deps: update acorn to 8.17.0

PR-URL: #63901
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: nodejs-github-bot

deps/acorn/acorn/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 8.17.0 (2026-06-11)
+
+### New features
+
+The new `strict` option can be used to start script sources in strict mode.
+
+### Bug fixes
+
+Fix a number of corner case bugs when `using` or `await using` appear in `for` loop specs.
+
+Disallow `new super()` expressions.
+
+Don't allow the conditional in a ternary expression to be a (naked) arrow function.
+
 ## 8.16.0 (2026-02-19)
 
 ### New features

deps/acorn/acorn/README.md

@@ -86,6 +86,9 @@ required):
  will be valid, even if `ecmaVersion` is less than 6. If set to `"commonjs"`,
  it is the same as `"script"` except that the top-level scope behaves like a function.
 
+-**strict**: When set to true, enable strict parsing mode even if
+`sourceType` is `"script"`.
+
 -**onInsertedSemicolon**: If given a callback, that callback will be
  called whenever a missing semicolon is inserted by the parser. The
  callback will be given the character offset of the point where the

deps/acorn/acorn/dist/acorn.d.mts

@@ -619,6 +619,12 @@ export interface Options {
  */
 sourceType?: "script"|"module"|"commonjs"
 
+/**
+ * When set to true, enable strict parsing mode even if `sourceType`
+ * is `"script"`.
+ */
+strict?: boolean
+
 /**
  * a callback that will be called when a semicolon is automatically inserted.
  * @param lastTokEnd the position of the comma as an offset

deps/acorn/acorn/dist/acorn.d.ts

@@ -619,6 +619,12 @@ export interface Options {
  */
 sourceType?: "script"|"module"|"commonjs"
 
+/**
+ * When set to true, enable strict parsing mode even if `sourceType`
+ * is `"script"`.
+ */
+strict?: boolean
+
 /**
  * a callback that will be called when a semicolon is automatically inserted.
  * @param lastTokEnd the position of the comma as an offset

deps/acorn/acorn/dist/acorn.js

@@ -342,6 +342,9 @@
 // Can be either `"script"`, `"module"` or `"commonjs"`. This influences global
 // strict mode and parsing of `import` and `export` declarations.
 sourceType: "script",
+// When set to true, enable strict parsing mode even if `sourceType`
+// is `"script"`.
+strict: false,
 // `onInsertedSemicolon` can be a callback that will be called when
 // a semicolon is automatically inserted. It will be passed the
 // position of the inserted semicolon as an offset, and if
@@ -568,7 +571,7 @@
 
 // Figure out if it's a module code.
 this.inModule=options.sourceType==="module";
-this.strict=this.inModule||this.strictDirective(this.pos);
+this.strict=this.inModule||options.strict===true||this.strictDirective(this.pos);
 
 // Used to signify the start of a potential arrow function
 this.potentialArrowAt=-1;
@@ -606,9 +609,11 @@
 varprototypeAccessors={inFunction: {configurable: true},inGenerator: {configurable: true},inAsync: {configurable: true},canAwait: {configurable: true},allowReturn: {configurable: true},allowSuper: {configurable: true},allowDirectSuper: {configurable: true},treatFunctionsAsVar: {configurable: true},allowNewDotTarget: {configurable: true},allowUsing: {configurable: true},inClassStaticBlock: {configurable: true}};
 
 Parser.prototype.parse=functionparse(){
+varthis$1$1=this;
+
 varnode=this.options.program||this.startNode();
 this.nextToken();
-returnthis.parseTopLevel(node)
+returnthis.catchStackOverflow(function(){returnthis$1$1.parseTopLevel(node);})
 };
 
 prototypeAccessors.inFunction.get=function(){return(this.currentVarScope().flags&SCOPE_FUNCTION)>0};
@@ -747,6 +752,17 @@
 returntrue
 };
 
+pp$9.catchStackOverflow=function(f){
+try{
+returnf()
+}catch(e){
+if(einstanceofError&&(/\bstack\b.*\b(exceeded|overflow)\b/i.test(e.message)||/\btoomuchrecursion\b/i.test(e.message)))
+{this.raise(this.start,"Not enough stack space to parse input");}
+else
+{throwe}
+}
+};
+
 // Asserts that following token is given contextual keyword.
 
 pp$9.expectContextual=function(name){
@@ -850,10 +866,10 @@
 // to its body instead of creating a new node.
 
 pp$8.parseTopLevel=function(node){
-varexports=Object.create(null);
+varexports$1=Object.create(null);
 if(!node.body){node.body=[];}
 while(this.type!==types$1.eof){
-varstmt=this.parseStatement(null,true,exports);
+varstmt=this.parseStatement(null,true,exports$1);
 node.body.push(stmt);
 }
 if(this.inModule)
@@ -942,7 +958,18 @@
 while(isIdentifierChar(ch=this.fullCharCodeAt(next)))
 if(ch===92){returntrue}
 varid=this.input.slice(idStart,next);
-if(keywordRelationalOperator.test(id)||isFor&&id==="of"){returnfalse}
+if(keywordRelationalOperator.test(id)){returnfalse}
+if(isFor&&!isAwaitUsing&&id==="of"){
+// Look ahead for using declaration with initializer, i.e., `for (using of = ...)`
+skipWhiteSpace.lastIndex=next;
+varskipAfterOf=skipWhiteSpace.exec(this.input);
+next=next+skipAfterOf[0].length;
+if(this.input.charCodeAt(next)!==61/* '=' */||
+// Check for ==, === and => operators
+(ch=this.input.charCodeAt(next+1))===61/* '=' */||ch===62/* '>' */){
+returnfalse
+}
+}
 returntrue
 };
 
@@ -961,7 +988,7 @@
 // `if (foo) /blah/.exec(foo)`, where looking at the previous token
 // does not help.
 
-pp$8.parseStatement=function(context,topLevel,exports){
+pp$8.parseStatement=function(context,topLevel,exports$1){
 varstarttype=this.type,node=this.startNode(),kind;
 
 if(this.isLet(context)){
@@ -1016,7 +1043,7 @@
 if(!this.inModule)
 {this.raise(this.start,"'import' and 'export' may appear only with 'sourceType: module'");}
 }
-returnstarttype===types$1._import ? this.parseImport(node) : this.parseExport(node,exports)
+returnstarttype===types$1._import ? this.parseImport(node) : this.parseExport(node,exports$1)
 
 // If the statement does not start with a statement keyword or a
 // brace, it's an ExpressionStatement or LabeledStatement. We
@@ -1035,6 +1062,10 @@
 if(!this.allowUsing){
 this.raise(this.start,"Using declaration cannot appear in the top level when source type is `script` or in the bare case statement");
 }
+if(context){
+// Cases like `for (;;) using x = ...;`, `if (true) await using x = ...;`, etc. are not allowed.
+this.raise(this.start,"Using declaration is not allowed in single-statement positions");
+}
 if(usingKind==="await using"){
 if(!this.canAwait){
 this.raise(this.start,"Await using cannot appear outside of async function");
@@ -1168,11 +1199,12 @@
 // Helper method to parse for loop after variable initialization
 pp$8.parseForAfterInit=function(node,init,awaitAt){
 if((this.type===types$1._in||(this.options.ecmaVersion>=6&&this.isContextual("of")))&&init.declarations.length===1){
-if(this.options.ecmaVersion>=9){
-if(this.type===types$1._in){
-if(awaitAt>-1){this.unexpected(awaitAt);}
-}else{node.await=awaitAt>-1;}
-}
+if(this.type===types$1._in){
+if((init.kind==="using"||init.kind==="await using")&&!init.declarations[0].init){
+this.raise(this.start,"Using declaration is not allowed in for-in loops");
+}
+if(this.options.ecmaVersion>=9&&awaitAt>-1){this.unexpected(awaitAt);}
+}elseif(this.options.ecmaVersion>=9){node.await=awaitAt>-1;}
 returnthis.parseForIn(node,init)
 }
 if(awaitAt>-1){this.unexpected(awaitAt);}
@@ -1777,11 +1809,11 @@
 
 // Parses module export declaration.
 
-pp$8.parseExportAllDeclaration=function(node,exports){
+pp$8.parseExportAllDeclaration=function(node,exports$1){
 if(this.options.ecmaVersion>=11){
 if(this.eatContextual("as")){
 node.exported=this.parseModuleExportName();
-this.checkExport(exports,node.exported,this.lastTokStart);
+this.checkExport(exports$1,node.exported,this.lastTokStart);
 }else{
 node.exported=null;
 }
@@ -1795,31 +1827,31 @@
 returnthis.finishNode(node,"ExportAllDeclaration")
 };
 
-pp$8.parseExport=function(node,exports){
+pp$8.parseExport=function(node,exports$1){
 this.next();
 // export * from '...'
 if(this.eat(types$1.star)){
-returnthis.parseExportAllDeclaration(node,exports)
+returnthis.parseExportAllDeclaration(node,exports$1)
 }
 if(this.eat(types$1._default)){// export default ...
-this.checkExport(exports,"default",this.lastTokStart);
+this.checkExport(exports$1,"default",this.lastTokStart);
 node.declaration=this.parseExportDefaultDeclaration();
 returnthis.finishNode(node,"ExportDefaultDeclaration")
 }
 // export var|const|let|function|class ...
 if(this.shouldParseExportStatement()){
 node.declaration=this.parseExportDeclaration(node);
 if(node.declaration.type==="VariableDeclaration")
-{this.checkVariableExport(exports,node.declaration.declarations);}
+{this.checkVariableExport(exports$1,node.declaration.declarations);}
 else
-{this.checkExport(exports,node.declaration.id,node.declaration.id.start);}
+{this.checkExport(exports$1,node.declaration.id,node.declaration.id.start);}
 node.specifiers=[];
 node.source=null;
 if(this.options.ecmaVersion>=16)
 {node.attributes=[];}
 }else{// export { x, y as z } [from '...']
 node.declaration=null;
-node.specifiers=this.parseExportSpecifiers(exports);
+node.specifiers=this.parseExportSpecifiers(exports$1);
 if(this.eatContextual("from")){
 if(this.type!==types$1.string){this.unexpected();}
 node.source=this.parseExprAtom();
@@ -1869,47 +1901,47 @@
 }
 };
 
-pp$8.checkExport=function(exports,name,pos){
-if(!exports){return}
+pp$8.checkExport=function(exports$1,name,pos){
+if(!exports$1){return}
 if(typeofname!=="string")
 {name=name.type==="Identifier" ? name.name : name.value;}
-if(hasOwn(exports,name))
+if(hasOwn(exports$1,name))
 {this.raiseRecoverable(pos,"Duplicate export '"+name+"'");}
-exports[name]=true;
+exports$1[name]=true;
 };
 
-pp$8.checkPatternExport=function(exports,pat){
+pp$8.checkPatternExport=function(exports$1,pat){
 vartype=pat.type;
 if(type==="Identifier")
-{this.checkExport(exports,pat,pat.start);}
+{this.checkExport(exports$1,pat,pat.start);}
 elseif(type==="ObjectPattern")
 {for(vari=0,list=pat.properties;i<list.length;i+=1)
 {
 varprop=list[i];
 
-this.checkPatternExport(exports,prop);
+this.checkPatternExport(exports$1,prop);
 }}
 elseif(type==="ArrayPattern")
 {for(vari$1=0,list$1=pat.elements;i$1<list$1.length;i$1+=1){
 varelt=list$1[i$1];
 
-if(elt){this.checkPatternExport(exports,elt);}
+if(elt){this.checkPatternExport(exports$1,elt);}
 }}
 elseif(type==="Property")
-{this.checkPatternExport(exports,pat.value);}
+{this.checkPatternExport(exports$1,pat.value);}
 elseif(type==="AssignmentPattern")
-{this.checkPatternExport(exports,pat.left);}
+{this.checkPatternExport(exports$1,pat.left);}
 elseif(type==="RestElement")
-{this.checkPatternExport(exports,pat.argument);}
+{this.checkPatternExport(exports$1,pat.argument);}
 };
 
-pp$8.checkVariableExport=function(exports,decls){
-if(!exports){return}
+pp$8.checkVariableExport=function(exports$1,decls){
+if(!exports$1){return}
 for(vari=0,list=decls;i<list.length;i+=1)
 {
 vardecl=list[i];
 
-this.checkPatternExport(exports,decl.id);
+this.checkPatternExport(exports$1,decl.id);
 }
 };
 
@@ -1924,21 +1956,21 @@
 
 // Parses a comma-separated list of module exports.
 
-pp$8.parseExportSpecifier=function(exports){
+pp$8.parseExportSpecifier=function(exports$1){
 varnode=this.startNode();
 node.local=this.parseModuleExportName();
 
 node.exported=this.eatContextual("as") ? this.parseModuleExportName() : node.local;
 this.checkExport(
-exports,
+exports$1,
 node.exported,
 node.exported.start
 );
 
 returnthis.finishNode(node,"ExportSpecifier")
 };
 
-pp$8.parseExportSpecifiers=function(exports){
+pp$8.parseExportSpecifiers=function(exports$1){
 varnodes=[],first=true;
 // export { x, y as z } [from '...']
 this.expect(types$1.braceL);
@@ -1948,7 +1980,7 @@
 if(this.afterTrailingComma(types$1.braceR)){break}
 }else{first=false;}
 
-nodes.push(this.parseExportSpecifier(exports));
+nodes.push(this.parseExportSpecifier(exports$1));
 }
 returnnodes
 };
@@ -2679,15 +2711,19 @@
 // delayed syntax error at correct position).
 
 pp$5.parseExpression=function(forInit,refDestructuringErrors){
-varstartPos=this.start,startLoc=this.startLoc;
-varexpr=this.parseMaybeAssign(forInit,refDestructuringErrors);
-if(this.type===types$1.comma){
-varnode=this.startNodeAt(startPos,startLoc);
-node.expressions=[expr];
-while(this.eat(types$1.comma)){node.expressions.push(this.parseMaybeAssign(forInit,refDestructuringErrors));}
-returnthis.finishNode(node,"SequenceExpression")
-}
-returnexpr
+varthis$1$1=this;
+
+returnthis.catchStackOverflow(function(){
+varstartPos=this$1$1.start,startLoc=this$1$1.startLoc;
+varexpr=this$1$1.parseMaybeAssign(forInit,refDestructuringErrors);
+if(this$1$1.type===types$1.comma){
+varnode=this$1$1.startNodeAt(startPos,startLoc);
+node.expressions=[expr];
+while(this$1$1.eat(types$1.comma)){node.expressions.push(this$1$1.parseMaybeAssign(forInit,refDestructuringErrors));}
+returnthis$1$1.finishNode(node,"SequenceExpression")
+}
+returnexpr
+})
 };
 
 // Parse an assignment expression. This includes applications of
@@ -2752,7 +2788,7 @@
 varstartPos=this.start,startLoc=this.startLoc;
 varexpr=this.parseExprOps(forInit,refDestructuringErrors);
 if(this.checkExpressionErrors(refDestructuringErrors)){returnexpr}
-if(this.eat(types$1.question)){
+if(!(expr.type==="ArrowFunctionExpression"&&expr.start===startPos)&&this.eat(types$1.question)){
 varnode=this.startNodeAt(startPos,startLoc);
 node.test=expr;
 node.consequent=this.parseMaybeAssign();
@@ -3304,6 +3340,8 @@
 }
 varstartPos=this.start,startLoc=this.startLoc;
 node.callee=this.parseSubscripts(this.parseExprAtom(null,false,true),startPos,startLoc,true,false);
+if(node.callee.type==="Super")
+{this.raiseRecoverable(startPos,"Invalid use of 'super'");}
 if(this.eat(types$1.parenL)){node.arguments=this.parseExprList(types$1.parenR,this.options.ecmaVersion>=8,false);}
 else{node.arguments=empty;}
 returnthis.finishNode(node,"NewExpression")
@@ -6220,7 +6258,7 @@
 // [ghbt]: https://github.com/acornjs/acorn/issues
 
 
-varversion="8.16.0";
+varversion="8.17.0";
 
 Parser.acorn={
 Parser: Parser,