Dear Maintainer,

Debian provided deep-freeze-es6 (under debian/build_modules) breaks freezing
nested objects, by recursively freezing properties of an object without first
checking if a property object has already been frozen, causing errors such as:

Uncaught TypeError: "begin" is read-only
    deepFreeze http://localhost:3000/highlight-1bbf5e38.js:16
    HLJS http://localhost:3000/highlight-1bbf5e38.js:2493
    hljs http://localhost:3000/highlight-1bbf5e38.js:2508
    <anonymous> http://localhost:3000/highlight-1bbf5e38.js:2512

In this concrete example, APOS_STRING_MODE first gets frozen. Due to
aforementioned problem, APOS_STRING_MODE.contains.0, which is BACKSLASH_ESCAPE,
is also frozen. Then, later when BACKSLASH_ESCAPE itself gets frozen again (or
maybe being frozen again as something else's .contains.0, or maybe in a reverse
order), this error is thrown.

Upstream uses a `!Object.isFrozen(prop)` check to avoid this problem, see
https://github.com/christophehurpeau/deep-freeze-es6/blob/c1b69815/lib/index.js#L49

The fix is simple:

diff --git a/debian/build_modules/deep-freeze-es6/index.js b/debian/build_modules/deep-freeze-es6/index.js
index 50ef5d2..47c87de 100644
--- a/debian/build_modules/deep-freeze-es6/index.js
+++ b/debian/build_modules/deep-freeze-es6/index.js
@@ -5,7 +5,9 @@ export function deepFreeze(obj) {
   // On gèle les propriétés avant de geler l'objet
   for (let name of propNames) {
     let value = obj[name];
-    obj[name] = value && typeof value === "object" ? deepFreeze(value) : value;
+    if ((typeof value === "object" || typeof value === "function") && !Object.isFrozen(value)) {
+      deepFreeze(value)
+    }
   }

   // On gèle l'objet initial

Hello,

Bug #1144874 in highlight.js reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/highlight.js/-/commit/d5e213370829610678321fb301826a0858180b7e
Closes: #1144874
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1144874

We believe that the bug you reported is fixed in the latest version of
highlight.js, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144874@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated highlight.js package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 26 Aug 2026 22:11:29 +0200
Source: highlight.js
Architecture: source
Version: 10.7.3+dfsg-6
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1144874 1144876
Changes:
 highlight.js (10.7.3+dfsg-6) unstable; urgency=medium
 .
   * Team upload
   * Fix deep-freeze-es6 build module: skip already frozen values
     (Closes: #1144874)
   * Fix language registration with rollup >= 3 (Closes: #1144876)
Checksums-Sha1:
 f1e96de72ba95f83b03e1c791e0de9d4670695fc 2592 highlight.js_10.7.3+dfsg-6.dsc
 7747068160c11cff4ff03900219929c6efa879af 43632 highlight.js_10.7.3+dfsg-6.debian.tar.xz
Checksums-Sha256:
 ca2310b823246b1b6b998bf7934468ac0aa240c0b12da837b1f66fa11b36d6f3 2592 highlight.js_10.7.3+dfsg-6.dsc
 4e0df470dca43dea18ef142ae4951293da441123241df0ba837745717f910577 43632 highlight.js_10.7.3+dfsg-6.debian.tar.xz
Files:
 144faff7cb66fccee7b1147bc69eabaa 2592 javascript optional highlight.js_10.7.3+dfsg-6.dsc
 afd8ad954cc592977ff8f2fffa8bebeb 43632 javascript optional highlight.js_10.7.3+dfsg-6.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqPSPQACgkQ9tdMp8mZ
7umuuQ//eI6pYNFy+VYWGuUYXRmjRHqBtsXXDgtw80y2bINMFaetnbqcOnZByjtl
9EpEV5LAGD1JO5AreFC91cyd06RY8cunqV0xViGcojAMyR1/ck5HB2BxfGD7VDia
F97Gr0E4ycOpZwZ1rgXBu37gLUyviTM/BY+rd7w+Hml8n1anBokP7vU5TQDamNj0
Y752NFcliqqkY6XmnpwsXzaX/NwNOHWMCxFIQXJaxV5uKn2k9KFGNq9t86lpQPtA
lTgL2xxXMs8aMRPa+AXsCttPwStM8B3V0GgQA6hhKj+wn71pJT7x//RLJQZWHAK4
ZIeyfdyaWWNAsW5r9PJxKZMNk/r9ElU9EwE/6IuMQA7vKC71xxN76DeESvi1kMQS
PWcrEWAtxOd+B5Rinp21AepZPXj/jtN1n10tdf0HuQsrqRJU5HU57RSlf3Is3uWR
ZOTHSFwhQAhsiLCFnbpYvih89YQM2KiWZ/Nr34I0rqPq7SxlPhW4NTAJDBUhGL8F
45ecZ0Z1WoQ895LG9SnXvEv4W8FvQvg2npRu1gD9lYdTFLJBDiUv7LaSjmpzoTkJ
gmDZBQIk/1H5HASY1Zu/aowslfb7Cwwbog+K682vKvd3NY4cm0WP80xmEu2YRXFf
KWXyJX/9qojrQbW+Zo1KxLvwkGGeVp4O3pYsrYRM+YPnp1kFhx0=
=boHA
-----END PGP SIGNATURE-----