Skip to content

Commit d47ba37

Browse files
socket-security[bot]socket-security[bot]
authored
Add Socket patch for CVE-2026-32141 in pkg:npm/flatted@3.3.3
Updates: - 6 blob(s) added - 0 blob(s) removed - Manifest updated
1 parent d4ccce0 commit d47ba37

7 files changed

Lines changed: 500 additions & 0 deletions

‎.socket/blob/31c585cc68df52af7200ab6feb886a87f287246f6af6ea4d927b6a4b1356f227‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
// Socket Community Patch: https://socket.dev
2+
// Date: Thu, 19 Mar 2026 13:31:01 GMT
3+
// For more information see https://socket.dev/patch/80a838c0-0f14-4eaf-832e-f5e107a9f7db
4+
// This file includes modifications made by Socket, Inc. on Thu, 19 Mar 2026; these modifications are called the "Patch". In some cases, Socket may be required to make the Patch available to you under specific terms, or may be prohibited from restricting certain rights you may have. For example, the terms of another applicable license may require Socket to make the Patch available under specific terms. In those cases, the Patch is made available to you under the required terms, and Socket does not seek to restrict your rights relative to the Patch where prohibited. In all other cases, the Patch is available to you exclusively under the PolyForm Shield License 1.0.0 (https://polyformproject.org/licenses/shield/1.0.0/). The Patch was distributed by Socket with additional information concerning licensing, attribution, and limitation of liability which may be relevant to you and your use of the Patch. As far as the law allows, the Patch and the software including the patch come as is, without any warranty or condition, and Socket will not be liable to you for any damages arising out of the applicable license terms or the use or nature of the Patch or the software including the patch, under any kind of legal claim.
5+
// Original License: MIT
6+
7+
self.Flatted = (function (exports) {
8+
'use strict';
9+
10+
function _typeof(o) {
11+
"@babel/helpers - typeof";
12+
13+
return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) {
14+
return typeof o;
15+
} : function (o) {
16+
return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
17+
}, _typeof(o);
18+
}
19+
20+
/// <reference types="../types/index.d.ts" />
21+
22+
// (c) 2020-present Andrea Giammarchi
23+
24+
var $parse = JSON.parse,
25+
$stringify = JSON.stringify;
26+
var keys = Object.keys;
27+
var Primitive = String; // it could be Number
28+
var primitive = 'string'; // it could be 'number'
29+
30+
var ignore = {};
31+
var object = 'object';
32+
var noop = function noop(_, value) {
33+
return value;
34+
};
35+
var primitives = function primitives(value) {
36+
return value instanceof Primitive ? Primitive(value) : value;
37+
};
38+
var Primitives = function Primitives(_, value) {
39+
return _typeof(value) === primitive ? new Primitive(value) : value;
40+
};
41+
var resolver = function resolver(input, lazy, parsed, $) {
42+
return function (output) {
43+
for (var ke = keys(output), length = ke.length, y = 0; y < length; y++) {
44+
var k = ke[y];
45+
var value = output[k];
46+
if (value instanceof Primitive) {
47+
var tmp = input[value];
48+
if (_typeof(tmp) === object && !parsed.has(tmp)) {
49+
parsed.add(tmp);
50+
output[k] = ignore;
51+
lazy.push({
52+
o: output,
53+
k: k,
54+
r: tmp
55+
});
56+
} else output[k] = $.call(output, k, tmp);
57+
} else if (output[k] !== ignore) output[k] = $.call(output, k, value);
58+
}
59+
return output;
60+
};
61+
};
62+
var set = function set(known, input, value) {
63+
var index = Primitive(input.push(value) - 1);
64+
known.set(value, index);
65+
return index;
66+
};
67+
68+
/**
69+
* Converts a specialized flatted string into a JS value.
70+
* @param {string} text
71+
* @param {(this: any, key: string, value: any) => any} [reviver]
72+
* @returns {any}
73+
*/
74+
var parse = function parse(text, reviver) {
75+
var input = $parse(text, Primitives).map(primitives);
76+
var $ = reviver || noop;
77+
var value = input[0];
78+
if (_typeof(value) === object && value) {
79+
var lazy = [];
80+
var revive = resolver(input, lazy, new Set(), $);
81+
value = revive(value);
82+
var i = 0;
83+
while (i < lazy.length) {
84+
// it could be a lazy.shift() but that's costly
85+
var _lazy$i = lazy[i++],
86+
o = _lazy$i.o,
87+
k = _lazy$i.k,
88+
r = _lazy$i.r;
89+
o[k] = $.call(o, k, revive(r));
90+
}
91+
}
92+
return $.call({
93+
'': value
94+
}, '', value);
95+
};
96+
97+
/**
98+
* Converts a JS value into a specialized flatted string.
99+
* @param {any} value
100+
* @param {((this: any, key: string, value: any) => any) | (string | number)[] | null | undefined} [replacer]
101+
* @param {string | number | undefined} [space]
102+
* @returns {string}
103+
*/
104+
var stringify = function stringify(value, replacer, space) {
105+
var $ = replacer && _typeof(replacer) === object ? function (k, v) {
106+
return k === '' || -1 < replacer.indexOf(k) ? v : void 0;
107+
} : replacer || noop;
108+
var known = new Map();
109+
var input = [];
110+
var output = [];
111+
var i = +set(known, input, $.call({
112+
'': value
113+
}, '', value));
114+
var firstRun = !i;
115+
while (i < input.length) {
116+
firstRun = true;
117+
output[i] = $stringify(input[i++], replace, space);
118+
}
119+
return '[' + output.join(',') + ']';
120+
function replace(key, value) {
121+
if (firstRun) {
122+
firstRun = !firstRun;
123+
return value;
124+
}
125+
var after = $.call(this, key, value);
126+
switch (_typeof(after)) {
127+
case object:
128+
if (after === null) return after;
129+
case primitive:
130+
return known.get(after) || set(known, input, after);
131+
}
132+
return after;
133+
}
134+
};
135+
136+
/**
137+
* Converts a generic value into a JSON serializable object without losing recursion.
138+
* @param {any} value
139+
* @returns {any}
140+
*/
141+
var toJSON = function toJSON(value) {
142+
return $parse(stringify(value));
143+
};
144+
145+
/**
146+
* Converts a previously serialized object with recursion into a recursive one.
147+
* @param {any} value
148+
* @returns {any}
149+
*/
150+
var fromJSON = function fromJSON(value) {
151+
return parse($stringify(value));
152+
};
153+
154+
exports.fromJSON = fromJSON;
155+
exports.parse = parse;
156+
exports.stringify = stringify;
157+
exports.toJSON = toJSON;
158+
159+
return exports;
160+
161+
})({});

‎.socket/blob/3ef3dda70bb8cac33795ba9a6c3ebf7ceb65126f92a3c38583d1eb936ba2d6fe‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
// Socket Community Patch: https://socket.dev
2+
// Date: Thu, 19 Mar 2026 13:31:01 GMT
3+
// For more information see https://socket.dev/patch/80a838c0-0f14-4eaf-832e-f5e107a9f7db
4+
// This file includes modifications made by Socket, Inc. on Thu, 19 Mar 2026; these modifications are called the "Patch". In some cases, Socket may be required to make the Patch available to you under specific terms, or may be prohibited from restricting certain rights you may have. For example, the terms of another applicable license may require Socket to make the Patch available under specific terms. In those cases, the Patch is made available to you under the required terms, and Socket does not seek to restrict your rights relative to the Patch where prohibited. In all other cases, the Patch is available to you exclusively under the PolyForm Shield License 1.0.0 (https://polyformproject.org/licenses/shield/1.0.0/). The Patch was distributed by Socket with additional information concerning licensing, attribution, and limitation of liability which may be relevant to you and your use of the Patch. As far as the law allows, the Patch and the software including the patch come as is, without any warranty or condition, and Socket will not be liable to you for any damages arising out of the applicable license terms or the use or nature of the Patch or the software including the patch, under any kind of legal claim.
5+
// Original License: MIT
6+
7+
'use strict';
8+
/// <reference types="../types/index.d.ts" />
9+
10+
// (c) 2020-present Andrea Giammarchi
11+
12+
const {parse: $parse, stringify: $stringify} = JSON;
13+
const {keys} = Object;
14+
15+
const Primitive = String; // it could be Number
16+
const primitive = 'string'; // it could be 'number'
17+
18+
const ignore = {};
19+
const object = 'object';
20+
21+
const noop = (_, value) => value;
22+
23+
const primitives = value => (
24+
value instanceof Primitive ? Primitive(value) : value
25+
);
26+
27+
const Primitives = (_, value) => (
28+
typeof value === primitive ? new Primitive(value) : value
29+
);
30+
31+
const resolver = (input, lazy, parsed, $) => output => {
32+
for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
33+
const k = ke[y];
34+
const value = output[k];
35+
if (value instanceof Primitive) {
36+
const tmp = input[value];
37+
if (typeof tmp === object && !parsed.has(tmp)) {
38+
parsed.add(tmp);
39+
output[k] = ignore;
40+
lazy.push({ o: output, k, r: tmp });
41+
}
42+
else
43+
output[k] = $.call(output, k, tmp);
44+
}
45+
else if (output[k] !== ignore)
46+
output[k] = $.call(output, k, value);
47+
}
48+
return output;
49+
};
50+
51+
const set = (known, input, value) => {
52+
const index = Primitive(input.push(value) - 1);
53+
known.set(value, index);
54+
return index;
55+
};
56+
57+
/**
58+
* Converts a specialized flatted string into a JS value.
59+
* @param {string} text
60+
* @param {(this: any, key: string, value: any) => any} [reviver]
61+
* @returns {any}
62+
*/
63+
const parse = (text, reviver) => {
64+
const input = $parse(text, Primitives).map(primitives);
65+
const $ = reviver || noop;
66+
67+
let value = input[0];
68+
69+
if (typeof value === object && value) {
70+
const lazy = [];
71+
const revive = resolver(input, lazy, new Set, $);
72+
value = revive(value);
73+
74+
let i = 0;
75+
while (i < lazy.length) {
76+
// it could be a lazy.shift() but that's costly
77+
const {o, k, r} = lazy[i++];
78+
o[k] = $.call(o, k, revive(r));
79+
}
80+
}
81+
82+
return $.call({'': value}, '', value);
83+
};
84+
exports.parse = parse;
85+
86+
/**
87+
* Converts a JS value into a specialized flatted string.
88+
* @param {any} value
89+
* @param {((this: any, key: string, value: any) => any) | (string | number)[] | null | undefined} [replacer]
90+
* @param {string | number | undefined} [space]
91+
* @returns {string}
92+
*/
93+
const stringify = (value, replacer, space) => {
94+
const $ = replacer && typeof replacer === object ?
95+
(k, v) => (k === '' || -1 < replacer.indexOf(k) ? v : void 0) :
96+
(replacer || noop);
97+
const known = new Map;
98+
const input = [];
99+
const output = [];
100+
let i = +set(known, input, $.call({'': value}, '', value));
101+
let firstRun = !i;
102+
while (i < input.length) {
103+
firstRun = true;
104+
output[i] = $stringify(input[i++], replace, space);
105+
}
106+
return '[' + output.join(',') + ']';
107+
function replace(key, value) {
108+
if (firstRun) {
109+
firstRun = !firstRun;
110+
return value;
111+
}
112+
const after = $.call(this, key, value);
113+
switch (typeof after) {
114+
case object:
115+
if (after === null) return after;
116+
case primitive:
117+
return known.get(after) || set(known, input, after);
118+
}
119+
return after;
120+
}
121+
};
122+
exports.stringify = stringify;
123+
124+
/**
125+
* Converts a generic value into a JSON serializable object without losing recursion.
126+
* @param {any} value
127+
* @returns {any}
128+
*/
129+
const toJSON = value => $parse(stringify(value));
130+
exports.toJSON = toJSON;
131+
132+
/**
133+
* Converts a previously serialized object with recursion into a recursive one.
134+
* @param {any} value
135+
* @returns {any}
136+
*/
137+
const fromJSON = value => parse($stringify(value));
138+
exports.fromJSON = fromJSON;

‎.socket/blob/66522437630181e864fdd203faff6ac4aff1c2358c57a679f183ca338b597b62‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
// Socket Community Patch: https://socket.dev
2+
// Date: Thu, 19 Mar 2026 13:31:01 GMT
3+
// For more information see https://socket.dev/patch/80a838c0-0f14-4eaf-832e-f5e107a9f7db
4+
// This file includes modifications made by Socket, Inc. on Thu, 19 Mar 2026; these modifications are called the "Patch". In some cases, Socket may be required to make the Patch available to you under specific terms, or may be prohibited from restricting certain rights you may have. For example, the terms of another applicable license may require Socket to make the Patch available under specific terms. In those cases, the Patch is made available to you under the required terms, and Socket does not seek to restrict your rights relative to the Patch where prohibited. In all other cases, the Patch is available to you exclusively under the PolyForm Shield License 1.0.0 (https://polyformproject.org/licenses/shield/1.0.0/). The Patch was distributed by Socket with additional information concerning licensing, attribution, and limitation of liability which may be relevant to you and your use of the Patch. As far as the law allows, the Patch and the software including the patch come as is, without any warranty or condition, and Socket will not be liable to you for any damages arising out of the applicable license terms or the use or nature of the Patch or the software including the patch, under any kind of legal claim.
5+
// Original License: MIT
6+
7+
const{parse:t,stringify:e}=JSON,{keys:n}=Object,o=String,r="string",s={},c="object",l=(t,e)=>e,f=t=>t instanceof o?o(t):t,i=(t,e)=>typeof e===r?new o(e):e,a=(t,e,n)=>{const r=o(e.push(n)-1);return t.set(n,r),r},u=(e,r)=>{const a=t(e,i).map(f),u=r||l;let p=a[0];if(typeof p===c&&p){const t=[],e=((t,e,r,l)=>f=>{for(let i=n(f),{length:a}=i,u=0;u<a;u++){const n=i[u],a=f[n];if(a instanceof o){const o=t[a];typeof o!==c||r.has(o)?f[n]=l.call(f,n,o):(r.add(o),f[n]=s,e.push({o:f,k:n,r:o}))}else f[n]!==s&&(f[n]=l.call(f,n,a))}return f})(a,t,new Set,u);p=e(p);let r=0;for(;r<t.length;){const{o:n,k:o,r:s}=t[r++];n[o]=u.call(n,o,e(s))}}return u.call({"":p},"",p)},p=(t,n,o)=>{const s=n&&typeof n===c?(t,e)=>""===t||-1<n.indexOf(t)?e:void 0:n||l,f=new Map,i=[],u=[];let p=+a(f,i,s.call({"":t},"",t)),h=!p;for(;p<i.length;)h=!0,u[p]=e(i[p++],g,o);return"["+u.join(",")+"]";function g(t,e){if(h)return h=!h,e;const n=s.call(this,t,e);switch(typeof n){case c:if(null===n)return n;case r:return f.get(n)||a(f,i,n)}return n}},h=e=>t(p(e)),g=t=>u(e(t));export{g as fromJSON,u as parse,p as stringify,h as toJSON};

‎.socket/blob/8f59caeca409a6a5f4614d711d54fb7398fcc9dd24439bed09c6f46f9c2b053e‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
// Socket Community Patch: https://socket.dev
2+
// Date: Thu, 19 Mar 2026 13:31:01 GMT
3+
// For more information see https://socket.dev/patch/80a838c0-0f14-4eaf-832e-f5e107a9f7db
4+
// This file includes modifications made by Socket, Inc. on Thu, 19 Mar 2026; these modifications are called the "Patch". In some cases, Socket may be required to make the Patch available to you under specific terms, or may be prohibited from restricting certain rights you may have. For example, the terms of another applicable license may require Socket to make the Patch available under specific terms. In those cases, the Patch is made available to you under the required terms, and Socket does not seek to restrict your rights relative to the Patch where prohibited. In all other cases, the Patch is available to you exclusively under the PolyForm Shield License 1.0.0 (https://polyformproject.org/licenses/shield/1.0.0/). The Patch was distributed by Socket with additional information concerning licensing, attribution, and limitation of liability which may be relevant to you and your use of the Patch. As far as the law allows, the Patch and the software including the patch come as is, without any warranty or condition, and Socket will not be liable to you for any damages arising out of the applicable license terms or the use or nature of the Patch or the software including the patch, under any kind of legal claim.
5+
// Original License: MIT
6+
7+
self.Flatted=function(t){"use strict";const{parse:e,stringify:n}=JSON,{keys:r}=Object,o=String,s="string",c={},l="object",f=(t,e)=>e,i=t=>t instanceof o?o(t):t,a=(t,e)=>typeof e===s?new o(e):e,u=(t,e,n)=>{const r=o(e.push(n)-1);return t.set(n,r),r},p=(t,n)=>{const s=e(t,a).map(i),u=n||f;let p=s[0];if(typeof p===l&&p){const t=[],e=((t,e,n,s)=>f=>{for(let i=r(f),{length:a}=i,u=0;u<a;u++){const r=i[u],a=f[r];if(a instanceof o){const o=t[a];typeof o!==l||n.has(o)?f[r]=s.call(f,r,o):(n.add(o),f[r]=c,e.push({o:f,k:r,r:o}))}else f[r]!==c&&(f[r]=s.call(f,r,a))}return f})(s,t,new Set,u);p=e(p);let n=0;for(;n<t.length;){const{o:r,k:o,r:s}=t[n++];r[o]=u.call(r,o,e(s))}}return u.call({"":p},"",p)},g=(t,e,r)=>{const o=e&&typeof e===l?(t,n)=>""===t||-1<e.indexOf(t)?n:void 0:e||f,c=new Map,i=[],a=[];let p=+u(c,i,o.call({"":t},"",t)),g=!p;for(;p<i.length;)g=!0,a[p]=n(i[p++],h,r);return"["+a.join(",")+"]";function h(t,e){if(g)return g=!g,e;const n=o.call(this,t,e);switch(typeof n){case l:if(null===n)return n;case s:return c.get(n)||u(c,i,n)}return n}};return t.fromJSON=t=>p(n(t)),t.parse=p,t.stringify=g,t.toJSON=t=>e(g(t)),t}({});

0 commit comments

Comments
 (0)