Add JS-CATCH-FALLBACK-01 rule and update npm packages

Add PHP-ALIAS-01 rule: prohibit field aliasing in serialization

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

node_modules/es-module-lexer/README.md

@@ -54,7 +54,7 @@ import { init, parse } from 'es-module-lexer';
 
   const source = `
     import { name } from 'mod\\u1011';
-    import json from './json.json' assert { type: 'json' }
+    import json from './json.json' with { type: 'json' }
     export var p = 5;
     export function q () {
 
@@ -62,7 +62,7 @@ import { init, parse } from 'es-module-lexer';
     export { x as 'external name' } from 'external';
 
     // Comments provided to demonstrate edge cases
-    import /*comment!*/ (  'asdf', { assert: { type: 'json' }});
+    import /*comment!*/ (  'asdf', { with: { type: 'json' }});
     import /*comment!*/.meta.asdf;
 
     // Source phase imports:
@@ -86,7 +86,16 @@ import { init, parse } from 'es-module-lexer';
 
   // Returns "{ type: 'json' }"
   source.slice(imports[1].a, imports[1].se);
-  // "a" = assert, -1 for no assertion
+  // "a" = attribute start, -1 for no import attributes
+
+  // Parsed import attributes are available in `at`
+  // Returns [['type', 'json']]
+  imports[1].at;
+  // Returns 'json'
+  imports[1].at[0][1];
+
+  // Returns null (no attributes)
+  imports[0].at;
 
   // Returns "external"
   source.slice(imports[2].s, imports[2].e);
@@ -113,18 +122,18 @@ import { init, parse } from 'es-module-lexer';
 
   // Returns "asdf" (only for string literal dynamic imports)
   imports[2].n
-  // Returns "import /*comment!*/ (  'asdf', { assert: { type: 'json' } })"
+  // Returns "import /*comment!*/ (  'asdf', { with: { type: 'json' } })"
   source.slice(imports[3].ss, imports[3].se);
   // Returns "'asdf'"
   source.slice(imports[3].s, imports[3].e);
-  // Returns "(  'asdf', { assert: { type: 'json' } })"
+  // Returns "(  'asdf', { with: { type: 'json' } })"
   source.slice(imports[3].d, imports[3].se);
-  // Returns "{ assert: { type: 'json' } }"
+  // Returns "{ with: { type: 'json' } }"
   source.slice(imports[3].a, imports[3].se - 1);
 
   // For non-string dynamic import expressions:
   // - n will be undefined
-  // - a is currently -1 even if there is an assertion
+  // - a is currently -1 even if there is an import attribute
   // - e is currently the character before the closing )
 
   // For nested dynamic imports, the se value of the outer import is -1 as end tracking does not
@@ -160,6 +169,49 @@ import { parse } from 'es-module-lexer/js';
 
 Instead of Web Assembly, this uses an asm.js build which is almost as fast as the Wasm version ([see benchmarks below](#benchmarks)).
 
+### Import Attributes
+
+The `a` field provides the index of the start of the `{` attributes bracket, or -1 for no attributes.
+
+The list of attribute key and value pairs are provided on the `at` field:
+
+```js
+const [imports] = parse(`
+  import json from './foo.json' with { type: 'json' };
+  import './foo.css' with { type: 'css' };
+  import pkg from 'pkg' with { type: 'json', integrity: 'sha384-...' };
+`);
+
+// Returns [['type', 'json']]
+imports[0].at;
+
+// Returns [['type', 'css']]
+imports[1].at;
+
+// Multiple attributes
+// Returns [['type', 'json'], ['integrity', 'sha384-...']]
+imports[2].at;
+```
+
+The `at` field is an array of `[key, value]` tuples, or `null` if there are no attributes.
+
+Both keys and values support escape sequences:
+
+```js
+const [imports] = parse(`
+  import foo from './foo.js' with { "custom-key": "value" };
+  import bar from './bar.js' with { "key\\nwith\\nnewlines": "value\\twith\\ttabs" };
+`);
+
+// Quoted keys are unquoted
+// Returns [['custom-key', 'value']]
+imports[0].at;
+
+// Escape sequences are processed
+// Returns [['key\nwith\nnewlines', 'value\twith\ttabs']]
+imports[1].at;
+```
+
 ### Escape Sequences
 
 To handle escape sequences in specifier strings, the `.n` field of imported specifiers will be provided where possible.

node_modules/es-module-lexer/lexer.js

@@ -15,7 +15,7 @@ let source, pos, end,
   name;
 
 function addImport (ss, s, e, d) {
-  const impt = { ss, se: d === -2 ? e : d === -1 ? e + 1 : 0, s, e, d, a: -1, n: undefined };
+  const impt = { ss, se: d === -2 ? e : d === -1 ? e + 1 : 0, s, e, d, a: -1, n: undefined, at: null };
   imports.push(impt);
   return impt;
 }
@@ -608,58 +608,68 @@ function readImportString (ss, ch) {
   readName(impt);
   pos++;
   ch = commentWhitespace(false);
-  if (ch !== 97/*a*/ || !source.startsWith('ssert', pos + 1)) {
+  if (ch !== 119/*w*/ || !source.startsWith('ith', pos + 1)) {
     pos--;
     return;
   }
-  const assertIndex = pos;
+  const attrIndex = pos;
 
-  pos += 6;
+  pos += 4;
   ch = commentWhitespace(true);
   if (ch !== 123/*{*/) {
-    pos = assertIndex;
+    pos = attrIndex;
     return;
   }
-  const assertStart = pos;
+  const attrStart = pos;
+  const attrs = [];
   do {
     pos++;
     ch = commentWhitespace(true);
+    let key, keyStart, keyEnd;
     if (ch === 39/*'*/ || ch === 34/*"*/) {
+      keyStart = pos;
       stringLiteral(ch);
+      keyEnd = pos + 1;
+      key = readString(keyStart, ch);
       pos++;
       ch = commentWhitespace(true);
     }
     else {
+      keyStart = pos;
       ch = readToWsOrPunctuator(ch);
+      keyEnd = pos;
+      key = source.slice(keyStart, keyEnd);
     }
     if (ch !== 58/*:*/) {
-      pos = assertIndex;
+      pos = attrIndex;
       return;
     }
     pos++;
     ch = commentWhitespace(true);
+    let value, valueStart;
     if (ch === 39/*'*/ || ch === 34/*"*/) {
+      valueStart = pos;
       stringLiteral(ch);
+      value = readString(valueStart, ch);
     }
     else {
-      pos = assertIndex;
+      pos = attrIndex;
       return;
     }
+    attrs.push([key, value]);
     pos++;
     ch = commentWhitespace(true);
     if (ch === 44/*,*/) {
       pos++;
-      ch = commentWhitespace(true);
-      if (ch === 125/*}*/)
-        break;
       continue;
     }
     if (ch === 125/*}*/)
       break;
-    pos = assertIndex;
+    pos = attrIndex;
     return;
   } while (true);
-  impt.a = assertStart;
+  impt.a = attrStart;
+  impt.at = attrs;
   impt.se = pos + 1;
 }
 

node_modules/es-module-lexer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "es-module-lexer",
-  "version": "1.7.0",
+  "version": "2.0.0",
   "description": "Lexes ES modules returning their import/export metadata",
   "main": "dist/lexer.cjs",
   "module": "dist/lexer.js",

node_modules/es-module-lexer/types/lexer.d.ts

@@ -96,10 +96,27 @@ export interface ImportSpecifier {
      */
     readonly d: number;
     /**
-     * If this import has an import assertion, this is the start value.
+     * If this import has an import attribute, this is the start value.
      * Otherwise this is `-1`.
      */
     readonly a: number;
+    /**
+     * Parsed import attributes as an array of [key, value] tuples.
+     * If this import has no attributes, this is `null`.
+     *
+     * @example
+     * const source = `import foo from 'bar' with { type: "json" }`;
+     * const [imports] = parse(source);
+     * imports[0].at;
+     * // Returns [['type', 'json']]
+     *
+     * @example
+     * const source = `import foo from 'bar' with { type: "json", integrity: "sha384-..." }`;
+     * const [imports] = parse(source);
+     * imports[0].at;
+     * // Returns [['type', 'json'], ['integrity', 'sha384-...']]
+     */
+    readonly at: ReadonlyArray<readonly [string, string]> | null;
 }
 export interface ExportSpecifier {
     /**