diff --git a/.eslintignore b/.eslintignore
deleted file mode 100644
index 60b57a4c..00000000
--- a/.eslintignore
+++ /dev/null
@@ -1,6 +0,0 @@
-node_modules
-dist
-docs/ts
-coverage
-ignore
-!*.js
diff --git a/.eslintrc.cjs b/.eslintrc.cjs
deleted file mode 100644
index e179b9d3..00000000
--- a/.eslintrc.cjs
+++ /dev/null
@@ -1,106 +0,0 @@
-'use strict';
-
-module.exports = {
- extends: ['ash-nazg/sauron-node-overrides'],
- settings: {
- polyfills: [
- 'Array.isArray',
- 'console',
- 'Date.now',
- 'document.head',
- 'document.querySelector',
- 'JSON',
- 'Number.isFinite',
- 'Number.parseInt',
- 'Object.keys',
- 'Object.values',
- 'XMLHttpRequest'
- ]
- },
- overrides: [
- {
- files: ['src/jsonpath-node.js', 'test-helpers/node-env.js'],
- env: {
- mocha: true
- },
- // ESLint doesn't seem to remember this
- parserOptions: {
- ecmaVersion: 2020,
- sourceType: 'module'
- },
- rules: {
- 'n/no-unsupported-features/es-syntax': ['error', {
- ignores: [
- 'regexpNamedCaptureGroups', 'modules', 'dynamicImport'
- ]
- }]
- }
- },
- {
- files: ['*.md/*.js', '*.md/*.html'],
- rules: {
- 'import/unambiguous': 0,
- 'import/no-commonjs': 0,
- 'import/no-unresolved': ['error', {
- ignore: ['jsonpath-plus']
- }],
- 'no-multiple-empty-lines': ['error', {
- max: 1, maxEOF: 2, maxBOF: 2
- }],
- 'no-undef': 0,
- 'no-unused-vars': ['error', {
- varsIgnorePattern: 'json|result'
- }],
- 'import/no-extraneous-dependencies': 0,
- 'n/no-extraneous-import': ['error', {
- allowModules: ['jsonpath-plus']
- }],
- 'n/no-missing-require': ['error', {
- allowModules: ['jsonpath-plus']
- }],
- // Unfortunately, with the new processor approach, the filename
- // is now README.md so our paths must be `../`. However, even
- // with that, eslint-plugin-node is not friendly to such
- // imports, so we disable
- 'n/no-missing-import': 'off',
- 'n/no-unpublished-import': 'off'
- }
- },
- {
- files: ['test/**'],
- extends: [
- 'plugin:chai-expect/recommended',
- 'plugin:chai-friendly/recommended'
- ],
- globals: {
- assert: 'readonly',
- expect: 'readonly',
- jsonpath: 'readonly'
- },
- env: {mocha: true},
- rules: {
- quotes: 0,
- 'quote-props': 0,
- 'import/unambiguous': 0,
- // Todo: Reenable
- 'max-len': 0
- }
- }
- ],
- rules: {
- indent: ['error', 4, {outerIIFEBody: 0}],
- 'promise/prefer-await-to-callbacks': 0,
- 'require-jsdoc': 0,
-
- // Disable for now
- 'eslint-comments/require-description': 0,
- // Reenable as have time and confirming no longer needing:
- // https://github.com/babel/babel/issues/8951#issuecomment-508045524 is no
- 'prefer-named-capture-group': 0,
- 'unicorn/prefer-spread': 0,
-
- // Reenable when no longer having problems
- 'unicorn/no-unsafe-regex': 0,
- 'unicorn/consistent-destructuring': 0
- }
-};
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index be663b1b..98904fef 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -6,6 +6,8 @@ labels: Bug - unconfirmed
---
## Describe the bug
diff --git a/.npmignore b/.npmignore
index 027c5012..614e4f74 100644
--- a/.npmignore
+++ b/.npmignore
@@ -5,9 +5,8 @@ rollup.config.js
lgtm.yml
.travis.yml
.DS_Store
-.babelrc
+.babelrc.json
.idea
-.remarkrc
docs
.nyc_output
coverage
@@ -18,3 +17,9 @@ mocha-multi-reporters.json
.nojekyll
ignore
pnpm-lock.yaml
+eslint.config.js
+.editorconfig
+.eslintignore
+licenseInfo.json
+tsconfig.json
+demo
diff --git a/CHANGES.md b/CHANGES.md
index 1f1f3b47..65729e21 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,78 @@
# CHANGES for jsonpath-plus
+## 10.3.0
+
+- fix(eval): rce using non-string prop names (#237)
+- feat(demo): make demo link shareable (#238)
+- chore: update deps. and devDeps.
+
+## 10.2.0
+
+- fix(eval): improve security of safe-eval (#233)
+- chore: update deps. and devDeps.
+
+## 10.1.0
+
+- feat: add typeof operator to safe script
+
+## 10.0.7
+
+- fix(security): prevent `constructor` access
+- docs: add security policy file
+
+## 10.0.6
+
+- fix(security): prevent `call`/`apply` invocation of `Function`
+
+## 10.0.5
+
+- fix: remove overly aggressive disabling of native functions but
+ disallow `__proto__`
+
+## 10.0.4
+
+- fix(security): further prevent binding of Function calls which may evade detection
+
+## 10.0.3
+
+- fix(security): prevent binding of Function calls which may evade detection
+
+## 10.0.2
+
+- fix(security): prevent Function calls outside of member expressions
+
+## 10.0.1
+
+- fix(security): prohibit `Function` in "safe" vm
+
+## 10.0.0
+
+BREAKING CHANGES:
+- Require Node 18+
+
+- fix(security): use safe vm by default in Node
+- chore: bump jsep, devDeps. and lint
+
+## 9.0.0
+
+BREAKING CHANGES:
+- Removes `preventEval` property. Prefer `eval: false` instead.
+- Changed behavior of `eval` property. In the browser, `eval`/`Function` won't be used by default to evaluate expressions. Instead, we'll safely evaluate using a subset of JavaScript. To resume using unsafe eval in the browser, pass in the option `eval: "native"`
+
+- feat: add safe eval for browser and `eval` option (#185) (@80avin)
+- feat: add `ignoreEvalErrors` property (@80avin)
+
+## 8.1.0
+
+- feat: add basic cli (#206) (@vid)
+
+## 8.0.0
+
+- Breaking change: Bump Node `engines` to 14
+- feat: add support for nested filter expressions (@carlosingles)
+- docs: update README and license (@akirataguchi115)
+- docs: github workflow badge (@dsanch3z)
+
## 7.2.0
- perf: optimize walk method by 10%-34% (@jacobroschen)
diff --git a/LICENSE-MIT.txt b/LICENSE
similarity index 98%
rename from LICENSE-MIT.txt
rename to LICENSE
index 1862fb48..65b363b1 100644
--- a/LICENSE-MIT.txt
+++ b/LICENSE
@@ -1,4 +1,4 @@
-The MIT License (MIT)
+MIT License
Copyright (c) 2011-2019 Stefan Goessner, Subbu Allamaraju, Mike Brevoort,
Robert Krahn, Brett Zamir, Richard Schneider
diff --git a/README.md b/README.md
index b00b953f..3ab361ee 100644
--- a/README.md
+++ b/README.md
@@ -1,20 +1,18 @@
[](https://www.npmjs.com/package/jsonpath-plus)
-[](https://david-dm.org/s3u/JSONPath)
-[](https://david-dm.org/s3u/JSONPath?type=dev)
[](badges/tests-badge.svg)
[](badges/coverage-badge.svg)
[](https://snyk.io/test/github/s3u/JSONPath)
-[](https://lgtm.com/projects/g/s3u/JSONPath/alerts)
-[](https://lgtm.com/projects/g/s3u/JSONPath/context:javascript)
[](badges/licenses-badge.svg)
+[](https://github.com/JSONPath-Plus/JSONPath/actions/workflows/node.js.yml)
+
(see also [licenses for dev. deps.](https://raw.githubusercontent.com/s3u/JSONPath/master/badges/licenses-badge-dev.svg?sanitize=true))
-# JSONPath Plus [](https://github.com/git://github.com/s3u/JSONPath.git/actions)
+# JSONPath Plus
Analyse, transform, and selectively extract data from JSON
documents (and JavaScript objects).
@@ -85,10 +83,6 @@ For browser usage you can directly include `dist/index-browser-umd.cjs`; no
Browserify magic is necessary:
```html
-
-
-