@heroku-cli/command - npm Package Compare versions

Comparing version 12.1.0 to 12.1.1-beta.0

lib/api-client.js

@@ -147,3 +147,3 @@ import { HTTP, HTTPError } from '@heroku/http-call';
                     }
-                    const isHerokuApi = ALLOWED_HEROKU_DOMAINS.some(domain => targetUrl.hostname.endsWith(`.${domain}`));
+                    const isHerokuApi = ALLOWED_HEROKU_DOMAINS.some(domain => targetUrl.hostname.endsWith(`.${domain}`) || targetUrl.hostname === domain);
                     const isLocalhost = LOCALHOST_DOMAINS.includes(targetUrl.hostname);
@@ -150,0 +150,0 @@ if (isHerokuApi || isLocalhost) {

lib/vars.js

@@ -68,5 +68,5 @@ import { ux } from '@oclif/core';
         const cleanHost = host.replace(/^https?:\/\//, '');
-        return ALLOWED_HEROKU_DOMAINS.some(domain => cleanHost.endsWith(`.${domain}`)) || LOCALHOST_DOMAINS.some(domain => cleanHost.includes(domain));
+        return ALLOWED_HEROKU_DOMAINS.some(domain => cleanHost.endsWith(`.${domain}`) || cleanHost === domain) || LOCALHOST_DOMAINS.some(domain => cleanHost.includes(domain));
     }
 }
 export const vars = new Vars();

package.json

 {
   "name": "@heroku-cli/command",
   "description": "base class for Heroku CLI commands",
-  "version": "12.1.0",
+  "version": "12.1.1-beta.0",
   "author": "Heroku",
@@ -69,3 +69,3 @@ "bugs": "https://github.com/heroku/heroku-cli-command/issues",
     "test": "nyc mocha --forbid-only \"test/**/*.test.ts\"",
-    "changelog": "conventional-changelog -p conventionalcommits -i CHANGELOG.md -s",
+    "changelog": "conventional-changelog -p conventionalcommits -i CHANGELOG.md -s -r 0",
     "example": "sh examples/run.sh"
@@ -72,0 +72,0 @@ },

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 2 instances in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 17 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 2 instances in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 17 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

75286

0.09%

Worsened metrics

Number of low quality alerts

1

Infinity%

Number of medium supply chain risk alerts

4

33.33%

No dependency changes