.name
+            name: def && def.mangled_name || M.name
         };
     });
 

node_modules/uglify-js/lib/output.js

@@ -91,13 +91,11 @@ function OutputStream(options) {
             comment_filter = function(comment) {
                 return comment.type != "comment5" && comments.test(comment.value);
             };
-        }
-        else if (typeof comments === "function") {
+        } else if (typeof comments === "function") {
             comment_filter = function(comment) {
                 return comment.type != "comment5" && comments(this, comment);
             };
-        }
-        else if (comments === "some") {
+        } else if (comments === "some") {
             comment_filter = is_some_comments;
         } else { // NOTE includes "all" option
             comment_filter = return_true;
@@ -136,8 +134,7 @@ function OutputStream(options) {
 
     function make_string(str, quote) {
         var dq = 0, sq = 0;
-        str = str.replace(/[\\\b\f\n\r\v\t\x22\x27\u2028\u2029\0\ufeff]/g,
-          function(s, i) {
+        str = str.replace(/[\\\b\f\n\r\v\t\x22\x27\u2028\u2029\0\ufeff]/g, function(s, i) {
             switch (s) {
               case '"': ++dq; return '"';
               case "'": ++sq; return "'";
@@ -453,7 +450,7 @@ function OutputStream(options) {
         var self = this;
         var scan = node instanceof AST_Exit && node.value;
         var comments = dump(node);
-        if (!comments) return;
+        if (!comments) comments = [];
 
         if (scan) {
             var tw = new TreeWalker(function(node) {
@@ -599,7 +596,6 @@ function OutputStream(options) {
             }
             print(encoded);
         },
-        encode_string   : encode_string,
         next_indent     : next_indent,
         with_indent     : with_indent,
         with_block      : with_block,
@@ -645,8 +641,7 @@ function OutputStream(options) {
         var self = this, generator = self._codegen;
         if (self instanceof AST_Scope) {
             active_scope = self;
-        }
-        else if (!use_asm && self instanceof AST_Directive && self.value == "use asm") {
+        } else if (!use_asm && self instanceof AST_Directive && self.value == "use asm") {
             use_asm = active_scope;
         }
         function doit() {
@@ -1045,11 +1040,9 @@ function OutputStream(options) {
                     return;
                 }
                 b = b.alternative;
-            }
-            else if (b instanceof AST_StatementWithBody) {
+            } else if (b instanceof AST_StatementWithBody) {
                 b = b.body;
-            }
-            else break;
+            } else break;
         }
         force_statement(self.body, output);
     }
@@ -1357,7 +1350,7 @@ function OutputStream(options) {
     });
     DEFPRINT(AST_Symbol, function(self, output) {
         var def = self.definition();
-        output.print_name(def ? def.mangled_name || def.name : self.name);
+        output.print_name(def && def.mangled_name || self.name);
     });
     DEFPRINT(AST_Hole, noop);
     DEFPRINT(AST_This, function(self, output) {
@@ -1383,8 +1376,27 @@ function OutputStream(options) {
         if (regexp.raw_source) {
             str = "/" + regexp.raw_source + str.slice(str.lastIndexOf("/"));
         }
-        str = output.to_utf8(str);
-        output.print(str);
+        output.print(output.to_utf8(str).replace(/\\(?:\0(?![0-9])|[^\0])/g, function(seq) {
+            switch (seq[1]) {
+              case "\n": return "\\n";
+              case "\r": return "\\r";
+              case "\t": return "\t";
+              case "\b": return "\b";
+              case "\f": return "\f";
+              case "\0": return "\0";
+              case "\x0B": return "\v";
+              case "\u2028": return "\\u2028";
+              case "\u2029": return "\\u2029";
+              default: return seq;
+            }
+        }).replace(/[\n\r\u2028\u2029]/g, function(c) {
+            switch (c) {
+              case "\n": return "\\n";
+              case "\r": return "\\r";
+              case "\u2028": return "\\u2028";
+              case "\u2029": return "\\u2029";
+            }
+        }));
         var p = output.parent();
         if (p instanceof AST_Binary && /^in/.test(p.operator) && p.left === self)
             output.print(" ");

node_modules/uglify-js/lib/parse.js

@@ -234,6 +234,7 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
         directives      : {},
         directive_stack : []
     };
+    var prev_was_dot = false;
 
     function peek() {
         return S.text.charAt(S.pos);
@@ -286,16 +287,12 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
         S.tokpos = S.pos;
     }
 
-    var prev_was_dot = false;
     function token(type, value, is_comment) {
-        S.regex_allowed = ((type == "operator" && !UNARY_POSTFIX[value]) ||
-                           (type == "keyword" && KEYWORDS_BEFORE_EXPRESSION[value]) ||
-                           (type == "punc" && PUNC_BEFORE_EXPRESSION[value]));
-        if (type == "punc" && value == ".") {
-            prev_was_dot = true;
-        } else if (!is_comment) {
-            prev_was_dot = false;
-        }
+        S.regex_allowed = type == "operator" && !UNARY_POSTFIX[value]
+            || type == "keyword" && KEYWORDS_BEFORE_EXPRESSION[value]
+            || type == "punc" && PUNC_BEFORE_EXPRESSION[value];
+        if (type == "punc" && value == ".") prev_was_dot = true;
+        else if (!is_comment) prev_was_dot = false;
         var ret = {
             type    : type,
             value   : value,
@@ -358,11 +355,8 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
             parse_error("Legacy octal literals are not allowed in strict mode");
         }
         var valid = parse_js_number(num);
-        if (!isNaN(valid)) {
-            return token("num", valid);
-        } else {
-            parse_error("Invalid syntax: " + num);
-        }
+        if (!isNaN(valid)) return token("num", valid);
+        parse_error("Invalid syntax: " + num);
     }
 
     function read_escaped_char(in_string) {
@@ -463,8 +457,7 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
                 if (ch == "\\") escaped = backslash = true, next();
                 else if (is_identifier_char(ch)) name += next();
                 else break;
-            }
-            else {
+            } else {
                 if (ch != "u") parse_error("Expecting UnicodeEscapeSequence -- uXXXX");
                 ch = read_escaped_char();
                 if (!is_identifier_char(ch)) parse_error("Unicode char: " + ch.charCodeAt(0) + " is not valid in identifier");
@@ -538,9 +531,7 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
 
     function handle_dot() {
         next();
-        return is_digit(peek().charCodeAt(0))
-            ? read_num(".")
-            : token("punc", ".");
+        return is_digit(peek().charCodeAt(0)) ? read_num(".") : token("punc", ".");
     }
 
     function read_word() {
@@ -592,11 +583,10 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
             switch (code) {
               case 34: case 39: return read_string(ch);
               case 46: return handle_dot();
-              case 47: {
-                  var tok = handle_slash();
-                  if (tok === next_token) continue;
-                  return tok;
-              }
+              case 47:
+                var tok = handle_slash();
+                if (tok === next_token) continue;
+                return tok;
             }
             if (is_digit(code)) return read_num();
             if (PUNC_CHARS[ch]) return token("punc", next());
@@ -614,12 +604,8 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
 
     next_token.add_directive = function(directive) {
         S.directive_stack[S.directive_stack.length - 1].push(directive);
-
-        if (S.directives[directive] === undefined) {
-            S.directives[directive] = 1;
-        } else {
-            S.directives[directive]++;
-        }
+        if (S.directives[directive]) S.directives[directive]++;
+        else S.directives[directive] = 1;
     }
 
     next_token.push_directives_stack = function() {
@@ -627,13 +613,10 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
     }
 
     next_token.pop_directives_stack = function() {
-        var directives = S.directive_stack[S.directive_stack.length - 1];
-
-        for (var i = 0; i < directives.length; i++) {
+        var directives = S.directive_stack.pop();
+        for (var i = directives.length; --i >= 0;) {
             S.directives[directives[i]]--;
         }
-
-        S.directive_stack.pop();
     }
 
     next_token.has_directive = function(directive) {
@@ -645,27 +628,17 @@ function tokenizer($TEXT, filename, html5_comments, shebang) {
 
 /* -----[ Parser (constants) ]----- */
 
-var UNARY_PREFIX = makePredicate([
-    "typeof",
-    "void",
-    "delete",
-    "--",
-    "++",
-    "!",
-    "~",
-    "-",
-    "+"
-]);
+var UNARY_PREFIX = makePredicate("typeof void delete -- ++ ! ~ - +");
 
-var UNARY_POSTFIX = makePredicate([ "--", "++" ]);
+var UNARY_POSTFIX = makePredicate("-- ++");
 
-var ASSIGNMENT = makePredicate([ "=", "+=", "-=", "/=", "*=", "%=", ">>=", "<<=", ">>>=", "|=", "^=", "&=" ]);
+var ASSIGNMENT = makePredicate("= += -= /= *= %= >>= <<= >>>= |= ^= &=");
 
 var PRECEDENCE = function(a, ret) {
-    for (var i = 0; i < a.length; ++i) {
-        var b = a[i];
-        for (var j = 0; j < b.length; ++j) {
-            ret[b[j]] = i + 1;
+    for (var i = 0; i < a.length;) {
+        var b = a[i++];
+        for (var j = 0; j < b.length; j++) {
+            ret[b[j]] = i;
         }
     }
     return ret;
@@ -682,7 +655,7 @@ var PRECEDENCE = function(a, ret) {
     ["*", "/", "%"]
 ], {});
 
-var ATOMIC_START_TOKEN = makePredicate([ "atom", "num", "string", "regexp", "name" ]);
+var ATOMIC_START_TOKEN = makePredicate("atom num string regexp name");
 
 /* -----[ Parser ]----- */
 
@@ -698,10 +671,9 @@ function parse($TEXT, options) {
     }, true);
 
     var S = {
-        input         : (typeof $TEXT == "string"
-                         ? tokenizer($TEXT, options.filename,
-                                     options.html5_comments, options.shebang)
-                         : $TEXT),
+        input         : typeof $TEXT == "string"
+                        ? tokenizer($TEXT, options.filename, options.html5_comments, options.shebang)
+                        : $TEXT,
         token         : null,
         prev          : null,
         peeked        : null,
@@ -757,15 +729,12 @@ function parse($TEXT, options) {
     }
 
     function unexpected(token) {
-        if (token == null)
-            token = S.token;
+        if (token == null) token = S.token;
         token_error(token, "Unexpected token: " + token_to_string(token.type, token.value));
     }
 
     function expect_token(type, val) {
-        if (is(type, val)) {
-            return next();
-        }
+        if (is(type, val)) return next();
         token_error(S.token, "Unexpected token: " + token_to_string(S.token.type, S.token.value) + ", expected: " + token_to_string(type, val));
     }
 
@@ -1284,6 +1253,7 @@ function parse($TEXT, options) {
                 var ex = expression(true);
                 var len = start.comments_before.length;
                 [].unshift.apply(ex.start.comments_before, start.comments_before);
+                start.comments_before.length = 0;
                 start.comments_before = ex.start.comments_before;
                 start.comments_before_length = len;
                 if (len == 0 && start.comments_before.length > 0) {
@@ -1299,6 +1269,7 @@ function parse($TEXT, options) {
                 var end = prev();
                 end.comments_before = ex.end.comments_before;
                 [].push.apply(ex.end.comments_after, end.comments_after);
+                end.comments_after.length = 0;
                 end.comments_after = ex.end.comments_after;
                 ex.end = end;
                 if (ex instanceof AST_Call) mark_pure(ex);

node_modules/uglify-js/lib/scope.js

@@ -55,6 +55,7 @@ function SymbolDef(scope, orig, init) {
     this.mangled_name = null;
     this.undeclared = false;
     this.id = SymbolDef.next_id++;
+    this.lambda = orig instanceof AST_SymbolLambda;
 }
 
 SymbolDef.next_id = 1;
@@ -191,13 +192,21 @@ AST_Toplevel.DEFMETHOD("figure_out_scope", function(options) {
     // pass 3: fix up any scoping issue with IE8
     if (options.ie8) self.walk(new TreeWalker(function(node) {
         if (node instanceof AST_SymbolCatch) {
-            redefine(node, node.thedef.defun);
+            var scope = node.thedef.defun;
+            if (scope.name instanceof AST_SymbolLambda && scope.name.name == node.name) {
+                scope = scope.parent_scope.resolve();
+            }
+            redefine(node, scope);
             return true;
         }
         if (node instanceof AST_SymbolLambda) {
             var def = node.thedef;
-            redefine(node, node.scope.parent_scope);
-            node.thedef.init = def.init;
+            redefine(node, node.scope.parent_scope.resolve());
+            if (typeof node.thedef.init !== "undefined") {
+                node.thedef.init = false;
+            } else if (def.init) {
+                node.thedef.init = def.init;
+            }
             return true;
         }
     }));
@@ -205,11 +214,19 @@ AST_Toplevel.DEFMETHOD("figure_out_scope", function(options) {
     function redefine(node, scope) {
         var name = node.name;
         var old_def = node.thedef;
-        var new_def = scope.find_variable(name) || self.globals.get(name) || scope.def_variable(node);
+        var new_def = scope.find_variable(name);
+        if (new_def) {
+            var redef;
+            while (redef = new_def.redefined()) new_def = redef;
+        } else {
+            new_def = self.globals.get(name) || scope.def_variable(node);
+        }
         old_def.orig.concat(old_def.references).forEach(function(node) {
             node.thedef = new_def;
             node.reference(options);
         });
+        if (old_def.lambda) new_def.lambda = true;
+        if (new_def.undeclared) self.variables.set(name, new_def);
     }
 });
 
@@ -281,9 +298,7 @@ AST_Scope.DEFMETHOD("def_variable", function(symbol, init) {
     var def = this.variables.get(symbol.name);
     if (def) {
         def.orig.push(symbol);
-        if (def.init && (def.scope !== symbol.scope || def.init instanceof AST_Function)) {
-            def.init = init;
-        }
+        if (def.init instanceof AST_Function) def.init = init;
     } else {
         def = new SymbolDef(this, symbol, init);
         this.variables.set(symbol.name, def);
@@ -413,7 +428,9 @@ AST_Toplevel.DEFMETHOD("mangle_names", function(options) {
             if (options.cache && node instanceof AST_Toplevel) {
                 node.globals.each(mangle);
             }
-            node.variables.each(mangle);
+            node.variables.each(function(def) {
+                if (!defer_redef(def)) mangle(def);
+            });
             return true;
         }
         if (node instanceof AST_Label) {
@@ -426,22 +443,11 @@ AST_Toplevel.DEFMETHOD("mangle_names", function(options) {
         }
         if (!options.ie8 && node instanceof AST_Catch) {
             var def = node.argname.definition();
-            var redef = def.redefined();
-            if (redef) {
-                redefined.push(def);
-                reference(node.argname);
-                def.references.forEach(reference);
-            }
+            var redef = defer_redef(def, node.argname);
             descend();
             if (!redef) mangle(def);
             return true;
         }
-
-        function reference(sym) {
-            sym.thedef = redef;
-            sym.reference(options);
-            sym.thedef = def;
-        }
     });
     this.walk(tw);
     redefined.forEach(mangle);
@@ -450,6 +456,21 @@ AST_Toplevel.DEFMETHOD("mangle_names", function(options) {
         if (options.reserved.has[def.name]) return;
         def.mangle(options);
     }
+
+    function defer_redef(def, node) {
+        var redef = def.redefined();
+        if (!redef) return false;
+        redefined.push(def);
+        def.references.forEach(reference);
+        if (node) reference(node);
+        return true;
+
+        function reference(sym) {
+            sym.thedef = redef;
+            sym.reference(options);
+            sym.thedef = def;
+        }
+    }
 });
 
 AST_Toplevel.DEFMETHOD("find_colliding_names", function(options) {
@@ -499,13 +520,14 @@ AST_Toplevel.DEFMETHOD("expand_names", function(options) {
         if (def.global && options.cache) return;
         if (def.unmangleable(options)) return;
         if (options.reserved.has[def.name]) return;
-        var d = def.redefined();
-        def.name = d ? d.name : next_name();
+        var redef = def.redefined();
+        var name = redef ? redef.rename || redef.name : next_name();
+        def.rename = name;
         def.orig.forEach(function(sym) {
-            sym.name = def.name;
+            sym.name = name;
         });
         def.references.forEach(function(sym) {
-            sym.name = def.name;
+            sym.name = name;
         });
     }
 });

node_modules/uglify-js/lib/utils.js

@@ -127,8 +127,7 @@ var MAP = (function() {
                 } else {
                     top.push(val);
                 }
-            }
-            else if (val !== skip) {
+            } else if (val !== skip) {
                 if (val instanceof Splice) {
                     ret.push.apply(ret, backwards ? val.v.slice().reverse() : val.v);
                 } else {
@@ -145,8 +144,7 @@ var MAP = (function() {
             } else {
                 for (i = 0; i < a.length; ++i) if (doit()) break;
             }
-        }
-        else {
+        } else {
             for (i in a) if (HOP(a, i)) if (doit()) break;
         }
         return top.concat(ret);