@endo/module-source - npm Package Compare versions

Comparing version 1.3.3 to 1.4.0

package.json

 {
   "name": "@endo/module-source",
-  "version": "1.3.3",
+  "version": "1.4.0",
   "description": "Ponyfill for the SES ModuleSource and module-to-program transformer",
@@ -36,3 +36,3 @@ "keywords": [
     "postpack": "git clean -fX \"*.d.ts*\" \"*.d.cts*\" \"*.d.mts*\" \"*.tsbuildinfo\"",
-    "cover": "c8 ava",
+    "cover": "c8 ava --config test/_ava-ses.config.js",
     "lint": "yarn lint:types && yarn lint:eslint",
@@ -42,24 +42,21 @@ "lint:types": "tsc",
     "lint-fix": "eslint --fix .",
-    "test": "ava",
+    "test": "yarn run -T ses-ava",
+    "test:c8": "c8 ${C8_OPTIONS:-} yarn run -T ses-ava",
     "test:xs": "node scripts/generate-test-xs.js && xst tmp/test-xs.js"
   },
   "dependencies": {
-    "@babel/generator": "^7.26.3",
-    "@babel/parser": "~7.26.2",
-    "@babel/traverse": "~7.25.9",
-    "@babel/types": "~7.26.0",
-    "ses": "^1.14.0"
+    "@babel/generator": "^7.28.3",
+    "@babel/parser": "~7.28.3",
+    "@babel/traverse": "~7.28.3",
+    "@babel/types": "~7.28.2",
+    "@endo/harden": "^1.1.0",
+    "ses": "^1.15.0"
   },
   "devDependencies": {
-    "ava": "^6.1.3",
+    "ava": "catalog:dev",
     "babel-eslint": "^10.1.0",
     "benchmark": "^2.1.4",
-    "c8": "^7.14.0",
-    "eslint": "^8.57.1",
-    "eslint-config-airbnb-base": "^15.0.0",
-    "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-eslint-comments": "^3.2.0",
-    "eslint-plugin-import": "^2.31.0",
-    "prettier": "^3.5.3",
-    "typescript": "~5.8.3"
+    "c8": "catalog:dev",
+    "eslint": "catalog:dev",
+    "typescript": "~5.9.2"
   },
@@ -88,7 +85,6 @@ "files": [
   },
-  "ava": {
-    "files": [
-      "test/**/*.test.*"
-    ],
-    "timeout": "2m"
+  "sesAvaConfigs": {
+    "lockdown": "../../ava-endo-lockdown.config.mjs",
+    "unsafe": "../../ava-endo-lockdown-unsafe.config.mjs",
+    "ses": "../../ava-ses-shims-only.config.mjs"
   },
@@ -98,3 +94,3 @@ "typeCoverage": {
   },
-  "gitHead": "9815aea9541f241389d2135c6097a7442bdffa17"
+  "gitHead": "f91329e8616a19f131d009356a5f11ef11c839cc"
 }

src/module-source.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"module-source.d.ts","sourceRoot":"","sources":["module-source.js"],"names":[],"mappings":"AAmCA;;;;;;GAMG;AAEH;;;;GAIG;AAEH;;;;;;GAMG;AAKH;;;;;;;GAOG;AACH,qCAHW,MAAM,SACN,MAAM,GAAG,OAAO,QAqC1B;;IApED;;;;;;OAMG;IAEH;;;;OAIG;IAEH;;;;;;OAMG;IAKH;;;;;;;OAOG;IACH,oBAHW,MAAM,SACN,MAAM,GAAG,OAAO,EAqC1B;IAhBC,kBAAyC;IACzC,eAMC;IACD,mBAA+C;IAC/C,8BAA0C;IAC1C,uBAAsC;IACtC,qBAAkC;IAClC,wBAAwC;IACxC,yBAAkC;IAClC,6BAA0C;;;iBAhE9B,MAAM;YACN,MAAM;cACN,MAAM;YACN,MAAM;;wCAKT,MAAM,WACN,oBAAoB"}
+{"version":3,"file":"module-source.d.ts","sourceRoot":"","sources":["module-source.js"],"names":[],"mappings":"AAmCA;;;;;;GAMG;AAEH;;;;GAIG;AAEH;;;;;;GAMG;AAKH;;;;;;;GAOG;AACH,qCAHW,MAAM,SACN,MAAM,GAAG,OAAO,QAmD1B;;IAlFD;;;;;;OAMG;IAEH;;;;OAIG;IAEH;;;;;;OAMG;IAKH;;;;;;;OAOG;IACH,oBAHW,MAAM,SACN,MAAM,GAAG,OAAO,EAmD1B;IA9BC,kBAAyC;IACzC,eAQC;IACD,mBAA+C;IAC/C,8BAA0C;IAa1C,uBAA8C;IAC9C,qBAA0C;IAC1C,wBAAgD;IAChD,yBAAkC;IAClC,6BAA0C;;;iBA9E9B,MAAM;YACN,MAAM;cACN,MAAM;YACN,MAAM;;wCAKT,MAAM,WACN,oBAAoB"}

src/module-source.js

@@ -93,3 +93,5 @@ /* eslint no-underscore-dangle: ["off"] */
       ...keys(fixedExportMap),
-      ...values(reexportMap).flatMap(([_, exportName]) => exportName),
+      ...values(reexportMap)
+        .flat()
+        .map(([_, exportName]) => exportName),
     ].sort(),
@@ -99,5 +101,17 @@ );
   this.__syncModuleProgram__ = functorSource;
-  this.__liveExportMap__ = liveExportMap;
-  this.__reexportMap__ = reexportMap;
-  this.__fixedExportMap__ = fixedExportMap;
+  for (const entry of values(liveExportMap)) {
+    freeze(entry);
+  }
+  for (const entry of values(fixedExportMap)) {
+    freeze(entry);
+  }
+  for (const reexports of values(reexportMap)) {
+    for (const pair of reexports) {
+      freeze(pair);
+    }
+    freeze(reexports);
+  }
+  this.__liveExportMap__ = freeze(liveExportMap);
+  this.__reexportMap__ = freeze(reexportMap);
+  this.__fixedExportMap__ = freeze(fixedExportMap);
   this.__needsImport__ = needsImport;
@@ -136,1 +150,6 @@ this.__needsImportMeta__ = needsImportMeta;
 Object.setPrototypeOf(ModuleSource.prototype, AbstractModuleSource.prototype);
+
+freeze(AbstractModuleSource);
+freeze(AbstractModuleSource.prototype);
+freeze(ModuleSource.prototype);
+freeze(ModuleSource);

src/transform-analyze.js

@@ -186,5 +186,5 @@ // @ts-nocheck XXX Babel types
 
-      return harden({ ...ss, endowments, src: actualSource });
+      return { ...ss, endowments, src: actualSource };
     },
   };
 };

src/transform-source.d.ts

@@ -1,2 +0,2 @@
-export function makeTransformSource(makeModulePlugins: any, babel?: null): (source: any, sourceOptions?: {}) => string;
+export function makeTransformSource(makeModulePlugins: any, babel?: null): (source: any, sourceOptions?: {}) => any;
 //# sourceMappingURL=transform-source.d.ts.map

src/transform-source.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"transform-source.d.ts","sourceRoot":"","sources":["transform-source.js"],"names":[],"mappings":"AAeO,uHAmDN"}
+{"version":3,"file":"transform-source.d.ts","sourceRoot":"","sources":["transform-source.js"],"names":[],"mappings":"AAeO,oHAmDN"}

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

64364

0.78%

Dev dependency count

6

-45.45%

Lines of code

1162

1.57%

Worsened metrics

Dependency count

6

20%

Number of medium supply chain risk alerts

1

Infinity%

Dependency changes

• + Added

  @endo/harden@^1.1.0

• + Added

  @babel/helper-globals@7.28.0
  (transitive)

• + Added

  @babel/parser@7.28.6
  (transitive)

• + Added

  @babel/traverse@7.28.6
  (transitive)

• + Added

  @babel/types@7.28.6
  (transitive)

• + Added

  @endo/harden@1.1.0
  (transitive)

• - Removed

  @babel/parser@7.26.10
  (transitive)

• - Removed

  @babel/traverse@7.25.9
  (transitive)

• - Removed

  @babel/types@7.26.10
  (transitive)

• - Removed

  globals@11.12.0
  (transitive)

• Updated

  @babel/generator@^7.28.3

• Updated

  @babel/parser@~7.28.3

• Updated

  @babel/traverse@~7.28.3

• Updated

  @babel/types@~7.28.2

• Updated

  ses@^1.15.0