Socket
Socket
Sign inDemoInstall

@changesets/get-dependents-graph

Package Overview
Dependencies
Maintainers
3
Versions
23
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@changesets/get-dependents-graph - npm Package Compare versions

Comparing version 1.2.5-temp.0 to 1.3.0

43

CHANGELOG.md
# @changesets/get-dependents-graph
## 1.2.5-temp.0
## 1.3.0
### Patch Changes
### Minor Changes
- Updated dependencies [[`636c7d7`](https://github.com/changesets/changesets/commit/636c7d7c9333664c91cd4d0ff678d5acb17256ad)]:
- @changesets/types@4.1.0-temp.0
- [#704](https://github.com/changesets/changesets/pull/704) [`6f9c9d6`](https://github.com/changesets/changesets/commit/6f9c9d60c0e02c79d555c48deb01559057f1d252) Thanks [@Andarist](https://github.com/Andarist)! - Dependencies specified using a tag will no longer mark the graph as invalid. With such dependencies the user's intent is to fetch those from the registry even if otherwise they could be linked locally.

@@ -14,5 +13,5 @@ ## 1.2.4

- [#667](https://github.com/atlassian/changesets/pull/667) [`fe8db75`](https://github.com/atlassian/changesets/commit/fe8db7500f81caea9064f8bec02bcb77e0fd8fce) Thanks [@fz6m](https://github.com/fz6m)! - Upgraded `@manypkg/get-packages` dependency to fix getting correct packages in pnpm workspaces with exclude rules.
- [#667](https://github.com/changesets/changesets/pull/667) [`fe8db75`](https://github.com/changesets/changesets/commit/fe8db7500f81caea9064f8bec02bcb77e0fd8fce) Thanks [@fz6m](https://github.com/fz6m)! - Upgraded `@manypkg/get-packages` dependency to fix getting correct packages in pnpm workspaces with exclude rules.
- Updated dependencies [[`9a993ba`](https://github.com/atlassian/changesets/commit/9a993ba09629c1620d749432520470cec49d3a96)]:
- Updated dependencies [[`9a993ba`](https://github.com/changesets/changesets/commit/9a993ba09629c1620d749432520470cec49d3a96)]:
- @changesets/types@4.0.2

@@ -24,3 +23,3 @@

- [#585](https://github.com/atlassian/changesets/pull/585) [`74dda8c`](https://github.com/atlassian/changesets/commit/74dda8c0d8bd1741ca7b19f0ccb37b2330dc9549) Thanks [@javier-garcia-meteologica](https://github.com/javier-garcia-meteologica)! - Add support for `workspace:^` and `workspace:~` dependency ranges.
- [#585](https://github.com/changesets/changesets/pull/585) [`74dda8c`](https://github.com/changesets/changesets/commit/74dda8c0d8bd1741ca7b19f0ccb37b2330dc9549) Thanks [@javier-garcia-meteologica](https://github.com/javier-garcia-meteologica)! - Add support for `workspace:^` and `workspace:~` dependency ranges.

@@ -31,3 +30,3 @@ ## 1.2.2

- Updated dependencies [[`e89e28a`](https://github.com/atlassian/changesets/commit/e89e28a05f5fa43307db73812a6bcd269b62ddee)]:
- Updated dependencies [[`e89e28a`](https://github.com/changesets/changesets/commit/e89e28a05f5fa43307db73812a6bcd269b62ddee)]:
- @changesets/types@4.0.1

@@ -39,3 +38,3 @@

- Updated dependencies [[`de2b4a5`](https://github.com/atlassian/changesets/commit/de2b4a5a7b244a37d94625bcb70ecde9dde5b612)]:
- Updated dependencies [[`de2b4a5`](https://github.com/changesets/changesets/commit/de2b4a5a7b244a37d94625bcb70ecde9dde5b612)]:
- @changesets/types@4.0.0

@@ -47,7 +46,7 @@

- [`12f9a43`](https://github.com/atlassian/changesets/commit/12f9a433a6c3ac38f9405fcd77c9108c423d7101) [#507](https://github.com/atlassian/changesets/pull/507) Thanks [@zkochan](https://github.com/zkochan)! - New setting added: bumpVersionsWithWorkspaceProtocolOnly. When it is set to `true`, versions are bumped in `dependencies`, only if those versions are prefixed by the workspace protocol. For instance, `"foo": "workspace:^1.0.0"`.
- [`12f9a43`](https://github.com/changesets/changesets/commit/12f9a433a6c3ac38f9405fcd77c9108c423d7101) [#507](https://github.com/changesets/changesets/pull/507) Thanks [@zkochan](https://github.com/zkochan)! - New setting added: bumpVersionsWithWorkspaceProtocolOnly. When it is set to `true`, versions are bumped in `dependencies`, only if those versions are prefixed by the workspace protocol. For instance, `"foo": "workspace:^1.0.0"`.
### Patch Changes
- Updated dependencies [[`12f9a43`](https://github.com/atlassian/changesets/commit/12f9a433a6c3ac38f9405fcd77c9108c423d7101)]:
- Updated dependencies [[`12f9a43`](https://github.com/changesets/changesets/commit/12f9a433a6c3ac38f9405fcd77c9108c423d7101)]:
- @changesets/types@3.3.0

@@ -59,3 +58,3 @@

- Updated dependencies [[`2b49d66`](https://github.com/atlassian/changesets/commit/2b49d668ecaa1333bc5c7c5be4648dda1b11528d)]:
- Updated dependencies [[`2b49d66`](https://github.com/changesets/changesets/commit/2b49d668ecaa1333bc5c7c5be4648dda1b11528d)]:
- @changesets/types@3.0.0

@@ -67,3 +66,3 @@

- [`d678da5`](https://github.com/atlassian/changesets/commit/d678da5e9936862bb66e5edb538c5b8be23d4ffe) [#324](https://github.com/atlassian/changesets/pull/324) Thanks [@zkochan](https://github.com/zkochan)! - Dev dependencies that are installed via the link or file protocol are ignored.
- [`d678da5`](https://github.com/changesets/changesets/commit/d678da5e9936862bb66e5edb538c5b8be23d4ffe) [#324](https://github.com/changesets/changesets/pull/324) Thanks [@zkochan](https://github.com/zkochan)! - Dev dependencies that are installed via the link or file protocol are ignored.

@@ -74,5 +73,5 @@ ## 1.1.1

- [`1706fb7`](https://github.com/atlassian/changesets/commit/1706fb751ecc2f5a792c42f467b2063078d58716) [#321](https://github.com/atlassian/changesets/pull/321) Thanks [@mitchellhamilton](https://github.com/mitchellhamilton)! - Fix TypeScript declarations
- [`1706fb7`](https://github.com/changesets/changesets/commit/1706fb751ecc2f5a792c42f467b2063078d58716) [#321](https://github.com/changesets/changesets/pull/321) Thanks [@mitchellhamilton](https://github.com/mitchellhamilton)! - Fix TypeScript declarations
- Updated dependencies [[`1706fb7`](https://github.com/atlassian/changesets/commit/1706fb751ecc2f5a792c42f467b2063078d58716)]:
- Updated dependencies [[`1706fb7`](https://github.com/changesets/changesets/commit/1706fb751ecc2f5a792c42f467b2063078d58716)]:
- @changesets/types@2.0.1

@@ -84,7 +83,7 @@

- [`c3cc232`](https://github.com/atlassian/changesets/commit/c3cc23204c6cb80487aced1b37ebe8ffde0e2111) [#311](https://github.com/atlassian/changesets/pull/311) Thanks [@zkochan](https://github.com/zkochan)! - Added support for workspace ranges. Package graph validation understands them now and allows them to satisfy dependents' required ranges.
- [`c3cc232`](https://github.com/changesets/changesets/commit/c3cc23204c6cb80487aced1b37ebe8ffde0e2111) [#311](https://github.com/changesets/changesets/pull/311) Thanks [@zkochan](https://github.com/zkochan)! - Added support for workspace ranges. Package graph validation understands them now and allows them to satisfy dependents' required ranges.
### Patch Changes
- Updated dependencies [[`011d57f`](https://github.com/atlassian/changesets/commit/011d57f1edf9e37f75a8bef4f918e72166af096e)]:
- Updated dependencies [[`011d57f`](https://github.com/changesets/changesets/commit/011d57f1edf9e37f75a8bef4f918e72166af096e)]:
- @changesets/types@2.0.0

@@ -96,7 +95,7 @@

- [`04ddfd7`](https://github.com/atlassian/changesets/commit/04ddfd7c3acbfb84ef9c92873fe7f9dea1f5145c) [#305](https://github.com/atlassian/changesets/pull/305) Thanks [@Noviny](https://github.com/Noviny)! - Add link to changelog in readme
- [`04ddfd7`](https://github.com/changesets/changesets/commit/04ddfd7c3acbfb84ef9c92873fe7f9dea1f5145c) [#305](https://github.com/changesets/changesets/pull/305) Thanks [@Noviny](https://github.com/Noviny)! - Add link to changelog in readme
* [`b49e1cf`](https://github.com/atlassian/changesets/commit/b49e1cff65dca7fe9e341a35aa91704aa0e51cb3) [#306](https://github.com/atlassian/changesets/pull/306) Thanks [@Andarist](https://github.com/Andarist)! - Ignore `node_modules` when glob searching for packages. This fixes an issue with package cycles.
* [`b49e1cf`](https://github.com/changesets/changesets/commit/b49e1cff65dca7fe9e341a35aa91704aa0e51cb3) [#306](https://github.com/changesets/changesets/pull/306) Thanks [@Andarist](https://github.com/Andarist)! - Ignore `node_modules` when glob searching for packages. This fixes an issue with package cycles.
* Updated dependencies [[`04ddfd7`](https://github.com/atlassian/changesets/commit/04ddfd7c3acbfb84ef9c92873fe7f9dea1f5145c), [`e56928b`](https://github.com/atlassian/changesets/commit/e56928bbd6f9096def06ac37487bdbf28efec9d1)]:
* Updated dependencies [[`04ddfd7`](https://github.com/changesets/changesets/commit/04ddfd7c3acbfb84ef9c92873fe7f9dea1f5145c), [`e56928b`](https://github.com/changesets/changesets/commit/e56928bbd6f9096def06ac37487bdbf28efec9d1)]:
- @changesets/types@1.0.1

@@ -108,7 +107,7 @@

- [`cc8c921`](https://github.com/atlassian/changesets/commit/cc8c92143d4c4b7cca8b9917dfc830a40b5cda20) [#290](https://github.com/atlassian/changesets/pull/290) Thanks [@mitchellhamilton](https://github.com/mitchellhamilton)! - Initial release of `@changesets/get-dependents-graph`. If you're migrating from `get-dependents-graph`, you will need to pass the `Packages` object(which is returned from `@manypkg/get-packages`) to `getDependentsGraph` and also import `getDependentsGraph` as a named export instead of a default export.
- [`cc8c921`](https://github.com/changesets/changesets/commit/cc8c92143d4c4b7cca8b9917dfc830a40b5cda20) [#290](https://github.com/changesets/changesets/pull/290) Thanks [@mitchellhamilton](https://github.com/mitchellhamilton)! - Initial release of `@changesets/get-dependents-graph`. If you're migrating from `get-dependents-graph`, you will need to pass the `Packages` object(which is returned from `@manypkg/get-packages`) to `getDependentsGraph` and also import `getDependentsGraph` as a named export instead of a default export.
### Patch Changes
- Updated dependencies [[`41e2e3d`](https://github.com/atlassian/changesets/commit/41e2e3dd1053ff2f35a1a07e60793c9099f26997), [`cc8c921`](https://github.com/atlassian/changesets/commit/cc8c92143d4c4b7cca8b9917dfc830a40b5cda20), [`cc8c921`](https://github.com/atlassian/changesets/commit/cc8c92143d4c4b7cca8b9917dfc830a40b5cda20), [`2363366`](https://github.com/atlassian/changesets/commit/2363366756d1b15bddf6d803911baccfca03cbdf)]:
- Updated dependencies [[`41e2e3d`](https://github.com/changesets/changesets/commit/41e2e3dd1053ff2f35a1a07e60793c9099f26997), [`cc8c921`](https://github.com/changesets/changesets/commit/cc8c92143d4c4b7cca8b9917dfc830a40b5cda20), [`cc8c921`](https://github.com/changesets/changesets/commit/cc8c92143d4c4b7cca8b9917dfc830a40b5cda20), [`2363366`](https://github.com/changesets/changesets/commit/2363366756d1b15bddf6d803911baccfca03cbdf)]:
- @changesets/types@1.0.0

@@ -24,9 +24,9 @@ 'use strict';

for (const name of Object.keys(deps)) {
const depVersion = deps[name];
const depRange = deps[name];
if ((depVersion.startsWith("link:") || depVersion.startsWith("file:")) && type === "devDependencies") {
if ((depRange.startsWith("link:") || depRange.startsWith("file:")) && type === "devDependencies") {
continue;
}
allDependencies.set(name, depVersion);
allDependencies.set(name, depRange);
}

@@ -38,2 +38,16 @@ }

const isProtocolRange = range => range.indexOf(":") !== -1;
const getValidRange = potentialRange => {
if (isProtocolRange(potentialRange)) {
return null;
}
try {
return new semver__default['default'].Range(potentialRange);
} catch (_unused) {
return null;
}
};
function getDependencyGraph(packages, opts) {

@@ -59,12 +73,12 @@ const graph = new Map();

for (let [depName, depVersion] of allDependencies) {
for (let [depName, depRange] of allDependencies) {
const match = packagesByName[depName];
if (!match) continue;
const expected = match.packageJson.version;
const usesWorkspaceRange = depVersion.startsWith("workspace:");
const usesWorkspaceRange = depRange.startsWith("workspace:");
if (usesWorkspaceRange) {
depVersion = depVersion.replace(/^workspace:/, "");
depRange = depRange.replace(/^workspace:/, "");
if (depVersion === "*" || depVersion === "^" || depVersion === "~") {
if (depRange === "*" || depRange === "^" || depRange === "~") {
dependencies.push(depName);

@@ -75,9 +89,16 @@ continue;

continue;
} // internal dependencies only need to semver satisfy, not '==='
}
const range = getValidRange(depRange);
if (!semver__default['default'].satisfies(expected, depVersion)) {
if (range && !range.test(expected) || isProtocolRange(depRange)) {
valid = false;
console.error(`Package ${chalk__default['default'].cyan(`"${name}"`)} must depend on the current version of ${chalk__default['default'].cyan(`"${depName}"`)}: ${chalk__default['default'].green(`"${expected}"`)} vs ${chalk__default['default'].red(`"${depVersion}"`)}`);
console.error(`Package ${chalk__default['default'].cyan(`"${name}"`)} must depend on the current version of ${chalk__default['default'].cyan(`"${depName}"`)}: ${chalk__default['default'].green(`"${expected}"`)} vs ${chalk__default['default'].red(`"${depRange}"`)}`);
continue;
} // `depRange` could have been a tag and if a tag has been used there might have been a reason for that
// we should not count this as a local monorepro dependant
if (!range) {
continue;
}

@@ -84,0 +105,0 @@

@@ -22,7 +22,14 @@ "use strict";

if (deps) for (const name of Object.keys(deps)) {
const depVersion = deps[name];
(depVersion.startsWith("link:") || depVersion.startsWith("file:")) && "devDependencies" === type || allDependencies.set(name, depVersion);
const depRange = deps[name];
(depRange.startsWith("link:") || depRange.startsWith("file:")) && "devDependencies" === type || allDependencies.set(name, depRange);
}
}
return allDependencies;
}, isProtocolRange = range => -1 !== range.indexOf(":"), getValidRange = potentialRange => {
if (isProtocolRange(potentialRange)) return null;
try {
return new semver__default.default.Range(potentialRange);
} catch (_unused) {
return null;
}
};

@@ -39,8 +46,8 @@

const {name: name} = pkg.packageJson, dependencies = [], allDependencies = getAllDependencies(pkg.packageJson);
for (let [depName, depVersion] of allDependencies) {
for (let [depName, depRange] of allDependencies) {
const match = packagesByName[depName];
if (!match) continue;
const expected = match.packageJson.version;
if (depVersion.startsWith("workspace:")) {
if (depVersion = depVersion.replace(/^workspace:/, ""), "*" === depVersion || "^" === depVersion || "~" === depVersion) {
if (depRange.startsWith("workspace:")) {
if (depRange = depRange.replace(/^workspace:/, ""), "*" === depRange || "^" === depRange || "~" === depRange) {
dependencies.push(depName);

@@ -50,4 +57,4 @@ continue;

} else if (!0 === (null == opts ? void 0 : opts.bumpVersionsWithWorkspaceProtocolOnly)) continue;
semver__default.default.satisfies(expected, depVersion) ? dependencies.push(depName) : (valid = !1,
console.error(`Package ${chalk__default.default.cyan(`"${name}"`)} must depend on the current version of ${chalk__default.default.cyan(`"${depName}"`)}: ${chalk__default.default.green(`"${expected}"`)} vs ${chalk__default.default.red(`"${depVersion}"`)}`));
const range = getValidRange(depRange);
range && !range.test(expected) || isProtocolRange(depRange) ? (valid = !1, console.error(`Package ${chalk__default.default.cyan(`"${name}"`)} must depend on the current version of ${chalk__default.default.cyan(`"${depName}"`)}: ${chalk__default.default.green(`"${expected}"`)} vs ${chalk__default.default.red(`"${depRange}"`)}`)) : range && dependencies.push(depName);
}

@@ -54,0 +61,0 @@ graph.set(name, {

@@ -15,9 +15,9 @@ import semver from 'semver';

for (const name of Object.keys(deps)) {
const depVersion = deps[name];
const depRange = deps[name];
if ((depVersion.startsWith("link:") || depVersion.startsWith("file:")) && type === "devDependencies") {
if ((depRange.startsWith("link:") || depRange.startsWith("file:")) && type === "devDependencies") {
continue;
}
allDependencies.set(name, depVersion);
allDependencies.set(name, depRange);
}

@@ -29,2 +29,16 @@ }

const isProtocolRange = range => range.indexOf(":") !== -1;
const getValidRange = potentialRange => {
if (isProtocolRange(potentialRange)) {
return null;
}
try {
return new semver.Range(potentialRange);
} catch (_unused) {
return null;
}
};
function getDependencyGraph(packages, opts) {

@@ -50,12 +64,12 @@ const graph = new Map();

for (let [depName, depVersion] of allDependencies) {
for (let [depName, depRange] of allDependencies) {
const match = packagesByName[depName];
if (!match) continue;
const expected = match.packageJson.version;
const usesWorkspaceRange = depVersion.startsWith("workspace:");
const usesWorkspaceRange = depRange.startsWith("workspace:");
if (usesWorkspaceRange) {
depVersion = depVersion.replace(/^workspace:/, "");
depRange = depRange.replace(/^workspace:/, "");
if (depVersion === "*" || depVersion === "^" || depVersion === "~") {
if (depRange === "*" || depRange === "^" || depRange === "~") {
dependencies.push(depName);

@@ -66,9 +80,16 @@ continue;

continue;
} // internal dependencies only need to semver satisfy, not '==='
}
const range = getValidRange(depRange);
if (!semver.satisfies(expected, depVersion)) {
if (range && !range.test(expected) || isProtocolRange(depRange)) {
valid = false;
console.error(`Package ${chalk.cyan(`"${name}"`)} must depend on the current version of ${chalk.cyan(`"${depName}"`)}: ${chalk.green(`"${expected}"`)} vs ${chalk.red(`"${depVersion}"`)}`);
console.error(`Package ${chalk.cyan(`"${name}"`)} must depend on the current version of ${chalk.cyan(`"${depName}"`)}: ${chalk.green(`"${expected}"`)} vs ${chalk.red(`"${depRange}"`)}`);
continue;
} // `depRange` could have been a tag and if a tag has been used there might have been a reason for that
// we should not count this as a local monorepro dependant
if (!range) {
continue;
}

@@ -75,0 +96,0 @@

{
"name": "@changesets/get-dependents-graph",
"version": "1.2.5-temp.0",
"version": "1.3.0",
"description": "Get the graph of dependents in a monorepo",

@@ -10,3 +10,3 @@ "main": "dist/get-dependents-graph.cjs.js",

"dependencies": {
"@changesets/types": "^4.1.0-temp.0",
"@changesets/types": "^4.0.2",
"@manypkg/get-packages": "^1.1.3",

@@ -13,0 +13,0 @@ "chalk": "^2.1.0",

import getDependencyGraph from "./get-dependency-graph";
const consoleError = console.error;
beforeEach(async () => {
console.error = jest.fn();
});
afterEach(async () => {
console.error = consoleError;
});
describe("getting the dependency graph", function() {

@@ -33,3 +43,37 @@ it("should skip dependencies specified through the link protocol", function() {

expect(valid).toBeTruthy();
expect((console.error as any).mock.calls).toMatchInlineSnapshot(`Array []`);
});
it("should skip dependencies specified using a tag", function() {
const { graph, valid } = getDependencyGraph({
root: {
dir: ".",
packageJson: { name: "root", version: "1.0.0" }
},
packages: [
{
dir: "examples/foo",
packageJson: {
name: "foo-example",
version: "1.0.0",
dependencies: {
bar: "latest"
}
}
},
{
dir: "packages/bar",
packageJson: {
name: "bar",
version: "1.0.0"
}
}
],
tool: "pnpm"
});
expect(graph.get("foo-example")!.dependencies).toStrictEqual([]);
expect(valid).toBeTruthy();
expect((console.error as any).mock.calls).toMatchInlineSnapshot(`Array []`);
});
it("should set valid to false if the link protocol is used in a non-dev dep", function() {

@@ -63,3 +107,10 @@ const { valid } = getDependencyGraph({

expect(valid).toBeFalsy();
expect((console.error as any).mock.calls).toMatchInlineSnapshot(`
Array [
Array [
"Package \\"foo\\" must depend on the current version of \\"bar\\": \\"1.0.0\\" vs \\"link:../bar\\"",
],
]
`);
});
});

@@ -22,5 +22,5 @@ // This is a modified version of the graph-getting in bolt

for (const name of Object.keys(deps)) {
const depVersion = deps[name];
const depRange = deps[name];
if (
(depVersion.startsWith("link:") || depVersion.startsWith("file:")) &&
(depRange.startsWith("link:") || depRange.startsWith("file:")) &&
type === "devDependencies"

@@ -31,3 +31,3 @@ ) {

allDependencies.set(name, depVersion);
allDependencies.set(name, depRange);
}

@@ -39,2 +39,16 @@ }

const isProtocolRange = (range: string) => range.indexOf(":") !== -1;
const getValidRange = (potentialRange: string) => {
if (isProtocolRange(potentialRange)) {
return null;
}
try {
return new semver.Range(potentialRange);
} catch {
return null;
}
};
export default function getDependencyGraph(

@@ -71,3 +85,3 @@ packages: Packages,

for (let [depName, depVersion] of allDependencies) {
for (let [depName, depRange] of allDependencies) {
const match = packagesByName[depName];

@@ -77,8 +91,8 @@ if (!match) continue;

const expected = match.packageJson.version;
const usesWorkspaceRange = depVersion.startsWith("workspace:");
const usesWorkspaceRange = depRange.startsWith("workspace:");
if (usesWorkspaceRange) {
depVersion = depVersion.replace(/^workspace:/, "");
depRange = depRange.replace(/^workspace:/, "");
if (depVersion === "*" || depVersion === "^" || depVersion === "~") {
if (depRange === "*" || depRange === "^" || depRange === "~") {
dependencies.push(depName);

@@ -91,4 +105,5 @@ continue;

// internal dependencies only need to semver satisfy, not '==='
if (!semver.satisfies(expected, depVersion)) {
const range = getValidRange(depRange);
if ((range && !range.test(expected)) || isProtocolRange(depRange)) {
valid = false;

@@ -100,5 +115,3 @@ console.error(

`"${depName}"`
)}: ${chalk.green(`"${expected}"`)} vs ${chalk.red(
`"${depVersion}"`
)}`
)}: ${chalk.green(`"${expected}"`)} vs ${chalk.red(`"${depRange}"`)}`
);

@@ -108,2 +121,8 @@ continue;

// `depRange` could have been a tag and if a tag has been used there might have been a reason for that
// we should not count this as a local monorepro dependant
if (!range) {
continue;
}
dependencies.push(depName);

@@ -110,0 +129,0 @@ }

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc