Socket
Socket
Sign inDemoInstall

@npmcli/arborist

Package Overview
Dependencies
Maintainers
6
Versions
193
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@npmcli/arborist - npm Package Compare versions

Comparing version 5.0.6 to 5.1.0

22

lib/arborist/build-ideal-tree.js

@@ -127,2 +127,3 @@ // mixin implementing the buildIdealTree method

includeWorkspaceRoot = false,
installLinks = false,
legacyPeerDeps = false,

@@ -139,2 +140,3 @@ packageLock = true,

this.idealTree = idealTree
this.installLinks = installLinks
this.legacyPeerDeps = legacyPeerDeps

@@ -415,2 +417,3 @@

global: this[_global],
installLinks: this.installLinks,
legacyPeerDeps: this.legacyPeerDeps,

@@ -430,2 +433,3 @@ loadOverrides: true,

global: this[_global],
installLinks: this.installLinks,
legacyPeerDeps: this.legacyPeerDeps,

@@ -999,2 +1003,3 @@ root,

strictPeerDeps: this[_strictPeerDeps],
installLinks: this.installLinks,
legacyPeerDeps: this.legacyPeerDeps,

@@ -1159,2 +1164,3 @@ globalStyle: this[_globalStyle],

sourceReference: node,
installLinks: this.installLinks,
legacyPeerDeps: this.legacyPeerDeps,

@@ -1277,6 +1283,7 @@ overrides: node.overrides,

// might be within another package that doesn't exist yet.
const { legacyPeerDeps } = this
const { installLinks, legacyPeerDeps } = this
const isWorkspace = this.idealTree.workspaces && this.idealTree.workspaces.has(spec.name)
// spec is a directory, link it
if (spec.type === 'directory') {
// spec is a directory, link it unless installLinks is set or it's a workspace
if (spec.type === 'directory' && (isWorkspace || !installLinks)) {
return this[_linkFromSpec](name, spec, parent, edge)

@@ -1288,3 +1295,3 @@ }

// takes priority.
if (this.idealTree.workspaces && this.idealTree.workspaces.has(spec.name)) {
if (isWorkspace) {
const existingNode = this.idealTree.edgesOut.get(spec.name).to

@@ -1299,3 +1306,3 @@ if (existingNode && existingNode.isWorkspace && existingNode.satisfies(edge)) {

return this[_fetchManifest](spec)
.then(pkg => new Node({ name, pkg, parent, legacyPeerDeps }), error => {
.then(pkg => new Node({ name, pkg, parent, installLinks, legacyPeerDeps }), error => {
error.requiredBy = edge.from.location || '.'

@@ -1310,2 +1317,3 @@

error,
installLinks,
legacyPeerDeps,

@@ -1320,5 +1328,5 @@ })

const realpath = spec.fetchSpec
const { legacyPeerDeps } = this
const { installLinks, legacyPeerDeps } = this
return rpj(realpath + '/package.json').catch(() => ({})).then(pkg => {
const link = new Link({ name, parent, realpath, pkg, legacyPeerDeps })
const link = new Link({ name, parent, realpath, pkg, installLinks, legacyPeerDeps })
this[_linkNodes].add(link)

@@ -1325,0 +1333,0 @@ return link

@@ -286,2 +286,3 @@ // mix-in implementing the loadActual method

return this[normalize(path) === real ? _newNode : _newLink]({
installLinks: this.installLinks,
legacyPeerDeps: this.legacyPeerDeps,

@@ -288,0 +289,0 @@ path,

@@ -281,2 +281,3 @@ // mixin providing the loadVirtual method

const node = new Node({
installLinks: this.installLinks,
legacyPeerDeps: this.legacyPeerDeps,

@@ -308,2 +309,3 @@ root: this.virtualTree,

const link = new Link({
installLinks: this.installLinks,
legacyPeerDeps: this.legacyPeerDeps,

@@ -310,0 +312,0 @@ path,

@@ -56,5 +56,3 @@ // Do not rely on package._fields, so that we don't throw

case 'directory':
// directory must be a link to the specified folder
return !!child.isLink &&
relative(child.realpath, requested.fetchSpec) === ''
return linkValid(child, requested, requestor)

@@ -112,2 +110,14 @@ case 'file':

const linkValid = (child, requested, requestor) => {
const isLink = !!child.isLink
// if we're installing links and the node is a link, then it's invalid because we want
// a real node to be there
if (requestor.installLinks) {
return !isLink
}
// directory must be a link to the specified folder
return isLink && relative(child.realpath, requested.fetchSpec) === ''
}
const tarballValid = (child, requested, requestor) => {

@@ -114,0 +124,0 @@ if (child.isLink) {

@@ -89,2 +89,3 @@ // inventory, path, realpath, root, and parent

fsChildren,
installLinks = false,
legacyPeerDeps = false,

@@ -156,2 +157,3 @@ linksIn,

this.hasShrinkwrap = hasShrinkwrap || pkg._hasShrinkwrap || false
this.installLinks = installLinks
this.legacyPeerDeps = legacyPeerDeps

@@ -1154,2 +1156,5 @@

}
if (node.isLink && node.target) {
node.target.root = null
}
}

@@ -1156,0 +1161,0 @@

@@ -48,2 +48,3 @@ // Given a dep, a node that depends on it, and the edge representing that

strictPeerDeps,
installLinks,
legacyPeerDeps,

@@ -60,2 +61,3 @@ globalStyle,

strictPeerDeps,
installLinks,
legacyPeerDeps,

@@ -298,2 +300,3 @@ globalStyle,

integrity: dep.integrity,
installLinks: this.installLinks,
legacyPeerDeps: this.legacyPeerDeps,

@@ -300,0 +303,0 @@ error: dep.errors[0],

{
"name": "@npmcli/arborist",
"version": "5.0.6",
"version": "5.1.0",
"description": "Manage node_modules trees",

@@ -5,0 +5,0 @@ "dependencies": {

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc