@npmcli/arborist - npm Package Compare versions

Comparing version 1.0.5 to 1.0.6

lib/diff.js

@@ -9,2 +9,3 @@ // a tree representing the difference between two trees
 const {depth} = require('treeverse')
+const {existsSync} = require('fs')
 
@@ -41,4 +42,6 @@ const ssri = require('ssri')
 
-const getAction = ({actual, ideal}) =>
-  !ideal ? 'REMOVE'
+const getAction = ({actual, ideal}) => {
+  if (!ideal)
+    return 'REMOVE'
+
   // bundled meta-deps are copied over to the ideal tree when we visit it,
@@ -48,16 +51,24 @@ // so they'll appear to be missing here.  There's no need to handle them
   // Otherwise, add the missing node.
-  : !actual ? (ideal.inDepBundle ? null : 'ADD')
+  if (!actual)
+    return ideal.inDepBundle ? null : 'ADD'
+
   // always ignore the root node
-  : ideal.isRoot && actual.isRoot ||
+  if (ideal.isRoot && actual.isRoot)
+    return null
+
+  const binsExist = ideal.binPaths.every((path) => existsSync(path))
+
   // top nodes, links, and git deps won't have integrity, but do have resolved
-    !ideal.integrity && !actual.integrity &&
-      ideal.resolved === actual.resolved ||
+  if (!ideal.integrity && !actual.integrity && ideal.resolved === actual.resolved && binsExist)
+    return null
+
   // otherwise, verify that it's the same bits
   // note that if ideal has integrity, and resolved doesn't, we treat
   // that as a 'change', so that it gets re-fetched and locked down.
-    ideal.integrity &&
-    actual.integrity &&
-    ssri.parse(ideal.integrity).match(actual.integrity) ? null
-  : 'CHANGE'
+  if (!ideal.integrity || !actual.integrity || !ssri.parse(ideal.integrity).match(actual.integrity) || !binsExist)
+    return 'CHANGE'
 
+  return null
+}
+
 const allChildren = node => {
@@ -64,0 +75,0 @@ if (!node)

package.json

 {
   "name": "@npmcli/arborist",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Manage node_modules trees",
@@ -5,0 +5,0 @@ "dependencies": {

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

287038

increased by0.07%

Lines of code

6927

increased by0.07%

Worsened metrics

Number of low supply chain risk alerts

6

increased by20%

No dependency changes