chore(deps-dev): Bump just-bash from 3.2.0 to 3.3.0

[dependabot]

Bumps just-bash from 3.2.0 to 3.3.0.

Release notes

Sourced from just-bash's releases.

just-bash@3.3.0

Minor Changes

• #291 47f604a Thanks @​trieloff! - jq: add external-argument flags (--arg, --argjson, --rawfile, --slurpfile, --args, --jsonargs) and the $ARGS object ($ARGS.named / $ARGS.positional), matching real jq 1.7.1 behavior including exit codes, error messages, and prototype-sensitive key handling.

• #336 d97425d Thanks @​trieloff! - Support user file descriptors (fd >= 3). exec 3< file, N< file / N> file / N>> file on any command, read -u N, read <&N, >&N, N<&M, and N<&- now go through a real descriptor table: a descriptor carries one shared read position, exec keeps it open until it is closed, and every other construct — including done N< file on a loop — gets it only for the duration of that command.

• #331 6680247 Thanks @​trieloff! - Treat a - FILE operand in grep as standard input, matching GNU. grep PATTERN - now reads stdin instead of failing with "No such file or directory", stdin is labelled (standard input) in the multi-file prefix and in -l/-L/-c output, repeated - operands see the stream drained by the first one, and - is exempt from -r recursion and --include/--exclude filtering.

• #325 edc7f2f Thanks @​trieloff! - Support process substitution <(cmd) and >(cmd).

  <(cmd) runs cmd and substitutes a readable /dev/fd/N path backed by an in-memory file; >(cmd) substitutes a writable path whose contents are fed to cmd once the outer command finishes. Descriptors are numbered from 63 downwards like bash and released when the command that opened them completes. Process substitutions retain their surrounding word context in assignments, conditionals, regular expressions, and heredoc delimiters. Previously any use raised Parse error: Expected redirection target.

• #327 eaedb5b Thanks @​trieloff! - Add grep -f FILE / --file=FILE to read patterns from a file (one per line). Patterns from -f OR-combine with -e patterns and with each other, -f - reads patterns from stdin, empty pattern lines match every line, and an empty pattern file selects nothing (exit 1). Newline-separated PATTERNS operands are now split into individual patterns, and -x groups alternatives correctly (^(?:a|b)$).

Patch Changes

• #358 bd1df37 Thanks @​privatenumber! - Parse and serialize bare file descriptor variable redirections such as {output}>output.log and {input}<<EOF. Bare redirects create their target with a command-scoped descriptor, while named command forms keep the allocated descriptor available.

• #347 abb904b Thanks @​privatenumber! - Fix escaped reserved words being parsed as shell syntax. Unquoted escapes now retain their provenance through lexing and word parsing, including when the word is serialized back to Bash.

• #332 4f9bdec Thanks @​trieloff! - Fix grep -L exit status to match GNU grep. The status reports whether a line was selected, not whether a filename was printed, so grep -L now exits 0 when every file matched (printing nothing) and 1 when no file matched (printing every name) — previously these were inverted.

• #339 31d247f Thanks @​mutewinter! - network: restore private-range-enforced requests from the bundled build

  Every request made with denyPrivateRanges enabled failed with Network access denied: DNS pinning unavailable for private IP enforcement, so curl could not reach any host at all. The published ESM bundle was affected; source consumers and the CommonJS bundle were not.

  The pinned connection owner reads Agent and fetch off a dynamic import("undici"). Node's resolution of the package exposes those as named exports, but the ESM build inlines undici's CommonJS module into a chunk whose namespace carries it under default alone, so Agent was undefined and the TypeError from constructing it was reported as a runtime incapable of pinning.

  The namespace is now normalized before the transport is read off it, which also covers a consumer that bundles just-bash further.

• #336 d97425d Thanks @​trieloff! - Stop command groups, function bodies and eval from rewinding stdin they never replaced, so { { read a; }; read b; } gives b the second line instead of replaying the first.

• #348 1a7940d Thanks @​privatenumber! - Reject unsupported command-leading reserved words in every parser context instead of discarding them or executing them as simple commands. Unknown command AST nodes now fail explicitly instead of returning a successful result.

• #345 2208a34 Thanks @​privatenumber! - Restore command groups and subshells after the process-substitution and stdin-ownership changes were combined without forwarding ownership through inner command dispatch.

• #336 d97425d Thanks @​trieloff! - Apply output redirections attached to while and until loops. while true; do echo x; break; done >/dev/null no longer leaks its output to the caller, and > file, >>, 2>, 2>&1, &> and >| now behave on loops the way they already did on for and case. until loops also gained the input-redirection handling while loops already had, so until ! read l; do ...; done < file reads from the file. A loop now only restores stdin it owns, so reading inside a loop no longer rewinds an enclosing group's read position: printf 'a\nb\n' | { while read x; do break; done; read y; } sees y=b.

• #328 65dafd5 Thanks @​trieloff! - Stop pipelines from draining the enclosing shell's stdin, so while read …; do … | …; done < file runs once per line again.

... (truncated)

Commits

• 53b07e5 chore: release (#337)
• 3ee215c Harden real filesystem write isolation (#368)
• 1fbde34 fix(parser): preserve unterminated heredocs (#360)
• bd1df37 fix(parser): preserve fd variables on heredoc redirections (#358)
• 63c36d5 fix(js-exec): wait for top-level await completion (#353)
• 244f73c ci: run WASM tests on Node 24 in PRs (#352)
• e64a9f6 fix(parser): preserve process substitution contexts (#351)
• 1a7940d fix(parser): fail closed on unsupported command syntax (#348)
• 19a02c2 fix(sqlite3): report SQL errors on stderr and exit 1 without -bail (#338)
• 31d247f fix(network): read the pinned transport off the bundled undici namespace (#339)
• Additional commits viewable in compare view

[dependabot-pr-auto-approver]

Automatically approved by dependabot auto-approve workflow