@dotenvx/dotenvx - npm Package Compare versions

Comparing version 0.6.13 to 0.7.1

package.json

 {
-  "version": "0.6.13",
+  "version": "0.7.1",
   "name": "@dotenvx/dotenvx",
@@ -29,2 +29,3 @@ "description": "a better dotenv–from the creator of `dotenv`",
     "dotenv": "^16.3.1",
+    "execa": "^5.1.1",
     "winston": "^3.11.0",
@@ -31,0 +32,0 @@ "xxhashjs": "^0.2.2"

src/cli/dotenvx.js

@@ -61,3 +61,3 @@ #!/usr/bin/env node
   .option('-o, --overload', 'override existing env variables')
-  .action(function () {
+  .action(async function () {
     const options = this.opts()
@@ -171,3 +171,3 @@ logger.debug('configuring options')
 
-      helpers.executeCommand(subCommand, process.env)
+      await helpers.executeCommand(subCommand, process.env)
     }
@@ -174,0 +174,0 @@ })

src/cli/helpers.js

 const fs = require('fs')
 const path = require('path')
+const execa = require('execa')
 const crypto = require('crypto')
-const { spawn } = require('child_process')
 const xxhash = require('xxhashjs')
@@ -21,12 +21,29 @@
 
-const executeCommand = function (subCommand, env) {
-  const subprocess = spawn(subCommand[0], subCommand.slice(1), {
-    stdio: 'inherit',
-    shell: true,
-    env: { ...process.env, ...env }
-  })
+const executeCommand = async function (subCommand, env) {
+  // handler for SIGINT
+  let subprocess
+  const sigintHandler = () => {
+    if (subprocess) {
+      subprocess.kill('SIGINT') // Send SIGINT to the subprocess
+    }
+  }
 
-  subprocess.on('close', (code) => {
-    if (code > 0) {
-      logger.error(`command [${subCommand.join(' ')}] failed (code: ${code})`)
+  try {
+    const subprocess = execa(subCommand[0], subCommand.slice(1), {
+      stdio: 'inherit',
+      env: { ...process.env, ...env }
+    })
+
+    process.on('SIGINT', sigintHandler)
+
+    // Wait for the subprocess to finish
+    const { exitCode } = await subprocess
+
+    if (exitCode !== 0) {
+      throw new Error(`Command failed with exit code ${exitCode}`)
+    }
+  } catch (error) {
+    if (error.signal !== 'SIGINT') {
+      logger.error(error.message)
+      logger.error(`command [${subCommand.join(' ')}] failed`)
       logger.error('')
@@ -39,16 +56,8 @@ logger.error(`  try without dotenvx: [${subCommand.join(' ')}]`)
 
-    process.exit(code)
-  })
-
-  subprocess.on('error', (err) => {
-    logger.error(err)
-    logger.error(`command [${subCommand.join(' ')}] failed`)
-    logger.error('')
-    logger.error(`  try without dotenvx: [${subCommand.join(' ')}]`)
-    logger.error('')
-    logger.error('if that succeeds, then dotenvx is the culprit. report issue:')
-    logger.error(`<${REPORT_ISSUE_LINK}>`)
-
-    process.exit(1)
-  })
+    // Exit with the error code from the subprocess, or 1 if unavailable
+    process.exit(error.exitCode || 1)
+  } finally {
+    // Clean up: Remove the SIGINT handler
+    process.removeListener('SIGINT', sigintHandler)
+  }
 }
@@ -55,0 +64,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

29905

increased by0.86%

Lines of code

598

increased by1.36%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Dependency count

5

increased by25%

Dependency changes

• + Addedexeca@^5.1.1

• + Addedcross-spawn@7.0.6(transitive)

• + Addedexeca@5.1.1(transitive)

• + Addedget-stream@6.0.1(transitive)

• + Addedhuman-signals@2.1.0(transitive)

• + Addedisexe@2.0.0(transitive)

• + Addedmerge-stream@2.0.0(transitive)

• + Addedmimic-fn@2.1.0(transitive)

• + Addednpm-run-path@4.0.1(transitive)

• + Addedonetime@5.1.2(transitive)

• + Addedpath-key@3.1.1(transitive)

• + Addedshebang-command@2.0.0(transitive)

• + Addedshebang-regex@3.0.0(transitive)

• + Addedsignal-exit@3.0.7(transitive)

• + Addedstrip-final-newline@2.0.0(transitive)

• + Addedwhich@2.0.2(transitive)