update node_modules

node_modules/.package-lock.json

@@ -21,12 +21,12 @@
             }
         },
         "node_modules/accepts": {
-            "version": "1.3.7",
+            "version": "1.3.8",
-            "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.7.tgz",
+            "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
-            "integrity": "sha512-Il80Qs2WjYlJIBNzNkK6KYqlVMTbZLXgHx2oT0pU/fjRHyEp+PEfEPY0R3WCwAGVOtauxh1hOxNgIf5bv7dQpA==",
+            "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
             "dependencies": {
-                "mime-types": "~2.1.24",
+                "mime-types": "~2.1.34",
-                "negotiator": "0.6.2"
+                "negotiator": "0.6.3"
             },
             "engines": {
                 "node": ">= 0.6"
@@ -61,21 +61,26 @@
                 "node": ">= 0.8"
             }
         },
+        "node_modules/basic-auth/node_modules/safe-buffer": {
+            "version": "5.1.2",
+            "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+            "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+        },
         "node_modules/body-parser": {
-            "version": "1.19.0",
+            "version": "1.19.2",
-            "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.0.tgz",
+            "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.19.2.tgz",
-            "integrity": "sha512-dhEPs72UPbDnAQJ9ZKMNTP6ptJaionhP5cBb541nXPlW60Jepo9RV/a4fX4XWW9CuFNK22krhrj1+rgzifNCsw==",
+            "integrity": "sha512-SAAwOxgoCKMGs9uUAUFHygfLAyaniaoun6I8mFY9pRAJL9+Kec34aU+oIjDhTycub1jozEfEwx1W1IuOYxVSFw==",
             "dependencies": {
-                "bytes": "3.1.0",
+                "bytes": "3.1.2",
                 "content-type": "~1.0.4",
                 "debug": "2.6.9",
                 "depd": "~1.1.2",
-                "http-errors": "1.7.2",
+                "http-errors": "1.8.1",
                 "iconv-lite": "0.4.24",
                 "on-finished": "~2.3.0",
-                "qs": "6.7.0",
+                "qs": "6.9.7",
-                "raw-body": "2.4.0",
+                "raw-body": "2.4.3",
-                "type-is": "~1.6.17"
+                "type-is": "~1.6.18"
             },
             "engines": {
                 "node": ">= 0.8"
@@ -91,9 +96,9 @@
             }
         },
         "node_modules/bytes": {
-            "version": "3.1.0",
+            "version": "3.1.2",
-            "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
+            "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
-            "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg==",
+            "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
             "engines": {
                 "node": ">= 0.8"
             }
@@ -104,11 +109,11 @@
             "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s="
         },
         "node_modules/content-disposition": {
-            "version": "0.5.3",
+            "version": "0.5.4",
-            "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.3.tgz",
+            "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
-            "integrity": "sha512-ExO0774ikEObIAEV9kDo50o+79VCUdEB6n6lzKgGwupcVeRlhrj3qGAfwq8G6uBJjkqLrhT0qEYFcWng8z1z0g==",
+            "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
             "dependencies": {
-                "safe-buffer": "5.1.2"
+                "safe-buffer": "5.2.1"
             },
             "engines": {
                 "node": ">= 0.6"
@@ -123,9 +128,9 @@
             }
         },
         "node_modules/cookie": {
-            "version": "0.4.0",
+            "version": "0.4.2",
-            "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.0.tgz",
+            "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.2.tgz",
-            "integrity": "sha512-+Hp8fLp57wnUSt0tY0tHEXh4voZRDnoIrZPqlo3DPiI4y9lwg/jqx+1Om94/W6ZaPDOUbnjOt/99w66zk+l1Xg==",
+            "integrity": "sha512-aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA==",
             "engines": {
                 "node": ">= 0.6"
             }
@@ -197,16 +202,16 @@
             }
         },
         "node_modules/express": {
-            "version": "4.17.1",
+            "version": "4.17.3",
-            "resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz",
+            "resolved": "https://registry.npmjs.org/express/-/express-4.17.3.tgz",
-            "integrity": "sha512-mHJ9O79RqluphRrcw2X/GTh3k9tVv8YcoyY4Kkh4WDMUYKRZUq0h1o0w2rrrxBqM7VoeUVqgb27xlEMXTnYt4g==",
+            "integrity": "sha512-yuSQpz5I+Ch7gFrPCk4/c+dIBKlQUxtgwqzph132bsT6qhuzss6I8cLJQz7B3rFblzd6wtcI0ZbGltH/C4LjUg==",
             "dependencies": {
-                "accepts": "~1.3.7",
+                "accepts": "~1.3.8",
                 "array-flatten": "1.1.1",
-                "body-parser": "1.19.0",
+                "body-parser": "1.19.2",
-                "content-disposition": "0.5.3",
+                "content-disposition": "0.5.4",
                 "content-type": "~1.0.4",
-                "cookie": "0.4.0",
+                "cookie": "0.4.2",
                 "cookie-signature": "1.0.6",
                 "debug": "2.6.9",
                 "depd": "~1.1.2",
@@ -220,13 +225,13 @@
                 "on-finished": "~2.3.0",
                 "parseurl": "~1.3.3",
                 "path-to-regexp": "0.1.7",
-                "proxy-addr": "~2.0.5",
+                "proxy-addr": "~2.0.7",
-                "qs": "6.7.0",
+                "qs": "6.9.7",
                 "range-parser": "~1.2.1",
-                "safe-buffer": "5.1.2",
+                "safe-buffer": "5.2.1",
-                "send": "0.17.1",
+                "send": "0.17.2",
-                "serve-static": "1.14.1",
+                "serve-static": "1.14.2",
-                "setprototypeof": "1.1.1",
+                "setprototypeof": "1.2.0",
                 "statuses": "~1.5.0",
                 "type-is": "~1.6.18",
                 "utils-merge": "1.0.1",
@@ -237,12 +242,12 @@
             }
         },
         "node_modules/express-handlebars": {
-            "version": "5.3.4",
+            "version": "5.3.5",
-            "resolved": "https://registry.npmjs.org/express-handlebars/-/express-handlebars-5.3.4.tgz",
+            "resolved": "https://registry.npmjs.org/express-handlebars/-/express-handlebars-5.3.5.tgz",
-            "integrity": "sha512-b36grfkbXZItLLQV6cwzA20o6Zg4Eckke3PjHF4EGQIQLGs5IPMjpAxepdGb45A/bECekXzA9STzNqvEgrdRPw==",
+            "integrity": "sha512-r9pzDc94ZNJ7FVvtsxLfPybmN0eFAUnR61oimNPRpD0D7nkLcezrkpZzoXS5TI75wYHRbflPLTU39B62pwB4DA==",
             "dependencies": {
                 "glob": "^7.2.0",
-                "graceful-fs": "^4.2.7",
+                "graceful-fs": "^4.2.8",
                 "handlebars": "^4.7.7"
             },
             "engines": {
@@ -326,9 +331,9 @@
             }
         },
         "node_modules/graceful-fs": {
-            "version": "4.2.8",
+            "version": "4.2.9",
-            "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.8.tgz",
+            "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.9.tgz",
-            "integrity": "sha512-qkIilPUYcNhJpd33n0GBXTB1MMPp14TxEsEs0pTrsSVucApsYzW5V+Q8Qxhik6KU3evy+qkAAowTByymK0avdg=="
+            "integrity": "sha512-NtNxqUcXgpW2iMrfqSfR73Glt39K+BLwWsPs94yR63v45T0Wbej7eRmL5cWfwEgqXnmjQp3zaJTshdRW/qC2ZQ=="
         },
         "node_modules/handlebars": {
             "version": "4.7.7",
@@ -351,15 +356,15 @@
             }
         },
         "node_modules/http-errors": {
-            "version": "1.7.2",
+            "version": "1.8.1",
-            "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.7.2.tgz",
+            "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
-            "integrity": "sha512-uUQBt3H/cSIVfch6i1EuPNy/YsRSOUBXTVfZ+yR7Zjez3qjBz6i9+i4zjNaoqcoFVI4lQJ5plg63TvGfRSDCRg==",
+            "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
             "dependencies": {
                 "depd": "~1.1.2",
-                "inherits": "2.0.3",
+                "inherits": "2.0.4",
-                "setprototypeof": "1.1.1",
+                "setprototypeof": "1.2.0",
                 "statuses": ">= 1.5.0 < 2",
-                "toidentifier": "1.0.0"
+                "toidentifier": "1.0.1"
             },
             "engines": {
                 "node": ">= 0.6"
@@ -386,9 +391,9 @@
             }
         },
         "node_modules/inherits": {
-            "version": "2.0.3",
+            "version": "2.0.4",
-            "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
+            "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-            "integrity": "sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4="
+            "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
         },
         "node_modules/ipaddr.js": {
             "version": "1.9.1",
@@ -431,28 +436,28 @@
             }
         },
         "node_modules/mime-db": {
-            "version": "1.50.0",
+            "version": "1.52.0",
-            "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.50.0.tgz",
+            "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
-            "integrity": "sha512-9tMZCDlYHqeERXEHO9f/hKfNXhre5dK2eE/krIvUjZbS2KPcqGDfNShIWS1uW9XOTKQKqK6qbeOci18rbfW77A==",
+            "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
             "engines": {
                 "node": ">= 0.6"
             }
         },
         "node_modules/mime-types": {
-            "version": "2.1.33",
+            "version": "2.1.35",
-            "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.33.tgz",
+            "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-            "integrity": "sha512-plLElXp7pRDd0bNZHw+nMd52vRYjLwQjygaNg7ddJ2uJtTlmnTCjWuPKxVu6//AdaRuME84SvLW91sIkBqGT0g==",
+            "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
             "dependencies": {
-                "mime-db": "1.50.0"
+                "mime-db": "1.52.0"
             },
             "engines": {
                 "node": ">= 0.6"
             }
         },
         "node_modules/minimatch": {
-            "version": "3.0.4",
+            "version": "3.1.2",
-            "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
+            "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-            "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
+            "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
             "dependencies": {
                 "brace-expansion": "^1.1.7"
             },
@@ -494,9 +499,9 @@
             "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g="
         },
         "node_modules/negotiator": {
-            "version": "0.6.2",
+            "version": "0.6.3",
-            "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.2.tgz",
+            "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
-            "integrity": "sha512-hZXc7K2e+PgeI1eDBe/10Ard4ekbfrrqG8Ep+8Jmf4JID2bNg7NvCPOZN+kfF574pFQI7mum2AUqDidoKqcTOw==",
+            "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
             "engines": {
                 "node": ">= 0.6"
             }
@@ -567,11 +572,14 @@
             }
         },
         "node_modules/qs": {
-            "version": "6.7.0",
+            "version": "6.9.7",
-            "resolved": "https://registry.npmjs.org/qs/-/qs-6.7.0.tgz",
+            "resolved": "https://registry.npmjs.org/qs/-/qs-6.9.7.tgz",
-            "integrity": "sha512-VCdBRNFTX1fyE7Nb6FYoURo/SPe62QCaAyzJvUjwRaIsc+NePBEniHlvxFmmX56+HZphIGtV0XeCirBtpDrTyQ==",
+            "integrity": "sha512-IhMFgUmuNpyRfxA90umL7ByLlgRXu6tIfKPpF5TmcfRLlLCckfP/g3IQmju6jjpu+Hh8rA+2p6A27ZSPOOHdKw==",
             "engines": {
                 "node": ">=0.6"
+            },
+            "funding": {
+                "url": "https://github.com/sponsors/ljharb"
             }
         },
         "node_modules/range-parser": {
@@ -583,12 +591,12 @@
             }
         },
         "node_modules/raw-body": {
-            "version": "2.4.0",
+            "version": "2.4.3",
-            "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.0.tgz",
+            "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.4.3.tgz",
-            "integrity": "sha512-4Oz8DUIwdvoa5qMJelxipzi/iJIi40O5cGV1wNYp5hvZP8ZN0T+jiNkL0QepXs+EsQ9XJ8ipEDoiH70ySUJP3Q==",
+            "integrity": "sha512-UlTNLIcu0uzb4D2f4WltY6cVjLi+/jEN4lgEUj3E04tpMDpUlkBo/eSn6zou9hum2VMNpCCUone0O0WeJim07g==",
             "dependencies": {
-                "bytes": "3.1.0",
+                "bytes": "3.1.2",
-                "http-errors": "1.7.2",
+                "http-errors": "1.8.1",
                 "iconv-lite": "0.4.24",
                 "unpipe": "1.0.0"
             },
@@ -597,9 +605,23 @@
             }
         },
         "node_modules/safe-buffer": {
-            "version": "5.1.2",
+            "version": "5.2.1",
-            "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+            "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-            "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+            "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+            "funding": [
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/feross"
+                },
+                {
+                    "type": "patreon",
+                    "url": "https://www.patreon.com/feross"
+                },
+                {
+                    "type": "consulting",
+                    "url": "https://feross.org/support"
+                }
+            ]
         },
         "node_modules/safer-buffer": {
             "version": "2.1.2",
@@ -607,9 +629,9 @@
             "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
         },
         "node_modules/send": {
-            "version": "0.17.1",
+            "version": "0.17.2",
-            "resolved": "https://registry.npmjs.org/send/-/send-0.17.1.tgz",
+            "resolved": "https://registry.npmjs.org/send/-/send-0.17.2.tgz",
-            "integrity": "sha512-BsVKsiGcQMFwT8UxypobUKyv7irCNRHk1T0G680vk88yf6LBByGcZJOTJCrTP2xVN6yI+XjPJcNuE3V4fT9sAg==",
+            "integrity": "sha512-UJYB6wFSJE3G00nEivR5rgWp8c2xXvJ3OPWPhmuteU0IKj8nKbG3DrjiOmLwpnHGYWAVwA69zmTm++YG0Hmwww==",
             "dependencies": {
                 "debug": "2.6.9",
                 "depd": "~1.1.2",
@@ -618,9 +640,9 @@
                 "escape-html": "~1.0.3",
                 "etag": "~1.8.1",
                 "fresh": "0.5.2",
-                "http-errors": "~1.7.2",
+                "http-errors": "1.8.1",
                 "mime": "1.6.0",
-                "ms": "2.1.1",
+                "ms": "2.1.3",
                 "on-finished": "~2.3.0",
                 "range-parser": "~1.2.1",
                 "statuses": "~1.5.0"
@@ -630,28 +652,28 @@
             }
         },
         "node_modules/send/node_modules/ms": {
-            "version": "2.1.1",
+            "version": "2.1.3",
-            "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.1.tgz",
+            "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-            "integrity": "sha512-tgp+dl5cGk28utYktBsrFqA7HKgrhgPsg6Z/EfhWI4gl1Hwq8B/GmY/0oXZ6nF8hDVesS/FpnYaD/kOWhYQvyg=="
+            "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
         },
         "node_modules/serve-static": {
-            "version": "1.14.1",
+            "version": "1.14.2",
-            "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.1.tgz",
+            "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.14.2.tgz",
-            "integrity": "sha512-JMrvUwE54emCYWlTI+hGrGv5I8dEwmco/00EvkzIIsR7MqrHonbD9pO2MOfFnpFntl7ecpZs+3mW+XbQZu9QCg==",
+            "integrity": "sha512-+TMNA9AFxUEGuC0z2mevogSnn9MXKb4fa7ngeRMJaaGv8vTwnIEkKi+QGvPt33HSnf8pRS+WGM0EbMtCJLKMBQ==",
             "dependencies": {
                 "encodeurl": "~1.0.2",
                 "escape-html": "~1.0.3",
                 "parseurl": "~1.3.3",
-                "send": "0.17.1"
+                "send": "0.17.2"
             },
             "engines": {
                 "node": ">= 0.8.0"
             }
         },
         "node_modules/setprototypeof": {
-            "version": "1.1.1",
+            "version": "1.2.0",
-            "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.1.1.tgz",
+            "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
-            "integrity": "sha512-JvdAWfbXeIGaZ9cILp38HntZSFSo3mWg6xGcJJsd+d4aRMOqauag1C63dJfDw7OaMYwEbHMOxEZ1lqVRYP2OAw=="
+            "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
         },
         "node_modules/source-map": {
             "version": "0.6.1",
@@ -670,9 +692,9 @@
             }
         },
         "node_modules/toidentifier": {
-            "version": "1.0.0",
+            "version": "1.0.1",
-            "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.0.tgz",
+            "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
-            "integrity": "sha512-yaOH/Pk/VEhBWWTlhI+qXxDFXlejDGcQipMlyxda9nthulaxLZUNcUqFxokp0vcYnvteJln5FNQDRrxj3YcbVw==",
+            "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
             "engines": {
                 "node": ">=0.6"
             }
@@ -698,9 +720,9 @@
             }
         },
         "node_modules/uglify-js": {
-            "version": "3.14.2",
+            "version": "3.15.3",
-            "resolved": "https://registry.npmjs.org/uglify-js/-/uglify-js-3.14.2.tgz",
+            "resolved": "https://registry.npmjs.org/uglify-js/-/uglify-js-3.15.3.tgz",
-            "integrity": "sha512-rtPMlmcO4agTUfz10CbgJ1k6UAoXM2gWb3GoMPPZB/+/Ackf8lNWk11K4rYi2D0apgoFRLtQOZhb+/iGNJq26A==",
+            "integrity": "sha512-6iCVm2omGJbsu3JWac+p6kUiOpg3wFO2f8lIXjfEb8RrmLjzog1wTPMmwKB7swfzzqxj9YM+sGUM++u1qN4qJg==",
             "optional": true,
             "bin": {
                 "uglifyjs": "bin/uglifyjs"

node_modules/accepts/HISTORY.md

@@ -1,3 +1,10 @@
+1.3.8 / 2022-02-02
+==================
+
+  * deps: mime-types@~2.1.34
+    - deps: mime-db@~1.51.0
+  * deps: negotiator@0.6.3
+
 1.3.7 / 2019-04-29
 ==================
 

node_modules/accepts/README.md

@@ -3,7 +3,7 @@
 [![NPM Version][npm-version-image]][npm-url]
 [![NPM Downloads][npm-downloads-image]][npm-url]
 [![Node.js Version][node-version-image]][node-version-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][github-actions-ci-image]][github-actions-ci-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
 Higher level content negotiation based on [negotiator](https://www.npmjs.com/package/negotiator).
@@ -29,8 +29,6 @@ $ npm install accepts
 
 ## API
 
-<!-- eslint-disable no-unused-vars -->
-
 ```js
 var accepts = require('accepts')
 ```
@@ -133,10 +131,10 @@ curl -I -H'Accept: text/html' http://localhost:3000/
 
 [coveralls-image]: https://badgen.net/coveralls/c/github/jshttp/accepts/master
 [coveralls-url]: https://coveralls.io/r/jshttp/accepts?branch=master
+[github-actions-ci-image]: https://badgen.net/github/checks/jshttp/accepts/master?label=ci
+[github-actions-ci-url]: https://github.com/jshttp/accepts/actions/workflows/ci.yml
 [node-version-image]: https://badgen.net/npm/node/accepts
 [node-version-url]: https://nodejs.org/en/download
 [npm-downloads-image]: https://badgen.net/npm/dm/accepts
 [npm-url]: https://npmjs.org/package/accepts
 [npm-version-image]: https://badgen.net/npm/v/accepts
-[travis-image]: https://badgen.net/travis/jshttp/accepts/master
-[travis-url]: https://travis-ci.org/jshttp/accepts

node_modules/accepts/package.json

@@ -1,7 +1,7 @@
 {
   "name": "accepts",
   "description": "Higher-level content negotiation",
-  "version": "1.3.7",
+  "version": "1.3.8",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
@@ -9,20 +9,20 @@
   "license": "MIT",
   "repository": "jshttp/accepts",
   "dependencies": {
-    "mime-types": "~2.1.24",
+    "mime-types": "~2.1.34",
-    "negotiator": "0.6.2"
+    "negotiator": "0.6.3"
   },
   "devDependencies": {
     "deep-equal": "1.0.1",
-    "eslint": "5.16.0",
+    "eslint": "7.32.0",
-    "eslint-config-standard": "12.0.0",
+    "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.17.2",
+    "eslint-plugin-import": "2.25.4",
-    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-markdown": "2.2.1",
-    "eslint-plugin-node": "8.0.1",
+    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "4.1.1",
+    "eslint-plugin-promise": "4.3.1",
-    "eslint-plugin-standard": "4.0.0",
+    "eslint-plugin-standard": "4.1.0",
-    "mocha": "6.1.4",
+    "mocha": "9.2.0",
-    "nyc": "14.0.0"
+    "nyc": "15.1.0"
   },
   "files": [
     "LICENSE",
@@ -33,10 +33,10 @@
     "node": ">= 0.6"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md .",
+    "lint": "eslint .",
     "test": "mocha --reporter spec --check-leaks --bail test/",
-    "test-cov": "nyc --reporter=html --reporter=text npm test",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
-    "test-travis": "nyc --reporter=text npm test"
+    "test-cov": "nyc --reporter=html --reporter=text npm test"
   },
   "keywords": [
     "content",

node_modules/basic-auth/node_modules/safe-buffer/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) Feross Aboukhadijeh
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

node_modules/basic-auth/node_modules/safe-buffer/README.md

@@ -0,0 +1,584 @@
+# safe-buffer [![travis][travis-image]][travis-url] [![npm][npm-image]][npm-url] [![downloads][downloads-image]][downloads-url] [![javascript style guide][standard-image]][standard-url]
+
+[travis-image]: https://img.shields.io/travis/feross/safe-buffer/master.svg
+[travis-url]: https://travis-ci.org/feross/safe-buffer
+[npm-image]: https://img.shields.io/npm/v/safe-buffer.svg
+[npm-url]: https://npmjs.org/package/safe-buffer
+[downloads-image]: https://img.shields.io/npm/dm/safe-buffer.svg
+[downloads-url]: https://npmjs.org/package/safe-buffer
+[standard-image]: https://img.shields.io/badge/code_style-standard-brightgreen.svg
+[standard-url]: https://standardjs.com
+
+#### Safer Node.js Buffer API
+
+**Use the new Node.js Buffer APIs (`Buffer.from`, `Buffer.alloc`,
+`Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`) in all versions of Node.js.**
+
+**Uses the built-in implementation when available.**
+
+## install
+
+```
+npm install safe-buffer
+```
+
+## usage
+
+The goal of this package is to provide a safe replacement for the node.js `Buffer`.
+
+It's a drop-in replacement for `Buffer`. You can use it by adding one `require` line to
+the top of your node.js modules:
+
+```js
+var Buffer = require('safe-buffer').Buffer
+
+// Existing buffer code will continue to work without issues:
+
+new Buffer('hey', 'utf8')
+new Buffer([1, 2, 3], 'utf8')
+new Buffer(obj)
+new Buffer(16) // create an uninitialized buffer (potentially unsafe)
+
+// But you can use these new explicit APIs to make clear what you want:
+
+Buffer.from('hey', 'utf8') // convert from many types to a Buffer
+Buffer.alloc(16) // create a zero-filled buffer (safe)
+Buffer.allocUnsafe(16) // create an uninitialized buffer (potentially unsafe)
+```
+
+## api
+
+### Class Method: Buffer.from(array)
+<!-- YAML
+added: v3.0.0
+-->
+
+* `array` {Array}
+
+Allocates a new `Buffer` using an `array` of octets.
+
+```js
+const buf = Buffer.from([0x62,0x75,0x66,0x66,0x65,0x72]);
+  // creates a new Buffer containing ASCII bytes
+  // ['b','u','f','f','e','r']
+```
+
+A `TypeError` will be thrown if `array` is not an `Array`.
+
+### Class Method: Buffer.from(arrayBuffer[, byteOffset[, length]])
+<!-- YAML
+added: v5.10.0
+-->
+
+* `arrayBuffer` {ArrayBuffer} The `.buffer` property of a `TypedArray` or
+  a `new ArrayBuffer()`
+* `byteOffset` {Number} Default: `0`
+* `length` {Number} Default: `arrayBuffer.length - byteOffset`
+
+When passed a reference to the `.buffer` property of a `TypedArray` instance,
+the newly created `Buffer` will share the same allocated memory as the
+TypedArray.
+
+```js
+const arr = new Uint16Array(2);
+arr[0] = 5000;
+arr[1] = 4000;
+
+const buf = Buffer.from(arr.buffer); // shares the memory with arr;
+
+console.log(buf);
+  // Prints: <Buffer 88 13 a0 0f>
+
+// changing the TypedArray changes the Buffer also
+arr[1] = 6000;
+
+console.log(buf);
+  // Prints: <Buffer 88 13 70 17>
+```
+
+The optional `byteOffset` and `length` arguments specify a memory range within
+the `arrayBuffer` that will be shared by the `Buffer`.
+
+```js
+const ab = new ArrayBuffer(10);
+const buf = Buffer.from(ab, 0, 2);
+console.log(buf.length);
+  // Prints: 2
+```
+
+A `TypeError` will be thrown if `arrayBuffer` is not an `ArrayBuffer`.
+
+### Class Method: Buffer.from(buffer)
+<!-- YAML
+added: v3.0.0
+-->
+
+* `buffer` {Buffer}
+
+Copies the passed `buffer` data onto a new `Buffer` instance.
+
+```js
+const buf1 = Buffer.from('buffer');
+const buf2 = Buffer.from(buf1);
+
+buf1[0] = 0x61;
+console.log(buf1.toString());
+  // 'auffer'
+console.log(buf2.toString());
+  // 'buffer' (copy is not changed)
+```
+
+A `TypeError` will be thrown if `buffer` is not a `Buffer`.
+
+### Class Method: Buffer.from(str[, encoding])
+<!-- YAML
+added: v5.10.0
+-->
+
+* `str` {String} String to encode.
+* `encoding` {String} Encoding to use, Default: `'utf8'`
+
+Creates a new `Buffer` containing the given JavaScript string `str`. If
+provided, the `encoding` parameter identifies the character encoding.
+If not provided, `encoding` defaults to `'utf8'`.
+
+```js
+const buf1 = Buffer.from('this is a tést');
+console.log(buf1.toString());
+  // prints: this is a tést
+console.log(buf1.toString('ascii'));
+  // prints: this is a tC)st
+
+const buf2 = Buffer.from('7468697320697320612074c3a97374', 'hex');
+console.log(buf2.toString());
+  // prints: this is a tést
+```
+
+A `TypeError` will be thrown if `str` is not a string.
+
+### Class Method: Buffer.alloc(size[, fill[, encoding]])
+<!-- YAML
+added: v5.10.0
+-->
+
+* `size` {Number}
+* `fill` {Value} Default: `undefined`
+* `encoding` {String} Default: `utf8`
+
+Allocates a new `Buffer` of `size` bytes. If `fill` is `undefined`, the
+`Buffer` will be *zero-filled*.
+
+```js
+const buf = Buffer.alloc(5);
+console.log(buf);
+  // <Buffer 00 00 00 00 00>
+```
+
+The `size` must be less than or equal to the value of
+`require('buffer').kMaxLength` (on 64-bit architectures, `kMaxLength` is
+`(2^31)-1`). Otherwise, a [`RangeError`][] is thrown. A zero-length Buffer will
+be created if a `size` less than or equal to 0 is specified.
+
+If `fill` is specified, the allocated `Buffer` will be initialized by calling
+`buf.fill(fill)`. See [`buf.fill()`][] for more information.
+
+```js
+const buf = Buffer.alloc(5, 'a');
+console.log(buf);
+  // <Buffer 61 61 61 61 61>
+```
+
+If both `fill` and `encoding` are specified, the allocated `Buffer` will be
+initialized by calling `buf.fill(fill, encoding)`. For example:
+
+```js
+const buf = Buffer.alloc(11, 'aGVsbG8gd29ybGQ=', 'base64');
+console.log(buf);
+  // <Buffer 68 65 6c 6c 6f 20 77 6f 72 6c 64>
+```
+
+Calling `Buffer.alloc(size)` can be significantly slower than the alternative
+`Buffer.allocUnsafe(size)` but ensures that the newly created `Buffer` instance
+contents will *never contain sensitive data*.
+
+A `TypeError` will be thrown if `size` is not a number.
+
+### Class Method: Buffer.allocUnsafe(size)
+<!-- YAML
+added: v5.10.0
+-->
+
+* `size` {Number}
+
+Allocates a new *non-zero-filled* `Buffer` of `size` bytes.  The `size` must
+be less than or equal to the value of `require('buffer').kMaxLength` (on 64-bit
+architectures, `kMaxLength` is `(2^31)-1`). Otherwise, a [`RangeError`][] is
+thrown. A zero-length Buffer will be created if a `size` less than or equal to
+0 is specified.
+
+The underlying memory for `Buffer` instances created in this way is *not
+initialized*. The contents of the newly created `Buffer` are unknown and
+*may contain sensitive data*. Use [`buf.fill(0)`][] to initialize such
+`Buffer` instances to zeroes.
+
+```js
+const buf = Buffer.allocUnsafe(5);
+console.log(buf);
+  // <Buffer 78 e0 82 02 01>
+  // (octets will be different, every time)
+buf.fill(0);
+console.log(buf);
+  // <Buffer 00 00 00 00 00>
+```
+
+A `TypeError` will be thrown if `size` is not a number.
+
+Note that the `Buffer` module pre-allocates an internal `Buffer` instance of
+size `Buffer.poolSize` that is used as a pool for the fast allocation of new
+`Buffer` instances created using `Buffer.allocUnsafe(size)` (and the deprecated
+`new Buffer(size)` constructor) only when `size` is less than or equal to
+`Buffer.poolSize >> 1` (floor of `Buffer.poolSize` divided by two). The default
+value of `Buffer.poolSize` is `8192` but can be modified.
+
+Use of this pre-allocated internal memory pool is a key difference between
+calling `Buffer.alloc(size, fill)` vs. `Buffer.allocUnsafe(size).fill(fill)`.
+Specifically, `Buffer.alloc(size, fill)` will *never* use the internal Buffer
+pool, while `Buffer.allocUnsafe(size).fill(fill)` *will* use the internal
+Buffer pool if `size` is less than or equal to half `Buffer.poolSize`. The
+difference is subtle but can be important when an application requires the
+additional performance that `Buffer.allocUnsafe(size)` provides.
+
+### Class Method: Buffer.allocUnsafeSlow(size)
+<!-- YAML
+added: v5.10.0
+-->
+
+* `size` {Number}
+
+Allocates a new *non-zero-filled* and non-pooled `Buffer` of `size` bytes.  The
+`size` must be less than or equal to the value of
+`require('buffer').kMaxLength` (on 64-bit architectures, `kMaxLength` is
+`(2^31)-1`). Otherwise, a [`RangeError`][] is thrown. A zero-length Buffer will
+be created if a `size` less than or equal to 0 is specified.
+
+The underlying memory for `Buffer` instances created in this way is *not
+initialized*. The contents of the newly created `Buffer` are unknown and
+*may contain sensitive data*. Use [`buf.fill(0)`][] to initialize such
+`Buffer` instances to zeroes.
+
+When using `Buffer.allocUnsafe()` to allocate new `Buffer` instances,
+allocations under 4KB are, by default, sliced from a single pre-allocated
+`Buffer`. This allows applications to avoid the garbage collection overhead of
+creating many individually allocated Buffers. This approach improves both
+performance and memory usage by eliminating the need to track and cleanup as
+many `Persistent` objects.
+
+However, in the case where a developer may need to retain a small chunk of
+memory from a pool for an indeterminate amount of time, it may be appropriate
+to create an un-pooled Buffer instance using `Buffer.allocUnsafeSlow()` then
+copy out the relevant bits.
+
+```js
+// need to keep around a few small chunks of memory
+const store = [];
+
+socket.on('readable', () => {
+  const data = socket.read();
+  // allocate for retained data
+  const sb = Buffer.allocUnsafeSlow(10);
+  // copy the data into the new allocation
+  data.copy(sb, 0, 0, 10);
+  store.push(sb);
+});
+```
+
+Use of `Buffer.allocUnsafeSlow()` should be used only as a last resort *after*
+a developer has observed undue memory retention in their applications.
+
+A `TypeError` will be thrown if `size` is not a number.
+
+### All the Rest
+
+The rest of the `Buffer` API is exactly the same as in node.js.
+[See the docs](https://nodejs.org/api/buffer.html).
+
+
+## Related links
+
+- [Node.js issue: Buffer(number) is unsafe](https://github.com/nodejs/node/issues/4660)
+- [Node.js Enhancement Proposal: Buffer.from/Buffer.alloc/Buffer.zalloc/Buffer() soft-deprecate](https://github.com/nodejs/node-eps/pull/4)
+
+## Why is `Buffer` unsafe?
+
+Today, the node.js `Buffer` constructor is overloaded to handle many different argument
+types like `String`, `Array`, `Object`, `TypedArrayView` (`Uint8Array`, etc.),
+`ArrayBuffer`, and also `Number`.
+
+The API is optimized for convenience: you can throw any type at it, and it will try to do
+what you want.
+
+Because the Buffer constructor is so powerful, you often see code like this:
+
+```js
+// Convert UTF-8 strings to hex
+function toHex (str) {
+  return new Buffer(str).toString('hex')
+}
+```
+
+***But what happens if `toHex` is called with a `Number` argument?***
+
+### Remote Memory Disclosure
+
+If an attacker can make your program call the `Buffer` constructor with a `Number`
+argument, then they can make it allocate uninitialized memory from the node.js process.
+This could potentially disclose TLS private keys, user data, or database passwords.
+
+When the `Buffer` constructor is passed a `Number` argument, it returns an
+**UNINITIALIZED** block of memory of the specified `size`. When you create a `Buffer` like
+this, you **MUST** overwrite the contents before returning it to the user.
+
+From the [node.js docs](https://nodejs.org/api/buffer.html#buffer_new_buffer_size):
+
+> `new Buffer(size)`
+>
+> - `size` Number
+>
+> The underlying memory for `Buffer` instances created in this way is not initialized.
+> **The contents of a newly created `Buffer` are unknown and could contain sensitive
+> data.** Use `buf.fill(0)` to initialize a Buffer to zeroes.
+
+(Emphasis our own.)
+
+Whenever the programmer intended to create an uninitialized `Buffer` you often see code
+like this:
+
+```js
+var buf = new Buffer(16)
+
+// Immediately overwrite the uninitialized buffer with data from another buffer
+for (var i = 0; i < buf.length; i++) {
+  buf[i] = otherBuf[i]
+}
+```
+
+
+### Would this ever be a problem in real code?
+
+Yes. It's surprisingly common to forget to check the type of your variables in a
+dynamically-typed language like JavaScript.
+
+Usually the consequences of assuming the wrong type is that your program crashes with an
+uncaught exception. But the failure mode for forgetting to check the type of arguments to
+the `Buffer` constructor is more catastrophic.
+
+Here's an example of a vulnerable service that takes a JSON payload and converts it to
+hex:
+
+```js
+// Take a JSON payload {str: "some string"} and convert it to hex
+var server = http.createServer(function (req, res) {
+  var data = ''
+  req.setEncoding('utf8')
+  req.on('data', function (chunk) {
+    data += chunk
+  })
+  req.on('end', function () {
+    var body = JSON.parse(data)
+    res.end(new Buffer(body.str).toString('hex'))
+  })
+})
+
+server.listen(8080)
+```
+
+In this example, an http client just has to send:
+
+```json
+{
+  "str": 1000
+}
+```
+
+and it will get back 1,000 bytes of uninitialized memory from the server.
+
+This is a very serious bug. It's similar in severity to the
+[the Heartbleed bug](http://heartbleed.com/) that allowed disclosure of OpenSSL process
+memory by remote attackers.
+
+
+### Which real-world packages were vulnerable?
+
+#### [`bittorrent-dht`](https://www.npmjs.com/package/bittorrent-dht)
+
+[Mathias Buus](https://github.com/mafintosh) and I
+([Feross Aboukhadijeh](http://feross.org/)) found this issue in one of our own packages,
+[`bittorrent-dht`](https://www.npmjs.com/package/bittorrent-dht). The bug would allow
+anyone on the internet to send a series of messages to a user of `bittorrent-dht` and get
+them to reveal 20 bytes at a time of uninitialized memory from the node.js process.
+
+Here's
+[the commit](https://github.com/feross/bittorrent-dht/commit/6c7da04025d5633699800a99ec3fbadf70ad35b8)
+that fixed it. We released a new fixed version, created a
+[Node Security Project disclosure](https://nodesecurity.io/advisories/68), and deprecated all
+vulnerable versions on npm so users will get a warning to upgrade to a newer version.
+
+#### [`ws`](https://www.npmjs.com/package/ws)
+
+That got us wondering if there were other vulnerable packages. Sure enough, within a short
+period of time, we found the same issue in [`ws`](https://www.npmjs.com/package/ws), the
+most popular WebSocket implementation in node.js.
+
+If certain APIs were called with `Number` parameters instead of `String` or `Buffer` as
+expected, then uninitialized server memory would be disclosed to the remote peer.
+
+These were the vulnerable methods:
+
+```js
+socket.send(number)
+socket.ping(number)
+socket.pong(number)
+```
+
+Here's a vulnerable socket server with some echo functionality:
+
+```js
+server.on('connection', function (socket) {
+  socket.on('message', function (message) {
+    message = JSON.parse(message)
+    if (message.type === 'echo') {
+      socket.send(message.data) // send back the user's message
+    }
+  })
+})
+```
+
+`socket.send(number)` called on the server, will disclose server memory.
+
+Here's [the release](https://github.com/websockets/ws/releases/tag/1.0.1) where the issue
+was fixed, with a more detailed explanation. Props to
+[Arnout Kazemier](https://github.com/3rd-Eden) for the quick fix. Here's the
+[Node Security Project disclosure](https://nodesecurity.io/advisories/67).
+
+
+### What's the solution?
+
+It's important that node.js offers a fast way to get memory otherwise performance-critical
+applications would needlessly get a lot slower.
+
+But we need a better way to *signal our intent* as programmers. **When we want
+uninitialized memory, we should request it explicitly.**
+
+Sensitive functionality should not be packed into a developer-friendly API that loosely
+accepts many different types. This type of API encourages the lazy practice of passing
+variables in without checking the type very carefully.
+
+#### A new API: `Buffer.allocUnsafe(number)`
+
+The functionality of creating buffers with uninitialized memory should be part of another
+API. We propose `Buffer.allocUnsafe(number)`. This way, it's not part of an API that
+frequently gets user input of all sorts of different types passed into it.
+
+```js
+var buf = Buffer.allocUnsafe(16) // careful, uninitialized memory!
+
+// Immediately overwrite the uninitialized buffer with data from another buffer
+for (var i = 0; i < buf.length; i++) {
+  buf[i] = otherBuf[i]
+}
+```
+
+
+### How do we fix node.js core?
+
+We sent [a PR to node.js core](https://github.com/nodejs/node/pull/4514) (merged as
+`semver-major`) which defends against one case:
+
+```js
+var str = 16
+new Buffer(str, 'utf8')
+```
+
+In this situation, it's implied that the programmer intended the first argument to be a
+string, since they passed an encoding as a second argument. Today, node.js will allocate
+uninitialized memory in the case of `new Buffer(number, encoding)`, which is probably not
+what the programmer intended.
+
+But this is only a partial solution, since if the programmer does `new Buffer(variable)`
+(without an `encoding` parameter) there's no way to know what they intended. If `variable`
+is sometimes a number, then uninitialized memory will sometimes be returned.
+
+### What's the real long-term fix?
+
+We could deprecate and remove `new Buffer(number)` and use `Buffer.allocUnsafe(number)` when
+we need uninitialized memory. But that would break 1000s of packages.
+
+~~We believe the best solution is to:~~
+
+~~1. Change `new Buffer(number)` to return safe, zeroed-out memory~~
+
+~~2. Create a new API for creating uninitialized Buffers. We propose: `Buffer.allocUnsafe(number)`~~
+
+#### Update
+
+We now support adding three new APIs:
+
+- `Buffer.from(value)` - convert from any type to a buffer
+- `Buffer.alloc(size)` - create a zero-filled buffer
+- `Buffer.allocUnsafe(size)` - create an uninitialized buffer with given size
+
+This solves the core problem that affected `ws` and `bittorrent-dht` which is
+`Buffer(variable)` getting tricked into taking a number argument.
+
+This way, existing code continues working and the impact on the npm ecosystem will be
+minimal. Over time, npm maintainers can migrate performance-critical code to use
+`Buffer.allocUnsafe(number)` instead of `new Buffer(number)`.
+
+
+### Conclusion
+
+We think there's a serious design issue with the `Buffer` API as it exists today. It
+promotes insecure software by putting high-risk functionality into a convenient API
+with friendly "developer ergonomics".
+
+This wasn't merely a theoretical exercise because we found the issue in some of the
+most popular npm packages.
+
+Fortunately, there's an easy fix that can be applied today. Use `safe-buffer` in place of
+`buffer`.
+
+```js
+var Buffer = require('safe-buffer').Buffer
+```
+
+Eventually, we hope that node.js core can switch to this new, safer behavior. We believe
+the impact on the ecosystem would be minimal since it's not a breaking change.
+Well-maintained, popular packages would be updated to use `Buffer.alloc` quickly, while
+older, insecure packages would magically become safe from this attack vector.
+
+
+## links
+
+- [Node.js PR: buffer: throw if both length and enc are passed](https://github.com/nodejs/node/pull/4514)
+- [Node Security Project disclosure for `ws`](https://nodesecurity.io/advisories/67)
+- [Node Security Project disclosure for`bittorrent-dht`](https://nodesecurity.io/advisories/68)
+
+
+## credit
+
+The original issues in `bittorrent-dht`
+([disclosure](https://nodesecurity.io/advisories/68)) and
+`ws` ([disclosure](https://nodesecurity.io/advisories/67)) were discovered by
+[Mathias Buus](https://github.com/mafintosh) and
+[Feross Aboukhadijeh](http://feross.org/).
+
+Thanks to [Adam Baldwin](https://github.com/evilpacket) for helping disclose these issues
+and for his work running the [Node Security Project](https://nodesecurity.io/).
+
+Thanks to [John Hiesey](https://github.com/jhiesey) for proofreading this README and
+auditing the code.
+
+
+## license
+
+MIT. Copyright (C) [Feross Aboukhadijeh](http://feross.org)

node_modules/basic-auth/node_modules/safe-buffer/index.d.ts

@@ -0,0 +1,187 @@
+declare module "safe-buffer" {
+  export class Buffer {
+    length: number
+    write(string: string, offset?: number, length?: number, encoding?: string): number;
+    toString(encoding?: string, start?: number, end?: number): string;
+    toJSON(): { type: 'Buffer', data: any[] };
+    equals(otherBuffer: Buffer): boolean;
+    compare(otherBuffer: Buffer, targetStart?: number, targetEnd?: number, sourceStart?: number, sourceEnd?: number): number;
+    copy(targetBuffer: Buffer, targetStart?: number, sourceStart?: number, sourceEnd?: number): number;
+    slice(start?: number, end?: number): Buffer;
+    writeUIntLE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;
+    writeUIntBE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;
+    writeIntLE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;
+    writeIntBE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;
+    readUIntLE(offset: number, byteLength: number, noAssert?: boolean): number;
+    readUIntBE(offset: number, byteLength: number, noAssert?: boolean): number;
+    readIntLE(offset: number, byteLength: number, noAssert?: boolean): number;
+    readIntBE(offset: number, byteLength: number, noAssert?: boolean): number;
+    readUInt8(offset: number, noAssert?: boolean): number;
+    readUInt16LE(offset: number, noAssert?: boolean): number;
+    readUInt16BE(offset: number, noAssert?: boolean): number;
+    readUInt32LE(offset: number, noAssert?: boolean): number;
+    readUInt32BE(offset: number, noAssert?: boolean): number;
+    readInt8(offset: number, noAssert?: boolean): number;
+    readInt16LE(offset: number, noAssert?: boolean): number;
+    readInt16BE(offset: number, noAssert?: boolean): number;
+    readInt32LE(offset: number, noAssert?: boolean): number;
+    readInt32BE(offset: number, noAssert?: boolean): number;
+    readFloatLE(offset: number, noAssert?: boolean): number;
+    readFloatBE(offset: number, noAssert?: boolean): number;
+    readDoubleLE(offset: number, noAssert?: boolean): number;
+    readDoubleBE(offset: number, noAssert?: boolean): number;
+    swap16(): Buffer;
+    swap32(): Buffer;
+    swap64(): Buffer;
+    writeUInt8(value: number, offset: number, noAssert?: boolean): number;
+    writeUInt16LE(value: number, offset: number, noAssert?: boolean): number;
+    writeUInt16BE(value: number, offset: number, noAssert?: boolean): number;
+    writeUInt32LE(value: number, offset: number, noAssert?: boolean): number;
+    writeUInt32BE(value: number, offset: number, noAssert?: boolean): number;
+    writeInt8(value: number, offset: number, noAssert?: boolean): number;
+    writeInt16LE(value: number, offset: number, noAssert?: boolean): number;
+    writeInt16BE(value: number, offset: number, noAssert?: boolean): number;
+    writeInt32LE(value: number, offset: number, noAssert?: boolean): number;
+    writeInt32BE(value: number, offset: number, noAssert?: boolean): number;
+    writeFloatLE(value: number, offset: number, noAssert?: boolean): number;
+    writeFloatBE(value: number, offset: number, noAssert?: boolean): number;
+    writeDoubleLE(value: number, offset: number, noAssert?: boolean): number;
+    writeDoubleBE(value: number, offset: number, noAssert?: boolean): number;
+    fill(value: any, offset?: number, end?: number): this;
+    indexOf(value: string | number | Buffer, byteOffset?: number, encoding?: string): number;
+    lastIndexOf(value: string | number | Buffer, byteOffset?: number, encoding?: string): number;
+    includes(value: string | number | Buffer, byteOffset?: number, encoding?: string): boolean;
+
+    /**
+     * Allocates a new buffer containing the given {str}.
+     *
+     * @param str String to store in buffer.
+     * @param encoding encoding to use, optional.  Default is 'utf8'
+     */
+     constructor (str: string, encoding?: string);
+    /**
+     * Allocates a new buffer of {size} octets.
+     *
+     * @param size count of octets to allocate.
+     */
+    constructor (size: number);
+    /**
+     * Allocates a new buffer containing the given {array} of octets.
+     *
+     * @param array The octets to store.
+     */
+    constructor (array: Uint8Array);
+    /**
+     * Produces a Buffer backed by the same allocated memory as
+     * the given {ArrayBuffer}.
+     *
+     *
+     * @param arrayBuffer The ArrayBuffer with which to share memory.
+     */
+    constructor (arrayBuffer: ArrayBuffer);
+    /**
+     * Allocates a new buffer containing the given {array} of octets.
+     *
+     * @param array The octets to store.
+     */
+    constructor (array: any[]);
+    /**
+     * Copies the passed {buffer} data onto a new {Buffer} instance.
+     *
+     * @param buffer The buffer to copy.
+     */
+    constructor (buffer: Buffer);
+    prototype: Buffer;
+    /**
+     * Allocates a new Buffer using an {array} of octets.
+     *
+     * @param array
+     */
+    static from(array: any[]): Buffer;
+    /**
+     * When passed a reference to the .buffer property of a TypedArray instance,
+     * the newly created Buffer will share the same allocated memory as the TypedArray.
+     * The optional {byteOffset} and {length} arguments specify a memory range
+     * within the {arrayBuffer} that will be shared by the Buffer.
+     *
+     * @param arrayBuffer The .buffer property of a TypedArray or a new ArrayBuffer()
+     * @param byteOffset
+     * @param length
+     */
+    static from(arrayBuffer: ArrayBuffer, byteOffset?: number, length?: number): Buffer;
+    /**
+     * Copies the passed {buffer} data onto a new Buffer instance.
+     *
+     * @param buffer
+     */
+    static from(buffer: Buffer): Buffer;
+    /**
+     * Creates a new Buffer containing the given JavaScript string {str}.
+     * If provided, the {encoding} parameter identifies the character encoding.
+     * If not provided, {encoding} defaults to 'utf8'.
+     *
+     * @param str
+     */
+    static from(str: string, encoding?: string): Buffer;
+    /**
+     * Returns true if {obj} is a Buffer
+     *
+     * @param obj object to test.
+     */
+    static isBuffer(obj: any): obj is Buffer;
+    /**
+     * Returns true if {encoding} is a valid encoding argument.
+     * Valid string encodings in Node 0.12: 'ascii'|'utf8'|'utf16le'|'ucs2'(alias of 'utf16le')|'base64'|'binary'(deprecated)|'hex'
+     *
+     * @param encoding string to test.
+     */
+    static isEncoding(encoding: string): boolean;
+    /**
+     * Gives the actual byte length of a string. encoding defaults to 'utf8'.
+     * This is not the same as String.prototype.length since that returns the number of characters in a string.
+     *
+     * @param string string to test.
+     * @param encoding encoding used to evaluate (defaults to 'utf8')
+     */
+    static byteLength(string: string, encoding?: string): number;
+    /**
+     * Returns a buffer which is the result of concatenating all the buffers in the list together.
+     *
+     * If the list has no items, or if the totalLength is 0, then it returns a zero-length buffer.
+     * If the list has exactly one item, then the first item of the list is returned.
+     * If the list has more than one item, then a new Buffer is created.
+     *
+     * @param list An array of Buffer objects to concatenate
+     * @param totalLength Total length of the buffers when concatenated.
+     *   If totalLength is not provided, it is read from the buffers in the list. However, this adds an additional loop to the function, so it is faster to provide the length explicitly.
+     */
+    static concat(list: Buffer[], totalLength?: number): Buffer;
+    /**
+     * The same as buf1.compare(buf2).
+     */
+    static compare(buf1: Buffer, buf2: Buffer): number;
+    /**
+     * Allocates a new buffer of {size} octets.
+     *
+     * @param size count of octets to allocate.
+     * @param fill if specified, buffer will be initialized by calling buf.fill(fill).
+     *    If parameter is omitted, buffer will be filled with zeros.
+     * @param encoding encoding used for call to buf.fill while initalizing
+     */
+    static alloc(size: number, fill?: string | Buffer | number, encoding?: string): Buffer;
+    /**
+     * Allocates a new buffer of {size} octets, leaving memory not initialized, so the contents
+     * of the newly created Buffer are unknown and may contain sensitive data.
+     *
+     * @param size count of octets to allocate
+     */
+    static allocUnsafe(size: number): Buffer;
+    /**
+     * Allocates a new non-pooled buffer of {size} octets, leaving memory not initialized, so the contents
+     * of the newly created Buffer are unknown and may contain sensitive data.
+     *
+     * @param size count of octets to allocate
+     */
+    static allocUnsafeSlow(size: number): Buffer;
+  }
+}

node_modules/basic-auth/node_modules/safe-buffer/index.js

@@ -0,0 +1,62 @@
+/* eslint-disable node/no-deprecated-api */
+var buffer = require('buffer')
+var Buffer = buffer.Buffer
+
+// alternative to using Object.keys for old browsers
+function copyProps (src, dst) {
+  for (var key in src) {
+    dst[key] = src[key]
+  }
+}
+if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) {
+  module.exports = buffer
+} else {
+  // Copy properties from require('buffer')
+  copyProps(buffer, exports)
+  exports.Buffer = SafeBuffer
+}
+
+function SafeBuffer (arg, encodingOrOffset, length) {
+  return Buffer(arg, encodingOrOffset, length)
+}
+
+// Copy static methods from Buffer
+copyProps(Buffer, SafeBuffer)
+
+SafeBuffer.from = function (arg, encodingOrOffset, length) {
+  if (typeof arg === 'number') {
+    throw new TypeError('Argument must not be a number')
+  }
+  return Buffer(arg, encodingOrOffset, length)
+}
+
+SafeBuffer.alloc = function (size, fill, encoding) {
+  if (typeof size !== 'number') {
+    throw new TypeError('Argument must be a number')
+  }
+  var buf = Buffer(size)
+  if (fill !== undefined) {
+    if (typeof encoding === 'string') {
+      buf.fill(fill, encoding)
+    } else {
+      buf.fill(fill)
+    }
+  } else {
+    buf.fill(0)
+  }
+  return buf
+}
+
+SafeBuffer.allocUnsafe = function (size) {
+  if (typeof size !== 'number') {
+    throw new TypeError('Argument must be a number')
+  }
+  return Buffer(size)
+}
+
+SafeBuffer.allocUnsafeSlow = function (size) {
+  if (typeof size !== 'number') {
+    throw new TypeError('Argument must be a number')
+  }
+  return buffer.SlowBuffer(size)
+}

node_modules/basic-auth/node_modules/safe-buffer/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "safe-buffer",
+  "description": "Safer Node.js Buffer API",
+  "version": "5.1.2",
+  "author": {
+    "name": "Feross Aboukhadijeh",
+    "email": "feross@feross.org",
+    "url": "http://feross.org"
+  },
+  "bugs": {
+    "url": "https://github.com/feross/safe-buffer/issues"
+  },
+  "devDependencies": {
+    "standard": "*",
+    "tape": "^4.0.0"
+  },
+  "homepage": "https://github.com/feross/safe-buffer",
+  "keywords": [
+    "buffer",
+    "buffer allocate",
+    "node security",
+    "safe",
+    "safe-buffer",
+    "security",
+    "uninitialized"
+  ],
+  "license": "MIT",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/feross/safe-buffer.git"
+  },
+  "scripts": {
+    "test": "standard && tape test/*.js"
+  }
+}

node_modules/body-parser/HISTORY.md

@@ -1,3 +1,27 @@
+1.19.2 / 2022-02-15
+===================
+
+  * deps: bytes@3.1.2
+  * deps: qs@6.9.7
+    * Fix handling of `__proto__` keys
+  * deps: raw-body@2.4.3
+    - deps: bytes@3.1.2
+
+1.19.1 / 2021-12-10
+===================
+
+  * deps: bytes@3.1.1
+  * deps: http-errors@1.8.1
+    - deps: inherits@2.0.4
+    - deps: toidentifier@1.0.1
+    - deps: setprototypeof@1.2.0
+  * deps: qs@6.9.6
+  * deps: raw-body@2.4.2
+    - deps: bytes@3.1.1
+    - deps: http-errors@1.8.1
+  * deps: safe-buffer@5.2.1
+  * deps: type-is@~1.6.18
+
 1.19.0 / 2019-04-25
 ===================
 

node_modules/body-parser/README.md

@@ -2,7 +2,7 @@
 
 [![NPM Version][npm-image]][npm-url]
 [![NPM Downloads][downloads-image]][downloads-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][github-actions-ci-image]][github-actions-ci-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
 Node.js body parsing middleware.
@@ -49,8 +49,6 @@ $ npm install body-parser
 
 ## API
 
-<!-- eslint-disable no-unused-vars -->
-
 ```js
 var bodyParser = require('body-parser')
 ```
@@ -281,14 +279,15 @@ encoding of the request. The parsing can be aborted by throwing an error.
 
 ## Errors
 
-The middlewares provided by this module create errors depending on the error
+The middlewares provided by this module create errors using the
-condition during parsing. The errors will typically have a `status`/`statusCode`
+[`http-errors` module](https://www.npmjs.com/package/http-errors). The errors
-property that contains the suggested HTTP response code, an `expose` property
+will typically have a `status`/`statusCode` property that contains the suggested
-to determine if the `message` property should be displayed to the client, a
+HTTP response code, an `expose` property to determine if the `message` property
-`type` property to determine the type of error without matching against the
+should be displayed to the client, a `type` property to determine the type of
-`message`, and a `body` property containing the read body, if available.
+error without matching against the `message`, and a `body` property containing
+the read body, if available.
 
-The following are the common errors emitted, though any error can come through
+The following are the common errors created, though any error can come through
 for various reasons.
 
 ### content encoding unsupported
@@ -299,6 +298,20 @@ contained an encoding but the "inflation" option was set to `false`. The
 `'encoding.unsupported'`, and the `charset` property will be set to the
 encoding that is unsupported.
 
+### entity parse failed
+
+This error will occur when the request contained an entity that could not be
+parsed by the middleware. The `status` property is set to `400`, the `type`
+property is set to `'entity.parse.failed'`, and the `body` property is set to
+the entity value that failed parsing.
+
+### entity verify failed
+
+This error will occur when the request contained an entity that could not be
+failed verification by the defined `verify` option. The `status` property is
+set to `403`, the `type` property is set to `'entity.verify.failed'`, and the
+`body` property is set to the entity value that failed verification.
+
 ### request aborted
 
 This error will occur when the request is aborted by the client before reading
@@ -435,9 +448,9 @@ app.use(bodyParser.text({ type: 'text/html' }))
 
 [npm-image]: https://img.shields.io/npm/v/body-parser.svg
 [npm-url]: https://npmjs.org/package/body-parser
-[travis-image]: https://img.shields.io/travis/expressjs/body-parser/master.svg
-[travis-url]: https://travis-ci.org/expressjs/body-parser
 [coveralls-image]: https://img.shields.io/coveralls/expressjs/body-parser/master.svg
 [coveralls-url]: https://coveralls.io/r/expressjs/body-parser?branch=master
 [downloads-image]: https://img.shields.io/npm/dm/body-parser.svg
 [downloads-url]: https://npmjs.org/package/body-parser
+[github-actions-ci-image]: https://img.shields.io/github/workflow/status/expressjs/body-parser/ci/master?label=ci
+[github-actions-ci-url]: https://github.com/expressjs/body-parser?query=workflow%3Aci

node_modules/body-parser/package.json

@@ -1,7 +1,7 @@
 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "1.19.0",
+  "version": "1.19.2",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
@@ -9,30 +9,30 @@
   "license": "MIT",
   "repository": "expressjs/body-parser",
   "dependencies": {
-    "bytes": "3.1.0",
+    "bytes": "3.1.2",
     "content-type": "~1.0.4",
     "debug": "2.6.9",
     "depd": "~1.1.2",
-    "http-errors": "1.7.2",
+    "http-errors": "1.8.1",
     "iconv-lite": "0.4.24",
     "on-finished": "~2.3.0",
-    "qs": "6.7.0",
+    "qs": "6.9.7",
-    "raw-body": "2.4.0",
+    "raw-body": "2.4.3",
-    "type-is": "~1.6.17"
+    "type-is": "~1.6.18"
   },
   "devDependencies": {
-    "eslint": "5.16.0",
+    "eslint": "7.32.0",
-    "eslint-config-standard": "12.0.0",
+    "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.17.2",
+    "eslint-plugin-import": "2.25.4",
-    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-markdown": "2.2.1",
-    "eslint-plugin-node": "8.0.1",
+    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "4.1.1",
+    "eslint-plugin-promise": "5.2.0",
-    "eslint-plugin-standard": "4.0.0",
+    "eslint-plugin-standard": "4.1.0",
-    "istanbul": "0.4.5",
     "methods": "1.1.2",
-    "mocha": "6.1.4",
+    "mocha": "9.2.0",
-    "safe-buffer": "5.1.2",
+    "nyc": "15.1.0",
-    "supertest": "4.0.2"
+    "safe-buffer": "5.2.1",
+    "supertest": "6.2.2"
   },
   "files": [
     "lib/",
@@ -44,9 +44,9 @@
     "node": ">= 0.8"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md .",
+    "lint": "eslint .",
     "test": "mocha --require test/support/env --reporter spec --check-leaks --bail test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/"
+    "test-cov": "nyc --reporter=html --reporter=text npm test"
   }
 }

node_modules/bytes/History.md

@@ -1,3 +1,13 @@
+3.1.2 / 2022-01-27
+==================
+
+  * Fix return value for un-parsable strings
+
+3.1.1 / 2021-11-15
+==================
+
+  * Fix "thousandsSeparator" incorrecting formatting fractional part
+
 3.1.0 / 2019-01-22
 ==================
 

node_modules/bytes/Readme.md

@@ -2,7 +2,7 @@
 
 [![NPM Version][npm-image]][npm-url]
 [![NPM Downloads][downloads-image]][downloads-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][ci-image]][ci-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
 Utility to parse a string bytes (ex: `1TB`) to bytes (`1099511627776`) and vice-versa.
@@ -23,6 +23,33 @@ $ npm install bytes
 var bytes = require('bytes');
 ```
 
+#### bytes(number｜string value, [options]): number｜string｜null
+
+Default export function. Delegates to either `bytes.format` or `bytes.parse` based on the type of `value`.
+
+**Arguments**
+
+| Name    | Type     | Description        |
+|---------|----------|--------------------|
+| value   | `number`｜`string` | Number value to format or string value to parse |
+| options | `Object` | Conversion options for `format` |
+
+**Returns**
+
+| Name    | Type             | Description                                     |
+|---------|------------------|-------------------------------------------------|
+| results | `string`｜`number`｜`null` | Return null upon error. Numeric value in bytes, or string value otherwise. |
+
+**Example**
+
+```js
+bytes(1024);
+// output: '1KB'
+
+bytes('1KB');
+// output: 1024
+```
+
 #### bytes.format(number value, [options]): string｜null
 
 Format the given value in bytes into a string. If the value is negative, it is kept as such. If it is a float, it is
@@ -41,7 +68,7 @@ Format the given value in bytes into a string. If the value is negative, it is k
 |-------------------|--------|-----------------------------------------------------------------------------------------|
 | decimalPlaces | `number`｜`null` | Maximum number of decimal places to include in output. Default value to `2`. |
 | fixedDecimals | `boolean`｜`null` | Whether to always display the maximum number of decimal places. Default value to `false` |
-| thousandsSeparator | `string`｜`null` | Example of values: `' '`, `','` and `.`... Default value to `''`. |
+| thousandsSeparator | `string`｜`null` | Example of values: `' '`, `','` and `'.'`... Default value to `''`. |
 | unit | `string`｜`null` | The unit in which the result will be returned (B/KB/MB/GB/TB). Default value to `''` (which means auto detect). |
 | unitSeparator | `string`｜`null` | Separator to use between number and unit. Default value to `''`. |
 
@@ -54,21 +81,20 @@ Format the given value in bytes into a string. If the value is negative, it is k
 **Example**
 
 ```js
-bytes(1024);
+bytes.format(1024);
 // output: '1KB'
 
-bytes(1000);
+bytes.format(1000);
 // output: '1000B'
 
-bytes(1000, {thousandsSeparator: ' '});
+bytes.format(1000, {thousandsSeparator: ' '});
 // output: '1 000B'
 
-bytes(1024 * 1.7, {decimalPlaces: 0});
+bytes.format(1024 * 1.7, {decimalPlaces: 0});
 // output: '2KB'
 
-bytes(1024, {unitSeparator: ' '});
+bytes.format(1024, {unitSeparator: ' '});
 // output: '1 KB'
-
 ```
 
 #### bytes.parse(string｜number value): number｜null
@@ -102,25 +128,25 @@ The units are in powers of two, not ten. This means 1kb = 1024b according to thi
 **Example**
 
 ```js
-bytes('1KB');
+bytes.parse('1KB');
 // output: 1024
 
-bytes('1024');
+bytes.parse('1024');
 // output: 1024
 
-bytes(1024);
+bytes.parse(1024);
-// output: 1KB
+// output: 1024
 ```
 
 ## License
 
 [MIT](LICENSE)
 
+[ci-image]: https://badgen.net/github/checks/visionmedia/bytes.js/master?label=ci
+[ci-url]: https://github.com/visionmedia/bytes.js/actions?query=workflow%3Aci
 [coveralls-image]: https://badgen.net/coveralls/c/github/visionmedia/bytes.js/master
 [coveralls-url]: https://coveralls.io/r/visionmedia/bytes.js?branch=master
 [downloads-image]: https://badgen.net/npm/dm/bytes
 [downloads-url]: https://npmjs.org/package/bytes
-[npm-image]: https://badgen.net/npm/node/bytes
+[npm-image]: https://badgen.net/npm/v/bytes
 [npm-url]: https://npmjs.org/package/bytes
-[travis-image]: https://badgen.net/travis/visionmedia/bytes.js/master
-[travis-url]: https://travis-ci.org/visionmedia/bytes.js

node_modules/bytes/index.js

@@ -117,7 +117,11 @@ function format(value, options) {
   }
 
   if (thousandsSeparator) {
-    str = str.replace(formatThousandsRegExp, thousandsSeparator);
+    str = str.split('.').map(function (s, i) {
+      return i === 0
+        ? s.replace(formatThousandsRegExp, thousandsSeparator)
+        : s
+    }).join('.');
   }
 
   return str + unitSeparator + unit;
@@ -158,5 +162,9 @@ function parse(val) {
     unit = results[4].toLowerCase();
   }
 
+  if (isNaN(floatValue)) {
+    return null;
+  }
+
   return Math.floor(map[unit] * floatValue);
 }

node_modules/bytes/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bytes",
   "description": "Utility to parse a string bytes to bytes and vice-versa",
-  "version": "3.1.0",
+  "version": "3.1.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "contributors": [
     "Jed Watson <jed.watson@me.com>",
@@ -19,9 +19,10 @@
   ],
   "repository": "visionmedia/bytes.js",
   "devDependencies": {
-    "eslint": "5.12.1",
+    "eslint": "7.32.0",
-    "mocha": "5.2.0",
+    "eslint-plugin-markdown": "2.2.1",
-    "nyc": "13.1.0"
+    "mocha": "9.2.0",
+    "nyc": "15.1.0"
   },
   "files": [
     "History.md",
@@ -35,7 +36,7 @@
   "scripts": {
     "lint": "eslint .",
     "test": "mocha --check-leaks --reporter spec",
-    "test-ci": "nyc --reporter=text npm test",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
     "test-cov": "nyc --reporter=html --reporter=text npm test"
   }
 }

node_modules/content-disposition/HISTORY.md

@@ -1,3 +1,8 @@
+0.5.4 / 2021-12-10
+==================
+
+  * deps: safe-buffer@5.2.1
+
 0.5.3 / 2018-12-17
 ==================
 

node_modules/content-disposition/README.md

@@ -3,7 +3,7 @@
 [![NPM Version][npm-image]][npm-url]
 [![NPM Downloads][downloads-image]][downloads-url]
 [![Node.js Version][node-version-image]][node-version-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][github-actions-ci-image]][github-actions-ci-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
 Create and parse HTTP `Content-Disposition` header
@@ -16,8 +16,6 @@ $ npm install content-disposition
 
 ## API
 
-<!-- eslint-disable no-unused-vars -->
-
 ```js
 var contentDisposition = require('content-disposition')
 ```
@@ -28,8 +26,6 @@ Create an attachment `Content-Disposition` header value using the given file nam
 if supplied. The `filename` is optional and if no file name is desired, but you
 want to specify `options`, set `filename` to `undefined`.
 
-<!-- eslint-disable no-undef -->
-
 ```js
 res.setHeader('Content-Disposition', contentDisposition('∫ maths.pdf'))
 ```
@@ -70,8 +66,6 @@ it). The type is normalized to lower-case.
 
 ### contentDisposition.parse(string)
 
-<!-- eslint-disable no-undef, no-unused-vars -->
-
 ```js
 var disposition = contentDisposition.parse('attachment; filename="EURO rates.txt"; filename*=UTF-8\'\'%e2%82%ac%20rates.txt')
 ```
@@ -140,9 +134,9 @@ $ npm test
 [npm-url]: https://npmjs.org/package/content-disposition
 [node-version-image]: https://img.shields.io/node/v/content-disposition.svg
 [node-version-url]: https://nodejs.org/en/download
-[travis-image]: https://img.shields.io/travis/jshttp/content-disposition.svg
-[travis-url]: https://travis-ci.org/jshttp/content-disposition
 [coveralls-image]: https://img.shields.io/coveralls/jshttp/content-disposition.svg
 [coveralls-url]: https://coveralls.io/r/jshttp/content-disposition?branch=master
 [downloads-image]: https://img.shields.io/npm/dm/content-disposition.svg
 [downloads-url]: https://npmjs.org/package/content-disposition
+[github-actions-ci-image]: https://img.shields.io/github/workflow/status/jshttp/content-disposition/ci/master?label=ci
+[github-actions-ci-url]: https://github.com/jshttp/content-disposition?query=workflow%3Aci

node_modules/content-disposition/index.js

@@ -255,7 +255,7 @@ function format (obj) {
 }
 
 /**
- * Decode a RFC 6987 field value (gracefully).
+ * Decode a RFC 5987 field value (gracefully).
  *
  * @param {string} str
  * @return {string}

node_modules/content-disposition/package.json

@@ -1,7 +1,7 @@
 {
   "name": "content-disposition",
   "description": "Create and parse Content-Disposition header",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
   "license": "MIT",
   "keywords": [
@@ -12,19 +12,19 @@
   ],
   "repository": "jshttp/content-disposition",
   "dependencies": {
-    "safe-buffer": "5.1.2"
+    "safe-buffer": "5.2.1"
   },
   "devDependencies": {
     "deep-equal": "1.0.1",
-    "eslint": "5.10.0",
+    "eslint": "7.32.0",
-    "eslint-config-standard": "12.0.0",
+    "eslint-config-standard": "13.0.1",
-    "eslint-plugin-import": "2.14.0",
+    "eslint-plugin-import": "2.25.3",
-    "eslint-plugin-markdown": "1.0.0-rc.1",
+    "eslint-plugin-markdown": "2.2.1",
-    "eslint-plugin-node": "7.0.1",
+    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "4.0.1",
+    "eslint-plugin-promise": "5.2.0",
-    "eslint-plugin-standard": "4.0.0",
+    "eslint-plugin-standard": "4.1.0",
     "istanbul": "0.4.5",
-    "mocha": "5.2.0"
+    "mocha": "9.1.3"
   },
   "files": [
     "LICENSE",
@@ -36,9 +36,9 @@
     "node": ">= 0.6"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md .",
+    "lint": "eslint .",
     "test": "mocha --reporter spec --bail --check-leaks test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/"
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/"
   }
 }

node_modules/cookie/HISTORY.md

@@ -1,3 +1,14 @@
+0.4.2 / 2022-02-02
+==================
+
+  * pref: read value only when assigning in parse
+  * pref: remove unnecessary regexp in parse
+
+0.4.1 / 2020-04-21
+==================
+
+  * Fix `maxAge` option to reject invalid values
+
 0.4.0 / 2019-05-15
 ==================
 

node_modules/cookie/README.md

@@ -3,13 +3,17 @@
 [![NPM Version][npm-version-image]][npm-url]
 [![NPM Downloads][npm-downloads-image]][npm-url]
 [![Node.js Version][node-version-image]][node-version-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][github-actions-ci-image]][github-actions-ci-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
 Basic HTTP cookie parser and serializer for HTTP servers.
 
 ## Installation
 
+This is a [Node.js](https://nodejs.org/en/) module available through the
+[npm registry](https://www.npmjs.com/). Installation is done using the
+[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
+
 ```sh
 $ npm install cookie
 ```
@@ -194,32 +198,61 @@ $ npm test
 ```
 $ npm run bench
 
-> cookie@0.3.1 bench cookie
+> cookie@0.4.1 bench
 > node benchmark/index.js
 
-  http_parser@2.8.0
+  node@16.13.1
-  node@6.14.2
+  v8@9.4.146.24-node.14
-  v8@5.1.281.111
+  uv@1.42.0
-  uv@1.16.1
   zlib@1.2.11
-  ares@1.10.1-DEV
+  brotli@1.0.9
-  icu@58.2
+  ares@1.18.1
-  modules@48
+  modules@93
-  napi@3
+  nghttp2@1.45.1
-  openssl@1.0.2o
+  napi@8
+  llhttp@6.0.4
+  openssl@1.1.1l+quic
+  cldr@39.0
+  icu@69.1
+  tz@2021a
+  unicode@13.0
+  ngtcp2@0.1.0-DEV
+  nghttp3@0.1.0-DEV
+
+> node benchmark/parse-top.js
+
+  cookie.parse - top sites
+
+  15 tests completed.
+
+  parse accounts.google.com x   504,358 ops/sec ±6.55% (171 runs sampled)
+  parse apple.com           x 1,369,991 ops/sec ±0.84% (189 runs sampled)
+  parse cloudflare.com      x   360,669 ops/sec ±3.75% (182 runs sampled)
+  parse docs.google.com     x   521,496 ops/sec ±4.90% (180 runs sampled)
+  parse drive.google.com    x   553,514 ops/sec ±0.59% (189 runs sampled)
+  parse en.wikipedia.org    x   286,052 ops/sec ±0.62% (188 runs sampled)
+  parse linkedin.com        x   178,817 ops/sec ±0.61% (192 runs sampled)
+  parse maps.google.com     x   284,585 ops/sec ±0.68% (188 runs sampled)
+  parse microsoft.com       x   161,230 ops/sec ±0.56% (192 runs sampled)
+  parse play.google.com     x   352,144 ops/sec ±1.01% (181 runs sampled)
+  parse plus.google.com     x   275,204 ops/sec ±7.78% (156 runs sampled)
+  parse support.google.com  x   339,493 ops/sec ±1.02% (191 runs sampled)
+  parse www.google.com      x   286,110 ops/sec ±0.90% (191 runs sampled)
+  parse youtu.be            x   548,557 ops/sec ±0.60% (184 runs sampled)
+  parse youtube.com         x   545,293 ops/sec ±0.65% (191 runs sampled)
 
 > node benchmark/parse.js
 
-  cookie.parse
+  cookie.parse - generic
 
   6 tests completed.
 
-  simple      x 1,200,691 ops/sec ±1.12% (189 runs sampled)
+  simple      x 1,266,646 ops/sec ±0.65% (191 runs sampled)
-  decode      x 1,012,994 ops/sec ±0.97% (186 runs sampled)
+  decode      x   838,413 ops/sec ±0.60% (191 runs sampled)
-  unquote     x 1,074,174 ops/sec ±2.43% (186 runs sampled)
+  unquote     x   877,820 ops/sec ±0.72% (189 runs sampled)
-  duplicates  x   438,424 ops/sec ±2.17% (184 runs sampled)
+  duplicates  x   516,680 ops/sec ±0.61% (191 runs sampled)
-  10 cookies  x   147,154 ops/sec ±1.01% (186 runs sampled)
+  10 cookies  x   156,874 ops/sec ±0.52% (189 runs sampled)
-  100 cookies x    14,274 ops/sec ±1.07% (187 runs sampled)
+  100 cookies x    14,663 ops/sec ±0.53% (191 runs sampled)
 ```
 
 ## References
@@ -244,10 +277,10 @@ $ npm run bench
 
 [coveralls-image]: https://badgen.net/coveralls/c/github/jshttp/cookie/master
 [coveralls-url]: https://coveralls.io/r/jshttp/cookie?branch=master
+[github-actions-ci-image]: https://img.shields.io/github/workflow/status/jshttp/cookie/ci/master?label=ci
+[github-actions-ci-url]: https://github.com/jshttp/cookie/actions/workflows/ci.yml
 [node-version-image]: https://badgen.net/npm/node/cookie
 [node-version-url]: https://nodejs.org/en/download
 [npm-downloads-image]: https://badgen.net/npm/dm/cookie
 [npm-url]: https://npmjs.org/package/cookie
 [npm-version-image]: https://badgen.net/npm/v/cookie
-[travis-image]: https://badgen.net/travis/jshttp/cookie/master
-[travis-url]: https://travis-ci.org/jshttp/cookie

node_modules/cookie/index.js

@@ -22,7 +22,6 @@ exports.serialize = serialize;
 
 var decode = decodeURIComponent;
 var encode = encodeURIComponent;
-var pairSplitRegExp = /; */;
 
 /**
  * RegExp to match field-content in RFC 7230 sec 3.2
@@ -53,28 +52,29 @@ function parse(str, options) {
 
   var obj = {}
   var opt = options || {};
-  var pairs = str.split(pairSplitRegExp);
+  var pairs = str.split(';')
   var dec = opt.decode || decode;
 
   for (var i = 0; i < pairs.length; i++) {
     var pair = pairs[i];
-    var eq_idx = pair.indexOf('=');
+    var index = pair.indexOf('=')
 
     // skip things that don't look like key=value
-    if (eq_idx < 0) {
+    if (index < 0) {
       continue;
     }
 
-    var key = pair.substr(0, eq_idx).trim()
+    var key = pair.substring(0, index).trim()
-    var val = pair.substr(++eq_idx, pair.length).trim();
-
-    // quoted values
-    if ('"' == val[0]) {
-      val = val.slice(1, -1);
-    }
 
     // only assign once
     if (undefined == obj[key]) {
+      var val = pair.substring(index + 1, pair.length).trim()
+
+      // quoted values
+      if (val[0] === '"') {
+        val = val.slice(1, -1)
+      }
+
       obj[key] = tryDecode(val, dec);
     }
   }
@@ -120,7 +120,11 @@ function serialize(name, val, options) {
 
   if (null != opt.maxAge) {
     var maxAge = opt.maxAge - 0;
-    if (isNaN(maxAge)) throw new Error('maxAge should be a Number');
+
+    if (isNaN(maxAge) || !isFinite(maxAge)) {
+      throw new TypeError('option maxAge is invalid')
+    }
+
     str += '; Max-Age=' + Math.floor(maxAge);
   }
 

node_modules/cookie/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cookie",
   "description": "HTTP server cookie parsing and serialization",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "author": "Roman Shtylman <shtylman@gmail.com>",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>"
@@ -15,10 +15,11 @@
   "devDependencies": {
     "beautify-benchmark": "0.2.4",
     "benchmark": "2.1.4",
-    "eslint": "5.16.0",
+    "eslint": "7.32.0",
-    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-markdown": "2.2.1",
-    "istanbul": "0.4.5",
+    "mocha": "9.2.0",
-    "mocha": "6.1.4"
+    "nyc": "15.1.0",
+    "top-sites": "1.1.85"
   },
   "files": [
     "HISTORY.md",
@@ -31,10 +32,11 @@
   },
   "scripts": {
     "bench": "node benchmark/index.js",
-    "lint": "eslint --plugin markdown --ext js,md .",
+    "lint": "eslint .",
-    "test": "mocha --reporter spec --bail --check-leaks test/",
+    "test": "mocha --reporter spec --bail --check-leaks --ui qunit test/",
-    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",
+    "test-cov": "nyc --reporter=html --reporter=text npm test",
+    "update-bench": "node scripts/update-benchmark.js",
     "version": "node scripts/version-history.js && git add HISTORY.md"
   }
 }

node_modules/express-handlebars/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [5.3.5](https://github.com/express-handlebars/express-handlebars/compare/v5.3.4...v5.3.5) (2021-11-13)
+
+
+### Bug Fixes
+
+* update deps ([b516cff](https://github.com/express-handlebars/express-handlebars/commit/b516cff30ba3de90db02b3a3682c9ffbcfb10091))
+
 ## [5.3.4](https://github.com/express-handlebars/express-handlebars/compare/v5.3.3...v5.3.4) (2021-09-23)
 
 

node_modules/express-handlebars/package.json

@@ -1,7 +1,7 @@
 {
   "name": "express-handlebars",
   "description": "A Handlebars view engine for Express which doesn't suck.",
-  "version": "5.3.4",
+  "version": "5.3.5",
   "homepage": "https://github.com/express-handlebars/express-handlebars",
   "keywords": [
     "express",
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "glob": "^7.2.0",
-    "graceful-fs": "^4.2.7",
+    "graceful-fs": "^4.2.8",
     "handlebars": "^4.7.7"
   },
   "main": "index.js",
@@ -33,18 +33,18 @@
     "example": "examples"
   },
   "devDependencies": {
-    "@semantic-release/changelog": "^6.0.0",
+    "@semantic-release/changelog": "^6.0.1",
     "@semantic-release/commit-analyzer": "^9.0.1",
-    "@semantic-release/git": "^10.0.0",
+    "@semantic-release/git": "^10.0.1",
-    "@semantic-release/github": "^8.0.0",
+    "@semantic-release/github": "^8.0.2",
-    "@semantic-release/npm": "^8.0.0",
+    "@semantic-release/npm": "^8.0.3",
     "@semantic-release/release-notes-generator": "^10.0.2",
     "eslint": "^7.32.0",
     "eslint-config-standard": "^16.0.3",
-    "eslint-plugin-import": "^2.24.2",
+    "eslint-plugin-import": "^2.25.3",
     "eslint-plugin-node": "^11.1.0",
-    "eslint-plugin-promise": "^5.1.0",
+    "eslint-plugin-promise": "^5.1.1",
-    "jest-cli": "^27.2.1",
+    "jest-cli": "^27.3.1",
     "semantic-release": "^18.0.0"
   },
   "release": {

node_modules/express/History.md

@@ -1,3 +1,51 @@
+4.17.3 / 2022-02-16
+===================
+
+  * deps: accepts@~1.3.8
+    - deps: mime-types@~2.1.34
+    - deps: negotiator@0.6.3
+  * deps: body-parser@1.19.2
+    - deps: bytes@3.1.2
+    - deps: qs@6.9.7
+    - deps: raw-body@2.4.3
+  * deps: cookie@0.4.2
+  * deps: qs@6.9.7
+    * Fix handling of `__proto__` keys
+  * pref: remove unnecessary regexp for trust proxy
+
+4.17.2 / 2021-12-16
+===================
+
+  * Fix handling of `undefined` in `res.jsonp`
+  * Fix handling of `undefined` when `"json escape"` is enabled
+  * Fix incorrect middleware execution with unanchored `RegExp`s
+  * Fix `res.jsonp(obj, status)` deprecation message
+  * Fix typo in `res.is` JSDoc
+  * deps: body-parser@1.19.1
+    - deps: bytes@3.1.1
+    - deps: http-errors@1.8.1
+    - deps: qs@6.9.6
+    - deps: raw-body@2.4.2
+    - deps: safe-buffer@5.2.1
+    - deps: type-is@~1.6.18
+  * deps: content-disposition@0.5.4
+    - deps: safe-buffer@5.2.1
+  * deps: cookie@0.4.1
+    - Fix `maxAge` option to reject invalid values
+  * deps: proxy-addr@~2.0.7
+    - Use `req.socket` over deprecated `req.connection`
+    - deps: forwarded@0.2.0
+    - deps: ipaddr.js@1.9.1
+  * deps: qs@6.9.6
+  * deps: safe-buffer@5.2.1
+  * deps: send@0.17.2
+    - deps: http-errors@1.8.1
+    - deps: ms@2.1.3
+    - pref: ignore empty http tokens
+  * deps: serve-static@1.14.2
+    - deps: send@0.17.2
+  * deps: setprototypeof@1.2.0
+
 4.17.1 / 2019-05-25
 ===================
 

node_modules/express/Readme.md

@@ -4,7 +4,7 @@
 
   [![NPM Version][npm-image]][npm-url]
   [![NPM Downloads][downloads-image]][downloads-url]
-  [![Linux Build][travis-image]][travis-url]
+  [![Linux Build][ci-image]][ci-url]
   [![Windows Build][appveyor-image]][appveyor-url]
   [![Test Coverage][coveralls-image]][coveralls-url]
 
@@ -27,6 +27,9 @@ This is a [Node.js](https://nodejs.org/en/) module available through the
 Before installing, [download and install Node.js](https://nodejs.org/en/download/).
 Node.js 0.10 or higher is required.
 
+If this is a brand new project, make sure to create a `package.json` first with
+the [`npm init` command](https://docs.npmjs.com/creating-a-package-json-file).
+
 Installation is done using the
 [`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
 
@@ -95,7 +98,7 @@ $ npm start
 ## Philosophy
 
   The Express philosophy is to provide small, robust tooling for HTTP servers, making
-  it a great solution for single page applications, web sites, hybrids, or public
+  it a great solution for single page applications, websites, hybrids, or public
   HTTP APIs.
 
   Express does not force you to use any specific ORM or template engine. With support for over
@@ -143,12 +146,12 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d
 
   [MIT](LICENSE)
 
+[ci-image]: https://img.shields.io/github/workflow/status/expressjs/express/ci/master.svg?label=linux
+[ci-url]: https://github.com/expressjs/express/actions?query=workflow%3Aci
 [npm-image]: https://img.shields.io/npm/v/express.svg
 [npm-url]: https://npmjs.org/package/express
 [downloads-image]: https://img.shields.io/npm/dm/express.svg
-[downloads-url]: https://npmjs.org/package/express
+[downloads-url]: https://npmcharts.com/compare/express?minimal=true
-[travis-image]: https://img.shields.io/travis/expressjs/express/master.svg?label=linux
-[travis-url]: https://travis-ci.org/expressjs/express
 [appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/express/master.svg?label=windows
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/express
 [coveralls-image]: https://img.shields.io/coveralls/expressjs/express/master.svg

node_modules/express/lib/application.js

@@ -276,7 +276,7 @@ app.route = function route(path) {
  * In this case EJS provides a `.renderFile()` method with
  * the same signature that Express expects: `(path, options, callback)`,
  * though note that it aliases this method as `ejs.__express` internally
- * so if you're using ".ejs" extensions you dont need to do anything.
+ * so if you're using ".ejs" extensions you don't need to do anything.
  *
  * Some template engines do not follow this convention, the
  * [Consolidate.js](https://github.com/tj/consolidate.js)

node_modules/express/lib/request.js

@@ -251,7 +251,7 @@ req.param = function param(name, defaultValue) {
 
 /**
  * Check if the incoming request contains the "Content-Type"
- * header field, and it contains the give mime `type`.
+ * header field, and it contains the given mime `type`.
  *
  * Examples:
  *

node_modules/express/lib/response.js

@@ -284,9 +284,9 @@ res.jsonp = function jsonp(obj) {
 
   // allow status / body
   if (arguments.length === 2) {
-    // res.json(body, status) backwards compat
+    // res.jsonp(body, status) backwards compat
     if (typeof arguments[1] === 'number') {
-      deprecate('res.jsonp(obj, status): Use res.status(status).json(obj) instead');
+      deprecate('res.jsonp(obj, status): Use res.status(status).jsonp(obj) instead');
       this.statusCode = arguments[1];
     } else {
       deprecate('res.jsonp(status, obj): Use res.status(status).jsonp(obj) instead');
@@ -322,10 +322,15 @@ res.jsonp = function jsonp(obj) {
     // restrict callback charset
     callback = callback.replace(/[^\[\]\w$.]/g, '');
 
+    if (body === undefined) {
+      // empty argument
+      body = ''
+    } else if (typeof body === 'string') {
       // replace chars not allowed in JavaScript that are in JSON
       body = body
         .replace(/\u2028/g, '\\u2028')
-      .replace(/\u2029/g, '\\u2029');
+        .replace(/\u2029/g, '\\u2029')
+    }
 
     // the /**/ is a specific security mitigation for "Rosetta Flash JSONP abuse"
     // the typeof check is just to reduce client error noise
@@ -364,7 +369,7 @@ res.sendStatus = function sendStatus(statusCode) {
  *
  * Automatically sets the _Content-Type_ response header field.
  * The callback `callback(err)` is invoked when the transfer is complete
- * or when an error occurs. Be sure to check `res.sentHeader`
+ * or when an error occurs. Be sure to check `res.headersSent`
  * if you wish to attempt responding, as the header and some data
  * may have already been transferred.
  *
@@ -446,7 +451,7 @@ res.sendFile = function sendFile(path, options, callback) {
  *
  * Automatically sets the _Content-Type_ response header field.
  * The callback `callback(err)` is invoked when the transfer is complete
- * or when an error occurs. Be sure to check `res.sentHeader`
+ * or when an error occurs. Be sure to check `res.headersSent`
  * if you wish to attempt responding, as the header and some data
  * may have already been transferred.
  *
@@ -519,7 +524,7 @@ res.sendfile = deprecate.function(res.sendfile,
  * Optionally providing an alternate attachment `filename`,
  * and optional callback `callback(err)`. The callback is invoked
  * when the data transfer is complete, or when an error has
- * ocurred. Be sure to check `res.headersSent` if you plan to respond.
+ * occurred. Be sure to check `res.headersSent` if you plan to respond.
  *
  * Optionally providing an `options` object to use with `res.sendFile()`.
  * This function will set the `Content-Disposition` header, overriding
@@ -623,7 +628,7 @@ res.type = function contentType(type) {
  *        res.send('<p>hey</p>');
  *      },
  *
- *      'appliation/json': function(){
+ *      'application/json': function () {
  *        res.send({ message: 'hey' });
  *      }
  *    });
@@ -726,7 +731,7 @@ res.append = function append(field, val) {
     // concat the new and prev vals
     value = Array.isArray(prev) ? prev.concat(val)
       : Array.isArray(val) ? [prev].concat(val)
-      : [prev, val];
+        : [prev, val]
   }
 
   return this.set(field, value);
@@ -1122,7 +1127,7 @@ function stringify (value, replacer, spaces, escape) {
     ? JSON.stringify(value, replacer, spaces)
     : JSON.stringify(value);
 
-  if (escape) {
+  if (escape && typeof json === 'string') {
     json = json.replace(/[<>&]/g, function (c) {
       switch (c.charCodeAt(0)) {
         case 0x3c:

node_modules/express/lib/router/index.js

@@ -287,6 +287,12 @@ proto.handle = function handle(req, res, out) {
 
   function trim_prefix(layer, layerError, layerPath, path) {
     if (layerPath.length !== 0) {
+      // Validate path is a prefix match
+      if (layerPath !== path.substr(0, layerPath.length)) {
+        next(layerError)
+        return
+      }
+
       // Validate path breaks on a path separator
       var c = path[layerPath.length]
       if (c && c !== '/' && c !== '.') return next(layerError)

node_modules/express/lib/utils.js

@@ -157,6 +157,7 @@ exports.compileETag = function(val) {
 
   switch (val) {
     case true:
+    case 'weak':
       fn = exports.wetag;
       break;
     case false:
@@ -164,9 +165,6 @@ exports.compileETag = function(val) {
     case 'strong':
       fn = exports.etag;
       break;
-    case 'weak':
-      fn = exports.wetag;
-      break;
     default:
       throw new TypeError('unknown value for etag function: ' + val);
   }
@@ -191,6 +189,7 @@ exports.compileQueryParser = function compileQueryParser(val) {
 
   switch (val) {
     case true:
+    case 'simple':
       fn = querystring.parse;
       break;
     case false:
@@ -199,9 +198,6 @@ exports.compileQueryParser = function compileQueryParser(val) {
     case 'extended':
       fn = parseExtendedQueryString;
       break;
-    case 'simple':
-      fn = querystring.parse;
-      break;
     default:
       throw new TypeError('unknown value for query parser function: ' + val);
   }
@@ -232,7 +228,8 @@ exports.compileTrust = function(val) {
 
   if (typeof val === 'string') {
     // Support comma-separated values
-    val = val.split(/ *, */);
+    val = val.split(',')
+      .map(function (v) { return v.trim() })
   }
 
   return proxyaddr.compile(val || []);

node_modules/express/package.json

@@ -1,7 +1,7 @@
 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.17.1",
+  "version": "4.17.3",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Aaron Heckmann <aaron.heckmann+github@gmail.com>",
@@ -20,6 +20,7 @@
     "framework",
     "sinatra",
     "web",
+    "http",
     "rest",
     "restful",
     "router",
@@ -27,12 +28,12 @@
     "api"
   ],
   "dependencies": {
-    "accepts": "~1.3.7",
+    "accepts": "~1.3.8",
     "array-flatten": "1.1.1",
-    "body-parser": "1.19.0",
+    "body-parser": "1.19.2",
-    "content-disposition": "0.5.3",
+    "content-disposition": "0.5.4",
     "content-type": "~1.0.4",
-    "cookie": "0.4.0",
+    "cookie": "0.4.2",
     "cookie-signature": "1.0.6",
     "debug": "2.6.9",
     "depd": "~1.1.2",
@@ -46,13 +47,13 @@
     "on-finished": "~2.3.0",
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
-    "proxy-addr": "~2.0.5",
+    "proxy-addr": "~2.0.7",
-    "qs": "6.7.0",
+    "qs": "6.9.7",
     "range-parser": "~1.2.1",
-    "safe-buffer": "5.1.2",
+    "safe-buffer": "5.2.1",
-    "send": "0.17.1",
+    "send": "0.17.2",
-    "serve-static": "1.14.1",
+    "serve-static": "1.14.2",
-    "setprototypeof": "1.1.1",
+    "setprototypeof": "1.2.0",
     "statuses": "~1.5.0",
     "type-is": "~1.6.18",
     "utils-merge": "1.0.1",
@@ -60,22 +61,23 @@
   },
   "devDependencies": {
     "after": "0.8.2",
-    "connect-redis": "3.4.1",
+    "connect-redis": "3.4.2",
-    "cookie-parser": "~1.4.4",
+    "cookie-parser": "1.4.6",
-    "cookie-session": "1.3.3",
+    "cookie-session": "2.0.0",
-    "ejs": "2.6.1",
+    "ejs": "3.1.6",
-    "eslint": "2.13.1",
+    "eslint": "7.32.0",
-    "express-session": "1.16.1",
+    "express-session": "1.17.2",
-    "hbs": "4.0.4",
+    "hbs": "4.2.0",
-    "istanbul": "0.4.5",
+    "marked": "0.7.0",
-    "marked": "0.6.2",
     "method-override": "3.0.0",
-    "mocha": "5.2.0",
+    "mocha": "9.2.0",
-    "morgan": "1.9.1",
+    "morgan": "1.10.0",
-    "multiparty": "4.2.1",
+    "multiparty": "4.2.3",
+    "nyc": "15.1.0",
     "pbkdf2-password": "1.2.1",
+    "resolve-path": "1.4.0",
     "should": "13.2.3",
-    "supertest": "3.3.0",
+    "supertest": "6.2.2",
     "vhost": "~3.0.2"
   },
   "engines": {
@@ -91,8 +93,8 @@
   "scripts": {
     "lint": "eslint .",
     "test": "mocha --require test/support/env --reporter spec --bail --check-leaks test/ test/acceptance/",
-    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --require test/support/env --reporter spec --check-leaks test/ test/acceptance/",
+    "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --require test/support/env --reporter dot --check-leaks test/ test/acceptance/",
+    "test-cov": "nyc --reporter=html --reporter=text npm test",
     "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/"
   }
 }

node_modules/graceful-fs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "graceful-fs",
   "description": "A drop-in replacement for fs, making various improvements.",
-  "version": "4.2.8",
+  "version": "4.2.9",
   "repository": {
     "type": "git",
     "url": "https://github.com/isaacs/node-graceful-fs"

node_modules/graceful-fs/polyfills.js

@@ -310,8 +310,10 @@ function patch (fs) {
     return function (target, options) {
       var stats = options ? orig.call(fs, target, options)
         : orig.call(fs, target)
+      if (stats) {
         if (stats.uid < 0) stats.uid += 0x100000000
         if (stats.gid < 0) stats.gid += 0x100000000
+      }
       return stats;
     }
   }

node_modules/http-errors/HISTORY.md

@@ -1,3 +1,19 @@
+2021-11-14 / 1.8.1
+==================
+
+  * deps: toidentifier@1.0.1
+
+2020-06-29 / 1.8.0
+==================
+
+  * Add `isHttpError` export to determine if value is an HTTP error
+  * deps: setprototypeof@1.2.0
+
+2019-06-24 / 1.7.3
+==================
+
+  * deps: inherits@2.0.4
+
 2019-02-18 / 1.7.2
 ==================
 

node_modules/http-errors/README.md

@@ -3,7 +3,7 @@
 [![NPM Version][npm-version-image]][npm-url]
 [![NPM Downloads][npm-downloads-image]][node-url]
 [![Node.js Version][node-image]][node-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][ci-image]][ci-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
 Create HTTP errors for Express, Koa, Connect, etc. with ease.
@@ -53,8 +53,6 @@ This is the current API, currently extracted from Koa and subject to change.
 Create a new error object with the given message `msg`.
 The error object inherits from `createError.HttpError`.
 
-<!-- eslint-disable no-undef, no-unused-vars -->
-
 ```js
 var err = createError(404, 'This video does not exist!')
 ```
@@ -70,7 +68,7 @@ properties. This will not alter the inheritance of the given
 `error` object, and the modified `error` object is the
 return value.
 
-<!-- eslint-disable no-redeclare, no-undef, no-unused-vars -->
+<!-- eslint-disable no-redeclare -->
 
 ```js
 fs.readFile('foo.txt', function (err, buf) {
@@ -88,13 +86,19 @@ fs.readFile('foo.txt', function (err, buf) {
 - `error` - the error object to extend
 - `properties` - custom properties to attach to the object
 
+### createError.isHttpError(val)
+
+Determine if the provided `val` is an `HttpError`. This will return `true`
+if the error inherits from the `HttpError` constructor of this module or
+matches the "duck type" for an error this module creates. All outputs from
+the `createError` factory will return `true` for this function, including
+if an non-`HttpError` was passed into the factory.
+
 ### new createError\[code || name\](\[msg]\))
 
 Create a new error object with the given message `msg`.
 The error object inherits from `createError.HttpError`.
 
-<!-- eslint-disable no-undef, no-unused-vars -->
-
 ```js
 var err = new createError.NotFound()
 ```
@@ -152,6 +156,8 @@ var err = new createError.NotFound()
 
 [MIT](LICENSE)
 
+[ci-image]: https://badgen.net/github/checks/jshttp/http-errors/master?label=ci
+[ci-url]: https://github.com/jshttp/http-errors/actions?query=workflow%3Aci
 [coveralls-image]: https://badgen.net/coveralls/c/github/jshttp/http-errors/master
 [coveralls-url]: https://coveralls.io/r/jshttp/http-errors?branch=master
 [node-image]: https://badgen.net/npm/node/http-errors

node_modules/http-errors/index.js

@@ -25,6 +25,7 @@ var toIdentifier = require('toidentifier')
 
 module.exports = createError
 module.exports.HttpError = createHttpErrorConstructor()
+module.exports.isHttpError = createIsHttpErrorFunction(module.exports.HttpError)
 
 // Populate exports for all constructors
 populateConstructorExports(module.exports, statuses.codes, module.exports.HttpError)
@@ -130,7 +131,7 @@ function createHttpErrorConstructor () {
  */
 
 function createClientErrorConstructor (HttpError, name, code) {
-  var className = name.match(/Error$/) ? name : name + 'Error'
+  var className = toClassName(name)
 
   function ClientError (message) {
     // create the error object
@@ -172,13 +173,34 @@ function createClientErrorConstructor (HttpError, name, code) {
   return ClientError
 }
 
+/**
+ * Create function to test is a value is a HttpError.
+ * @private
+ */
+
+function createIsHttpErrorFunction (HttpError) {
+  return function isHttpError (val) {
+    if (!val || typeof val !== 'object') {
+      return false
+    }
+
+    if (val instanceof HttpError) {
+      return true
+    }
+
+    return val instanceof Error &&
+      typeof val.expose === 'boolean' &&
+      typeof val.statusCode === 'number' && val.status === val.statusCode
+  }
+}
+
 /**
  * Create a constructor for a server error.
  * @private
  */
 
 function createServerErrorConstructor (HttpError, name, code) {
-  var className = name.match(/Error$/) ? name : name + 'Error'
+  var className = toClassName(name)
 
   function ServerError (message) {
     // create the error object
@@ -264,3 +286,14 @@ function populateConstructorExports (exports, codes, HttpError) {
   exports["I'mateapot"] = deprecate.function(exports.ImATeapot,
     '"I\'mateapot"; use "ImATeapot" instead')
 }
+
+/**
+ * Get a class name from a name identifier.
+ * @private
+ */
+
+function toClassName (name) {
+  return name.substr(-5) !== 'Error'
+    ? name + 'Error'
+    : name
+}

node_modules/http-errors/package.json

@@ -1,7 +1,7 @@
 {
   "name": "http-errors",
   "description": "Create HTTP error objects",
-  "version": "1.7.2",
+  "version": "1.8.1",
   "author": "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",
   "contributors": [
     "Alan Plum <me@pluma.io>",
@@ -11,30 +11,30 @@
   "repository": "jshttp/http-errors",
   "dependencies": {
     "depd": "~1.1.2",
-    "inherits": "2.0.3",
+    "inherits": "2.0.4",
-    "setprototypeof": "1.1.1",
+    "setprototypeof": "1.2.0",
     "statuses": ">= 1.5.0 < 2",
-    "toidentifier": "1.0.0"
+    "toidentifier": "1.0.1"
   },
   "devDependencies": {
-    "eslint": "5.13.0",
+    "eslint": "7.32.0",
-    "eslint-config-standard": "12.0.0",
+    "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.16.0",
+    "eslint-plugin-import": "2.25.3",
-    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-markdown": "2.2.1",
-    "eslint-plugin-node": "7.0.1",
+    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "4.0.1",
+    "eslint-plugin-promise": "5.1.1",
-    "eslint-plugin-standard": "4.0.0",
+    "eslint-plugin-standard": "4.1.0",
-    "istanbul": "0.4.5",
+    "mocha": "9.1.3",
-    "mocha": "5.2.0"
+    "nyc": "15.1.0"
   },
   "engines": {
     "node": ">= 0.6"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md . && node ./scripts/lint-readme-list.js",
+    "lint": "eslint . && node ./scripts/lint-readme-list.js",
     "test": "mocha --reporter spec --bail",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter dot"
+    "test-cov": "nyc --reporter=html --reporter=text npm test"
   },
   "keywords": [
     "http",

node_modules/inherits/inherits.js

@@ -1,7 +1,9 @@
 try {
   var util = require('util');
+  /* istanbul ignore next */
   if (typeof util.inherits !== 'function') throw '';
   module.exports = util.inherits;
 } catch (e) {
+  /* istanbul ignore next */
   module.exports = require('./inherits_browser.js');
 }

node_modules/inherits/inherits_browser.js

@@ -1,6 +1,7 @@
 if (typeof Object.create === 'function') {
   // implementation from standard node.js 'util' module
   module.exports = function inherits(ctor, superCtor) {
+    if (superCtor) {
       ctor.super_ = superCtor
       ctor.prototype = Object.create(superCtor.prototype, {
         constructor: {
@@ -9,15 +10,18 @@ if (typeof Object.create === 'function') {
           writable: true,
           configurable: true
         }
-    });
+      })
+    }
   };
 } else {
   // old school shim for old browsers
   module.exports = function inherits(ctor, superCtor) {
+    if (superCtor) {
       ctor.super_ = superCtor
       var TempCtor = function () {}
       TempCtor.prototype = superCtor.prototype
       ctor.prototype = new TempCtor()
       ctor.prototype.constructor = ctor
     }
+  }
 }

node_modules/inherits/package.json

@@ -1,7 +1,7 @@
 {
   "name": "inherits",
   "description": "Browser-friendly inheritance fully compatible with standard node.js inherits()",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "keywords": [
     "inheritance",
     "class",
@@ -17,10 +17,10 @@
   "repository": "git://github.com/isaacs/inherits",
   "license": "ISC",
   "scripts": {
-    "test": "node test"
+    "test": "tap"
   },
   "devDependencies": {
-    "tap": "^7.1.0"
+    "tap": "^14.2.4"
   },
   "files": [
     "inherits.js",

node_modules/mime-db/HISTORY.md

@@ -1,3 +1,18 @@
+1.52.0 / 2022-02-21
+===================
+
+  * Add extensions from IANA for more `image/*` types
+  * Add extension `.asc` to `application/pgp-keys`
+  * Add extensions to various XML types
+  * Add new upstream MIME types
+
+1.51.0 / 2021-11-08
+===================
+
+  * Add new upstream MIME types
+  * Mark `image/vnd.microsoft.icon` as compressible
+  * Mark `image/vnd.ms-dds` as compressible
+
 1.50.0 / 2021-09-15
 ===================
 

node_modules/mime-db/LICENSE

@@ -1,22 +1,23 @@
+(The MIT License)
 
-The MIT License (MIT)
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015-2022 Douglas Christopher Wilson <doug@somethingdoug.com>
 
-Copyright (c) 2014 Jonathan Ong me@jongleberry.com
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
+The above copyright notice and this permission notice shall be
-of this software and associated documentation files (the "Software"), to deal
+included in all copies or substantial portions of the Software.
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-all copies or substantial portions of the Software.
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.

node_modules/mime-db/README.md

@@ -6,7 +6,7 @@
 [![Build Status][ci-image]][ci-url]
 [![Coverage Status][coveralls-image]][coveralls-url]
 
-This is a database of all mime types.
+This is a large database of mime types and information about them.
 It consists of a single, public JSON file and does not include any logic,
 allowing it to remain as un-opinionated as possible with an API.
 It aggregates data from the following sources:

node_modules/mime-db/db.json

@@ -250,6 +250,10 @@
   "application/cfw": {
     "source": "iana"
   },
+  "application/city+json": {
+    "source": "iana",
+    "compressible": true
+  },
   "application/clr": {
     "source": "iana"
   },
@@ -293,7 +297,8 @@
   },
   "application/cpl+xml": {
     "source": "iana",
-    "compressible": true
+    "compressible": true,
+    "extensions": ["cpl"]
   },
   "application/csrattrs": {
     "source": "iana"
@@ -328,6 +333,11 @@
     "compressible": true,
     "extensions": ["mpd"]
   },
+  "application/dash-patch+xml": {
+    "source": "iana",
+    "compressible": true,
+    "extensions": ["mpp"]
+  },
   "application/dashdelta": {
     "source": "iana"
   },
@@ -868,7 +878,8 @@
   },
   "application/media-policy-dataset+xml": {
     "source": "iana",
-    "compressible": true
+    "compressible": true,
+    "extensions": ["mpf"]
   },
   "application/media_control+xml": {
     "source": "iana",
@@ -1024,6 +1035,9 @@
   "application/oauth-authz-req+jwt": {
     "source": "iana"
   },
+  "application/oblivious-dns-message": {
+    "source": "iana"
+  },
   "application/ocsp-request": {
     "source": "iana"
   },
@@ -1116,7 +1130,8 @@
     "extensions": ["pgp"]
   },
   "application/pgp-keys": {
-    "source": "iana"
+    "source": "iana",
+    "extensions": ["asc"]
   },
   "application/pgp-signature": {
     "source": "iana",
@@ -1536,6 +1551,10 @@
     "compressible": true,
     "extensions": ["srx"]
   },
+  "application/spdx+json": {
+    "source": "iana",
+    "compressible": true
+  },
   "application/spirits-event+xml": {
     "source": "iana",
     "compressible": true
@@ -2017,6 +2036,10 @@
   "application/vnd.afpc.modca-pagesegment": {
     "source": "iana"
   },
+  "application/vnd.age": {
+    "source": "iana",
+    "extensions": ["age"]
+  },
   "application/vnd.ah-barcode": {
     "source": "iana"
   },
@@ -2639,6 +2662,10 @@
   "application/vnd.ecip.rlp": {
     "source": "iana"
   },
+  "application/vnd.eclipse.ditto+json": {
+    "source": "iana",
+    "compressible": true
+  },
   "application/vnd.ecowin.chart": {
     "source": "iana",
     "extensions": ["mag"]
@@ -2796,6 +2823,10 @@
   "application/vnd.etsi.tsl.der": {
     "source": "iana"
   },
+  "application/vnd.eu.kasparian.car+json": {
+    "source": "iana",
+    "compressible": true
+  },
   "application/vnd.eudora.data": {
     "source": "iana"
   },
@@ -2826,6 +2857,10 @@
   "application/vnd.f-secure.mobile": {
     "source": "iana"
   },
+  "application/vnd.familysearch.gedcom+zip": {
+    "source": "iana",
+    "compressible": false
+  },
   "application/vnd.fastcopy-disk-image": {
     "source": "iana"
   },
@@ -3116,6 +3151,16 @@
     "source": "iana",
     "extensions": ["les"]
   },
+  "application/vnd.hl7cda+xml": {
+    "source": "iana",
+    "charset": "UTF-8",
+    "compressible": true
+  },
+  "application/vnd.hl7v2+xml": {
+    "source": "iana",
+    "charset": "UTF-8",
+    "compressible": true
+  },
   "application/vnd.hp-hpgl": {
     "source": "iana",
     "extensions": ["hpgl"]
@@ -3529,6 +3574,10 @@
     "source": "iana",
     "compressible": true
   },
+  "application/vnd.maxar.archive.3tz+zip": {
+    "source": "iana",
+    "compressible": false
+  },
   "application/vnd.maxmind.maxmind-db": {
     "source": "iana"
   },
@@ -3858,6 +3907,10 @@
     "source": "iana",
     "extensions": ["taglet"]
   },
+  "application/vnd.nacamar.ybrid+json": {
+    "source": "iana",
+    "compressible": true
+  },
   "application/vnd.ncd.control": {
     "source": "iana"
   },
@@ -5145,6 +5198,10 @@
     "source": "iana",
     "compressible": true
   },
+  "application/vnd.syft+json": {
+    "source": "iana",
+    "compressible": true
+  },
   "application/vnd.symbian.install": {
     "source": "apache",
     "extensions": ["sis","sisx"]
@@ -5535,7 +5592,8 @@
   },
   "application/watcherinfo+xml": {
     "source": "iana",
-    "compressible": true
+    "compressible": true,
+    "extensions": ["wif"]
   },
   "application/webpush-options+json": {
     "source": "iana",
@@ -6955,10 +7013,12 @@
     "extensions": ["apng"]
   },
   "image/avci": {
-    "source": "iana"
+    "source": "iana",
+    "extensions": ["avci"]
   },
   "image/avcs": {
-    "source": "iana"
+    "source": "iana",
+    "extensions": ["avcs"]
   },
   "image/avif": {
     "source": "iana",
@@ -7192,6 +7252,7 @@
   },
   "image/vnd.microsoft.icon": {
     "source": "iana",
+    "compressible": true,
     "extensions": ["ico"]
   },
   "image/vnd.mix": {
@@ -7201,6 +7262,7 @@
     "source": "iana"
   },
   "image/vnd.ms-dds": {
+    "compressible": true,
     "extensions": ["dds"]
   },
   "image/vnd.ms-modi": {
@@ -7890,6 +7952,10 @@
     "source": "iana",
     "charset": "UTF-8"
   },
+  "text/vnd.familysearch.gedcom": {
+    "source": "iana",
+    "extensions": ["ged"]
+  },
   "text/vnd.ficlab.flt": {
     "source": "iana"
   },

node_modules/mime-db/index.js

@@ -1,6 +1,7 @@
 /*!
  * mime-db
  * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2015-2022 Douglas Christopher Wilson
  * MIT Licensed
  */
 

node_modules/mime-db/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mime-db",
   "description": "Media Type Database",
-  "version": "1.50.0",
+  "version": "1.52.0",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",
@@ -25,15 +25,16 @@
     "csv-parse": "4.16.3",
     "eslint": "7.32.0",
     "eslint-config-standard": "15.0.1",
-    "eslint-plugin-import": "2.24.2",
+    "eslint-plugin-import": "2.25.4",
     "eslint-plugin-markdown": "2.2.1",
     "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "5.1.0",
+    "eslint-plugin-promise": "5.1.1",
     "eslint-plugin-standard": "4.1.0",
     "gnode": "0.1.2",
-    "mocha": "9.1.1",
+    "media-typer": "1.1.0",
+    "mocha": "9.2.1",
     "nyc": "15.1.0",
-    "raw-body": "2.4.1",
+    "raw-body": "2.5.0",
     "stream-to-array": "2.3.0"
   },
   "files": [

node_modules/mime-types/HISTORY.md

@@ -1,3 +1,18 @@
+2.1.35 / 2022-03-12
+===================
+
+  * deps: mime-db@1.52.0
+    - Add extensions from IANA for more `image/*` types
+    - Add extension `.asc` to `application/pgp-keys`
+    - Add extensions to various XML types
+    - Add new upstream MIME types
+
+2.1.34 / 2021-11-08
+===================
+
+  * deps: mime-db@1.51.0
+    - Add new upstream MIME types
+
 2.1.33 / 2021-10-01
 ===================
 
@@ -18,7 +33,6 @@
   * deps: mime-db@1.48.0
     - Add extension `.mvt` to `application/vnd.mapbox-vector-tile`
     - Add new upstream MIME types
-    - Mark `text/yaml` as compressible
 
 2.1.30 / 2021-04-02
 ===================
@@ -96,7 +110,6 @@
     - Add extension `.nq` to `application/n-quads`
     - Add extension `.nt` to `application/n-triples`
     - Add new upstream MIME types
-    - Mark `text/less` as compressible
 
 2.1.21 / 2018-10-19
 ===================
@@ -349,7 +362,6 @@
 
   * deps: mime-db@~1.1.0
     - Add new mime types
-    - Add additional compressible
     - Update charsets
 
 2.0.1 / 2014-09-07

node_modules/mime-types/README.md

@@ -103,7 +103,7 @@ A map of extensions by content-type.
 [MIT](LICENSE)
 
 [ci-image]: https://badgen.net/github/checks/jshttp/mime-types/master?label=ci
-[ci-url]: https://github.com/jshttp/mime-types/actions?query=workflow%3Aci
+[ci-url]: https://github.com/jshttp/mime-types/actions/workflows/ci.yml
 [coveralls-image]: https://badgen.net/coveralls/c/github/jshttp/mime-types/master
 [coveralls-url]: https://coveralls.io/r/jshttp/mime-types?branch=master
 [node-version-image]: https://badgen.net/npm/node/mime-types

node_modules/mime-types/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mime-types",
   "description": "The ultimate javascript content-type utility.",
-  "version": "2.1.33",
+  "version": "2.1.35",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jeremiah Senkpiel <fishrock123@rocketmail.com> (https://searchbeam.jit.su)",
@@ -14,17 +14,17 @@
   ],
   "repository": "jshttp/mime-types",
   "dependencies": {
-    "mime-db": "1.50.0"
+    "mime-db": "1.52.0"
   },
   "devDependencies": {
     "eslint": "7.32.0",
     "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.24.2",
+    "eslint-plugin-import": "2.25.4",
     "eslint-plugin-markdown": "2.2.1",
     "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "5.1.0",
+    "eslint-plugin-promise": "5.2.0",
     "eslint-plugin-standard": "4.1.0",
-    "mocha": "9.1.2",
+    "mocha": "9.2.2",
     "nyc": "15.1.0"
   },
   "files": [

node_modules/minimatch/README.md

@@ -2,7 +2,7 @@
 
 A minimal matching utility.
 
-[![Build Status](https://secure.travis-ci.org/isaacs/minimatch.svg)](http://travis-ci.org/isaacs/minimatch)
+[![Build Status](https://travis-ci.org/isaacs/minimatch.svg?branch=master)](http://travis-ci.org/isaacs/minimatch)
 
 
 This is the matching library used internally by npm.
@@ -171,6 +171,27 @@ Suppress the behavior of treating a leading `!` character as negation.
 Returns from negate expressions the same as if they were not negated.
 (Ie, true on a hit, false on a miss.)
 
+### partial
+
+Compare a partial path to a pattern.  As long as the parts of the path that
+are present are not contradicted by the pattern, it will be treated as a
+match.  This is useful in applications where you're walking through a
+folder structure, and don't yet have the full path, but want to ensure that
+you do not walk down paths that can never be a match.
+
+For example,
+
+```js
+minimatch('/a/b', '/a/*/c/d', { partial: true })  // true, might be /a/b/c/d
+minimatch('/a/b', '/**/d', { partial: true })     // true, might be /a/b/.../d
+minimatch('/x/y/z', '/a/**/z', { partial: true }) // false, because x !== a
+```
+
+### allowWindowsEscape
+
+Windows path separator `\` is by default converted to `/`, which
+prohibits the usage of `\` as a escape character. This flag skips that
+behavior and allows using the escape character.
 
 ## Comparisons to other fnmatch/glob implementations
 

node_modules/minimatch/minimatch.js

@@ -1,10 +1,10 @@
 module.exports = minimatch
 minimatch.Minimatch = Minimatch
 
-var path = { sep: '/' }
+var path = (function () { try { return require('path') } catch (e) {}}()) || {
-try {
+  sep: '/'
-  path = require('path')
+}
-} catch (er) {}
+minimatch.sep = path.sep
 
 var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {}
 var expand = require('brace-expansion')
@@ -56,43 +56,64 @@ function filter (pattern, options) {
 }
 
 function ext (a, b) {
-  a = a || {}
   b = b || {}
   var t = {}
-  Object.keys(b).forEach(function (k) {
-    t[k] = b[k]
-  })
   Object.keys(a).forEach(function (k) {
     t[k] = a[k]
   })
+  Object.keys(b).forEach(function (k) {
+    t[k] = b[k]
+  })
   return t
 }
 
 minimatch.defaults = function (def) {
-  if (!def || !Object.keys(def).length) return minimatch
+  if (!def || typeof def !== 'object' || !Object.keys(def).length) {
+    return minimatch
+  }
 
   var orig = minimatch
 
   var m = function minimatch (p, pattern, options) {
-    return orig.minimatch(p, pattern, ext(def, options))
+    return orig(p, pattern, ext(def, options))
   }
 
   m.Minimatch = function Minimatch (pattern, options) {
     return new orig.Minimatch(pattern, ext(def, options))
   }
+  m.Minimatch.defaults = function defaults (options) {
+    return orig.defaults(ext(def, options)).Minimatch
+  }
+
+  m.filter = function filter (pattern, options) {
+    return orig.filter(pattern, ext(def, options))
+  }
+
+  m.defaults = function defaults (options) {
+    return orig.defaults(ext(def, options))
+  }
+
+  m.makeRe = function makeRe (pattern, options) {
+    return orig.makeRe(pattern, ext(def, options))
+  }
+
+  m.braceExpand = function braceExpand (pattern, options) {
+    return orig.braceExpand(pattern, ext(def, options))
+  }
+
+  m.match = function (list, pattern, options) {
+    return orig.match(list, pattern, ext(def, options))
+  }
 
   return m
 }
 
 Minimatch.defaults = function (def) {
-  if (!def || !Object.keys(def).length) return Minimatch
   return minimatch.defaults(def).Minimatch
 }
 
 function minimatch (p, pattern, options) {
-  if (typeof pattern !== 'string') {
+  assertValidPattern(pattern)
-    throw new TypeError('glob pattern string required')
-  }
 
   if (!options) options = {}
 
@@ -101,9 +122,6 @@ function minimatch (p, pattern, options) {
     return false
   }
 
-  // "" only matches ""
-  if (pattern.trim() === '') return p === ''
-
   return new Minimatch(pattern, options).match(p)
 }
 
@@ -112,15 +130,14 @@ function Minimatch (pattern, options) {
     return new Minimatch(pattern, options)
   }
 
-  if (typeof pattern !== 'string') {
+  assertValidPattern(pattern)
-    throw new TypeError('glob pattern string required')
-  }
 
   if (!options) options = {}
+
   pattern = pattern.trim()
 
   // windows support: need to use /, not \
-  if (path.sep !== '/') {
+  if (!options.allowWindowsEscape && path.sep !== '/') {
     pattern = pattern.split(path.sep).join('/')
   }
 
@@ -131,6 +148,7 @@ function Minimatch (pattern, options) {
   this.negate = false
   this.comment = false
   this.empty = false
+  this.partial = !!options.partial
 
   // make the set of regexps etc.
   this.make()
@@ -140,9 +158,6 @@ Minimatch.prototype.debug = function () {}
 
 Minimatch.prototype.make = make
 function make () {
-  // don't do it more than once.
-  if (this._made) return
-
   var pattern = this.pattern
   var options = this.options
 
@@ -162,7 +177,7 @@ function make () {
   // step 2: expand braces
   var set = this.globSet = this.braceExpand()
 
-  if (options.debug) this.debug = console.error
+  if (options.debug) this.debug = function debug() { console.error.apply(console, arguments) }
 
   this.debug(this.pattern, set)
 
@@ -242,12 +257,11 @@ function braceExpand (pattern, options) {
   pattern = typeof pattern === 'undefined'
     ? this.pattern : pattern
 
-  if (typeof pattern === 'undefined') {
+  assertValidPattern(pattern)
-    throw new TypeError('undefined pattern')
-  }
 
-  if (options.nobrace ||
+  // Thanks to Yeting Li <https://github.com/yetingli> for
-    !pattern.match(/\{.*\}/)) {
+  // improving this regexp to avoid a ReDOS vulnerability.
+  if (options.nobrace || !/\{(?:(?!\{).)*\}/.test(pattern)) {
     // shortcut. no need to expand.
     return [pattern]
   }
@@ -255,6 +269,17 @@ function braceExpand (pattern, options) {
   return expand(pattern)
 }
 
+var MAX_PATTERN_LENGTH = 1024 * 64
+var assertValidPattern = function (pattern) {
+  if (typeof pattern !== 'string') {
+    throw new TypeError('invalid pattern')
+  }
+
+  if (pattern.length > MAX_PATTERN_LENGTH) {
+    throw new TypeError('pattern is too long')
+  }
+}
+
 // parse a component of the expanded set.
 // At this point, no pattern may contain "/" in it
 // so we're going to return a 2d array, where each entry is the full
@@ -269,14 +294,17 @@ function braceExpand (pattern, options) {
 Minimatch.prototype.parse = parse
 var SUBPARSE = {}
 function parse (pattern, isSub) {
-  if (pattern.length > 1024 * 64) {
+  assertValidPattern(pattern)
-    throw new TypeError('pattern is too long')
-  }
 
   var options = this.options
 
   // shortcuts
-  if (!options.noglobstar && pattern === '**') return GLOBSTAR
+  if (pattern === '**') {
+    if (!options.noglobstar)
+      return GLOBSTAR
+    else
+      pattern = '*'
+  }
   if (pattern === '') return ''
 
   var re = ''
@@ -332,10 +360,12 @@ function parse (pattern, isSub) {
     }
 
     switch (c) {
-      case '/':
+      /* istanbul ignore next */
+      case '/': {
         // completely not allowed, even escaped.
         // Should already be path-split by now.
         return false
+      }
 
       case '\\':
         clearStateChar()
@@ -454,7 +484,6 @@ function parse (pattern, isSub) {
 
         // handle the case where we left a class open.
         // "[z-a]" is valid, equivalent to "\[z-a\]"
-        if (inClass) {
         // split where the last [ was, make sure we don't have
         // an invalid re. if so, re-walk the contents of the
         // would-be class to re-translate any characters that
@@ -473,7 +502,6 @@ function parse (pattern, isSub) {
           inClass = false
           continue
         }
-        }
 
         // finish up the class.
         hasMagic = true
@@ -556,9 +584,7 @@ function parse (pattern, isSub) {
   // something that could conceivably capture a dot
   var addPatternStart = false
   switch (re.charAt(0)) {
-    case '.':
+    case '[': case '.': case '(': addPatternStart = true
-    case '[':
-    case '(': addPatternStart = true
   }
 
   // Hack to work around lack of negative lookbehind in JS
@@ -620,7 +646,7 @@ function parse (pattern, isSub) {
   var flags = options.nocase ? 'i' : ''
   try {
     var regExp = new RegExp('^' + re + '$', flags)
-  } catch (er) {
+  } catch (er) /* istanbul ignore next - should be impossible */ {
     // If it was an invalid regular expression, then it can't match
     // anything.  This trick looks for a character after the end of
     // the string, which is of course impossible, except in multi-line
@@ -678,7 +704,7 @@ function makeRe () {
 
   try {
     this.regexp = new RegExp(re, flags)
-  } catch (ex) {
+  } catch (ex) /* istanbul ignore next - should be impossible */ {
     this.regexp = false
   }
   return this.regexp
@@ -696,8 +722,8 @@ minimatch.match = function (list, pattern, options) {
   return list
 }
 
-Minimatch.prototype.match = match
+Minimatch.prototype.match = function match (f, partial) {
-function match (f, partial) {
+  if (typeof partial === 'undefined') partial = this.partial
   this.debug('match', f, this.pattern)
   // short-circuit in the case of busted things.
   // comments, etc.
@@ -779,6 +805,7 @@ Minimatch.prototype.matchOne = function (file, pattern, partial) {
 
     // should be impossible.
     // some invalid regexp stuff in the set.
+    /* istanbul ignore if */
     if (p === false) return false
 
     if (p === GLOBSTAR) {
@@ -852,6 +879,7 @@ Minimatch.prototype.matchOne = function (file, pattern, partial) {
       // no match was found.
       // However, in partial mode, we can't say this is necessarily over.
       // If there's more *pattern* left, then
+      /* istanbul ignore if */
       if (partial) {
         // ran out of file
         this.debug('\n>>> no match, partial?', file, fr, pattern, pr)
@@ -865,11 +893,7 @@ Minimatch.prototype.matchOne = function (file, pattern, partial) {
     // patterns with magic have been turned into regexps.
     var hit
     if (typeof p === 'string') {
-      if (options.nocase) {
-        hit = f.toLowerCase() === p.toLowerCase()
-      } else {
       hit = f === p
-      }
       this.debug('string match', p, f, hit)
     } else {
       hit = f.match(p)
@@ -900,16 +924,16 @@ Minimatch.prototype.matchOne = function (file, pattern, partial) {
     // this is ok if we're doing the match as part of
     // a glob fs traversal.
     return partial
-  } else if (pi === pl) {
+  } else /* istanbul ignore else */ if (pi === pl) {
     // ran out of pattern, still have file left.
     // this is only acceptable if we're on the very last
     // empty segment of a file with a trailing slash.
     // a/* should match a/b/
-    var emptyFileEnd = (fi === fl - 1) && (file[fi] === '')
+    return (fi === fl - 1) && (file[fi] === '')
-    return emptyFileEnd
   }
 
   // should be unreachable.
+  /* istanbul ignore next */
   throw new Error('wtf?')
 }
 

node_modules/minimatch/package.json

@@ -2,14 +2,17 @@
   "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
   "name": "minimatch",
   "description": "a glob matcher in javascript",
-  "version": "3.0.4",
+  "version": "3.1.2",
+  "publishConfig": {
+    "tag": "v3-legacy"
+  },
   "repository": {
     "type": "git",
     "url": "git://github.com/isaacs/minimatch.git"
   },
   "main": "minimatch.js",
   "scripts": {
-    "test": "tap test/*.js --cov",
+    "test": "tap",
     "preversion": "npm test",
     "postversion": "npm publish",
     "postpublish": "git push origin --all; git push origin --tags"
@@ -21,7 +24,7 @@
     "brace-expansion": "^1.1.7"
   },
   "devDependencies": {
-    "tap": "^10.3.2"
+    "tap": "^15.1.6"
   },
   "license": "ISC",
   "files": [

node_modules/negotiator/HISTORY.md

@@ -1,3 +1,8 @@
+0.6.3 / 2022-01-22
+==================
+
+  * Revert "Lazy-load modules from main entry point"
+
 0.6.2 / 2019-04-29
 ==================
 

node_modules/negotiator/README.md

@@ -3,7 +3,7 @@
 [![NPM Version][npm-image]][npm-url]
 [![NPM Downloads][downloads-image]][downloads-url]
 [![Node.js Version][node-version-image]][node-version-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][github-actions-ci-image]][github-actions-ci-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
 An HTTP content negotiator for Node.js
@@ -195,9 +195,9 @@ and more.
 [npm-url]: https://npmjs.org/package/negotiator
 [node-version-image]: https://img.shields.io/node/v/negotiator.svg
 [node-version-url]: https://nodejs.org/en/download/
-[travis-image]: https://img.shields.io/travis/jshttp/negotiator/master.svg
-[travis-url]: https://travis-ci.org/jshttp/negotiator
 [coveralls-image]: https://img.shields.io/coveralls/jshttp/negotiator/master.svg
 [coveralls-url]: https://coveralls.io/r/jshttp/negotiator?branch=master
 [downloads-image]: https://img.shields.io/npm/dm/negotiator.svg
 [downloads-url]: https://npmjs.org/package/negotiator
+[github-actions-ci-image]: https://img.shields.io/github/workflow/status/jshttp/negotiator/ci/master?label=ci
+[github-actions-ci-url]: https://github.com/jshttp/negotiator/actions/workflows/ci.yml

node_modules/negotiator/index.js

@@ -8,12 +8,10 @@
 
 'use strict';
 
-/**
+var preferredCharsets = require('./lib/charset')
- * Cached loaded submodules.
+var preferredEncodings = require('./lib/encoding')
- * @private
+var preferredLanguages = require('./lib/language')
- */
+var preferredMediaTypes = require('./lib/mediaType')
-
-var modules = Object.create(null);
 
 /**
  * Module exports.
@@ -43,7 +41,6 @@ Negotiator.prototype.charset = function charset(available) {
 };
 
 Negotiator.prototype.charsets = function charsets(available) {
-  var preferredCharsets = loadModule('charset').preferredCharsets;
   return preferredCharsets(this.request.headers['accept-charset'], available);
 };
 
@@ -53,7 +50,6 @@ Negotiator.prototype.encoding = function encoding(available) {
 };
 
 Negotiator.prototype.encodings = function encodings(available) {
-  var preferredEncodings = loadModule('encoding').preferredEncodings;
   return preferredEncodings(this.request.headers['accept-encoding'], available);
 };
 
@@ -63,7 +59,6 @@ Negotiator.prototype.language = function language(available) {
 };
 
 Negotiator.prototype.languages = function languages(available) {
-  var preferredLanguages = loadModule('language').preferredLanguages;
   return preferredLanguages(this.request.headers['accept-language'], available);
 };
 
@@ -73,7 +68,6 @@ Negotiator.prototype.mediaType = function mediaType(available) {
 };
 
 Negotiator.prototype.mediaTypes = function mediaTypes(available) {
-  var preferredMediaTypes = loadModule('mediaType').preferredMediaTypes;
   return preferredMediaTypes(this.request.headers.accept, available);
 };
 
@@ -86,39 +80,3 @@ Negotiator.prototype.preferredLanguage = Negotiator.prototype.language;
 Negotiator.prototype.preferredLanguages = Negotiator.prototype.languages;
 Negotiator.prototype.preferredMediaType = Negotiator.prototype.mediaType;
 Negotiator.prototype.preferredMediaTypes = Negotiator.prototype.mediaTypes;
-
-/**
- * Load the given module.
- * @private
- */
-
-function loadModule(moduleName) {
-  var module = modules[moduleName];
-
-  if (module !== undefined) {
-    return module;
-  }
-
-  // This uses a switch for static require analysis
-  switch (moduleName) {
-    case 'charset':
-      module = require('./lib/charset');
-      break;
-    case 'encoding':
-      module = require('./lib/encoding');
-      break;
-    case 'language':
-      module = require('./lib/language');
-      break;
-    case 'mediaType':
-      module = require('./lib/mediaType');
-      break;
-    default:
-      throw new Error('Cannot find module \'' + moduleName + '\'');
-  }
-
-  // Store to prevent invoking require()
-  modules[moduleName] = module;
-
-  return module;
-}

node_modules/negotiator/lib/language.js

@@ -54,9 +54,9 @@ function parseLanguage(str, i) {
   var match = simpleLanguageRegExp.exec(str);
   if (!match) return null;
 
-  var prefix = match[1],
+  var prefix = match[1]
-    suffix = match[2],
+  var suffix = match[2]
-    full = prefix;
+  var full = prefix
 
   if (suffix) full += "-" + suffix;
 

node_modules/negotiator/package.json

@@ -1,7 +1,7 @@
 {
   "name": "negotiator",
   "description": "HTTP content negotiation",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Federico Romero <federico.romero@outboxlabs.com>",
@@ -18,10 +18,10 @@
   ],
   "repository": "jshttp/negotiator",
   "devDependencies": {
-    "eslint": "5.16.0",
+    "eslint": "7.32.0",
-    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-markdown": "2.2.1",
-    "mocha": "6.1.4",
+    "mocha": "9.1.3",
-    "nyc": "14.0.0"
+    "nyc": "15.1.0"
   },
   "files": [
     "lib/",
@@ -34,9 +34,9 @@
     "node": ">= 0.6"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md .",
+    "lint": "eslint .",
     "test": "mocha --reporter spec --check-leaks --bail test/",
-    "test-cov": "nyc --reporter=html --reporter=text npm test",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
-    "test-travis": "nyc --reporter=text npm test"
+    "test-cov": "nyc --reporter=html --reporter=text npm test"
   }
 }

node_modules/qs/.editorconfig

@@ -8,10 +8,14 @@ charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
 max_line_length = 160
+quote_type = single
 
 [test/*]
 max_line_length = off
 
+[LICENSE.md]
+indent_size = off
+
 [*.md]
 max_line_length = off
 
@@ -28,3 +32,9 @@ indent_size = 2
 [LICENSE]
 indent_size = 2
 max_line_length = off
+
+[coverage/**/*]
+indent_size = off
+indent_style = off
+indent = off
+max_line_length = off

node_modules/qs/.eslintignore

@@ -1 +0,0 @@
-dist

node_modules/qs/.eslintrc

@@ -3,6 +3,10 @@
 
     "extends": "@ljharb",
 
+    "ignorePatterns": [
+        "dist/",
+    ],
+
     "rules": {
         "complexity": 0,
         "consistent-return": 1,
@@ -10,12 +14,25 @@
         "id-length": [2, { "min": 1, "max": 25, "properties": "never" }],
         "indent": [2, 4],
         "max-lines-per-function": [2, { "max": 150 }],
-        "max-params": [2, 14],
+        "max-params": [2, 15],
         "max-statements": [2, 52],
         "multiline-comment-style": 0,
         "no-continue": 1,
         "no-magic-numbers": 0,
         "no-restricted-syntax": [2, "BreakStatement", "DebuggerStatement", "ForInStatement", "LabeledStatement", "WithStatement"],
-        "operator-linebreak": [2, "before"],
+    },
+
+    "overrides": [
+        {
+            "files": "test/**",
+            "rules": {
+                "function-paren-newline": 0,
+                "max-lines-per-function": 0,
+                "max-statements": 0,
+                "no-buffer-constructor": 0,
+                "no-extend-native": 0,
+                "no-throw-literal": 0,
             }
+        }
+    ]
 }

node_modules/qs/.github/FUNDING.yml

@@ -0,0 +1,12 @@
+# These are supported funding model platforms
+
+github: [ljharb]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: npm/qs
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+custom: # Replace with a single custom sponsorship URL

node_modules/qs/.nycrc

@@ -0,0 +1,13 @@
+{
+	"all": true,
+	"check-coverage": false,
+	"reporter": ["text-summary", "text", "html", "json"],
+	"lines": 86,
+	"statements": 85.93,
+	"functions": 82.43,
+	"branches": 76.06,
+	"exclude": [
+		"coverage",
+		"dist"
+	]
+}

node_modules/qs/CHANGELOG.md

@@ -1,3 +1,118 @@
+## **6.9.7**
+- [Fix] `parse`: ignore `__proto__` keys (#428)
+- [Fix] `stringify`: avoid encoding arrayformat comma when `encodeValuesOnly = true` (#424)
+- [Robustness] `stringify`: avoid relying on a global `undefined` (#427)
+- [readme] remove travis badge; add github actions/codecov badges; update URLs
+- [Docs] add note and links for coercing primitive values (#408)
+- [Tests] clean up stringify tests slightly
+- [meta] fix README.md (#399)
+- Revert "[meta] ignore eclint transitive audit warning"
+- [actions] backport actions from main
+- [Dev Deps] backport updates from main
+
+## **6.9.6**
+- [Fix] restore `dist` dir; mistakenly removed in d4f6c32
+
+## **6.9.5**
+- [Fix] `stringify`: do not encode parens for RFC1738
+- [Fix] `stringify`: fix arrayFormat comma with empty array/objects (#350)
+- [Refactor] `format`: remove `util.assign` call
+- [meta] add "Allow Edits" workflow; update rebase workflow
+- [actions] switch Automatic Rebase workflow to `pull_request_target` event
+- [Tests] `stringify`: add tests for #378
+- [Tests] migrate tests to Github Actions
+- [Tests] run `nyc` on all tests; use `tape` runner
+- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `browserify`, `mkdirp`, `object-inspect`, `tape`; add `aud`
+
+## **6.9.4**
+- [Fix] `stringify`: when `arrayFormat` is `comma`, respect `serializeDate` (#364)
+- [Refactor] `stringify`: reduce branching (part of #350)
+- [Refactor] move `maybeMap` to `utils`
+- [Dev Deps] update `browserify`, `tape`
+
+## **6.9.3**
+- [Fix] proper comma parsing of URL-encoded commas (#361)
+- [Fix] parses comma delimited array while having percent-encoded comma treated as normal text (#336)
+
+## **6.9.2**
+- [Fix] `parse`: Fix parsing array from object with `comma` true (#359)
+- [Fix] `parse`: throw a TypeError instead of an Error for bad charset (#349)
+- [meta] ignore eclint transitive audit warning
+- [meta] fix indentation in package.json
+- [meta] add tidelift marketing copy
+- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `object-inspect`, `has-symbols`, `tape`, `mkdirp`, `iconv-lite`
+- [actions] add automatic rebasing / merge commit blocking
+
+## **6.9.1**
+- [Fix] `parse`: with comma true, handle field that holds an array of arrays (#335)
+- [Fix] `parse`: with comma true, do not split non-string values (#334)
+- [meta] add `funding` field
+- [Dev Deps] update `eslint`, `@ljharb/eslint-config`
+- [Tests] use shared travis-ci config
+
+## **6.9.0**
+- [New] `parse`/`stringify`: Pass extra key/value argument to `decoder` (#333)
+- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `evalmd`
+- [Tests] `parse`: add passing `arrayFormat` tests
+- [Tests] add `posttest` using `npx aud` to run `npm audit` without a lockfile
+- [Tests] up to `node` `v12.10`, `v11.15`, `v10.16`, `v8.16`
+- [Tests] `Buffer.from` in node v5.0-v5.9 and v4.0-v4.4 requires a TypedArray
+
+## **6.8.2**
+- [Fix] proper comma parsing of URL-encoded commas (#361)
+- [Fix] parses comma delimited array while having percent-encoded comma treated as normal text (#336)
+
+## **6.8.1**
+- [Fix] `parse`: Fix parsing array from object with `comma` true (#359)
+- [Fix] `parse`: throw a TypeError instead of an Error for bad charset (#349)
+- [Fix] `parse`: with comma true, handle field that holds an array of arrays (#335)
+- [fix] `parse`: with comma true, do not split non-string values (#334)
+- [meta] add tidelift marketing copy
+- [meta] add `funding` field
+- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `tape`, `safe-publish-latest`, `evalmd`, `has-symbols`, `iconv-lite`, `mkdirp`, `object-inspect`
+- [Tests] `parse`: add passing `arrayFormat` tests
+- [Tests] use shared travis-ci configs
+- [Tests] `Buffer.from` in node v5.0-v5.9 and v4.0-v4.4 requires a TypedArray
+- [actions] add automatic rebasing / merge commit blocking
+
+## **6.8.0**
+- [New] add `depth=false` to preserve the original key; [Fix] `depth=0` should preserve the original key (#326)
+- [New] [Fix] stringify symbols and bigints
+- [Fix] ensure node 0.12 can stringify Symbols
+- [Fix] fix for an impossible situation: when the formatter is called with a non-string value
+- [Refactor] `formats`: tiny bit of cleanup.
+- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `browserify`, `safe-publish-latest`, `iconv-lite`, `tape`
+- [Tests] add tests for `depth=0` and `depth=false` behavior, both current and intuitive/intended (#326)
+- [Tests] use `eclint` instead of `editorconfig-tools`
+- [docs] readme: add security note
+- [meta] add github sponsorship
+- [meta] add FUNDING.yml
+- [meta] Clean up license text so it’s properly detected as BSD-3-Clause
+
+## **6.7.2**
+- [Fix] proper comma parsing of URL-encoded commas (#361)
+- [Fix] parses comma delimited array while having percent-encoded comma treated as normal text (#336)
+
+## **6.7.1**
+- [Fix] `parse`: Fix parsing array from object with `comma` true (#359)
+- [Fix] `parse`: with comma true, handle field that holds an array of arrays (#335)
+- [fix] `parse`: with comma true, do not split non-string values (#334)
+- [Fix] `parse`: throw a TypeError instead of an Error for bad charset (#349)
+- [Fix] fix for an impossible situation: when the formatter is called with a non-string value
+- [Refactor] `formats`: tiny bit of cleanup.
+- readme: add security note
+- [meta] add tidelift marketing copy
+- [meta] add `funding` field
+- [meta] add FUNDING.yml
+- [meta] Clean up license text so it’s properly detected as BSD-3-Clause
+- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `tape`, `safe-publish-latest`, `evalmd`, `iconv-lite`, `mkdirp`, `object-inspect`, `browserify`
+- [Tests] `parse`: add passing `arrayFormat` tests
+- [Tests] use shared travis-ci configs
+- [Tests] `Buffer.from` in node v5.0-v5.9 and v4.0-v4.4 requires a TypedArray
+- [Tests] add tests for `depth=0` and `depth=false` behavior, both current and intuitive/intended
+- [Tests] use `eclint` instead of `editorconfig-tools`
+- [actions] add automatic rebasing / merge commit blocking
+
 ## **6.7.0**
 - [New] `stringify`/`parse`: add `comma` as an `arrayFormat` option (#276, #219)
 - [Fix] correctly parse nested arrays (#212)

node_modules/qs/LICENSE

@@ -1,28 +0,0 @@
-Copyright (c) 2014 Nathan LaFreniere and other contributors.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above copyright
-      notice, this list of conditions and the following disclaimer in the
-      documentation and/or other materials provided with the distribution.
-    * The names of any contributors may not be used to endorse or promote
-      products derived from this software without specific prior written
-      permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE FOR ANY
-DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-                                  *   *   *
-
-The complete list of contributors can be found at: https://github.com/hapijs/qs/graphs/contributors

node_modules/qs/LICENSE.md

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2014, Nathan LaFreniere and other [contributors](https://github.com/ljharb/qs/graphs/contributors)
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

node_modules/qs/README.md

@@ -1,12 +1,13 @@
 # qs <sup>[![Version Badge][2]][1]</sup>
 
-[![Build Status][3]][4]
+[![github actions][actions-image]][actions-url]
-[![dependency status][5]][6]
+[![coverage][codecov-image]][codecov-url]
-[![dev dependency status][7]][8]
+[![dependency status][deps-svg]][deps-url]
+[![dev dependency status][dev-deps-svg]][dev-deps-url]
 [![License][license-image]][license-url]
 [![Downloads][downloads-image]][downloads-url]
 
-[![npm badge][11]][1]
+[![npm badge][npm-badge-png]][package-url]
 
 A querystring parsing and stringifying library with some added security.
 
@@ -280,6 +281,17 @@ assert.deepEqual(arraysOfObjects, { a: ['b', 'c'] })
 ```
 (_this cannot convert nested objects, such as `a={b:1},{c:d}`_)
 
+### Parsing primitive/scalar values (numbers, booleans, null, etc)
+
+By default, all values are parsed as strings. This behavior will not change and is explained in [issue #91](https://github.com/ljharb/qs/issues/91).
+
+```javascript
+var primitiveValues = qs.parse('a=15&b=true&c=null');
+assert.deepEqual(primitiveValues, { a: '15', b: 'true', c: 'null' });
+```
+
+If you wish to auto-convert values which look like numbers, booleans, and other values into their primitive counterparts, you can use the [query-types Express JS middleware](https://github.com/xpepermint/query-types) which will auto-convert all request query parameters.
+
 ### Stringifying
 
 [](#preventEval)
@@ -330,6 +342,30 @@ var decoded = qs.parse('x=z', { decoder: function (str) {
 }})
 ```
 
+You can encode keys and values using different logic by using the type argument provided to the encoder:
+
+```javascript
+var encoded = qs.stringify({ a: { b: 'c' } }, { encoder: function (str, defaultEncoder, charset, type) {
+    if (type === 'key') {
+        return // Encoded key
+    } else if (type === 'value') {
+        return // Encoded value
+    }
+}})
+```
+
+The type argument is also provided to the decoder:
+
+```javascript
+var decoded = qs.parse('x=z', { decoder: function (str, defaultDecoder, charset, type) {
+    if (type === 'key') {
+        return // Decoded key
+    } else if (type === 'value') {
+        return // Decoded value
+    }
+}})
+```
+
 Examples beyond this point will be shown as though the output is not URI encoded for clarity. Please note that the return values in these cases *will* be URI encoded during real usage.
 
 When arrays are stringified, by default they are given explicit indices:
@@ -553,18 +589,28 @@ assert.equal(qs.stringify({ a: 'b c' }, { format : 'RFC3986' }), 'a=b%20c');
 assert.equal(qs.stringify({ a: 'b c' }, { format : 'RFC1738' }), 'a=b+c');
 ```
 
-[1]: https://npmjs.org/package/qs
+## Security
-[2]: http://versionbadg.es/ljharb/qs.svg
+
-[3]: https://api.travis-ci.org/ljharb/qs.svg
+Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report.
-[4]: https://travis-ci.org/ljharb/qs
+
-[5]: https://david-dm.org/ljharb/qs.svg
+## qs for enterprise
-[6]: https://david-dm.org/ljharb/qs
+
-[7]: https://david-dm.org/ljharb/qs/dev-status.svg
+Available as part of the Tidelift Subscription
-[8]: https://david-dm.org/ljharb/qs?type=dev
+
-[9]: https://ci.testling.com/ljharb/qs.png
+The maintainers of qs and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. [Learn more.](https://tidelift.com/subscription/pkg/npm-qs?utm_source=npm-qs&utm_medium=referral&utm_campaign=enterprise&utm_term=repo)
-[10]: https://ci.testling.com/ljharb/qs
+
-[11]: https://nodei.co/npm/qs.png?downloads=true&stars=true
+[package-url]: https://npmjs.org/package/qs
-[license-image]: http://img.shields.io/npm/l/qs.svg
+[npm-version-svg]: https://versionbadg.es/ljharb/qs.svg
+[deps-svg]: https://david-dm.org/ljharb/qs.svg
+[deps-url]: https://david-dm.org/ljharb/qs
+[dev-deps-svg]: https://david-dm.org/ljharb/qs/dev-status.svg
+[dev-deps-url]: https://david-dm.org/ljharb/qs#info=devDependencies
+[npm-badge-png]: https://nodei.co/npm/qs.png?downloads=true&stars=true
+[license-image]: https://img.shields.io/npm/l/qs.svg
 [license-url]: LICENSE
-[downloads-image]: http://img.shields.io/npm/dm/qs.svg
+[downloads-image]: https://img.shields.io/npm/dm/qs.svg
-[downloads-url]: http://npm-stat.com/charts.html?package=qs
+[downloads-url]: https://npm-stat.com/charts.html?package=qs
+[codecov-image]: https://codecov.io/gh/ljharb/qs/branch/main/graphs/badge.svg
+[codecov-url]: https://app.codecov.io/gh/ljharb/qs/
+[actions-image]: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/qs
+[actions-url]: https://github.com/ljharb/qs/actions

node_modules/qs/lib/formats.js

@@ -3,16 +3,21 @@
 var replace = String.prototype.replace;
 var percentTwenties = /%20/g;
 
+var Format = {
+    RFC1738: 'RFC1738',
+    RFC3986: 'RFC3986'
+};
+
 module.exports = {
-    'default': 'RFC3986',
+    'default': Format.RFC3986,
     formatters: {
         RFC1738: function (value) {
             return replace.call(value, percentTwenties, '+');
         },
         RFC3986: function (value) {
-            return value;
+            return String(value);
         }
     },
-    RFC1738: 'RFC1738',
+    RFC1738: Format.RFC1738,
-    RFC3986: 'RFC3986'
+    RFC3986: Format.RFC3986
 };

node_modules/qs/lib/parse.js

@@ -3,6 +3,7 @@
 var utils = require('./utils');
 
 var has = Object.prototype.hasOwnProperty;
+var isArray = Array.isArray;
 
 var defaults = {
     allowDots: false,
@@ -28,6 +29,14 @@ var interpretNumericEntities = function (str) {
     });
 };
 
+var parseArrayValue = function (val, options) {
+    if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {
+        return val.split(',');
+    }
+
+    return val;
+};
+
 // This is what browsers will submit when the ✓ character occurs in an
 // application/x-www-form-urlencoded body and the encoding of the page containing
 // the form is iso-8859-1, or when the submitted form has an accept-charset
@@ -72,19 +81,24 @@ var parseValues = function parseQueryStringValues(str, options) {
 
         var key, val;
         if (pos === -1) {
-            key = options.decoder(part, defaults.decoder, charset);
+            key = options.decoder(part, defaults.decoder, charset, 'key');
             val = options.strictNullHandling ? null : '';
         } else {
-            key = options.decoder(part.slice(0, pos), defaults.decoder, charset);
+            key = options.decoder(part.slice(0, pos), defaults.decoder, charset, 'key');
-            val = options.decoder(part.slice(pos + 1), defaults.decoder, charset);
+            val = utils.maybeMap(
+                parseArrayValue(part.slice(pos + 1), options),
+                function (encodedVal) {
+                    return options.decoder(encodedVal, defaults.decoder, charset, 'value');
+                }
+            );
         }
 
         if (val && options.interpretNumericEntities && charset === 'iso-8859-1') {
             val = interpretNumericEntities(val);
         }
 
-        if (val && options.comma && val.indexOf(',') > -1) {
+        if (part.indexOf('[]=') > -1) {
-            val = val.split(',');
+            val = isArray(val) ? [val] : val;
         }
 
         if (has.call(obj, key)) {
@@ -97,8 +111,8 @@ var parseValues = function parseQueryStringValues(str, options) {
     return obj;
 };
 
-var parseObject = function (chain, val, options) {
+var parseObject = function (chain, val, options, valuesParsed) {
-    var leaf = val;
+    var leaf = valuesParsed ? val : parseArrayValue(val, options);
 
     for (var i = chain.length - 1; i >= 0; --i) {
         var obj;
@@ -121,7 +135,7 @@ var parseObject = function (chain, val, options) {
             ) {
                 obj = [];
                 obj[index] = leaf;
-            } else {
+            } else if (cleanRoot !== '__proto__') {
                 obj[cleanRoot] = leaf;
             }
         }
@@ -132,7 +146,7 @@ var parseObject = function (chain, val, options) {
     return leaf;
 };
 
-var parseKeys = function parseQueryStringKeys(givenKey, val, options) {
+var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesParsed) {
     if (!givenKey) {
         return;
     }
@@ -147,7 +161,7 @@ var parseKeys = function parseQueryStringKeys(givenKey, val, options) {
 
     // Get the parent
 
-    var segment = brackets.exec(key);
+    var segment = options.depth > 0 && brackets.exec(key);
     var parent = segment ? key.slice(0, segment.index) : key;
 
     // Stash the parent if it exists
@@ -167,7 +181,7 @@ var parseKeys = function parseQueryStringKeys(givenKey, val, options) {
     // Loop through children appending to the array until we hit depth
 
     var i = 0;
-    while ((segment = child.exec(key)) !== null && i < options.depth) {
+    while (options.depth > 0 && (segment = child.exec(key)) !== null && i < options.depth) {
         i += 1;
         if (!options.plainObjects && has.call(Object.prototype, segment[1].slice(1, -1))) {
             if (!options.allowPrototypes) {
@@ -183,7 +197,7 @@ var parseKeys = function parseQueryStringKeys(givenKey, val, options) {
         keys.push('[' + key.slice(segment.index) + ']');
     }
 
-    return parseObject(keys, val, options);
+    return parseObject(keys, val, options, valuesParsed);
 };
 
 var normalizeParseOptions = function normalizeParseOptions(opts) {
@@ -196,7 +210,7 @@ var normalizeParseOptions = function normalizeParseOptions(opts) {
     }
 
     if (typeof opts.charset !== 'undefined' && opts.charset !== 'utf-8' && opts.charset !== 'iso-8859-1') {
-        throw new Error('The charset option must be either utf-8, iso-8859-1, or undefined');
+        throw new TypeError('The charset option must be either utf-8, iso-8859-1, or undefined');
     }
     var charset = typeof opts.charset === 'undefined' ? defaults.charset : opts.charset;
 
@@ -209,7 +223,8 @@ var normalizeParseOptions = function normalizeParseOptions(opts) {
         comma: typeof opts.comma === 'boolean' ? opts.comma : defaults.comma,
         decoder: typeof opts.decoder === 'function' ? opts.decoder : defaults.decoder,
         delimiter: typeof opts.delimiter === 'string' || utils.isRegExp(opts.delimiter) ? opts.delimiter : defaults.delimiter,
-        depth: typeof opts.depth === 'number' ? opts.depth : defaults.depth,
+        // eslint-disable-next-line no-implicit-coercion, no-extra-parens
+        depth: (typeof opts.depth === 'number' || opts.depth === false) ? +opts.depth : defaults.depth,
         ignoreQueryPrefix: opts.ignoreQueryPrefix === true,
         interpretNumericEntities: typeof opts.interpretNumericEntities === 'boolean' ? opts.interpretNumericEntities : defaults.interpretNumericEntities,
         parameterLimit: typeof opts.parameterLimit === 'number' ? opts.parameterLimit : defaults.parameterLimit,
@@ -234,7 +249,7 @@ module.exports = function (str, opts) {
     var keys = Object.keys(tempObj);
     for (var i = 0; i < keys.length; ++i) {
         var key = keys[i];
-        var newObj = parseKeys(key, tempObj[key], options);
+        var newObj = parseKeys(key, tempObj[key], options, typeof str === 'string');
         obj = utils.merge(obj, newObj, options);
     }
 

node_modules/qs/lib/stringify.js

@@ -5,19 +5,20 @@ var formats = require('./formats');
 var has = Object.prototype.hasOwnProperty;
 
 var arrayPrefixGenerators = {
-    brackets: function brackets(prefix) { // eslint-disable-line func-name-matching
+    brackets: function brackets(prefix) {
         return prefix + '[]';
     },
     comma: 'comma',
-    indices: function indices(prefix, key) { // eslint-disable-line func-name-matching
+    indices: function indices(prefix, key) {
         return prefix + '[' + key + ']';
     },
-    repeat: function repeat(prefix) { // eslint-disable-line func-name-matching
+    repeat: function repeat(prefix) {
         return prefix;
     }
 };
 
 var isArray = Array.isArray;
+var split = String.prototype.split;
 var push = Array.prototype.push;
 var pushToArray = function (arr, valueOrArray) {
     push.apply(arr, isArray(valueOrArray) ? valueOrArray : [valueOrArray]);
@@ -25,6 +26,7 @@ var pushToArray = function (arr, valueOrArray) {
 
 var toISO = Date.prototype.toISOString;
 
+var defaultFormat = formats['default'];
 var defaults = {
     addQueryPrefix: false,
     allowDots: false,
@@ -34,17 +36,26 @@ var defaults = {
     encode: true,
     encoder: utils.encode,
     encodeValuesOnly: false,
-    formatter: formats.formatters[formats['default']],
+    format: defaultFormat,
+    formatter: formats.formatters[defaultFormat],
     // deprecated
     indices: false,
-    serializeDate: function serializeDate(date) { // eslint-disable-line func-name-matching
+    serializeDate: function serializeDate(date) {
         return toISO.call(date);
     },
     skipNulls: false,
     strictNullHandling: false
 };
 
-var stringify = function stringify( // eslint-disable-line func-name-matching
+var isNonNullishPrimitive = function isNonNullishPrimitive(v) {
+    return typeof v === 'string'
+        || typeof v === 'number'
+        || typeof v === 'boolean'
+        || typeof v === 'symbol'
+        || typeof v === 'bigint';
+};
+
+var stringify = function stringify(
     object,
     prefix,
     generateArrayPrefix,
@@ -55,6 +66,7 @@ var stringify = function stringify( // eslint-disable-line func-name-matching
     sort,
     allowDots,
     serializeDate,
+    format,
     formatter,
     encodeValuesOnly,
     charset
@@ -65,21 +77,34 @@ var stringify = function stringify( // eslint-disable-line func-name-matching
     } else if (obj instanceof Date) {
         obj = serializeDate(obj);
     } else if (generateArrayPrefix === 'comma' && isArray(obj)) {
-        obj = obj.join(',');
+        obj = utils.maybeMap(obj, function (value) {
+            if (value instanceof Date) {
+                return serializeDate(value);
+            }
+            return value;
+        });
     }
 
     if (obj === null) {
         if (strictNullHandling) {
-            return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset) : prefix;
+            return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset, 'key', format) : prefix;
         }
 
         obj = '';
     }
 
-    if (typeof obj === 'string' || typeof obj === 'number' || typeof obj === 'boolean' || utils.isBuffer(obj)) {
+    if (isNonNullishPrimitive(obj) || utils.isBuffer(obj)) {
         if (encoder) {
-            var keyValue = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset);
+            var keyValue = encodeValuesOnly ? prefix : encoder(prefix, defaults.encoder, charset, 'key', format);
-            return [formatter(keyValue) + '=' + formatter(encoder(obj, defaults.encoder, charset))];
+            if (generateArrayPrefix === 'comma' && encodeValuesOnly) {
+                var valuesArray = split.call(String(obj), ',');
+                var valuesJoined = '';
+                for (var i = 0; i < valuesArray.length; ++i) {
+                    valuesJoined += (i === 0 ? '' : ',') + formatter(encoder(valuesArray[i], defaults.encoder, charset, 'value', format));
+                }
+                return [formatter(keyValue) + '=' + valuesJoined];
+            }
+            return [formatter(keyValue) + '=' + formatter(encoder(obj, defaults.encoder, charset, 'value', format))];
         }
         return [formatter(prefix) + '=' + formatter(String(obj))];
     }
@@ -91,24 +116,31 @@ var stringify = function stringify( // eslint-disable-line func-name-matching
     }
 
     var objKeys;
-    if (isArray(filter)) {
+    if (generateArrayPrefix === 'comma' && isArray(obj)) {
+        // we need to join elements in
+        objKeys = [{ value: obj.length > 0 ? obj.join(',') || null : void undefined }];
+    } else if (isArray(filter)) {
         objKeys = filter;
     } else {
         var keys = Object.keys(obj);
         objKeys = sort ? keys.sort(sort) : keys;
     }
 
-    for (var i = 0; i < objKeys.length; ++i) {
+    for (var j = 0; j < objKeys.length; ++j) {
-        var key = objKeys[i];
+        var key = objKeys[j];
+        var value = typeof key === 'object' && typeof key.value !== 'undefined' ? key.value : obj[key];
 
-        if (skipNulls && obj[key] === null) {
+        if (skipNulls && value === null) {
             continue;
         }
 
-        if (isArray(obj)) {
+        var keyPrefix = isArray(obj)
+            ? typeof generateArrayPrefix === 'function' ? generateArrayPrefix(prefix, key) : prefix
+            : prefix + (allowDots ? '.' + key : '[' + key + ']');
+
         pushToArray(values, stringify(
-                obj[key],
+            value,
-                typeof generateArrayPrefix === 'function' ? generateArrayPrefix(prefix, key) : prefix,
+            keyPrefix,
             generateArrayPrefix,
             strictNullHandling,
             skipNulls,
@@ -117,27 +149,11 @@ var stringify = function stringify( // eslint-disable-line func-name-matching
             sort,
             allowDots,
             serializeDate,
+            format,
             formatter,
             encodeValuesOnly,
             charset
         ));
-        } else {
-            pushToArray(values, stringify(
-                obj[key],
-                prefix + (allowDots ? '.' + key : '[' + key + ']'),
-                generateArrayPrefix,
-                strictNullHandling,
-                skipNulls,
-                encoder,
-                filter,
-                sort,
-                allowDots,
-                serializeDate,
-                formatter,
-                encodeValuesOnly,
-                charset
-            ));
-        }
     }
 
     return values;
@@ -148,7 +164,7 @@ var normalizeStringifyOptions = function normalizeStringifyOptions(opts) {
         return defaults;
     }
 
-    if (opts.encoder !== null && opts.encoder !== undefined && typeof opts.encoder !== 'function') {
+    if (opts.encoder !== null && typeof opts.encoder !== 'undefined' && typeof opts.encoder !== 'function') {
         throw new TypeError('Encoder has to be a function.');
     }
 
@@ -181,6 +197,7 @@ var normalizeStringifyOptions = function normalizeStringifyOptions(opts) {
         encoder: typeof opts.encoder === 'function' ? opts.encoder : defaults.encoder,
         encodeValuesOnly: typeof opts.encodeValuesOnly === 'boolean' ? opts.encodeValuesOnly : defaults.encodeValuesOnly,
         filter: filter,
+        format: format,
         formatter: formatter,
         serializeDate: typeof opts.serializeDate === 'function' ? opts.serializeDate : defaults.serializeDate,
         skipNulls: typeof opts.skipNulls === 'boolean' ? opts.skipNulls : defaults.skipNulls,
@@ -246,6 +263,7 @@ module.exports = function (object, opts) {
             options.sort,
             options.allowDots,
             options.serializeDate,
+            options.format,
             options.formatter,
             options.encodeValuesOnly,
             options.charset

node_modules/qs/lib/utils.js

@@ -1,5 +1,7 @@
 'use strict';
 
+var formats = require('./formats');
+
 var has = Object.prototype.hasOwnProperty;
 var isArray = Array.isArray;
 
@@ -43,6 +45,7 @@ var arrayToObject = function arrayToObject(source, options) {
 };
 
 var merge = function merge(target, source, options) {
+    /* eslint no-param-reassign: 0 */
     if (!source) {
         return target;
     }
@@ -119,14 +122,19 @@ var decode = function (str, decoder, charset) {
     }
 };
 
-var encode = function encode(str, defaultEncoder, charset) {
+var encode = function encode(str, defaultEncoder, charset, kind, format) {
     // This code was originally written by Brian White (mscdex) for the io.js core querystring library.
     // It has been adapted here for stricter adherence to RFC 3986
     if (str.length === 0) {
         return str;
     }
 
-    var string = typeof str === 'string' ? str : String(str);
+    var string = str;
+    if (typeof str === 'symbol') {
+        string = Symbol.prototype.toString.call(str);
+    } else if (typeof str !== 'string') {
+        string = String(str);
+    }
 
     if (charset === 'iso-8859-1') {
         return escape(string).replace(/%u[0-9a-f]{4}/gi, function ($0) {
@@ -146,6 +154,7 @@ var encode = function encode(str, defaultEncoder, charset) {
             || (c >= 0x30 && c <= 0x39) // 0-9
             || (c >= 0x41 && c <= 0x5A) // a-z
             || (c >= 0x61 && c <= 0x7A) // A-Z
+            || (format === formats.RFC1738 && (c === 0x28 || c === 0x29)) // ( )
         ) {
             out += string.charAt(i);
             continue;
@@ -168,6 +177,7 @@ var encode = function encode(str, defaultEncoder, charset) {
 
         i += 1;
         c = 0x10000 + (((c & 0x3FF) << 10) | (string.charCodeAt(i) & 0x3FF));
+        /* eslint operator-linebreak: [2, "before"] */
         out += hexTable[0xF0 | (c >> 18)]
             + hexTable[0x80 | ((c >> 12) & 0x3F)]
             + hexTable[0x80 | ((c >> 6) & 0x3F)]
@@ -217,6 +227,17 @@ var combine = function combine(a, b) {
     return [].concat(a, b);
 };
 
+var maybeMap = function maybeMap(val, fn) {
+    if (isArray(val)) {
+        var mapped = [];
+        for (var i = 0; i < val.length; i += 1) {
+            mapped.push(fn(val[i]));
+        }
+        return mapped;
+    }
+    return fn(val);
+};
+
 module.exports = {
     arrayToObject: arrayToObject,
     assign: assign,
@@ -226,5 +247,6 @@ module.exports = {
     encode: encode,
     isBuffer: isBuffer,
     isRegExp: isRegExp,
+    maybeMap: maybeMap,
     merge: merge
 };

node_modules/qs/package.json

@@ -2,11 +2,14 @@
     "name": "qs",
     "description": "A querystring parser that supports nesting and arrays, with a depth limit",
     "homepage": "https://github.com/ljharb/qs",
-    "version": "6.7.0",
+    "version": "6.9.7",
     "repository": {
         "type": "git",
         "url": "https://github.com/ljharb/qs.git"
     },
+    "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+    },
     "main": "lib/index.js",
     "contributors": [
         {
@@ -26,33 +29,42 @@
     "engines": {
         "node": ">=0.6"
     },
-    "dependencies": {},
     "devDependencies": {
-        "@ljharb/eslint-config": "^13.1.1",
+        "@ljharb/eslint-config": "^20.1.0",
-        "browserify": "^16.2.3",
+        "aud": "^1.1.5",
-        "covert": "^1.1.1",
+        "browserify": "^16.5.2",
-        "editorconfig-tools": "^0.1.1",
+        "eclint": "^2.8.1",
-        "eslint": "^5.15.3",
+        "eslint": "^8.6.0",
-        "evalmd": "^0.0.17",
+        "evalmd": "^0.0.19",
         "for-each": "^0.3.3",
-        "iconv-lite": "^0.4.24",
+        "has-symbols": "^1.0.2",
-        "mkdirp": "^0.5.1",
+        "iconv-lite": "^0.5.1",
-        "object-inspect": "^1.6.0",
+        "in-publish": "^2.0.1",
+        "mkdirp": "^0.5.5",
+        "nyc": "^10.3.2",
+        "object-inspect": "^1.12.0",
         "qs-iconv": "^1.0.4",
-        "safe-publish-latest": "^1.1.2",
+        "safe-publish-latest": "^2.0.0",
         "safer-buffer": "^2.1.2",
-        "tape": "^4.10.1"
+        "tape": "^5.4.0"
     },
     "scripts": {
-        "prepublish": "safe-publish-latest && npm run dist",
+        "prepublishOnly": "safe-publish-latest && npm run dist",
+        "prepublish": "not-in-publish || npm run prepublishOnly",
         "pretest": "npm run --silent readme && npm run --silent lint",
-        "test": "npm run --silent coverage",
+        "test": "npm run tests-only",
-        "tests-only": "node test",
+        "tests-only": "nyc tape 'test/**/*.js'",
+        "posttest": "aud --production",
         "readme": "evalmd README.md",
-        "postlint": "editorconfig-tools check * lib/* test/*",
+        "postlint": "eclint check * lib/* test/* !dist/*",
-        "lint": "eslint lib/*.js test/*.js",
+        "lint": "eslint .",
-        "coverage": "covert test",
         "dist": "mkdirp dist && browserify --standalone Qs lib/index.js > dist/qs.js"
     },
-    "license": "BSD-3-Clause"
+    "license": "BSD-3-Clause",
+    "greenkeeper": {
+        "ignore": [
+            "iconv-lite",
+            "mkdirp"
+        ]
+    }
 }

node_modules/qs/test/.eslintrc

@@ -1,17 +0,0 @@
-{
-    "rules": {
-		"array-bracket-newline": 0,
-		"array-element-newline": 0,
-		"consistent-return": 2,
-        "function-paren-newline": 0,
-        "max-lines": 0,
-        "max-lines-per-function": 0,
-        "max-nested-callbacks": [2, 3],
-        "max-statements": 0,
-		"no-buffer-constructor": 0,
-        "no-extend-native": 0,
-        "no-magic-numbers": 0,
-		"object-curly-newline": 0,
-        "sort-keys": 0
-    }
-}

node_modules/qs/test/index.js

@@ -1,7 +0,0 @@
-'use strict';
-
-require('./parse');
-
-require('./stringify');
-
-require('./utils');

node_modules/qs/test/parse.js

@@ -32,6 +32,38 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('arrayFormat: brackets allows only explicit arrays', function (st) {
+        st.deepEqual(qs.parse('a[]=b&a[]=c', { arrayFormat: 'brackets' }), { a: ['b', 'c'] });
+        st.deepEqual(qs.parse('a[0]=b&a[1]=c', { arrayFormat: 'brackets' }), { a: ['b', 'c'] });
+        st.deepEqual(qs.parse('a=b,c', { arrayFormat: 'brackets' }), { a: 'b,c' });
+        st.deepEqual(qs.parse('a=b&a=c', { arrayFormat: 'brackets' }), { a: ['b', 'c'] });
+        st.end();
+    });
+
+    t.test('arrayFormat: indices allows only indexed arrays', function (st) {
+        st.deepEqual(qs.parse('a[]=b&a[]=c', { arrayFormat: 'indices' }), { a: ['b', 'c'] });
+        st.deepEqual(qs.parse('a[0]=b&a[1]=c', { arrayFormat: 'indices' }), { a: ['b', 'c'] });
+        st.deepEqual(qs.parse('a=b,c', { arrayFormat: 'indices' }), { a: 'b,c' });
+        st.deepEqual(qs.parse('a=b&a=c', { arrayFormat: 'indices' }), { a: ['b', 'c'] });
+        st.end();
+    });
+
+    t.test('arrayFormat: comma allows only comma-separated arrays', function (st) {
+        st.deepEqual(qs.parse('a[]=b&a[]=c', { arrayFormat: 'comma' }), { a: ['b', 'c'] });
+        st.deepEqual(qs.parse('a[0]=b&a[1]=c', { arrayFormat: 'comma' }), { a: ['b', 'c'] });
+        st.deepEqual(qs.parse('a=b,c', { arrayFormat: 'comma' }), { a: 'b,c' });
+        st.deepEqual(qs.parse('a=b&a=c', { arrayFormat: 'comma' }), { a: ['b', 'c'] });
+        st.end();
+    });
+
+    t.test('arrayFormat: repeat allows only repeated values', function (st) {
+        st.deepEqual(qs.parse('a[]=b&a[]=c', { arrayFormat: 'repeat' }), { a: ['b', 'c'] });
+        st.deepEqual(qs.parse('a[0]=b&a[1]=c', { arrayFormat: 'repeat' }), { a: ['b', 'c'] });
+        st.deepEqual(qs.parse('a=b,c', { arrayFormat: 'repeat' }), { a: 'b,c' });
+        st.deepEqual(qs.parse('a=b&a=c', { arrayFormat: 'repeat' }), { a: ['b', 'c'] });
+        st.end();
+    });
+
     t.test('allows enabling dot notation', function (st) {
         st.deepEqual(qs.parse('a.b=c'), { 'a.b': 'c' });
         st.deepEqual(qs.parse('a.b=c', { allowDots: true }), { a: { b: 'c' } });
@@ -52,6 +84,18 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('uses original key when depth = 0', function (st) {
+        st.deepEqual(qs.parse('a[0]=b&a[1]=c', { depth: 0 }), { 'a[0]': 'b', 'a[1]': 'c' });
+        st.deepEqual(qs.parse('a[0][0]=b&a[0][1]=c&a[1]=d&e=2', { depth: 0 }), { 'a[0][0]': 'b', 'a[0][1]': 'c', 'a[1]': 'd', e: '2' });
+        st.end();
+    });
+
+    t.test('uses original key when depth = false', function (st) {
+        st.deepEqual(qs.parse('a[0]=b&a[1]=c', { depth: false }), { 'a[0]': 'b', 'a[1]': 'c' });
+        st.deepEqual(qs.parse('a[0][0]=b&a[0][1]=c&a[1]=d&e=2', { depth: false }), { 'a[0][0]': 'b', 'a[0][1]': 'c', 'a[1]': 'd', e: '2' });
+        st.end();
+    });
+
     t.deepEqual(qs.parse('a=b&a=c'), { a: ['b', 'c'] }, 'parses a simple array');
 
     t.test('parses an explicit array', function (st) {
@@ -356,6 +400,43 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('parses values with comma as array divider', function (st) {
+        st.deepEqual(qs.parse({ foo: 'bar,tee' }, { comma: false }), { foo: 'bar,tee' });
+        st.deepEqual(qs.parse({ foo: 'bar,tee' }, { comma: true }), { foo: ['bar', 'tee'] });
+        st.end();
+    });
+
+    t.test('use number decoder, parses string that has one number with comma option enabled', function (st) {
+        var decoder = function (str, defaultDecoder, charset, type) {
+            if (!isNaN(Number(str))) {
+                return parseFloat(str);
+            }
+            return defaultDecoder(str, defaultDecoder, charset, type);
+        };
+
+        st.deepEqual(qs.parse('foo=1', { comma: true, decoder: decoder }), { foo: 1 });
+        st.deepEqual(qs.parse('foo=0', { comma: true, decoder: decoder }), { foo: 0 });
+
+        st.end();
+    });
+
+    t.test('parses brackets holds array of arrays when having two parts of strings with comma as array divider', function (st) {
+        st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=4,5,6', { comma: true }), { foo: [['1', '2', '3'], ['4', '5', '6']] });
+        st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=', { comma: true }), { foo: [['1', '2', '3'], ''] });
+        st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=,', { comma: true }), { foo: [['1', '2', '3'], ['', '']] });
+        st.deepEqual(qs.parse('foo[]=1,2,3&foo[]=a', { comma: true }), { foo: [['1', '2', '3'], 'a'] });
+
+        st.end();
+    });
+
+    t.test('parses comma delimited array while having percent-encoded comma treated as normal text', function (st) {
+        st.deepEqual(qs.parse('foo=a%2Cb', { comma: true }), { foo: 'a,b' });
+        st.deepEqual(qs.parse('foo=a%2C%20b,d', { comma: true }), { foo: ['a, b', 'd'] });
+        st.deepEqual(qs.parse('foo=a%2C%20b,c%2C%20d', { comma: true }), { foo: ['a, b', 'c, d'] });
+
+        st.end();
+    });
+
     t.test('parses an object in dot notation', function (st) {
         var input = {
             'user.name': { 'pop[bob]': 3 },
@@ -532,13 +613,73 @@ test('parse()', function (t) {
 
         st.deepEqual(
             qs.parse('a[b]=c&a=toString', { plainObjects: true }),
-            { a: { b: 'c', toString: true } },
+            { __proto__: null, a: { __proto__: null, b: 'c', toString: true } },
             'can overwrite prototype with plainObjects true'
         );
 
         st.end();
     });
 
+    t.test('dunder proto is ignored', function (st) {
+        var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
+        var result = qs.parse(payload, { allowPrototypes: true });
+
+        st.deepEqual(
+            result,
+            {
+                categories: {
+                    length: '42'
+                }
+            },
+            'silent [[Prototype]] payload'
+        );
+
+        var plainResult = qs.parse(payload, { allowPrototypes: true, plainObjects: true });
+
+        st.deepEqual(
+            plainResult,
+            {
+                __proto__: null,
+                categories: {
+                    __proto__: null,
+                    length: '42'
+                }
+            },
+            'silent [[Prototype]] payload: plain objects'
+        );
+
+        var query = qs.parse('categories[__proto__]=cats&categories[__proto__]=dogs&categories[some][json]=toInject', { allowPrototypes: true });
+
+        st.notOk(Array.isArray(query.categories), 'is not an array');
+        st.notOk(query.categories instanceof Array, 'is not instanceof an array');
+        st.deepEqual(query.categories, { some: { json: 'toInject' } });
+        st.equal(JSON.stringify(query.categories), '{"some":{"json":"toInject"}}', 'stringifies as a non-array');
+
+        st.deepEqual(
+            qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true }),
+            {
+                foo: {
+                    bar: 'stuffs'
+                }
+            },
+            'hidden values'
+        );
+
+        st.deepEqual(
+            qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true, plainObjects: true }),
+            {
+                __proto__: null,
+                foo: {
+                    __proto__: null,
+                    bar: 'stuffs'
+                }
+            },
+            'hidden values: plain objects'
+        );
+
+        st.end();
+    });
+
     t.test('can return null objects', { skip: !Object.create }, function (st) {
         var expected = Object.create(null);
         expected.a = Object.create(null);
@@ -672,5 +813,20 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('allows for decoding keys and values differently', function (st) {
+        var decoder = function (str, defaultDecoder, charset, type) {
+            if (type === 'key') {
+                return defaultDecoder(str, defaultDecoder, charset, type).toLowerCase();
+            }
+            if (type === 'value') {
+                return defaultDecoder(str, defaultDecoder, charset, type).toUpperCase();
+            }
+            throw 'this should never happen! type: ' + type;
+        };
+
+        st.deepEqual(qs.parse('KeY=vAlUe', { decoder: decoder }), { key: 'VALUE' });
+        st.end();
+    });
+
     t.end();
 });

node_modules/qs/test/stringify.js

@@ -5,6 +5,8 @@ var qs = require('../');
 var utils = require('../lib/utils');
 var iconv = require('iconv-lite');
 var SaferBuffer = require('safer-buffer').Buffer;
+var hasSymbols = require('has-symbols');
+var hasBigInt = typeof BigInt === 'function';
 
 test('stringify()', function (t) {
     t.test('stringifies a querystring object', function (st) {
@@ -28,6 +30,39 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('stringifies symbols', { skip: !hasSymbols() }, function (st) {
+        st.equal(qs.stringify(Symbol.iterator), '');
+        st.equal(qs.stringify([Symbol.iterator]), '0=Symbol%28Symbol.iterator%29');
+        st.equal(qs.stringify({ a: Symbol.iterator }), 'a=Symbol%28Symbol.iterator%29');
+        st.equal(
+            qs.stringify({ a: [Symbol.iterator] }, { encodeValuesOnly: true, arrayFormat: 'brackets' }),
+            'a[]=Symbol%28Symbol.iterator%29'
+        );
+        st.end();
+    });
+
+    t.test('stringifies bigints', { skip: !hasBigInt }, function (st) {
+        var three = BigInt(3);
+        var encodeWithN = function (value, defaultEncoder, charset) {
+            var result = defaultEncoder(value, defaultEncoder, charset);
+            return typeof value === 'bigint' ? result + 'n' : result;
+        };
+        st.equal(qs.stringify(three), '');
+        st.equal(qs.stringify([three]), '0=3');
+        st.equal(qs.stringify([three], { encoder: encodeWithN }), '0=3n');
+        st.equal(qs.stringify({ a: three }), 'a=3');
+        st.equal(qs.stringify({ a: three }, { encoder: encodeWithN }), 'a=3n');
+        st.equal(
+            qs.stringify({ a: [three] }, { encodeValuesOnly: true, arrayFormat: 'brackets' }),
+            'a[]=3'
+        );
+        st.equal(
+            qs.stringify({ a: [three] }, { encodeValuesOnly: true, encoder: encodeWithN, arrayFormat: 'brackets' }),
+            'a[]=3n'
+        );
+        st.end();
+    });
+
     t.test('adds query prefix', function (st) {
         st.equal(qs.stringify({ a: 'b' }, { addQueryPrefix: true }), '?a=b');
         st.end();
@@ -97,10 +132,10 @@ test('stringify()', function (t) {
     });
 
     t.test('stringifies a nested array value', function (st) {
-        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { arrayFormat: 'indices' }), 'a%5Bb%5D%5B0%5D=c&a%5Bb%5D%5B1%5D=d');
+        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { encodeValuesOnly: true, arrayFormat: 'indices' }), 'a[b][0]=c&a[b][1]=d');
-        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { arrayFormat: 'brackets' }), 'a%5Bb%5D%5B%5D=c&a%5Bb%5D%5B%5D=d');
+        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { encodeValuesOnly: true, arrayFormat: 'brackets' }), 'a[b][]=c&a[b][]=d');
-        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { arrayFormat: 'comma' }), 'a%5Bb%5D=c%2Cd'); // a[b]=c,d
+        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { encodeValuesOnly: true, arrayFormat: 'comma' }), 'a[b]=c,d');
-        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }), 'a%5Bb%5D%5B0%5D=c&a%5Bb%5D%5B1%5D=d');
+        st.equal(qs.stringify({ a: { b: ['c', 'd'] } }, { encodeValuesOnly: true }), 'a[b][0]=c&a[b][1]=d');
         st.end();
     });
 
@@ -108,7 +143,7 @@ test('stringify()', function (t) {
         st.equal(
             qs.stringify(
                 { a: { b: ['c', 'd'] } },
-                { allowDots: true, encode: false, arrayFormat: 'indices' }
+                { allowDots: true, encodeValuesOnly: true, arrayFormat: 'indices' }
             ),
             'a.b[0]=c&a.b[1]=d',
             'indices: stringifies with dots + indices'
@@ -116,7 +151,7 @@ test('stringify()', function (t) {
         st.equal(
             qs.stringify(
                 { a: { b: ['c', 'd'] } },
-                { allowDots: true, encode: false, arrayFormat: 'brackets' }
+                { allowDots: true, encodeValuesOnly: true, arrayFormat: 'brackets' }
             ),
             'a.b[]=c&a.b[]=d',
             'brackets: stringifies with dots + brackets'
@@ -124,7 +159,7 @@ test('stringify()', function (t) {
         st.equal(
             qs.stringify(
                 { a: { b: ['c', 'd'] } },
-                { allowDots: true, encode: false, arrayFormat: 'comma' }
+                { allowDots: true, encodeValuesOnly: true, arrayFormat: 'comma' }
             ),
             'a.b=c,d',
             'comma: stringifies with dots + comma'
@@ -132,7 +167,7 @@ test('stringify()', function (t) {
         st.equal(
             qs.stringify(
                 { a: { b: ['c', 'd'] } },
-                { allowDots: true, encode: false }
+                { allowDots: true, encodeValuesOnly: true }
             ),
             'a.b[0]=c&a.b[1]=d',
             'default: stringifies with dots + indices'
@@ -180,17 +215,23 @@ test('stringify()', function (t) {
 
     t.test('stringifies an array with mixed objects and primitives', function (st) {
         st.equal(
-            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encode: false, arrayFormat: 'indices' }),
+            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encodeValuesOnly: true, arrayFormat: 'indices' }),
             'a[0][b]=1&a[1]=2&a[2]=3',
             'indices => indices'
         );
         st.equal(
-            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encode: false, arrayFormat: 'brackets' }),
+            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encodeValuesOnly: true, arrayFormat: 'brackets' }),
             'a[][b]=1&a[]=2&a[]=3',
             'brackets => brackets'
         );
         st.equal(
-            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encode: false }),
+            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encodeValuesOnly: true, arrayFormat: 'comma' }),
+            '???',
+            'brackets => brackets',
+            { skip: 'TODO: figure out what this should do' }
+        );
+        st.equal(
+            qs.stringify({ a: [{ b: 1 }, 2, 3] }, { encodeValuesOnly: true }),
             'a[0][b]=1&a[1]=2&a[2]=3',
             'default => indices'
         );
@@ -301,6 +342,27 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('stringifies an empty array in different arrayFormat', function (st) {
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false }), 'b[0]=&c=c');
+        // arrayFormat default
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'indices' }), 'b[0]=&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'brackets' }), 'b[]=&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'repeat' }), 'b=&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'comma' }), 'b=&c=c');
+        // with strictNullHandling
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'indices', strictNullHandling: true }), 'b[0]&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'brackets', strictNullHandling: true }), 'b[]&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'repeat', strictNullHandling: true }), 'b&c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'comma', strictNullHandling: true }), 'b&c=c');
+        // with skipNulls
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'indices', skipNulls: true }), 'c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'brackets', skipNulls: true }), 'c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'repeat', skipNulls: true }), 'c=c');
+        st.equal(qs.stringify({ a: [], b: [null], c: 'c' }, { encode: false, arrayFormat: 'comma', skipNulls: true }), 'c=c');
+
+        st.end();
+    });
+
     t.test('stringifies a null object', { skip: !Object.create }, function (st) {
         var obj = Object.create(null);
         obj.a = 'b';
@@ -520,6 +582,12 @@ test('stringify()', function (t) {
                 return String.fromCharCode(buffer.readUInt8(0) + 97);
             }
         }), 'a=b');
+
+        st.equal(qs.stringify({ a: SaferBuffer.from('a b') }, {
+            encoder: function (buffer) {
+                return buffer;
+            }
+        }), 'a=a b');
         st.end();
     });
 
@@ -554,23 +622,43 @@ test('stringify()', function (t) {
             'custom serializeDate function called'
         );
 
+        st.equal(
+            qs.stringify(
+                { a: [date] },
+                {
+                    serializeDate: function (d) { return d.getTime(); },
+                    arrayFormat: 'comma'
+                }
+            ),
+            'a=' + date.getTime(),
+            'works with arrayFormat comma'
+        );
+
         st.end();
     });
 
-    t.test('RFC 1738 spaces serialization', function (st) {
+    t.test('RFC 1738 serialization', function (st) {
         st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.RFC1738 }), 'a=b+c');
         st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.RFC1738 }), 'a+b=c+d');
+        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC1738 }), 'a+b=a+b');
+
+        st.equal(qs.stringify({ 'foo(ref)': 'bar' }, { format: qs.formats.RFC1738 }), 'foo(ref)=bar');
+
         st.end();
     });
 
     t.test('RFC 3986 spaces serialization', function (st) {
         st.equal(qs.stringify({ a: 'b c' }, { format: qs.formats.RFC3986 }), 'a=b%20c');
         st.equal(qs.stringify({ 'a b': 'c d' }, { format: qs.formats.RFC3986 }), 'a%20b=c%20d');
+        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }, { format: qs.formats.RFC3986 }), 'a%20b=a%20b');
+
         st.end();
     });
 
     t.test('Backward compatibility to RFC 3986', function (st) {
         st.equal(qs.stringify({ a: 'b c' }), 'a=b%20c');
+        st.equal(qs.stringify({ 'a b': SaferBuffer.from('a b') }), 'a%20b=a%20b');
+
         st.end();
     });
 
@@ -675,5 +763,42 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('allows for encoding keys and values differently', function (st) {
+        var encoder = function (str, defaultEncoder, charset, type) {
+            if (type === 'key') {
+                return defaultEncoder(str, defaultEncoder, charset, type).toLowerCase();
+            }
+            if (type === 'value') {
+                return defaultEncoder(str, defaultEncoder, charset, type).toUpperCase();
+            }
+            throw 'this should never happen! type: ' + type;
+        };
+
+        st.deepEqual(qs.stringify({ KeY: 'vAlUe' }, { encoder: encoder }), 'key=VALUE');
+        st.end();
+    });
+
+    t.test('objects inside arrays', function (st) {
+        var obj = { a: { b: { c: 'd', e: 'f' } } };
+        var withArray = { a: { b: [{ c: 'd', e: 'f' }] } };
+
+        st.equal(qs.stringify(obj, { encode: false }), 'a[b][c]=d&a[b][e]=f', 'no array, no arrayFormat');
+        st.equal(qs.stringify(obj, { encode: false, arrayFormat: 'bracket' }), 'a[b][c]=d&a[b][e]=f', 'no array, bracket');
+        st.equal(qs.stringify(obj, { encode: false, arrayFormat: 'indices' }), 'a[b][c]=d&a[b][e]=f', 'no array, indices');
+        st.equal(qs.stringify(obj, { encode: false, arrayFormat: 'comma' }), 'a[b][c]=d&a[b][e]=f', 'no array, comma');
+
+        st.equal(qs.stringify(withArray, { encode: false }), 'a[b][0][c]=d&a[b][0][e]=f', 'array, no arrayFormat');
+        st.equal(qs.stringify(withArray, { encode: false, arrayFormat: 'bracket' }), 'a[b][0][c]=d&a[b][0][e]=f', 'array, bracket');
+        st.equal(qs.stringify(withArray, { encode: false, arrayFormat: 'indices' }), 'a[b][0][c]=d&a[b][0][e]=f', 'array, indices');
+        st.equal(
+            qs.stringify(withArray, { encode: false, arrayFormat: 'comma' }),
+            '???',
+            'array, comma',
+            { skip: 'TODO: figure out what this should do' }
+        );
+
+        st.end();
+    });
+
     t.end();
 });

node_modules/qs/test/utils.js

@@ -130,7 +130,7 @@ test('isBuffer()', function (t) {
     var saferBuffer = SaferBuffer.from('abc');
     t.equal(utils.isBuffer(saferBuffer), true, 'SaferBuffer instance is a buffer');
 
-    var buffer = Buffer.from ? Buffer.from('abc') : new Buffer('abc');
+    var buffer = Buffer.from && Buffer.alloc ? Buffer.from('abc') : new Buffer('abc');
     t.equal(utils.isBuffer(buffer), true, 'real Buffer instance is a buffer');
     t.end();
 });

node_modules/raw-body/HISTORY.md

@@ -1,3 +1,22 @@
+2.4.3 / 2022-02-14
+==================
+
+  * deps: bytes@3.1.2
+
+2.4.2 / 2021-11-16
+==================
+
+  * deps: bytes@3.1.1
+  * deps: http-errors@1.8.1
+    - deps: setprototypeof@1.2.0
+    - deps: toidentifier@1.0.1
+
+2.4.1 / 2019-06-25
+==================
+
+  * deps: http-errors@1.7.3
+    - deps: inherits@2.0.4
+
 2.4.0 / 2019-04-17
 ==================
 

node_modules/raw-body/README.md

@@ -3,7 +3,7 @@
 [![NPM Version][npm-image]][npm-url]
 [![NPM Downloads][downloads-image]][downloads-url]
 [![Node.js Version][node-version-image]][node-version-url]
-[![Build status][travis-image]][travis-url]
+[![Build status][github-actions-ci-image]][github-actions-ci-url]
 [![Test coverage][coveralls-image]][coveralls-url]
 
 Gets the entire buffer of a stream either as a `Buffer` or a string.
@@ -33,8 +33,6 @@ $ npm install @types/node
 
 ## API
 
-<!-- eslint-disable no-unused-vars -->
-
 ```js
 var getRawBody = require('raw-body')
 ```
@@ -63,8 +61,10 @@ You can also pass a string in place of options to just specify the encoding.
 
 If an error occurs, the stream will be paused, everything unpiped,
 and you are responsible for correctly disposing the stream.
-For HTTP requests, no handling is required if you send a response.
+For HTTP requests, you may need to finish consuming the stream if
-For streams that use file descriptors, you should `stream.destroy()` or `stream.close()` to prevent leaks.
+you want to keep the socket open for future requests. For streams
+that use file descriptors, you should `stream.destroy()` or
+`stream.close()` to prevent leaks.
 
 ## Errors
 
@@ -81,7 +81,7 @@ otherwise an error created by this module, which has the following attributes:
 
 ### Types
 
-The errors from this module have a `type` property which allows for the progamatic
+The errors from this module have a `type` property which allows for the programmatic
 determination of the type of error returned.
 
 #### encoding.unsupported
@@ -211,9 +211,9 @@ server.listen(3000);
 [npm-url]: https://npmjs.org/package/raw-body
 [node-version-image]: https://img.shields.io/node/v/raw-body.svg
 [node-version-url]: https://nodejs.org/en/download/
-[travis-image]: https://img.shields.io/travis/stream-utils/raw-body/master.svg
-[travis-url]: https://travis-ci.org/stream-utils/raw-body
 [coveralls-image]: https://img.shields.io/coveralls/stream-utils/raw-body/master.svg
 [coveralls-url]: https://coveralls.io/r/stream-utils/raw-body?branch=master
 [downloads-image]: https://img.shields.io/npm/dm/raw-body.svg
 [downloads-url]: https://npmjs.org/package/raw-body
+[github-actions-ci-image]: https://img.shields.io/github/workflow/status/stream-utils/raw-body/ci/master?label=ci
+[github-actions-ci-url]: https://github.com/jshttp/stream-utils/raw-body?query=workflow%3Aci

node_modules/raw-body/package.json

@@ -1,7 +1,7 @@
 {
   "name": "raw-body",
   "description": "Get and validate the raw body of a readable stream.",
-  "version": "2.4.0",
+  "version": "2.4.3",
   "author": "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
@@ -10,24 +10,24 @@
   "license": "MIT",
   "repository": "stream-utils/raw-body",
   "dependencies": {
-    "bytes": "3.1.0",
+    "bytes": "3.1.2",
-    "http-errors": "1.7.2",
+    "http-errors": "1.8.1",
     "iconv-lite": "0.4.24",
     "unpipe": "1.0.0"
   },
   "devDependencies": {
-    "bluebird": "3.5.4",
+    "bluebird": "3.7.2",
-    "eslint": "5.16.0",
+    "eslint": "7.32.0",
-    "eslint-config-standard": "12.0.0",
+    "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.16.0",
+    "eslint-plugin-import": "2.25.4",
-    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-markdown": "2.2.1",
-    "eslint-plugin-node": "8.0.1",
+    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "4.1.1",
+    "eslint-plugin-promise": "5.2.0",
-    "eslint-plugin-standard": "4.0.0",
+    "eslint-plugin-standard": "4.1.0",
-    "istanbul": "0.4.5",
+    "mocha": "9.2.0",
-    "mocha": "6.1.3",
+    "nyc": "15.1.0",
-    "readable-stream": "2.3.6",
+    "readable-stream": "2.3.7",
-    "safe-buffer": "5.1.2"
+    "safe-buffer": "5.2.1"
   },
   "engines": {
     "node": ">= 0.8"
@@ -40,9 +40,9 @@
     "index.js"
   ],
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md .",
+    "lint": "eslint .",
     "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/"
+    "test-cov": "nyc --reporter=html --reporter=text npm test"
   }
 }

node_modules/safe-buffer/index.js

@@ -1,3 +1,4 @@
+/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
 /* eslint-disable node/no-deprecated-api */
 var buffer = require('buffer')
 var Buffer = buffer.Buffer
@@ -20,6 +21,8 @@ function SafeBuffer (arg, encodingOrOffset, length) {
   return Buffer(arg, encodingOrOffset, length)
 }
 
+SafeBuffer.prototype = Object.create(Buffer.prototype)
+
 // Copy static methods from Buffer
 copyProps(Buffer, SafeBuffer)
 

node_modules/safe-buffer/package.json

@@ -1,18 +1,18 @@
 {
   "name": "safe-buffer",
   "description": "Safer Node.js Buffer API",
-  "version": "5.1.2",
+  "version": "5.2.1",
   "author": {
     "name": "Feross Aboukhadijeh",
     "email": "feross@feross.org",
-    "url": "http://feross.org"
+    "url": "https://feross.org"
   },
   "bugs": {
     "url": "https://github.com/feross/safe-buffer/issues"
   },
   "devDependencies": {
     "standard": "*",
-    "tape": "^4.0.0"
+    "tape": "^5.0.0"
   },
   "homepage": "https://github.com/feross/safe-buffer",
   "keywords": [
@@ -33,5 +33,19 @@
   },
   "scripts": {
     "test": "standard && tape test/*.js"
+  },
+  "funding": [
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/feross"
+    },
+    {
+      "type": "patreon",
+      "url": "https://www.patreon.com/feross"
+    },
+    {
+      "type": "consulting",
+      "url": "https://feross.org/support"
     }
+  ]
 }

node_modules/send/HISTORY.md

@@ -1,3 +1,13 @@
+0.17.2 / 2021-12-11
+===================
+
+  * pref: ignore empty http tokens
+  * deps: http-errors@1.8.1
+    - deps: inherits@2.0.4
+    - deps: toidentifier@1.0.1
+    - deps: setprototypeof@1.2.0
+  * deps: ms@2.1.3
+
 0.17.1 / 2019-05-10
 ===================
 

node_modules/send/README.md

@@ -2,7 +2,7 @@
 
 [![NPM Version][npm-version-image]][npm-url]
 [![NPM Downloads][npm-downloads-image]][npm-url]
-[![Linux Build][travis-image]][travis-url]
+[![Linux Build][github-actions-ci-image]][github-actions-ci-url]
 [![Windows Build][appveyor-image]][appveyor-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
@@ -26,8 +26,6 @@ $ npm install send
 
 ## API
 
-<!-- eslint-disable no-unused-vars -->
-
 ```js
 var send = require('send')
 ```
@@ -87,7 +85,7 @@ This is skipped if the requested file already has an extension.
 
 ##### immutable
 
-Enable or diable the `immutable` directive in the `Cache-Control` response
+Enable or disable the `immutable` directive in the `Cache-Control` response
 header, defaults to `false`. If set to `true`, the `maxAge` option should
 also be specified to enable caching. The `immutable` directive will prevent
 supported clients from making conditional requests during the life of the
@@ -320,10 +318,10 @@ server.listen(3000)
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/send
 [coveralls-image]: https://badgen.net/coveralls/c/github/pillarjs/send/master
 [coveralls-url]: https://coveralls.io/r/pillarjs/send?branch=master
+[github-actions-ci-image]: https://badgen.net/github/checks/pillarjs/send/master?label=ci
+[github-actions-ci-url]: https://github.com/pillarjs/send/actions?query=workflow%3Aci
 [node-image]: https://badgen.net/npm/node/send
 [node-url]: https://nodejs.org/en/download/
 [npm-downloads-image]: https://badgen.net/npm/dm/send
 [npm-url]: https://npmjs.org/package/send
 [npm-version-image]: https://badgen.net/npm/v/send
-[travis-image]: https://badgen.net/travis/pillarjs/send/master?label=linux
-[travis-url]: https://travis-ci.org/pillarjs/send

node_modules/send/index.js

@@ -435,7 +435,7 @@ SendStream.prototype.onStatError = function onStatError (error) {
 
 SendStream.prototype.isFresh = function isFresh () {
   return fresh(this.req.headers, {
-    'etag': this.res.getHeader('ETag'),
+    etag: this.res.getHeader('ETag'),
     'last-modified': this.res.getHeader('Last-Modified')
   })
 }
@@ -1096,7 +1096,9 @@ function parseTokenList (str) {
         }
         break
       case 0x2c: /* , */
+        if (start !== end) {
           list.push(str.substring(start, end))
+        }
         start = end = i + 1
         break
       default:
@@ -1106,7 +1108,9 @@ function parseTokenList (str) {
   }
 
   // final token
+  if (start !== end) {
     list.push(str.substring(start, end))
+  }
 
   return list
 }

node_modules/send/node_modules/ms/index.js

@@ -23,12 +23,12 @@ var y = d * 365.25;
  * @api public
  */
 
-module.exports = function(val, options) {
+module.exports = function (val, options) {
   options = options || {};
   var type = typeof val;
   if (type === 'string' && val.length > 0) {
     return parse(val);
-  } else if (type === 'number' && isNaN(val) === false) {
+  } else if (type === 'number' && isFinite(val)) {
     return options.long ? fmtLong(val) : fmtShort(val);
   }
   throw new Error(
@@ -50,7 +50,7 @@ function parse(str) {
   if (str.length > 100) {
     return;
   }
-  var match = /^((?:\d+)?\-?\d?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
+  var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
     str
   );
   if (!match) {

node_modules/send/node_modules/ms/license.md

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2016 Zeit, Inc.
+Copyright (c) 2020 Vercel, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

node_modules/send/node_modules/ms/package.json

@@ -1,8 +1,8 @@
 {
   "name": "ms",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Tiny millisecond conversion utility",
-  "repository": "zeit/ms",
+  "repository": "vercel/ms",
   "main": "./index",
   "files": [
     "index.js"
@@ -28,10 +28,11 @@
   },
   "license": "MIT",
   "devDependencies": {
-    "eslint": "4.12.1",
+    "eslint": "4.18.2",
     "expect.js": "0.3.1",
     "husky": "0.14.3",
     "lint-staged": "5.0.0",
-    "mocha": "4.0.1"
+    "mocha": "4.0.1",
+    "prettier": "2.0.5"
   }
 }

node_modules/send/node_modules/ms/readme.md

@@ -1,7 +1,6 @@
 # ms
 
-[![Build Status](https://travis-ci.org/zeit/ms.svg?branch=master)](https://travis-ci.org/zeit/ms)
+![CI](https://github.com/vercel/ms/workflows/CI/badge.svg)
-[![Slack Channel](http://zeit-slackin.now.sh/badge.svg)](https://zeit.chat/)
 
 Use this package to easily convert various time formats to milliseconds.
 

node_modules/send/package.json

@@ -1,7 +1,7 @@
 {
   "name": "send",
   "description": "Better streaming static file server with Range and conditional-GET support",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "author": "TJ Holowaychuk <tj@vision-media.ca>",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
@@ -23,25 +23,25 @@
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
     "fresh": "0.5.2",
-    "http-errors": "~1.7.2",
+    "http-errors": "1.8.1",
     "mime": "1.6.0",
-    "ms": "2.1.1",
+    "ms": "2.1.3",
     "on-finished": "~2.3.0",
     "range-parser": "~1.2.1",
     "statuses": "~1.5.0"
   },
   "devDependencies": {
     "after": "0.8.2",
-    "eslint": "5.16.0",
+    "eslint": "7.32.0",
-    "eslint-config-standard": "12.0.0",
+    "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.17.2",
+    "eslint-plugin-import": "2.25.3",
-    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-markdown": "2.2.1",
-    "eslint-plugin-node": "8.0.1",
+    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "4.1.1",
+    "eslint-plugin-promise": "5.2.0",
-    "eslint-plugin-standard": "4.0.0",
+    "eslint-plugin-standard": "4.1.0",
-    "istanbul": "0.4.5",
+    "mocha": "9.1.3",
-    "mocha": "6.1.4",
+    "nyc": "15.1.0",
-    "supertest": "4.0.2"
+    "supertest": "6.1.6"
   },
   "files": [
     "HISTORY.md",
@@ -53,9 +53,9 @@
     "node": ">= 0.8.0"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md .",
+    "lint": "eslint .",
     "test": "mocha --check-leaks --reporter spec --bail",
-    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --check-leaks --reporter spec",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --check-leaks --reporter dot"
+    "test-cov": "nyc --reporter=html --reporter=text npm test"
   }
 }

node_modules/serve-static/HISTORY.md

@@ -1,3 +1,11 @@
+1.14.2 / 2021-12-15
+===================
+
+  * deps: send@0.17.2
+    - deps: http-errors@1.8.1
+    - deps: ms@2.1.3
+    - pref: ignore empty http tokens
+
 1.14.1 / 2019-05-10
 ===================
 

node_modules/serve-static/README.md

@@ -2,7 +2,7 @@
 
 [![NPM Version][npm-version-image]][npm-url]
 [![NPM Downloads][npm-downloads-image]][npm-url]
-[![Linux Build][travis-image]][travis-url]
+[![Linux Build][github-actions-ci-image]][github-actions-ci-url]
 [![Windows Build][appveyor-image]][appveyor-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
 
@@ -18,8 +18,6 @@ $ npm install serve-static
 
 ## API
 
-<!-- eslint-disable no-unused-vars -->
-
 ```js
 var serveStatic = require('serve-static')
 ```
@@ -141,7 +139,7 @@ var http = require('http')
 var serveStatic = require('serve-static')
 
 // Serve up public/ftp folder
-var serve = serveStatic('public/ftp', { 'index': ['index.html', 'index.htm'] })
+var serve = serveStatic('public/ftp', { index: ['index.html', 'index.htm'] })
 
 // Create server
 var server = http.createServer(function onRequest (req, res) {
@@ -162,8 +160,8 @@ var serveStatic = require('serve-static')
 
 // Serve up public/ftp folder
 var serve = serveStatic('public/ftp', {
-  'index': false,
+  index: false,
-  'setHeaders': setHeaders
+  setHeaders: setHeaders
 })
 
 // Set header to force download
@@ -192,15 +190,15 @@ var serveStatic = require('serve-static')
 
 var app = express()
 
-app.use(serveStatic('public/ftp', { 'index': ['default.html', 'default.htm'] }))
+app.use(serveStatic('public/ftp', { index: ['default.html', 'default.htm'] }))
 app.listen(3000)
 ```
 
 #### Multiple roots
 
 This example shows a simple way to search through multiple directories.
-Files are look for in `public-optimized/` first, then `public/` second as
+Files are searched for in `public-optimized/` first, then `public/` second
-a fallback.
+as a fallback.
 
 ```js
 var express = require('express')
@@ -250,10 +248,10 @@ function setCustomCacheControl (res, path) {
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/serve-static
 [coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/serve-static/master
 [coveralls-url]: https://coveralls.io/r/expressjs/serve-static?branch=master
+[github-actions-ci-image]: https://badgen.net/github/checks/expressjs/serve-static/master?label=linux
+[github-actions-ci-url]: https://github.com/expressjs/serve-static/actions?query=workflow%3Aci
 [node-image]: https://badgen.net/npm/node/serve-static
 [node-url]: https://nodejs.org/en/download/
 [npm-downloads-image]: https://badgen.net/npm/dm/serve-static
 [npm-url]: https://npmjs.org/package/serve-static
 [npm-version-image]: https://badgen.net/npm/v/serve-static
-[travis-image]: https://badgen.net/travis/expressjs/serve-static/master?label=linux
-[travis-url]: https://travis-ci.org/expressjs/serve-static

node_modules/serve-static/package.json

@@ -1,7 +1,7 @@
 {
   "name": "serve-static",
   "description": "Serve static files",
-  "version": "1.14.1",
+  "version": "1.14.2",
   "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
   "license": "MIT",
   "repository": "expressjs/serve-static",
@@ -9,20 +9,20 @@
     "encodeurl": "~1.0.2",
     "escape-html": "~1.0.3",
     "parseurl": "~1.3.3",
-    "send": "0.17.1"
+    "send": "0.17.2"
   },
   "devDependencies": {
-    "eslint": "5.16.0",
+    "eslint": "7.32.0",
-    "eslint-config-standard": "12.0.0",
+    "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.17.2",
+    "eslint-plugin-import": "2.25.3",
-    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-markdown": "2.2.1",
-    "eslint-plugin-node": "8.0.1",
+    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "4.1.1",
+    "eslint-plugin-promise": "5.2.0",
-    "eslint-plugin-standard": "4.0.0",
+    "eslint-plugin-standard": "4.1.0",
-    "istanbul": "0.4.5",
+    "mocha": "9.1.3",
-    "mocha": "6.1.4",
+    "nyc": "15.1.0",
-    "safe-buffer": "5.1.2",
+    "safe-buffer": "5.2.1",
-    "supertest": "4.0.2"
+    "supertest": "6.1.6"
   },
   "files": [
     "LICENSE",
@@ -33,10 +33,10 @@
     "node": ">= 0.8.0"
   },
   "scripts": {
-    "lint": "eslint --plugin markdown --ext js,md .",
+    "lint": "eslint .",
     "test": "mocha --reporter spec --bail --check-leaks test/",
-    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",
+    "test-cov": "nyc --reporter=html --reporter=text npm test",
     "version": "node scripts/version-history.js && git add HISTORY.md"
   }
 }

node_modules/setprototypeof/README.md

@@ -27,5 +27,5 @@ obj.foo() // bar
 TypeScript is also supported:
 
 ```typescript
-import setPrototypeOf = require('setprototypeof')
+import setPrototypeOf from 'setprototypeof'
 ```

node_modules/setprototypeof/index.js

@@ -9,7 +9,7 @@ function setProtoOf (obj, proto) {
 
 function mixinProperties (obj, proto) {
   for (var prop in proto) {
-    if (!obj.hasOwnProperty(prop)) {
+    if (!Object.prototype.hasOwnProperty.call(obj, prop)) {
       obj[prop] = proto[prop]
     }
   }

node_modules/setprototypeof/package.json

@@ -1,6 +1,6 @@
 {
   "name": "setprototypeof",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "A small polyfill for Object.setprototypeof",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -12,7 +12,9 @@
     "node4": "NODE_VER=4 npm run testversion",
     "node6": "NODE_VER=6 npm run testversion",
     "node9": "NODE_VER=9 npm run testversion",
-    "node11": "NODE_VER=11 npm run testversion"
+    "node11": "NODE_VER=11 npm run testversion",
+    "prepublishOnly": "npm t",
+    "postpublish": "git push origin && git push origin --tags"
   },
   "repository": {
     "type": "git",
@@ -30,7 +32,7 @@
   },
   "homepage": "https://github.com/wesleytodd/setprototypeof",
   "devDependencies": {
-    "mocha": "^5.2.0",
+    "mocha": "^6.1.4",
-    "standard": "^12.0.1"
+    "standard": "^13.0.2"
   }
 }

node_modules/toidentifier/HISTORY.md

@@ -0,0 +1,9 @@
+1.0.1 / 2021-11-14
+==================
+
+  * pref: enable strict mode
+
+1.0.0 / 2018-07-09
+==================
+
+  * Initial release

node_modules/toidentifier/README.md

@@ -2,7 +2,7 @@
 
 [![NPM Version][npm-image]][npm-url]
 [![NPM Downloads][downloads-image]][downloads-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][github-actions-ci-image]][github-actions-ci-url]
 [![Test Coverage][codecov-image]][codecov-url]
 
 > Convert a string of words to a JavaScript identifier
@@ -48,10 +48,10 @@ the following rules and the new string will be returned:
 [codecov-url]: https://codecov.io/gh/component/toidentifier
 [downloads-image]: https://img.shields.io/npm/dm/toidentifier.svg
 [downloads-url]: https://npmjs.org/package/toidentifier
+[github-actions-ci-image]: https://img.shields.io/github/workflow/status/component/toidentifier/ci/master?label=ci
+[github-actions-ci-url]: https://github.com/component/toidentifier?query=workflow%3Aci
 [npm-image]: https://img.shields.io/npm/v/toidentifier.svg
 [npm-url]: https://npmjs.org/package/toidentifier
-[travis-image]: https://img.shields.io/travis/component/toidentifier/master.svg
-[travis-url]: https://travis-ci.org/component/toidentifier
 
 
 ##