deps: cross-spawn@7.0.6

Author: wraithgar

node_modules/cross-spawn/lib/enoent.js

@@ -24,7 +24,7 @@ function hookChildProcess(cp, parsed) {
  // the command exists and emit an "error" instead
  // See https://github.com/IndigoUnited/node-cross-spawn/issues/16
  if (name === 'exit') {
- const err = verifyENOENT(arg1, parsed, 'spawn');
+ const err = verifyENOENT(arg1, parsed);
 
  if (err) {
  return originalEmit.call(cp, 'error', err);

node_modules/cross-spawn/lib/util/escape.js

@@ -15,15 +15,17 @@ function escapeArgument(arg, doubleEscapeMetaChars) {
  arg = `${arg}`;
 
  // Algorithm below is based on https://qntm.org/cmd
+ // It's slightly altered to disable JS backtracking to avoid hanging on specially crafted input
+ // Please see https://github.com/moxystudio/node-cross-spawn/pull/160 for more information
 
  // Sequence of backslashes followed by a double quote:
  // double up all the backslashes and escape the double quote
- arg = arg.replace(/(\\*)"/g, '$1$1\\"');
+ arg = arg.replace(/(?=(\\+?)?)\1"/g, '$1$1\\"');
 
  // Sequence of backslashes followed by the end of the string
  // (which will become a double quote later):
  // double up all the backslashes
- arg = arg.replace(/(\\*)$/, '$1$1');
+ arg = arg.replace(/(?=(\\+?)?)\1$/, '$1$1');
 
  // All other backslashes occur literally
 

node_modules/cross-spawn/package.json

@@ -1,6 +1,6 @@
 {
  "name": "cross-spawn",
- "version": "7.0.3",
+ "version": "7.0.6",
  "description": "Cross platform child_process#spawn and child_process#spawnSync",
  "keywords": [
  "spawn",
@@ -65,7 +65,7 @@
  "lint-staged": "^9.2.5",
  "mkdirp": "^0.5.1",
  "rimraf": "^3.0.0",
- "standard-version": "^7.0.0"
+ "standard-version": "^9.5.0"
  },
  "engines": {
  "node": ">= 8"

package-lock.json

@@ -6396,9 +6396,9 @@
  }
  },
  "node_modules/cross-spawn": {
- "version": "7.0.3",
- "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
- "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+ "version": "7.0.6",
+ "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+ "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
  "inBundle": true,
  "license": "MIT",
  "dependencies": {