@npmcli/arborist - npm Package Compare versions

Comparing version 1.0.11 to 1.0.12

lib/arborist/load-actual.js

 // mix-in implementing the loadActual method
 
-const {relative, dirname, resolve, join} = require('path')
+const {relative, dirname, resolve, join, normalize} = require('path')
 
@@ -212,3 +212,3 @@ const rpj = require('read-package-json-fast')
       .then(([pkg, error]) => {
-        return this[path === real ? _newNode : _newLink]({
+        return this[normalize(path) === real ? _newNode : _newLink]({
           legacyPeerDeps: this.legacyPeerDeps,
@@ -215,0 +215,0 @@ path,

lib/dep-valid.js

@@ -115,3 +115,3 @@ // Do not rely on package._fields, so that we don't throw
   if (child.resolved)
-    return child.resolved === `file:${requested.fetchSpec}`
+    return child.resolved.replace(/\\/g, '/') === `file:${requested.fetchSpec.replace(/\\/g, '/')}`
 
@@ -118,0 +118,0 @@ // if we have a legacy mutated package.json file.  we can't be 100%

lib/node.js

@@ -116,4 +116,4 @@ // inventory, path, realpath, root, and parent
     // should be equal if not a link
-    this.path = path
-    this.realpath = !this.isLink ? this.path : realpath
+    this.path = path && resolve(path)
+    this.realpath = !this.isLink ? this.path : resolve(realpath)
 
@@ -120,0 +120,0 @@ this.resolved = resolved || null

lib/yarn-lock.js

@@ -82,3 +82,3 @@ // parse a yarn lock file
     this.current = null
-    const linere = /([^\n]*)\n/gm
+    const linere = /([^\r\n]*)\r?\n/gm
     let match
@@ -85,0 +85,0 @@ let lineNum = 0

package.json

 {
   "name": "@npmcli/arborist",
-  "version": "1.0.11",
+  "version": "1.0.12",
   "description": "Manage node_modules trees",
@@ -12,3 +12,3 @@ "dependencies": {
     "@npmcli/node-gyp": "^1.0.0",
-    "@npmcli/run-script": "^1.7.2",
+    "@npmcli/run-script": "^1.8.0",
     "bin-links": "^2.2.1",
@@ -42,3 +42,3 @@ "cacache": "^15.0.3",
     "require-inject": "^1.4.4",
-    "tap": "^14.10.7",
+    "tap": "^14.11.0",
     "tcompare": "^3.0.4"
@@ -45,0 +45,0 @@ },

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

292231

increased by0.03%

Worsened metrics

Number of medium supply chain risk alerts

3

increased by50%

Dependency changes

• Updated@npmcli/run-script@^1.8.0