@hashicorp/js-releases - npm Package Compare versions

Comparing version 1.2.1 to 1.3.0

package.json

 {
   "name": "@hashicorp/js-releases",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Download packages from releases.hashicorp.com",
@@ -11,3 +11,3 @@ "main": "./out/index.js",
     "test": "mocha",
-    "package": "npm run-script test && npm run-script compile"
+    "prepare": "npm run-script test && npm run-script compile"
   },
@@ -27,15 +27,15 @@ "repository": {
     "del": "^5.1.0",
-    "openpgp": "vordimous/openpgpjs",
-    "semver": "^7.3.2",
+    "openpgp": "git+https://[e-mail]/vordimous/openpgpjs.git#058265f3748b37b6e830e7e675cb28c8202aeded",
+    "semver": "^7.3.4",
     "yauzl": "^2.10.0"
   },
   "devDependencies": {
-    "@types/mocha": "^8.0.2",
+    "@types/mocha": "^8.2.0",
     "@types/node": "^12.12.54",
-    "@types/openpgp": "^4.4.12",
+    "@types/openpgp": "^4.4.15",
     "@types/yauzl": "^2.9.1",
     "mocha": "^8.1.1",
-    "ts-node": "^9.0.0",
-    "typescript": "^3.9.7"
+    "ts-node": "^9.1.1",
+    "typescript": "^4.1.3"
   }
 }

New alerts

Git dependency

Supply chain risk

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable and can be used to inject untrusted code or reduce the likelihood of a reproducible install.

Found 1 instance in 1 package

Fixed alerts

GitHub dependency

Supply chain risk

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

Found 1 instance in 1 package

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

31945

increased by0.54%

Number of medium supply chain risk alerts

2

decreased by-33.33%

Dependency changes

• Updatedopenpgp@git+https://[e-mail]/vordimous/openpgpjs.git#058265f3748b37b6e830e7e675cb28c8202aeded

• Updatedsemver@^7.3.4