Merge branch 'main' into add-proto-null-in-object-eslint-rule

.github/workflows/scorecard.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@128a63446a954579617e875aaab7d2978154e969  # v2.4.0
+        uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845  # v2.4.1
         with:
           egress-policy: audit  # TODO: change to 'egress-policy: block' after couple of runs
 
@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@80e868c13c90f172d68d1f4501dee99e2479f7af  # v2.1.3
+        uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031  # v2.2.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -73,6 +73,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@83f0fe6c4988d98a455712a27f0255212bba9bd4  # v2.3.6
+        uses: github/codeql-action/upload-sarif@f6e388ebf0efc915c6c5b165b019ee61a6746a38  # v2.20.1
         with:
           sarif_file: results.sarif

benchmark/bar.R

@@ -0,0 +1,36 @@
+#!/usr/bin/env Rscript
+library(ggplot2);
+library(plyr);
+
+# get __dirname and load ./_cli.R
+args = commandArgs(trailingOnly = F);
+dirname = dirname(sub("--file=", "", args[grep("--file", args)]));
+source(paste0(dirname, '/_cli.R'), chdir=T);
+
+if (!is.null(args.options$help) ||
+   (!is.null(args.options$plot) && args.options$plot == TRUE)) {
+  stop("usage: cat file.csv | Rscript bar.R
+  --help           show this message
+  --plot filename  save plot to filename");
+}
+
+plot.filename = args.options$plot;
+
+dat = read.csv(
+  file('stdin'),
+  colClasses=c('character', 'character', 'character', 'numeric', 'numeric')
+);
+dat = data.frame(dat);
+
+dat$nameTwoLines = paste0(dat$filename, '\n', dat$configuration);
+dat$name = paste0(dat$filename, ' ', dat$configuration);
+
+# Create a box plot
+if (!is.null(plot.filename)) {
+  p = ggplot(data=dat, aes(x=nameTwoLines, y=rate, fill=binary));
+  p = p + geom_bar(stat="summary", position=position_dodge());
+  p = p + ylab("rate of operations (higher is better)");
+  p = p + xlab("benchmark");
+  p = p + theme(axis.text.x = element_text(angle = 90, hjust = 1, vjust = 0.5));
+  ggsave(plot.filename, p);
+}

benchmark/esm/esm-legacyMainResolve.js

@@ -0,0 +1,53 @@
+// Tests the impact on eager operations required for policies affecting
+// general startup, does not test lazy operations
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const common = require('../common.js');
+
+const tmpdir = require('../../test/common/tmpdir.js');
+const { pathToFileURL } = require('node:url');
+
+const benchmarkDirectory =
+  path.resolve(tmpdir.path, 'benchmark-import-meta-resolve');
+
+const configs = {
+  n: [1e4],
+  packageJsonUrl: [
+    'node_modules/test/package.json',
+  ],
+  packageConfigMain: ['', './index.js'],
+  resolvedFile: [
+    'node_modules/test/index.js',
+    'node_modules/test/index.json',
+    'node_modules/test/index.node',
+    'node_modules/non-exist',
+  ],
+};
+
+const options = {
+  flags: ['--expose-internals'],
+};
+
+const bench = common.createBenchmark(main, configs, options);
+
+function main(conf) {
+  const { legacyMainResolve } = require('internal/modules/esm/resolve');
+  tmpdir.refresh();
+
+  fs.mkdirSync(path.join(benchmarkDirectory, 'node_modules', 'test'), { recursive: true });
+  fs.writeFileSync(path.join(benchmarkDirectory, conf.resolvedFile), '\n');
+
+  const packageJsonUrl = pathToFileURL(conf.packageJsonUrl);
+  const packageConfigMain = { main: conf.packageConfigMain };
+
+  bench.start();
+
+  for (let i = 0; i < conf.n; i++) {
+    try {
+      legacyMainResolve(packageJsonUrl, packageConfigMain, undefined);
+    } catch { /* empty */ }
+  }
+
+  bench.end(conf.n);
+}

deps/acorn/acorn/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 8.9.0 (2023-06-16)
+
+### Bug fixes
+
+Forbid dynamic import after `new`, even when part of a member expression.
+
+### New features
+
+Add Unicode properties for ES2023.
+
+Add support for the `v` flag to regular expressions.
+
 ## 8.8.2 (2023-01-23)
 
 ### Bug fixes

deps/acorn/acorn/README.md

@@ -96,10 +96,11 @@ required):
   (when `sourceType` is not `"module"`).
 
 - **allowAwaitOutsideFunction**: If `false`, `await` expressions can
-  only appear inside `async` functions. Defaults to `true` for
-  `ecmaVersion` 2022 and later, `false` for lower versions. Setting this option to
-  `true` allows to have top-level `await` expressions. They are
-  still not allowed in non-`async` functions, though.
+  only appear inside `async` functions. Defaults to `true` in modules
+  for `ecmaVersion` 2022 and later, `false` for lower versions.
+  Setting this option to `true` allows to have top-level `await`
+  expressions. They are still not allowed in non-`async` functions,
+  though.
 
 - **allowSuperOutsideMethod**: By default, `super` outside a method
   raises an error. Set this to `true` to accept such code.

deps/acorn/acorn/dist/acorn.d.mts

@@ -0,0 +1,26 @@
+export {
+  Node,
+  Parser,
+  Position,
+  SourceLocation,
+  TokContext,
+  Token,
+  TokenType,
+  defaultOptions,
+  getLineInfo,
+  isIdentifierChar,
+  isIdentifierStart,
+  isNewLine,
+  lineBreak,
+  lineBreakG,
+  parse,
+  parseExpressionAt,
+  tokContexts,
+  tokTypes,
+  tokenizer,
+  version,
+  AbstractToken,
+  Comment,
+  Options,
+  ecmaVersion,
+} from "./acorn.js";

deps/acorn/acorn/dist/acorn.d.ts

@@ -249,4 +249,44 @@ declare namespace acorn {
   const lineBreakG: RegExp
 
   const version: string
+
+  const nonASCIIwhitespace: RegExp
+
+  const keywordTypes: {
+    _break: TokenType
+    _case: TokenType
+    _catch: TokenType
+    _continue: TokenType
+    _debugger: TokenType
+    _default: TokenType
+    _do: TokenType
+    _else: TokenType
+    _finally: TokenType
+    _for: TokenType
+    _function: TokenType
+    _if: TokenType
+    _return: TokenType
+    _switch: TokenType
+    _throw: TokenType
+    _try: TokenType
+    _var: TokenType
+    _const: TokenType
+    _while: TokenType
+    _with: TokenType
+    _new: TokenType
+    _this: TokenType
+    _super: TokenType
+    _class: TokenType
+    _extends: TokenType
+    _export: TokenType
+    _import: TokenType
+    _null: TokenType
+    _true: TokenType
+    _false: TokenType
+    _in: TokenType
+    _instanceof: TokenType
+    _typeof: TokenType
+    _void: TokenType
+    _delete: TokenType
+  }
 }