Merge branch 'main' into release/v2

* main:
  Prepare for release 2.24.0.
  Add option to specify AVD heap size (#245)
  Gradle 7.4.2.
  Bump GH actions (#240)
  Bump minimist from 1.2.5 to 1.2.6 (#237)
  Update dependencies in test-fixture.
  Add more .gitignore rules (#231)
  Update README for using with gradle/gradle-build-action (#230)

node_modules/.package-lock.json

@@ -74,9 +74,9 @@
       }
     },
     "node_modules/minimist": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
-      "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw=="
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
+      "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q=="
     },
     "node_modules/semver": {
       "version": "6.3.0",

node_modules/minimist/index.js

@@ -70,7 +70,7 @@ module.exports = function (args, opts) {
         var o = obj;
         for (var i = 0; i < keys.length-1; i++) {
             var key = keys[i];
-            if (key === '__proto__') return;
+            if (isConstructorOrProto(o, key)) return;
             if (o[key] === undefined) o[key] = {};
             if (o[key] === Object.prototype || o[key] === Number.prototype
                 || o[key] === String.prototype) o[key] = {};
@@ -79,7 +79,7 @@ module.exports = function (args, opts) {
         }
 
         var key = keys[keys.length - 1];
-        if (key === '__proto__') return;
+        if (isConstructorOrProto(o, key)) return;
         if (o === Object.prototype || o === Number.prototype
             || o === String.prototype) o = {};
         if (o === Array.prototype) o = [];
@@ -243,3 +243,7 @@ function isNumber (x) {
     return /^[-+]?(?:\d+(?:\.\d*)?|\.\d+)(e[-+]?\d+)?$/.test(x);
 }
 
+
+function isConstructorOrProto (obj, key) {
+    return key === 'constructor' && typeof obj[key] === 'function' || key === '__proto__';
+}

node_modules/minimist/package.json

@@ -1,67 +1,16 @@
 {
-  "_args": [
-    [
-      "minimist@1.2.5",
-      "/Users/Yang/Desktop/Projects/android-emulator-runner"
-    ]
-  ],
-  "_from": "minimist@1.2.5",
-  "_id": "minimist@1.2.5",
-  "_inBundle": false,
-  "_integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
-  "_location": "/minimist",
-  "_phantomChildren": {},
-  "_requested": {
-    "type": "version",
-    "registry": true,
-    "raw": "minimist@1.2.5",
-    "name": "minimist",
-    "escapedName": "minimist",
-    "rawSpec": "1.2.5",
-    "saveSpec": null,
-    "fetchSpec": "1.2.5"
-  },
-  "_requiredBy": [
-    "/",
-    "/@babel/core/json5",
-    "/@cnakazawa/watch",
-    "/json5",
-    "/sane"
-  ],
-  "_resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
-  "_spec": "1.2.5",
-  "_where": "/Users/Yang/Desktop/Projects/android-emulator-runner",
-  "author": {
-    "name": "James Halliday",
-    "email": "mail@substack.net",
-    "url": "http://substack.net"
-  },
-  "bugs": {
-    "url": "https://github.com/substack/minimist/issues"
-  },
+  "name": "minimist",
+  "version": "1.2.6",
   "description": "parse argument options",
+  "main": "index.js",
   "devDependencies": {
     "covert": "^1.0.0",
     "tap": "~0.4.0",
     "tape": "^3.5.0"
   },
-  "homepage": "https://github.com/substack/minimist",
-  "keywords": [
-    "argv",
-    "getopt",
-    "parser",
-    "optimist"
-  ],
-  "license": "MIT",
-  "main": "index.js",
-  "name": "minimist",
-  "repository": {
-    "type": "git",
-    "url": "git://github.com/substack/minimist.git"
-  },
   "scripts": {
-    "coverage": "covert test/*.js",
-    "test": "tap test/*.js"
+    "test": "tap test/*.js",
+    "coverage": "covert test/*.js"
   },
   "testling": {
     "files": "test/*.js",
@@ -76,5 +25,21 @@
       "opera/12"
     ]
   },
-  "version": "1.2.5"
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/substack/minimist.git"
+  },
+  "homepage": "https://github.com/substack/minimist",
+  "keywords": [
+    "argv",
+    "getopt",
+    "parser",
+    "optimist"
+  ],
+  "author": {
+    "name": "James Halliday",
+    "email": "mail@substack.net",
+    "url": "http://substack.net"
+  },
+  "license": "MIT"
 }

node_modules/minimist/readme.markdown

@@ -34,7 +34,10 @@ $ node example/parse.js -x 3 -y 4 -n5 -abc --beep=boop foo bar baz
 Previous versions had a prototype pollution bug that could cause privilege
 escalation in some circumstances when handling untrusted user input.
 
-Please use version 1.2.3 or later: https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
+Please use version 1.2.6 or later:
+
+* https://security.snyk.io/vuln/SNYK-JS-MINIMIST-2429795 (version <=1.2.5)
+* https://snyk.io/vuln/SNYK-JS-MINIMIST-559764 (version <=1.2.3)
 
 # methods
 

node_modules/minimist/test/proto.js

@@ -42,3 +42,19 @@ test('proto pollution (constructor)', function (t) {
     t.equal(argv.y, undefined);
     t.end();
 });
+
+test('proto pollution (constructor function)', function (t) {
+    var argv = parse(['--_.concat.constructor.prototype.y', '123']);
+    function fnToBeTested() {}
+    t.equal(fnToBeTested.y, undefined);
+    t.equal(argv.y, undefined);
+    t.end();
+});
+
+// powered by snyk - https://github.com/backstage/backstage/issues/10343
+test('proto pollution (constructor function) snyk', function (t) {
+    var argv = parse('--_.constructor.constructor.prototype.foo bar'.split(' '));
+    t.equal((function(){}).foo, undefined);
+    t.equal(argv.y, undefined);
+    t.end();
+})