@microsoft/node-core-library - npm Package Compare versions

Comparing version 3.19.3 to 4.0.0

package.json

 {
   "name": "@microsoft/node-core-library",
-  "version": "3.19.3",
-  "description": "Core libraries that every NodeJS toolchain project should use",
-  "main": "lib/index.js",
-  "typings": "dist/node-core-library.d.ts",
+  "version": "4.0.0",
+  "description": "(Please use \"@rushstack/node-core-library\" instead.)",
   "license": "MIT",
-  "repository": {
-    "url": "https://github.com/microsoft/rushstack/tree/master/libraries/node-core-library"
-  },
   "scripts": {
-    "build": "gulp test --clean"
-  },
-  "dependencies": {
-    "@types/node": "10.17.13",
-    "colors": "~1.2.1",
-    "fs-extra": "~7.0.1",
-    "jju": "~1.4.0",
-    "semver": "~5.3.0",
-    "timsort": "~0.3.0",
-    "z-schema": "~3.18.3"
-  },
-  "devDependencies": {
-    "@microsoft/node-library-build": "6.3.11",
-    "@microsoft/rush-stack-compiler-3.5": "0.3.11",
-    "@rushstack/eslint-config": "0.5.4",
-    "@types/fs-extra": "5.0.4",
-    "@types/jest": "23.3.11",
-    "@types/jju": "1.4.1",
-    "@types/semver": "5.3.33",
-    "@types/timsort": "0.3.0",
-    "@types/z-schema": "3.16.31",
-    "gulp": "~4.0.2"
+    "postinstall": "node postinstall.js"
   }
 }

README.md

 # @microsoft/node-core-library
 
-This library provides a conservative set of "core" NodeJS utilities whose
-purpose is to standardize how we solve common problems across our tooling
-projects.  In order to be considered "core", the class must meet ALL of
-these criteria:
+> Please use [@rushstack/node-core-library](https://www.npmjs.com/package/@rushstack/node-core-library) instead of this package.
 
-- small and self-contained (i.e. quick to install)
+IMPORTANT: This package has moved under the `@rushstack` NPM scope.
 
-- solves a ubiquitous problem (i.e. having one standardized approach is better
-  than allowing each developer to use their favorite library)
+```
+  OLD NAME: @microsoft/node-core-library (3.19.3)
+  NEW NAME: @rushstack/node-core-library (3.19.4)
+```
 
-- broad enough applicability to justify imposing it as a dependency for
-  nearly every NodeJS project
+The new package's CHANGELOG.md preserves version history from before the rename.
 
-- code is design reviewed, API approved, and documented
+The new package starts with a SemVer PATCH increment, since no code has changed.
 
-Examples of "core" functionality that meets this criteria:
-
-- basic file/folder manipulation
-- JSON file loader/saver/validator
-- package.json parser
-- build performance timers
-- executing shell commands
-
-This package is NOT intended to be a dumping ground for arbitrary utilities
-that seem like they might be useful.  Code should start somewhere else, and
-then graduate to **node-core-library** after its value has already been
-demonstrated.  If in doubt, create your own NPM package.
-
-API documentation for this package: https://rushstack.io/pages/api/node-core-library/
+To learn about the Rush Stack project, please visit https://rushstack.io/`

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Install scripts

Supply chain risk

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

No repository

Supply chain risk

Package does not have a linked source code repository. Without this field, a package will have no reference to the location of the source code use to generate the package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances in 1 package

Improved metrics

Dependency count

0

decreased by-100%

Dev dependency count

0

decreased by-100%

Number of low supply chain risk alerts

1

decreased by-83.33%

Number of medium supply chain risk alerts

1

decreased by-50%

Worsened metrics

Total package byte prevSize

1614

decreased by-99.74%

Number of package files

3

decreased by-97.3%

Lines of code

17

decreased by-99.8%

Number of lines in readme file

17

decreased by-46.87%

Number of high supply chain risk alerts

1

increased byInfinity%

Dependency changes

• - Removed@types/node@10.17.13

• - Removedcolors@~1.2.1

• - Removedfs-extra@~7.0.1

• - Removedjju@~1.4.0

• - Removedsemver@~5.3.0

• - Removedtimsort@~0.3.0

• - Removedz-schema@~3.18.3

• - Removed@types/node@10.17.13(transitive)

• - Removedcolors@1.2.5(transitive)

• - Removedcommander@2.20.3(transitive)

• - Removedfs-extra@7.0.1(transitive)

• - Removedgraceful-fs@4.2.11(transitive)

• - Removedjju@1.4.0(transitive)

• - Removedjsonfile@4.0.0(transitive)

• - Removedlodash.get@4.4.2(transitive)

• - Removedlodash.isequal@4.5.0(transitive)

• - Removedsemver@5.3.0(transitive)

• - Removedtimsort@0.3.0(transitive)

• - Removeduniversalify@0.1.2(transitive)

• - Removedvalidator@8.2.0(transitive)

• - Removedz-schema@3.18.4(transitive)