@napi-rs/cli - npm Package Compare versions

Comparing version 3.6.0 to 3.6.1

package.json

 {
   "name": "@napi-rs/cli",
-  "version": "3.6.0",
+  "version": "3.6.1",
   "description": "Cli tools for napi-rs",
@@ -78,3 +78,3 @@ "author": "LongYinan <[e-mail]>",
     "@emnapi/runtime": "^1.9.1",
-    "@oxc-node/core": "^0.0.35",
+    "@oxc-node/core": "^0.1.0",
     "@std/toml": "npm:@jsr/std__toml@^1.0.11",
@@ -88,3 +88,3 @@ "@types/inquirer": "^9.0.9",
     "env-paths": "^4.0.0",
-    "oxc-parser": "^0.121.0",
+    "oxc-parser": "^0.124.0",
     "prettier": "^3.6.2",
@@ -91,0 +91,0 @@ "tsdown": "^0.21.0",

src/api/build.ts

@@ -384,31 +384,7 @@ import { spawn } from 'node:child_process'
       } else {
-        if (
-          this.target.platform === 'linux' &&
-          process.platform === 'linux' &&
-          this.target.arch === process.arch &&
-          (function (abi: string | null) {
-            const glibcVersionRuntime =
-              // @ts-expect-error
-              process.report?.getReport()?.header?.glibcVersionRuntime
-            const libc = glibcVersionRuntime ? 'gnu' : 'musl'
-            return abi === libc
-          })(this.target.abi)
-        ) {
-          debug.warn(
-            'You are trying to cross compile to linux target on linux platform which is unnecessary.',
-          )
-        } else if (
-          this.target.platform === 'darwin' &&
-          process.platform === 'darwin'
-        ) {
-          debug.warn(
-            'You are trying to cross compile to darwin target on darwin platform which is unnecessary.',
-          )
-        } else {
-          // use cargo-zigbuild to cross compile to other platforms
-          debug('Use %i', 'cargo-zigbuild')
-          tryInstallCargoBinary('cargo-zigbuild', 'zigbuild')
-          this.args.push('zigbuild')
-          set = true
-        }
+        // use cargo-zigbuild to cross compile to other platforms
+        debug('Use %i', 'cargo-zigbuild')
+        tryInstallCargoBinary('cargo-zigbuild', 'zigbuild')
+        this.args.push('zigbuild')
+        set = true
       }
@@ -415,0 +391,0 @@ }

src/api/create-npm-dirs.ts

@@ -28,2 +28,48 @@ import { createRequire } from 'node:module'
 
+const WASM_RUNTIME_PACKAGE_NAME = '@napi-rs/wasm-runtime'
+
+async function getLatestWasmRuntimeVersion() {
+  const npmRegistryBase =
+    process.env.npm_config_registry?.replace(/\/?$/, '/') ??
+    'https://registry.npmjs.org/'
+  const packageMetadataUrl = `${npmRegistryBase}${WASM_RUNTIME_PACKAGE_NAME}`
+  let response: Response
+
+  try {
+    response = await fetch(packageMetadataUrl)
+  } catch (error) {
+    throw new Error(
+      `Failed to fetch ${packageMetadataUrl} while resolving ${WASM_RUNTIME_PACKAGE_NAME}. Check your network connection and npm registry availability.`,
+      { cause: error },
+    )
+  }
+
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch ${packageMetadataUrl} while resolving ${WASM_RUNTIME_PACKAGE_NAME}: npm registry responded with ${response.status} ${response.statusText || 'Unknown Status'}`,
+    )
+  }
+
+  let packageMeta: PackageMeta
+
+  try {
+    packageMeta = (await response.json()) as PackageMeta
+  } catch (error) {
+    throw new Error(
+      `Failed to parse npm registry metadata for ${WASM_RUNTIME_PACKAGE_NAME} from ${packageMetadataUrl}`,
+      { cause: error },
+    )
+  }
+
+  const latestVersion = packageMeta['dist-tags']?.latest
+
+  if (typeof latestVersion !== 'string' || latestVersion.trim().length === 0) {
+    throw new Error(
+      `npm registry metadata for ${WASM_RUNTIME_PACKAGE_NAME} from ${packageMetadataUrl} did not include a latest dist-tag`,
+    )
+  }
+
+  return latestVersion.trim()
+}
+
 export async function createNpmDirs(userOptions: CreateNpmDirsOptions) {
@@ -64,2 +110,5 @@ const options = applyDefaultCreateNpmDirsOptions(userOptions)
     )
+  const wasmRuntimeVersion = targets.some((target) => target.arch === 'wasm32')
+    ? await getLatestWasmRuntimeVersion()
+    : undefined
 
@@ -131,7 +180,4 @@ for (const target of targets) {
       const emnapiVersion = require('emnapi/package.json').version
-      const wasmRuntime = await fetch(
-        `https://registry.npmjs.org/@napi-rs/wasm-runtime`,
-      ).then((res) => res.json() as Promise<PackageMeta>)
       scopedPackageJson.dependencies = {
-        '@napi-rs/wasm-runtime': `^${wasmRuntime['dist-tags'].latest}`,
+        '@napi-rs/wasm-runtime': `^${wasmRuntimeVersion}`,
         '@emnapi/core': emnapiVersion,
@@ -138,0 +184,0 @@ '@emnapi/runtime': emnapiVersion,

src/api/new.ts

@@ -37,20 +37,11 @@ import { exec, execSync } from 'node:child_process'
 async function checkGitCommand(): Promise<boolean> {
-  try {
-    await new Promise((resolve) => {
-      const cp = exec('git --version')
-      cp.on('error', () => {
-        resolve(false)
-      })
-      cp.on('exit', (code) => {
-        if (code === 0) {
-          resolve(true)
-        } else {
-          resolve(false)
-        }
-      })
+  return new Promise<boolean>((resolve) => {
+    const cp = exec('git --version')
+    cp.on('error', () => {
+      resolve(false)
     })
-    return true
-  } catch {
-    return false
-  }
+    cp.on('exit', (code) => {
+      resolve(code === 0)
+    })
+  })
 }
@@ -136,3 +127,3 @@
           entry.name.endsWith('.wasi.cjs') ||
-          entry.name.endsWith('wasi-worker.browser.mjs ') ||
+          entry.name.endsWith('wasi-worker-browser.mjs') ||
           entry.name.endsWith('wasi-worker.mjs') ||
@@ -139,0 +130,0 @@ entry.name.endsWith('browser.js'))

src/api/rename.ts

@@ -48,4 +48,12 @@ import { existsSync } from 'node:fs'
     const configData = JSON.parse(configContent)
-    configData.binaryName = options.binaryName
-    configData.packageName = options.packageName
+    merge(
+      configData,
+      omitBy(
+        {
+          binaryName: options.binaryName,
+          packageName: options.packageName,
+        },
+        isNil,
+      ),
+    )
     await writeFileAsync(configPath, JSON.stringify(configData, null, 2))
@@ -77,3 +85,3 @@ }
   await writeFileAsync(cargoTomlPath, updatedTomlContent)
-  if (oldName !== options.binaryName) {
+  if (options.binaryName && oldName !== options.binaryName) {
     const githubActionsPath = find.dir('.github', {
@@ -80,0 +88,0 @@ cwd: options.cwd,

src/utils/metadata.ts

@@ -65,3 +65,3 @@ import { spawn } from 'node:child_process'
   let status = 0
-  let error = null
+  let error: Error | null = null
 
@@ -76,2 +76,6 @@ childProcess.stdout.on('data', (data) => {
 
+  childProcess.on('error', (err) => {
+    error = err
+  })
+
   await new Promise<void>((resolve) => {
@@ -78,0 +82,0 @@ childProcess.on('close', (code) => {

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 22 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 21 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1927397

0.38%

Lines of code

17340

0.36%

Worsened metrics

Number of low supply chain risk alerts

222

1.83%

Number of medium supply chain risk alerts

28

40%

No dependency changes