[From nobody Wed Aug 26 21:51:08 2026 Received: (at submit) by bugs.debian.org; 19 Aug 2026 15:54:14 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-112.4 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FOURLA,FROMDEVELOPER,PGPSIGNATURE,SPF_HELO_NONE,SPF_PASS, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 36; hammy, 150; neutral, 75; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <ncts@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:55932) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <ncts@debian.org>) id 1wwicI-002TLW-23 for submit@bugs.debian.org; Wed, 19 Aug 2026 15:54:14 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:To:From:Subject:Message-Id:Date: Content-Type:Mime-Version:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=q880PvPeYU0d56SbbMOloqnVXxrR1WgUP8f6S6FOO/8=; b=iRoTp5M6u4F1IW5PZrVJ0fuuHI Gp7bI09bUGYnyQGVsZ37d4WH6hqbmgNBo4Nhh3JK74zFFhkjXziL1GEMkNxNucdodMEbrBwz39G78 xr/yVHpU2ESPKIZkr7sEFovLRtLkrOLJB/uvZtENbWVAuKcYNeCogprEi7lOfOCHOGWkQYbCA7Hue 7s+6CYegmKmkLXgd/0ReI6pRDillGrtAux16pfOeb8IZKaB2ISKqgmezbszoq/sCBruyycwhYhR1l 6uT5VJH/gwe59WxzZjU7Zig/Z3tQb5fdZugyUcVYUovC563jFTsVAxieM5BdTCS3/WWgWpszr5z4E ba4xoUIw==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <ncts@debian.org>) id 1wwicG-009u1W-2J for submit@bugs.debian.org; Wed, 19 Aug 2026 15:54:13 +0000 Mime-Version: 1.0 Content-Type: multipart/signed; boundary=d25e4b4b244b66ec173e6f2fe1f0058673dad5637dde3f96b8d0c84a4798; micalg=pgp-sha512; protocol="application/pgp-signature" Date: Wed, 19 Aug 2026 15:54:06 +0000 Message-Id: <DKT1IQ9R9DLO.28DKD4PPUQLK5@debian.org> Subject: highlight.js: Debian provided deep-freeze-es6 breaks freezing nested objects From: "Blair Noctis" <ncts@debian.org> To: <submit@bugs.debian.org> X-Mailer: aerc 0.22.0 X-Debian-User: ncts Delivered-To: submit@bugs.debian.org --d25e4b4b244b66ec173e6f2fe1f0058673dad5637dde3f96b8d0c84a4798 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Source: highlight.js Version: 10.7.3+dfsg-5 Severity: grave Justification: renders package unusable Tags: patch X-Debbugs-Cc: debian-js@lists.debian.org, ncts@debian.org Dear Maintainer, Debian provided deep-freeze-es6 (under debian/build_modules) breaks freezin= g nested objects, by recursively freezing properties of an object without fir= st checking if a property object has already been frozen, causing errors such = as: Uncaught TypeError: "begin" is read-only deepFreeze http://localhost:3000/highlight-1bbf5e38.js:16 HLJS http://localhost:3000/highlight-1bbf5e38.js:2493 hljs http://localhost:3000/highlight-1bbf5e38.js:2508 <anonymous> http://localhost:3000/highlight-1bbf5e38.js:2512 In this concrete example, APOS_STRING_MODE first gets frozen. Due to aforementioned problem, APOS_STRING_MODE.contains.0, which is BACKSLASH_ESC= APE, is also frozen. Then, later when BACKSLASH_ESCAPE itself gets frozen again = (or maybe being frozen again as something else's .contains.0, or maybe in a rev= erse order), this error is thrown. Upstream uses a `!Object.isFrozen(prop)` check to avoid this problem, see https://github.com/christophehurpeau/deep-freeze-es6/blob/c1b69815/lib/inde= x.js#L49 The fix is simple: diff --git a/debian/build_modules/deep-freeze-es6/index.js b/debian/build_m= odules/deep-freeze-es6/index.js index 50ef5d2..47c87de 100644 --- a/debian/build_modules/deep-freeze-es6/index.js +++ b/debian/build_modules/deep-freeze-es6/index.js @@ -5,7 +5,9 @@ export function deepFreeze(obj) { // On g=C3=A8le les propri=C3=A9t=C3=A9s avant de geler l'objet for (let name of propNames) { let value =3D obj[name]; - obj[name] =3D value && typeof value =3D=3D=3D "object" ? deepFreeze(va= lue) : value; + if ((typeof value =3D=3D=3D "object" || typeof value =3D=3D=3D "functi= on") && !Object.isFrozen(value)) { + deepFreeze(value) + } } // On g=C3=A8le l'objet initial --=20 ,Sdrager Blair Noctis =F0=9F=87=B5=F0=9F=87=B8 --d25e4b4b244b66ec173e6f2fe1f0058673dad5637dde3f96b8d0c84a4798 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iIYEABYKAC4WIQSkiHwhuQf2oVaWacxWG2M00EUuRAUCaoXRnhAcbmN0c0BkZWJp YW4ub3JnAAoJEFYbYzTQRS5En0wBAO9+/xYZj6fyuFmrqSccrTZdE6HL6RAbq1IQ 2BTQcyWCAQDURvhP1/f/tggW4/T5x3WljyDxqoIk50OwDYTX/1YEBQ== =fsgc -----END PGP SIGNATURE----- --d25e4b4b244b66ec173e6f2fe1f0058673dad5637dde3f96b8d0c84a4798-- ]