Updated dependencies, fixes CWE-772: Missing Release of Resource after Effective Lifetime

bin/dot-object

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
 // vim: set filetype=javascript:
-'use strict';
+'use strict'
 
-var glob = require('glob');
-var fs = require('fs');
+var { Glob } = require('glob')
+var fs = require('fs')
 
 /**
  *
  *  dotob <pattern> -f require -t dependencies.npm
  *
  */
-var dotob = require('../index.js');
-var program = require('commander');
-var pkg = require('../package.json');
+var dotob = require('../index.js')
+var { Command } = require('commander')
+var program = new Command()
+var pkg = require('../package.json')
 
 program
   .version(pkg.version)
@@ -26,108 +27,112 @@ program
   .option('-s, --show', 'show all dotted paths')
   .option('-v, --verbose', 'Be verbose')
   .option('-d, --dry', 'Dry run do not modify files')
-  .parse(process.argv);
+  .action(function (options) {
+    must(options, 'pattern')
+    if (!options.remove && !options.dot && !options.show) {
+      must(options, 'from')
+      must(options, 'to')
+    }
+    var g = new Glob(options.pattern, {})
+
+    g.stream().on('data', processFile(options))
+
+  })
+program.parse(process.argv)
 
-function must(program, option) {
-  if(!program.hasOwnProperty(option)) {
+function must (options, option) {
+
+  if (!options.hasOwnProperty(option)) {
     console.log([
       'The', option, 'is required'
-    ].join(' '));
-    process.exit(1);
+    ].join(' '))
+    process.exit(1)
   }
 }
 
-must(program, 'pattern');
-
-if (!program.remove && !program.dot && !program.show) {
-  must(program, 'from');
-  must(program, 'to');
-}
-
-var g = glob(program.pattern);
-
-function finish(program, file, orig, json) {
+function finish (program, file, orig, json) {
 
-  return function(err) {
+  return function (err) {
     if (err) {
-      throw err;
+      throw err
     } else {
       if (program.verbose) {
         if (orig !== JSON.stringify(json)) {
-          console.log(file + ': updated.');
+          console.log(file + ': updated.')
         } else {
-          console.log(file + ': no matches.');
+          console.log(file + ': no matches.')
         }
       }
     }
-  };
+  }
 }
 
-function splim(path) {
+function splim (path) {
   return path.split(',')
-    .map(function(val) { return val.trim();  });
+    .map(function (val) {
+      return val.trim()
+    })
 }
 
-function processFile(file) {
+function processFile (program) {
+  return function (file) {
+    fs.readFile(file, 'utf8', function (err, contents) {
+      var json
 
-  fs.readFile(file, 'utf8', function(err, contents) {
-    var json;
+      if (err) {
+        console.log(err)
+        return
+      }
 
-    if (err) {
-      console.log(err);
-      return;
-    }
+      try {
+        json = JSON.parse(contents)
 
-    try {
-      json = JSON.parse(contents);
+        if (program.show) {
+          json = console.log(Object.keys(dotob.dot(json)).join('\n'))
+          process.exit()
+        } else if (program.dot) {
+          console.log(dotob.dot(json))
+          process.exit()
+        }
 
-      if(program.show) {
-        json = console.log(Object.keys(dotob.dot(json)).join('\n'));
-        process.exit()
-      } else if(program.dot) {
-        console.log(dotob.dot(json));
-        process.exit()
-      }
-
-      json = Array.isArray(json) ? json : [json];
-
-      if(program.remove) {
-        // support comma seperate list of removals
-        splim(program.remove)
-          .forEach(function(path) {
-            for (var j = 0; j < json.length; j++) {
-              dotob.remove(path, json[j]);
-            }
-          });
-      } else {
-        var from = splim(program.from);
-        var to = splim(program.to);
-        if (from.length === to.length) {
-          for (var i = 0; i < from.length; i++) {
-            for (var j = 0; j < json.length; j++) {
-              dotob.move(
-                from[i], to[i], json[j], program.merge
-              );
+        json = Array.isArray(json) ? json : [json]
+
+        if (program.remove) {
+          // support comma seperate list of removals
+          splim(program.remove)
+            .forEach(function (path) {
+              for (var j = 0; j < json.length; j++) {
+                dotob.remove(path, json[j])
+              }
+            })
+        } else {
+          var from = splim(program.from)
+          var to = splim(program.to)
+          if (from.length === to.length) {
+            for (var i = 0; i < from.length; i++) {
+              for (var j = 0; j < json.length; j++) {
+                dotob.move(
+                  from[i], to[i], json[j], program.merge
+                )
+              }
             }
+          } else {
+            console.error('--from and --to parameters are not of equal length')
           }
-        } else {
-          console.error('--from and --to parameters are not of equal length');
         }
-      }
 
-      if(program.dry) {
-        console.log(json);
-        finish(program, file, contents, json)();
-      } else {
-        fs.writeFile(file, JSON.stringify(json, null, 2), finish(
-          program, file, contents, json
-        ));
+        if (program.dry) {
+          console.log(json)
+          finish(program, file, contents, json)()
+        } else {
+          fs.writeFile(file, JSON.stringify(json, null, 2), finish(
+            program, file, contents, json
+          ))
+        }
+      } catch (e) {
+        console.log(file + ': ')
+        throw (e)
       }
-    } catch (e) {
-      console.log(file + ': ');
-      throw(e);
-    }
-  });
+    })
+  }
 }
-
-g.on('match', processFile);

package.json

@@ -57,8 +57,8 @@
     "dot"
   ],
   "dependencies": {
-    "commander": "^6.1.0",
-    "glob": "^7.1.6"
+    "glob": "^11.0.3",
+    "commander": "^14.0.1"
   },
   "packageManager": "yarn@4.1.1"
 }