.eslintrc.yml

@@ -0,0 +1,2 @@
+root: true
+extends: standard

.github/workflows/scorecard.yml

@@ -0,0 +1,73 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '16 21 * * 1'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -1,67 +1,4 @@
-# Compiled source #
-###################
-*.com
-*.class
-*.dll
-*.exe
-*.o
-*.so
-
-# Packages #
-############
-# it's better to unpack these files and commit the raw source
-# git has its own built in compression methods
-*.7z
-*.dmg
-*.gz
-*.iso
-*.jar
-*.rar
-*.tar
-*.zip
-
-# Logs and databases #
-######################
-*.log
-*.sql
-*.sqlite
-
-# OS generated files #
-######################
-.DS_Store*
-ehthumbs.db
-Icon?
-Thumbs.db
-
-# Node.js #
-###########
-lib-cov
-*.seed
-*.log
-*.csv
-*.dat
-*.out
-*.pid
-*.gz
-
-pids
-logs
-results
-
-coverage
-node_modules
+coverage/
+node_modules/
 npm-debug.log
-
-# Git #
-#######
-*.orig
-*.BASE.*
-*.BACKUP.*
-*.LOCAL.*
-*.REMOTE.*
-
-# Components #
-##############
-
-/build
-/components
+package-lock.json

.travis.yml

@@ -6,25 +6,103 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.6"
+  - "4.9"
   - "5.12"
-  - "6.9"
-  - "7.1"
-sudo: false
+  - "6.17"
+  - "7.10"
+  - "8.17"
+  - "9.11"
+  - "10.19"
+  - "11.15"
+  - "12.16"
+  - "13.10"
 cache:
   directories:
     - node_modules
 before_install:
+  - |
+    # Setup utility functions
+    function node_version_lt () {
+      [[ "$(v "$TRAVIS_NODE_VERSION")" -lt "$(v "${1}")" ]]
+    }
+    function npm_module_installed () {
+      npm -lsp ls | grep -Fq "$(pwd)/node_modules/${1}:${1}@"
+    }
+    function npm_remove_module_re () {
+      node -e '
+        fs = require("fs");
+        p = JSON.parse(fs.readFileSync("package.json", "utf8"));
+        r = RegExp(process.argv[1]);
+        for (k in p.devDependencies) {
+          if (r.test(k)) delete p.devDependencies[k];
+        }
+        fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
+      ' "$@"
+    }
+    function npm_use_module () {
+      node -e '
+        fs = require("fs");
+        p = JSON.parse(fs.readFileSync("package.json", "utf8"));
+        p.devDependencies[process.argv[1]] = process.argv[2];
+        fs.writeFileSync("package.json", JSON.stringify(p, null, 2) + "\n");
+      ' "$@"
+    }
+    function v () {
+      tr '.' '\n' <<< "${1}" \
+        | awk '{ printf "%03d", $0 }' \
+        | sed 's/^0*//'
+    }
+  # Configure npm
+  - |
+    # Skip updating shrinkwrap / lock
+    npm config set shrinkwrap false
   # Setup Node.js version-specific dependencies
-  - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
-  - "test $(echo $TRAVIS_NODE_VERSION | cut -d. -f1) -ge 4 || npm rm --save-dev eslint eslint-config-standard eslint-plugin-promise eslint-plugin-standard"
+  - |
+    # Configure eslint for linting
+    if node_version_lt '8.0'; then npm_remove_module_re '^eslint(-|$)'
+    fi
+  - |
+    # Configure istanbul for coverage
+    if node_version_lt '0.10'; then npm_remove_module_re '^istanbul$'
+    fi
+  - |
+    # Configure mocha for testing
+    if   node_version_lt '0.10'; then npm_use_module 'mocha' '2.5.3'
+    elif node_version_lt '4.0' ; then npm_use_module 'mocha' '3.5.3'
+    elif node_version_lt '6.0' ; then npm_use_module 'mocha' '5.2.0'
+    elif node_version_lt '8.0' ; then npm_use_module 'mocha' '6.2.2'
+    fi
+  - |
+    # Configure supertest for http calls
+    if   node_version_lt '0.10'; then npm_use_module 'supertest' '1.1.0'
+    elif node_version_lt '4.0' ; then npm_use_module 'supertest' '2.0.0'
+    elif node_version_lt '6.0' ; then npm_use_module 'supertest' '3.4.2'
+    fi
   # Update Node.js modules
-  - "test ! -d node_modules || npm prune"
-  - "test ! -d node_modules || npm rebuild"
+  - |
+    # Prune & rebuild node_modules
+    if [[ -d node_modules ]]; then
+      npm prune
+      npm rebuild
+    fi
+before_scrpt:
+  - |
+    # Contents of node_modules
+    npm -s ls ||:
 script:
-  # Run test script, depending on istanbul install
-  - "test ! -z $(npm -ps ls istanbul) || npm test"
-  - "test   -z $(npm -ps ls istanbul) || npm run-script test-travis"
-  - "test   -z $(npm -ps ls eslint  ) || npm run-script lint"
+  - |
+    # Run test script, depending on istanbul install
+    if npm_module_installed 'istanbul'; then npm run-script test-travis
+    else npm test
+    fi
+  - |
+    # Run linting, if eslint exists
+    if npm_module_installed 'eslint'; then npm run-script lint
+    fi
 after_script:
-  - "test -e ./coverage/lcov.info && npm install coveralls@2 && cat ./coverage/lcov.info | coveralls"
+  - |
+    # Upload coverage to coveralls if exists
+    if [[ -e ./coverage/lcov.info ]]; then
+      npm install --save-dev coveralls@2
+      coveralls < ./coverage/lcov.info
+    fi

HISTORY.md

@@ -1,3 +1,10 @@
+1.5.1 / 2019-05-08
+==================
+
+  * deps: accepts@~1.3.7
+    - deps: mime-types@~2.1.24
+    - deps: negotiator@0.6.2
+
 1.5.0 / 2016-11-15
 ==================
 

README.md

@@ -1,10 +1,9 @@
 # errorhandler
 
-[![NPM Version][npm-image]][npm-url]
-[![NPM Downloads][downloads-image]][downloads-url]
+[![NPM Version][npm-version-image]][npm-url]
+[![NPM Downloads][npm-downloads-image]][npm-url]
 [![Build Status][travis-image]][travis-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
-[![Gratipay][gratipay-image]][gratipay-url]
 
 Development-only error handler middleware.
 
@@ -36,6 +35,8 @@ $ npm install errorhandler
 
 ## API
 
+<!-- eslint-disable no-unused-vars -->
+
 ```js
 var errorhandler = require('errorhandler')
 ```
@@ -79,6 +80,7 @@ var errorhandler = require('errorhandler')
 
 var app = connect()
 
+// assumes NODE_ENV is set by the user
 if (process.env.NODE_ENV === 'development') {
   // only use in development
   app.use(errorhandler())
@@ -90,19 +92,22 @@ if (process.env.NODE_ENV === 'development') {
 Sometimes you may want to output the errors to a different location than STDERR
 during development, like a system notification, for example.
 
+<!-- eslint-disable handle-callback-err -->
+
 ```js
 var connect = require('connect')
 var errorhandler = require('errorhandler')
 var notifier = require('node-notifier')
 
 var app = connect()
 
+// assumes NODE_ENV is set by the user
 if (process.env.NODE_ENV === 'development') {
   // only use in development
-  app.use(errorhandler({log: errorNotification}))
+  app.use(errorhandler({ log: errorNotification }))
 }
 
-function errorNotification(err, str, req) {
+function errorNotification (err, str, req) {
   var title = 'Error in ' + req.method + ' ' + req.url
 
   notifier.notify({
@@ -116,13 +121,10 @@ function errorNotification(err, str, req) {
 
 [MIT](LICENSE)
 
-[npm-image]: https://img.shields.io/npm/v/errorhandler.svg
+[coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/errorhandler/master
+[coveralls-url]: https://coveralls.io/r/expressjs/errorhandler?branch=master
+[npm-downloads-image]: https://badgen.net/npm/dm/errorhandler
 [npm-url]: https://npmjs.org/package/errorhandler
-[travis-image]: https://img.shields.io/travis/expressjs/errorhandler/master.svg
+[npm-version-image]: https://badgen.net/npm/v/errorhandler
+[travis-image]: https://badgen.net/travis/expressjs/errorhandler/master
 [travis-url]: https://travis-ci.org/expressjs/errorhandler
-[coveralls-image]: https://img.shields.io/coveralls/expressjs/errorhandler/master.svg
-[coveralls-url]: https://coveralls.io/r/expressjs/errorhandler?branch=master
-[downloads-image]: https://img.shields.io/npm/dm/errorhandler.svg
-[downloads-url]: https://npmjs.org/package/errorhandler
-[gratipay-image]: https://img.shields.io/gratipay/dougwilson.svg
-[gratipay-url]: https://www.gratipay.com/dougwilson/

index.js

@@ -165,8 +165,8 @@ exports.title = 'Connect'
 
 function escapeHtmlBlock (str) {
   return escapeHtml(str)
-  .replace(DOUBLE_SPACE_REGEXP, '  ')
-  .replace(NEW_LINE_REGEXP, '<br>')
+    .replace(DOUBLE_SPACE_REGEXP, ' &nbsp;')
+    .replace(NEW_LINE_REGEXP, '<br>')
 }
 
 /**