🤖 Forwarded from downstream issue

• https://github.com/antfu/action-upstream-issue/issues/2 by @antfu

_{Original description}

Should report to upstream repo

Hey there!

I'd like to report a security issue but cannot find contact instructions on your repository.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

Hi,

Clear and concise description of the problem

I'm currently using objectMap to transform all empty values to null, but it's not recursive by default.

Suggested solution

This feature request proposes a second deepObjectMap method that would work with nested objects.

Alternative

No response

Additional context

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guide.
• Check that there isn't already an issue that request the same feature to avoid creating a duplicate.

🤖 Forwarded from downstream issue

• https://github.com/antfu/action-upstream-issue/issues/2 by @antfu

_{Original description}

Should report to upstream repo

Describe the bug

When using the latest version (v6.0.1), build reports an error with the following error message. It is available to use the previous v0.5.2.

Reproduction

sorry, Unable to provide

System Info

System:
    OS: Windows 10 10.0.19043
    CPU: (8) x64 AMD Ryzen 5 3550H with Radeon Vega Mobile Gfx
    Memory: 5.51 GB / 14.88 GB
  Binaries:
    Node: 14.19.0 - D:\Programs\nodejs\node.EXE
    Yarn: 1.22.17 - D:\Programs\nodejs\yarn.CMD
    npm: 6.14.16 - D:\Programs\nodejs\npm.CMD
  Browsers:
    Edge: Spartan (44.19041.1266.0), Chromium (106.0.1370.52)
    Internet Explorer: 11.0.19041.1566

Used Package Manager

pnpm

Validations

• Follow our Code of Conduct
• Read the Contributing Guide.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A, please open a GitHub Discussion instead.
• The provided reproduction is a minimal reproducible of the bug.

Describe the bug

The lerp method may have accuracy problems when calculating with decimals, which may not matter in some scenarios (such as calculating pixels), but may be confusing in some situations.

// math.test.ts
import { lerp } from './math'

it('lerp', () => {
  expect(lerp(0.2, 0.4, 0.5)).toMatchInlineSnapshot('0.30000000000000004')
})

Reproduction

https://github.com/CatsJuice/mir-antfu-utils-math-lerp-precision

System Info

System:
    OS: macOS 14.0
    CPU: (10) arm64 Apple M1 Pro
    Memory: 67.19 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 18.16.0 - ~/.nvm/versions/node/v18.16.0/bin/node
    Yarn: 1.22.17 - /usr/local/bin/yarn
    npm: 9.5.1 - ~/.nvm/versions/node/v18.16.0/bin/npm
  Browsers:
    Safari: 17.0

Used Package Manager

pnpm

Validations

• Follow our Code of Conduct
• Read the Contributing Guide.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A, please open a GitHub Discussion instead.
• The provided reproduction is a minimal reproducible of the bug.

Clear and concise description of the problem

Re: https://huntr.dev/bounties/009f1cd9-401c-49a7-bd08-be35cff6faef/

Thank you for all your hard work on fixing vulnerabilities on the utils lib.

Even after fix on 7.3, platforms such as SonaType are still flagging this package as insecure because one file wasn't updated (index.js) even though the commonJS and ESM versions are clear.

Quote:

The fix for this vulnerability was released for version 0.7.3 and onwards only on the index.mjs and index.cjs files. However the index.js file remains vulnerable.

Suggested solution

index.js should also include the Prototype Pollution fix

Alternative

No response

Additional context

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guide.
• Check that there isn't already an issue that request the same feature to avoid creating a duplicate.

Forwarded from downstream issue

• https://github.com/antfu/action-upstream-issue/issues/1 by @antfu

null

Describe the bug

I don't know if there's something wrong with the way I'm using it, but no matter how I assign a value to concurrency, all the Promises are always executed at the same time.

// main.ts

import { p } from "@antfu/utils";
import { loadData, sleep } from "./utils";

/**
 * Mock data loading
 * @returns 
 */
export async function loadData() {
  await sleep(Math.random() * 1000)
  return Math.round(Math.random() * 1000)
}

const concurrency = 1
let running = 0

p(
  Array.from({ length: 100 }).map(async (_, i) => {
    console.log(`start, running: ${running++}`)
    const data = await loadData();
    console.log(`end, running: ${running--}`)
    return data;
  }), 
  { concurrency }
)

The result of the above code is that all requests are executed simultaneously and end after a random time.

Reproduction

https://github.com/CatsJuice/mir-antfu-utils-p-not-working

System Info

System:
    OS: macOS 14.0
    CPU: (10) arm64 Apple M1 Pro
    Memory: 101.16 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 18.16.0 - ~/.nvm/versions/node/v18.16.0/bin/node
    Yarn: 1.22.17 - /usr/local/bin/yarn
    npm: 9.5.1 - ~/.nvm/versions/node/v18.16.0/bin/npm
  Browsers:
    Safari: 17.0

Used Package Manager

npm

Validations

• Follow our Code of Conduct
• Read the Contributing Guide.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A, please open a GitHub Discussion instead.
• The provided reproduction is a minimal reproducible of the bug.

🤖 Forwarded from downstream issue

• https://github.com/antfu/action-upstream-issue/issues/1 by @antfu

_{Original description}

🤖 Forwarded from downstream issue

• https://github.com/antfu/action-upstream-issue/issues/2 by @antfu

_{Original description}

Should report to upstream repo

Forwarded from downstream issue:

• antfu/test#1 by @antfu

_{Original description}

Hello

Describe the bug

README has docs link to https://www.paka.dev/npm/@antfu/utils however when we visit the site it throws error and renders below:

Reproduction

1. Open link in README:
   

System Info

n/a

Used Package Manager

n/a

Validations

• Follow our Code of Conduct
• Read the Contributing Guide.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A, please open a GitHub Discussion instead.
• The provided reproduction is a minimal reproducible of the bug.