v9 deps update

node_modules/.gitignore

@@ -87,9 +87,6 @@
 !/cross-spawn/node_modules/which
 !/cssesc
 !/debug
-!/debug/node_modules/
-/debug/node_modules/*
-!/debug/node_modules/ms
 !/defaults
 !/delegates
 !/diff

node_modules/cross-spawn/lib/enoent.js

@@ -24,7 +24,7 @@ function hookChildProcess(cp, parsed) {
         // the command exists and emit an "error" instead
         // See https://github.com/IndigoUnited/node-cross-spawn/issues/16
         if (name === 'exit') {
-            const err = verifyENOENT(arg1, parsed, 'spawn');
+            const err = verifyENOENT(arg1, parsed);
 
             if (err) {
                 return originalEmit.call(cp, 'error', err);

node_modules/cross-spawn/lib/util/escape.js

@@ -15,15 +15,17 @@ function escapeArgument(arg, doubleEscapeMetaChars) {
     arg = `${arg}`;
 
     // Algorithm below is based on https://qntm.org/cmd
+    // It's slightly altered to disable JS backtracking to avoid hanging on specially crafted input
+    // Please see https://github.com/moxystudio/node-cross-spawn/pull/160 for more information
 
     // Sequence of backslashes followed by a double quote:
     // double up all the backslashes and escape the double quote
-    arg = arg.replace(/(\\*)"/g, '$1$1\\"');
+    arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
 
     // Sequence of backslashes followed by the end of the string
     // (which will become a double quote later):
     // double up all the backslashes
-    arg = arg.replace(/(\\*)$/, '$1$1');
+    arg = arg.replace(/(?=(\\+?)?)\1$/, '$1$1');
 
     // All other backslashes occur literally
 

node_modules/cross-spawn/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cross-spawn",
-  "version": "7.0.3",
+  "version": "7.0.6",
   "description": "Cross platform child_process#spawn and child_process#spawnSync",
   "keywords": [
     "spawn",
@@ -65,7 +65,7 @@
     "lint-staged": "^9.2.5",
     "mkdirp": "^0.5.1",
     "rimraf": "^3.0.0",
-    "standard-version": "^7.0.0"
+    "standard-version": "^9.5.0"
   },
   "engines": {
     "node": ">= 8"

node_modules/debug/package.json

@@ -1,6 +1,6 @@
 {
   "name": "debug",
-  "version": "4.3.4",
+  "version": "4.3.7",
   "repository": {
     "type": "git",
     "url": "git://github.com/debug-js/debug.git"
@@ -16,7 +16,7 @@
     "LICENSE",
     "README.md"
   ],
-  "author": "Josh Junon <josh.junon@protonmail.com>",
+  "author": "Josh Junon (https://github.com/qix-)",
   "contributors": [
     "TJ Holowaychuk <[email protected]>",
     "Nathan Rajlich <[email protected]> (http://n8.io)",
@@ -26,12 +26,12 @@
   "scripts": {
     "lint": "xo",
     "test": "npm run test:node && npm run test:browser && npm run lint",
-    "test:node": "istanbul cover _mocha -- test.js",
+    "test:node": "istanbul cover _mocha -- test.js test.node.js",
     "test:browser": "karma start --single-run",
     "test:coverage": "cat ./coverage/lcov.info | coveralls"
   },
   "dependencies": {
-    "ms": "2.1.2"
+    "ms": "^2.1.3"
   },
   "devDependencies": {
     "brfs": "^2.0.1",
@@ -44,6 +44,7 @@
     "karma-mocha": "^1.3.0",
     "mocha": "^5.2.0",
     "mocha-lcov-reporter": "^1.2.0",
+    "sinon": "^14.0.0",
     "xo": "^0.23.0"
   },
   "peerDependenciesMeta": {

node_modules/debug/src/browser.js

@@ -125,14 +125,16 @@ function useColors() {
 		return false;
 	}
 
+	let m;
+
 	// Is webkit? http://stackoverflow.com/a/16459606/376773
 	// document is undefined in react-native: https://github.com/facebook/react-native/pull/1632
 	return (typeof document !== 'undefined' && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance) ||
 		// Is firebug? http://stackoverflow.com/a/398120/376773
 		(typeof window !== 'undefined' && window.console && (window.console.firebug || (window.console.exception && window.console.table))) ||
 		// Is firefox >= v31?
 		// https://developer.mozilla.org/en-US/docs/Tools/Web_Console#Styling_messages
-		(typeof navigator !== 'undefined' && navigator.userAgent && navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/) && parseInt(RegExp.$1, 10) >= 31) ||
+		(typeof navigator !== 'undefined' && navigator.userAgent && (m = navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/)) && parseInt(m[1], 10) >= 31) ||
 		// Double check webkit in userAgent just in case we are in a worker
 		(typeof navigator !== 'undefined' && navigator.userAgent && navigator.userAgent.toLowerCase().match(/applewebkit\/(\d+)/));
 }

node_modules/debug/src/node.js

@@ -187,11 +187,11 @@ function getDate() {
 }
 
 /**
- * Invokes `util.format()` with the specified arguments and writes to stderr.
+ * Invokes `util.formatWithOptions()` with the specified arguments and writes to stderr.
  */
 
 function log(...args) {
-	return process.stderr.write(util.format(...args) + '\n');
+	return process.stderr.write(util.formatWithOptions(exports.inspectOpts, ...args) + '\n');
 }
 
 /**

node_modules/hosted-git-info/lib/hosts.js

@@ -4,7 +4,11 @@
 
 const maybeJoin = (...args) => args.every(arg => arg) ? args.join('') : ''
 const maybeEncode = (arg) => arg ? encodeURIComponent(arg) : ''
-const formatHashFragment = (f) => f.toLowerCase().replace(/^\W+|\/|\W+$/g, '').replace(/\W+/g, '-')
+const formatHashFragment = (f) => f.toLowerCase()
+  .replace(/^\W+/g, '') // strip leading non-characters
+  .replace(/\W+$/g, '') // strip trailing non-characters
+  .replace(/\//g, '') // strip all slashes
+  .replace(/\W+/g, '-') // replace remaining non-characters with '-'
 
 const defaults = {
   sshtemplate: ({ domain, user, project, committish }) =>