@angular-devkit/schematics - npm Package Compare versions

Comparing version 9.0.0-next.14 to 9.0.0-next.15

package.json

 {
   "name": "@angular-devkit/schematics",
-  "version": "9.0.0-next.14",
+  "version": "9.0.0-next.15",
   "description": "Angular Schematics - Library",
@@ -21,3 +21,3 @@ "main": "src/index.js",
   "dependencies": {
-    "@angular-devkit/core": "9.0.0-next.14",
+    "@angular-devkit/core": "9.0.0-next.15",
     "rxjs": "6.5.3"
@@ -24,0 +24,0 @@ },

tools/node-module-engine-host.d.ts

@@ -20,4 +20,2 @@ /**
     constructor();
-    protected _resolvePackageJson(name: string, basedir?: string): string;
-    protected _resolvePath(name: string, basedir?: string): string;
     protected _resolveCollectionPath(name: string): string;
@@ -24,0 +22,0 @@ protected _resolveReferenceString(refString: string, parentPath: string): {

tools/node-module-engine-host.js

@@ -11,3 +11,2 @@ "use strict";
 const core_1 = require("@angular-devkit/core");
-const core = require("@angular-devkit/core/node");
 const path_1 = require("path");
@@ -28,60 +27,22 @@ const export_ref_1 = require("./export-ref");
     constructor() { super(); }
-    _resolvePackageJson(name, basedir = process.cwd()) {
-        return core.resolve(name, {
-            basedir,
-            checkLocal: true,
-            checkGlobal: true,
-            resolvePackageJson: true,
-        });
-    }
-    _resolvePath(name, basedir = process.cwd()) {
-        // Allow relative / absolute paths.
+    _resolveCollectionPath(name) {
+        let collectionPath = undefined;
         if (name.startsWith('.') || name.startsWith('/')) {
-            return path_1.resolve(basedir, name);
+            name = path_1.resolve(name);
         }
+        if (path_1.extname(name)) {
+            // When having an extension let's just resolve the provided path.
+            collectionPath = require.resolve(name);
+        }
         else {
-            // If it's a file inside a package, resolve the package then return the file...
-            if (name.split('/').length > (name[0] == '@' ? 2 : 1)) {
-                const rest = name.split('/');
-                const packageName = rest.shift() + (name[0] == '@' ? '/' + rest.shift() : '');
-                return path_1.resolve(core.resolve(packageName, {
-                    basedir,
-                    checkLocal: true,
-                    checkGlobal: true,
-                    resolvePackageJson: true,
-                }), '..', ...rest);
-            }
-            return core.resolve(name, {
-                basedir,
-                checkLocal: true,
-                checkGlobal: true,
-            });
-        }
-    }
-    _resolveCollectionPath(name) {
-        let collectionPath = undefined;
-        if (name.replace(/\\/g, '/').split('/').length > (name[0] == '@' ? 2 : 1)) {
-            try {
-                collectionPath = this._resolvePath(name, process.cwd());
-            }
-            catch (_a) {
-            }
-        }
-        if (!collectionPath) {
-            let packageJsonPath = this._resolvePackageJson(name, process.cwd());
-            // If it's a file, use it as is. Otherwise append package.json to it.
-            if (!core.fs.isFile(packageJsonPath)) {
-                packageJsonPath = path_1.join(packageJsonPath, 'package.json');
-            }
-            const pkgJsonSchematics = require(packageJsonPath)['schematics'];
-            if (!pkgJsonSchematics || typeof pkgJsonSchematics != 'string') {
+            const packageJsonPath = require.resolve(path_1.join(name, 'package.json'));
+            const { schematics } = require(packageJsonPath);
+            if (!schematics || typeof schematics !== 'string') {
                 throw new NodePackageDoesNotSupportSchematics(name);
             }
-            collectionPath = this._resolvePath(pkgJsonSchematics, path_1.dirname(packageJsonPath));
+            collectionPath = path_1.resolve(path_1.dirname(packageJsonPath), schematics);
         }
         try {
-            if (collectionPath) {
-                file_system_utility_1.readJsonFile(collectionPath);
-                return collectionPath;
-            }
+            file_system_utility_1.readJsonFile(collectionPath);
+            return collectionPath;
         }
@@ -88,0 +49,0 @@ catch (e) {

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

256200

-0.65%

Lines of code

6304

-0.65%

Number of low supply chain risk alerts

11

10%

Dependency changes

• + Added

  @angular-devkit/core@9.0.0-next.15
  (transitive)

• - Removed

  @angular-devkit/core@9.0.0-next.14
  (transitive)

• Updated

  @angular-devkit/core@9.0.0-next.15