@agoric/swingset-vat - npm Package Compare versions

Comparing version 0.0.1 to 0.0.3

package.json

 {
   "name": "@agoric/swingset-vat",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "Vat/Container Launcher",
+  "main": "src/main.js",
   "module": "src/index.js",
@@ -14,2 +15,5 @@ "engines": {
     "build-kernel": "node -r esm scripts/build-kernel.js",
+    "pack-evaluate": "cd agoric-evaluate && npm pack",
+    "pack": "npm run-script build-kernel && npm pack",
+    "publish": "npm run-script pack && npm publish --access public",
     "test": "npm run-script build-kernel && tape -r esm test/test-node-version.js && tape -r esm test/**/test*.js",
@@ -36,3 +40,3 @@ "pretty-fix": "prettier --write '**/*.{js,jsx}'",
   "dependencies": {
-    "@agoric/evaluate": "./agoric-evaluate",
+    "@agoric/evaluate": "file:./agoric-evaluate/agoric-evaluate-0.0.1.tgz",
     "@agoric/harden": "^0.0.4",
@@ -45,2 +49,10 @@ "@agoric/nat": "^2.0.0",
   },
+  "bundledDependencies": [
+    "@agoric/evaluate"
+  ],
+  "files": [
+    "bin/vat",
+    "src/**/*.js",
+    "src/bundles/kernel"
+  ],
   "repository": {
@@ -47,0 +59,0 @@ "type": "git",

Fixed alerts

GitHub dependency

Supply chain risk

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

Found 1 instance in 1 package

Improved metrics

Number of high supply chain risk alerts

0

decreased by-100%

Worsened metrics

Total package byte prevSize

163067

decreased by-39.4%

Number of package files

22

decreased by-29.03%

Lines of code

2078

decreased by-0.1%

Dependency changes

• Updated@agoric/evaluate@file:./agoric-evaluate/agoric-evaluate-0.0.1.tgz