Update npm/registry dependencies

app/package.json

@@ -7,6 +7,6 @@
     "better-sqlite3": "^13.0.3",
     "registry-foreign": "file:../foreign",
     "registry-lib": "file:../lib",
-    "yaml": "^2.8.2"
+    "yaml": "^2.9.1"
   }
 }

app/test/App/Manifest/SpagoYaml.purs

@@ -28,6 +28,22 @@ spec = do
         Left err -> Assert.fail $ path <> " failed: " <> err
         Right _ -> pure unit
 
+  Spec.it "Rejects YAML aliases but accepts literal asterisks" do
+    let
+      input =
+        """
+        package:
+          name: &name example
+          description: *name
+          dependencies: []
+        """
+      literalInput = String.replace (String.Pattern "*name") (String.Replacement "'*name'") input
+
+    parseYaml SpagoYaml.spagoYamlCodec input `Assert.shouldEqual` Left "YAML: YAML aliases are not supported"
+    case parseYaml SpagoYaml.spagoYamlCodec literalInput of
+      Left err -> Assert.fail err
+      Right config -> (config.package >>= _.description) `Assert.shouldEqual` Just "*name"
+
   Spec.it "Rejects deprecated SPDX identifiers in publish config" do
     let
       input =

foreign/package.json

@@ -4,19 +4,19 @@
   "private": true,
   "license": "BSD-3-Clause",
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1009.0",
-    "@octokit/plugin-retry": "^8.1.0",
-    "@octokit/plugin-throttling": "^11.0.3",
+    "@aws-sdk/client-s3": "^3.1149.0",
+    "@octokit/plugin-retry": "^8.1.1",
+    "@octokit/plugin-throttling": "^11.0.5",
     "@octokit/rest": "^22.0.1",
     "better-sqlite3": "^13.0.3",
     "fast-glob": "^3.3.3",
-    "fs-extra": "^11.3.4",
-    "fuse.js": "^7.1.0",
-    "jsonrepair": "^3.13.3",
+    "fs-extra": "^11.4.1",
+    "fuse.js": "^7.5.0",
+    "jsonrepair": "^3.15.0",
     "registry-lib": "file:../lib",
-    "semver": "^7.7.4",
-    "tar": "^7.5.21",
-    "tmp": "^0.2.5",
-    "yaml": "^2.8.2"
+    "semver": "^7.8.5",
+    "tar": "^7.5.22",
+    "tmp": "^0.2.7",
+    "yaml": "^2.9.1"
   }
 }

foreign/src/Foreign/SPDX.js

@@ -11,4 +11,4 @@ const allIdentifiers = identifiers.concat(deprecatedIdentifiers);
 const fuse = new Fuse(allIdentifiers);
 
 export const matchLicenseImpl = (identifier) =>
-  fuse.search(identifier).map(({ item }) => item);
+  identifier === "" ? [] : fuse.search(identifier).map(({ item }) => item);

foreign/src/Foreign/Yaml.js

@@ -1,11 +1,21 @@
 import Yaml from 'yaml';
 
 export function yamlDocParserImpl(fail, succ, s) {
-  const doc = Yaml.parseDocument(s);
-  if (doc.errors.length === 0) {
-    return succ(doc.toJSON());
-  } else {
-    // TODO: eh, we should return properly structured errors here
-    return fail(JSON.stringify(doc.errors));
+  let value;
+  try {
+    const doc = Yaml.parseDocument(s);
+    if (doc.errors.length !== 0) {
+      // TODO: eh, we should return properly structured errors here
+      return fail(JSON.stringify(doc.errors));
+    }
+    Yaml.visit(doc, {
+      Alias() {
+        throw new Error('YAML aliases are not supported');
+      }
+    });
+    value = doc.toJSON();
+  } catch (error) {
+    return fail(error instanceof Error ? error.message : String(error));
   }
+  return succ(value);
 }

lib/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "license": "BSD-3-Clause",
   "dependencies": {
-    "spdx-expression-parse": "^4.0.0",
+    "spdx-expression-parse": "^5.0.0",
     "ssh2": "^1.17.0"
   }
 }

nix/overlay.nix

@@ -167,7 +167,7 @@ in
     npmFlags = [ "--omit=optional" ];
 
     # To update: run `nix build .#server` and copy the hash from the error
-    npmDepsHash = "sha256-uj1LQ+Q9Zz8zguehJp9tQrEAMLoUm7BZEraCGQVGByQ=";
+    npmDepsHash = "sha256-7AFgk11qIzTqgn2jtXBw340ZFcGqJMtjeZ+Xvr0vqNc=";
 
     installPhase = ''
       mkdir -p $out