@mapbox/node-pre-gyp - npm Package Compare versions

Comparing version 1.0.0 to 1.0.1

CHANGELOG.md

 # node-pre-gyp changelog
 
+## 1.0.1
+- Switched from mkdirp@1.0.4 to make-dir@3.1.0 to avoid this bug: https://github.com/isaacs/node-mkdirp/issues/31
+
 ## 1.0.0
@@ -4,0 +7,0 @@ - Module is now name-spaced at `@mapbox/node-pre-gyp` and the original `node-pre-gyp` is deprecated.

lib/install.js

@@ -13,3 +13,3 @@ 'use strict';
 const napi = require('./util/napi.js');
-const mkdirp = require('mkdirp');
+const makeDir = require('make-dir');
 // for fetching binaries
@@ -228,3 +228,3 @@ const url = require('url');
 
-      mkdirp(to).then(() => {
+      makeDir(to).then(() => {
         const fileName = from.startsWith('file://') && from.slice('file://'.length);
@@ -231,0 +231,0 @@ if (fileName) {

lib/package.js

@@ -13,3 +13,3 @@ 'use strict';
 const existsAsync = fs.exists || path.exists;
-const mkdirp = require('mkdirp');
+const makeDir = require('make-dir');
 const tar = require('tar');
@@ -53,3 +53,3 @@
     };
-    mkdirp(path.dirname(tarball)).then(() => {
+    makeDir(path.dirname(tarball)).then(() => {
       let files = readdirSync(from);
@@ -56,0 +56,0 @@ const base = path.basename(from);

lib/testpackage.js

@@ -15,3 +15,3 @@ 'use strict';
 const tar = require('tar');
-const mkdirp = require('mkdirp');
+const makeDir = require('make-dir');
 
@@ -32,3 +32,3 @@ function testpackage(gyp, argv, callback) {
 
-    mkdirp(to).then(() => {
+    makeDir(to).then(() => {
       tar.extract({
@@ -35,0 +35,0 @@ file: tarball,

lib/util/abi_crosswalk.json

@@ -1970,2 +1970,10 @@ {
   },
+  "10.23.3": {
+    "node_abi": 64,
+    "v8": "6.8"
+  },
+  "10.24.0": {
+    "node_abi": 64,
+    "v8": "6.8"
+  },
   "11.0.0": {
@@ -2183,2 +2191,10 @@ "node_abi": 67,
   },
+  "12.20.2": {
+    "node_abi": 72,
+    "v8": "7.8"
+  },
+  "12.21.0": {
+    "node_abi": 72,
+    "v8": "7.8"
+  },
   "13.0.0": {
@@ -2340,2 +2356,10 @@ "node_abi": 79,
   },
+  "14.15.5": {
+    "node_abi": 83,
+    "v8": "8.4"
+  },
+  "14.16.0": {
+    "node_abi": 83,
+    "v8": "8.4"
+  },
   "15.0.0": {
@@ -2388,3 +2412,15 @@ "node_abi": 88,
     "v8": "8.6"
+  },
+  "15.9.0": {
+    "node_abi": 88,
+    "v8": "8.6"
+  },
+  "15.10.0": {
+    "node_abi": 88,
+    "v8": "8.6"
+  },
+  "15.11.0": {
+    "node_abi": 88,
+    "v8": "8.6"
   }
 }

lib/util/versioning.js

@@ -312,3 +312,4 @@ 'use strict';
     // > npm install v8-profiler --profiler_binary_host_mirror=https://npm.taobao.org/mirrors/node-inspector/
-  const host = process.env['npm_config_' + opts.module_name + '_binary_host_mirror'] || package_json.binary.host;
+  const validModuleName = opts.module_name.replace('-', '_');
+  const host = process.env['npm_config_' + validModuleName + '_binary_host_mirror'] || package_json.binary.host;
   opts.host = fix_slashes(eval_template(host, opts));
@@ -315,0 +316,0 @@ opts.module_path = eval_template(package_json.binary.module_path, opts);

package.json

 {
   "name": "@mapbox/node-pre-gyp",
   "description": "Node.js native addon binary install tool",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "keywords": [
@@ -25,3 +25,3 @@ "native",
     "http-proxy-agent": "^4.0.1",
-    "mkdirp": "^1.0.4",
+    "make-dir": "^3.1.0",
     "node-fetch": "^2.6.1",
@@ -28,0 +28,0 @@ "nopt": "^5.0.0",

README.md

@@ -1,4 +0,4 @@
-# node-pre-gyp
+# @mapbox/node-pre-gyp
 
-#### node-pre-gyp makes it easy to publish and install Node.js C++ addons from binaries
+#### @mapbox/node-pre-gyp makes it easy to publish and install Node.js C++ addons from binaries
 
@@ -10,2 +10,11 @@ [![Build Status](https://travis-ci.com/mapbox/node-pre-gyp.svg?branch=master)](https://travis-ci.com/mapbox/node-pre-gyp)
 
+### Special note on previous package
+
+On Feb 9th, 2021 `@mapbox/node-pre-gyp@1.0.0` was [released](./CHANGELOG.md). Older, unscoped versions that are not part of the `@mapbox` org are deprecated and only `@mapbox/node-pre-gyp` will see updates going forward. To upgrade to the new package do:
+
+```
+npm uninstall node-pre-gyp --save
+npm install @mapbox/node-pre-gyp --save
+```
+
 ### Features
@@ -15,3 +24,3 @@
  - A variety of developer targeted commands for packaging, testing, and publishing binaries.
- - A JavaScript module that can dynamically require your installed binary: `require('node-pre-gyp').find`
+ - A JavaScript module that can dynamically require your installed binary: `require('@mapbox/node-pre-gyp').find`
 
@@ -220,3 +229,3 @@ For a hello world example of a module packaged with `node-pre-gyp` see <https://github.com/springmeyer/node-addon-example> and [the wiki ](https://github.com/mapbox/node-pre-gyp/wiki/Modules-using-node-pre-gyp) for real world examples.
 ```js
-var binary = require('node-pre-gyp');
+var binary = require('@mapbox/node-pre-gyp');
 var path = require('path');
@@ -430,24 +439,33 @@ var binding_path = binary.find(path.resolve(path.join(__dirname,'./package.json')));
 
-It is recommended to create a IAM user with a policy that only gives permissions to the specific bucket you plan to publish to. This can be done in the [IAM console](https://console.aws.amazon.com/iam/) by: 1) adding a new user, 2) choosing `Attach User Policy`, 3) Using the `Policy Generator`, 4) selecting `Amazon S3` for the service, 5) adding the actions: `DeleteObject`, `GetObject`, `GetObjectAcl`, `ListBucket`, `PutObject`, `PutObjectAcl`, 6) adding an ARN of `arn:aws:s3:::bucket/*` (replacing `bucket` with your bucket name), and finally 7) clicking `Add Statement` and saving the policy. It should generate a policy like:
+It is recommended to create a IAM user with a policy that only gives permissions to the specific bucket you plan to publish to. This can be done in the [IAM console](https://console.aws.amazon.com/iam/) by: 1) adding a new user, 2) choosing `Attach User Policy`, 3) Using the `Policy Generator`, 4) selecting `Amazon S3` for the service, 5) adding the actions: `DeleteObject`, `GetObject`, `GetObjectAcl`, `ListBucket`, `HeadBucket`, `PutObject`, `PutObjectAcl`, 6) adding an ARN of `arn:aws:s3:::bucket/*` (replacing `bucket` with your bucket name), and finally 7) clicking `Add Statement` and saving the policy. It should generate a policy like:
 
 ```js
 {
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Sid": "Stmt1394587197000",
-      "Effect": "Allow",
-      "Action": [
-        "s3:DeleteObject",
-        "s3:GetObject",
-        "s3:GetObjectAcl",
-        "s3:ListBucket",
-        "s3:PutObject",
-        "s3:PutObjectAcl"
-      ],
-      "Resource": [
-        "arn:aws:s3:::your-bucket-name/*"
-      ]
-    }
-  ]
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "objects",
+            "Effect": "Allow",
+            "Action": [
+                "s3:PutObject",
+                "s3:GetObjectAcl",
+                "s3:GetObject",
+                "s3:DeleteObject",
+                "s3:PutObjectAcl"
+            ],
+            "Resource": "arn:aws:s3:::your-bucket-name/*"
+        },
+        {
+            "Sid": "bucket",
+            "Effect": "Allow",
+            "Action": "s3:ListBucket",
+            "Resource": "arn:aws:s3:::your-bucket-name"
+        },
+        {
+            "Sid": "buckets",
+            "Effect": "Allow",
+            "Action": "s3:HeadBucket",
+            "Resource": "*"
+        }
+    ]
 }
@@ -696,3 +714,3 @@ ```
 
-Using the `npm` config argument: `--{module_name}_binary_host_mirror` can download binary files through a mirror.
+Using the `npm` config argument: `--{module_name}_binary_host_mirror` can download binary files through a mirror, `-` in `module_name` will be replaced with `_`.
 
@@ -704,1 +722,7 @@ e.g.: Install [v8-profiler](https://www.npmjs.com/package/v8-profiler) from `npm`.
 ```
+
+e.g.: Install [canvas-prebuilt](https://www.npmjs.com/package/canvas-prebuilt) from `npm`.
+
+```bash
+$ npm install canvas-prebuilt --canvas_prebuilt_binary_host_mirror=https://npm.taobao.org/mirrors/canvas-prebuilt/
+```

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

161571

increased by1.09%

Lines of code

4348

increased by0.86%

Number of lines in readme file

723

increased by3.43%

Worsened metrics

Number of medium supply chain risk alerts

4

increased by33.33%

Dependency changes

• + Addedmake-dir@^3.1.0

• + Addedmake-dir@3.1.0(transitive)

• + Addedsemver@6.3.1(transitive)

• - Removedmkdirp@^1.0.4