Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More →
Socket
Sign inDemoInstall
Socket
Sign inDemoInstall

@npmcli/arborist

Package Overview
Dependencies
Maintainers
5
Versions
193
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@npmcli/arborist - npm Package Compare versions

Comparing version 6.0.0-pre.4 to 6.0.0-pre.5

3

bin/lib/logging.js
const log = require('proc-log')
const mkdirp = require('mkdirp')
const fs = require('fs')

@@ -73,3 +72,3 @@ const { dirname } = require('path')

log.silly('logfile', options.logfile)
mkdirp.sync(dirname(options.logfile))
fs.mkdirSync(dirname(options.logfile), { recursive: true })
const fd = fs.openSync(options.logfile, 'a')

@@ -76,0 +75,0 @@ addLogListener((str) => fs.writeSync(fd, str))

4

lib/add-rm-pkg-deps.js

@@ -38,4 +38,4 @@ // add and remove dependency specs to/from pkg manifest

pkg[depType] = pkg[depType] || {}
if (rawSpec !== '' || pkg[depType][name] === undefined) {
pkg[depType][name] = rawSpec || '*'
if (rawSpec !== '*' || pkg[depType][name] === undefined) {
pkg[depType][name] = rawSpec
}

@@ -42,0 +42,0 @@ if (addSaveType === 'optional') {

23

lib/arborist/build-ideal-tree.js

@@ -13,5 +13,3 @@ // mixin implementing the buildIdealTree method

const readdir = promisify(require('readdir-scoped-modules'))
const fs = require('fs')
const lstat = promisify(fs.lstat)
const readlink = promisify(fs.readlink)
const { lstat, readlink } = require('fs/promises')
const { depth } = require('treeverse')

@@ -52,3 +50,2 @@ const log = require('proc-log')

const _preferDedupe = Symbol('preferDedupe')
const _legacyBundling = Symbol('legacyBundling')
const _parseSettings = Symbol('parseSettings')

@@ -84,3 +81,3 @@ const _initTree = Symbol('initTree')

const _follow = Symbol('follow')
const _globalStyle = Symbol('globalStyle')
const _installStrategy = Symbol('installStrategy')
const _globalRootNode = Symbol('globalRootNode')

@@ -120,3 +117,3 @@ const _usePackageLock = Symbol.for('usePackageLock')

global = false,
globalStyle = false,
installStrategy = 'hoisted',
idealTree = null,

@@ -141,3 +138,3 @@ includeWorkspaceRoot = false,

this[_global] = !!global
this[_globalStyle] = this[_global] || globalStyle
this[_installStrategy] = global ? 'shallow' : installStrategy
this[_follow] = !!follow

@@ -151,3 +148,2 @@

this[_preferDedupe] = false
this[_legacyBundling] = false
this[_depsSeen] = new Set()

@@ -261,3 +257,2 @@ this[_depsQueue] = []

this[_preferDedupe] = !!options.preferDedupe
this[_legacyBundling] = !!options.legacyBundling

@@ -269,9 +264,8 @@ // validates list of update names, they must

const validationError =
new TypeError(`Update arguments must not contain package version specifiers
Try using the package name instead, e.g:
new TypeError(`Update arguments must only contain package names, eg:
npm update ${spec.name}`)
validationError.code = 'EUPDATEARGS'
if (spec.fetchSpec !== 'latest') {
// If they gave us anything other than a bare package name
if (spec.raw !== spec.name) {
throw validationError

@@ -963,7 +957,6 @@ }

preferDedupe: this[_preferDedupe],
legacyBundling: this[_legacyBundling],
strictPeerDeps: this[_strictPeerDeps],
installLinks: this.installLinks,
legacyPeerDeps: this.legacyPeerDeps,
globalStyle: this[_globalStyle],
installStrategy: this[_installStrategy],
}))

@@ -970,0 +963,0 @@

1

lib/arborist/index.js

@@ -79,2 +79,3 @@ // The arborist manages three trees:

lockfileVersion: lockfileVersion(options.lockfileVersion),
installStrategy: options.global ? 'shallow' : (options.installStrategy ? options.installStrategy : 'hoisted'),
}

@@ -81,0 +82,0 @@ this.replaceRegistryHost = this.options.replaceRegistryHost =

42

lib/arborist/reify.js

@@ -15,10 +15,9 @@ // mixin implementing the reify method

const { depth: dfwalk } = require('treeverse')
const fs = require('fs')
const { promisify } = require('util')
const lstat = promisify(fs.lstat)
const symlink = promisify(fs.symlink)
const mkdirp = require('mkdirp-infer-owner')
const justMkdirp = require('mkdirp')
const {
lstat,
mkdir,
rm,
symlink,
} = require('fs/promises')
const moveFile = require('@npmcli/move-file')
const rimraf = promisify(require('rimraf'))
const PackageJson = require('@npmcli/package-json')

@@ -179,3 +178,3 @@ const packageContents = require('@npmcli/installed-package-contents')

// in a project directory. We just want to make it if it's missing.
await justMkdirp(resolve(this.path))
await mkdir(resolve(this.path), { recursive: true })

@@ -438,6 +437,6 @@ // do not allow the top-level node_modules to be a symlink

if (er.code === 'ENOENT') {
return didMkdirp ? null : mkdirp(dirname(to)).then(() =>
return didMkdirp ? null : mkdir(dirname(to), { recursive: true }).then(() =>
this[_renamePath](from, to, true))
} else if (er.code === 'EEXIST') {
return rimraf(to).then(() => moveFile(from, to))
return rm(to, { recursive: true, force: true }).then(() => moveFile(from, to))
} else {

@@ -524,3 +523,3 @@ throw er

}
const made = await mkdirp(node.path)
const made = await mkdir(node.path, { recursive: true })
this[_sparseTreeDirs].add(node.path)

@@ -540,3 +539,3 @@ this[_sparseTreeRoots].add(made)

const unlinks = targets
.map(path => rimraf(path).catch(er => failures.push([path, er])))
.map(path => rm(path, { recursive: true, force: true }).catch(er => failures.push([path, er])))
return promiseAllRejectLate(unlinks).then(() => {

@@ -638,3 +637,3 @@ // eslint-disable-next-line promise/always-return

log.warn('reify', 'Removing non-directory', nm)
await rimraf(nm)
await rm(nm, { recursive: true, force: true })
}

@@ -673,3 +672,3 @@

if (node.isLink) {
await rimraf(node.path)
await rm(node.path, { recursive: true, force: true })
await this[_symlink](node)

@@ -700,3 +699,3 @@ } else {

const rel = relative(dir, target)
await mkdirp(dir)
await mkdir(dir, { recursive: true })
return symlink(rel, node.path, 'junction')

@@ -964,3 +963,3 @@ }

// The sparse tree has already been created, so we walk the diff
// kicking off each unpack job. If any fail, we rimraf the sparse
// kicking off each unpack job. If any fail, we rm the sparse
// tree entirely and try to put everything back where it was.

@@ -1046,3 +1045,4 @@ [_unpackNewModules] () {

if (node.isLink) {
return mkdirp(dirname(node.path)).then(() => this[_reifyNode](node))
return mkdir(dirname(node.path), { recursive: true, force: true })
.then(() => this[_reifyNode](node))
}

@@ -1063,3 +1063,3 @@

const dir = bd && bd.length ? node.path + '/node_modules' : node.path
return mkdirp(dir).then(() => this[_moveContents](node, fromPath))
return mkdir(dir, { recursive: true }).then(() => this[_moveContents](node, fromPath))
}))

@@ -1138,3 +1138,3 @@ }))

// If this fails, there isn't much we can do but tell the user about it.
// Thankfully, it's pretty unlikely that it'll fail, since rimraf is a tank.
// Thankfully, it's pretty unlikely that it'll fail, since rm is a node builtin.
async [_removeTrash] () {

@@ -1144,6 +1144,6 @@ process.emit('time', 'reify:trash')

const failures = []
const rm = path => rimraf(path).catch(er => failures.push([path, er]))
const _rm = path => rm(path, { recursive: true, force: true }).catch(er => failures.push([path, er]))
for (const path of this[_trashList]) {
promises.push(rm(path))
promises.push(_rm(path))
}

@@ -1150,0 +1150,0 @@

28

lib/consistent-resolve.js

@@ -22,13 +22,19 @@ // take a path and a resolved value, and turn it into a resolution from

} = npa(resolved, fromPath)
const isPath = type === 'file' || type === 'directory'
return isPath && !relPaths ? `file:${fetchSpec.replace(/#/g, '%23')}`
: isPath ? 'file:' + (toPath ? relpath(toPath, fetchSpec.replace(/#/g, '%23')) : fetchSpec.replace(/#/g, '%23'))
: hosted ? `git+${
hosted.auth ? hosted.https(hostedOpt) : hosted.sshurl(hostedOpt)
}`
: type === 'git' ? saveSpec
// always return something. 'foo' is interpreted as 'foo@' otherwise.
: rawSpec === '' && raw.slice(-1) !== '@' ? raw
// just strip off the name, but otherwise return as-is
: rawSpec
if (type === 'file' || type === 'directory') {
const cleanFetchSpec = fetchSpec.replace(/#/g, '%23')
if (relPaths && toPath) {
return `file:${relpath(toPath, cleanFetchSpec)}`
}
return `file:${cleanFetchSpec}`
}
if (hosted) {
return `git+${hosted.auth ? hosted.https(hostedOpt) : hosted.sshurl(hostedOpt)}`
}
if (type === 'git') {
return saveSpec
}
if (rawSpec === '*') {
return raw
}
return rawSpec
} catch (_) {

@@ -35,0 +41,0 @@ // whatever we passed in was not acceptable to npa.

2

lib/edge.js

@@ -169,3 +169,3 @@ // An edge in the dependency graph

get spec () {
if (this.overrides && this.overrides.value && this.overrides.name === this.name) {
if (this.overrides?.value && this.overrides.value !== '*' && this.overrides.name === this.name) {
if (this.overrides.value.startsWith('$')) {

@@ -172,0 +172,0 @@ const ref = this.overrides.value.slice(1)

11

lib/override-set.js

@@ -28,3 +28,3 @@ const npa = require('npm-package-arg')

this.key = key
this.keySpec = spec.rawSpec === '' ? '' : spec.toString()
this.keySpec = spec.toString()
this.value = overrides['.'] || this.keySpec

@@ -54,4 +54,3 @@ }

if (rule.keySpec === '' ||
semver.intersects(edge.spec, rule.keySpec)) {
if (semver.intersects(edge.spec, rule.keySpec)) {
return rule

@@ -70,4 +69,3 @@ }

if (rule.keySpec === '' ||
semver.satisfies(node.version, rule.keySpec) ||
if (semver.satisfies(node.version, rule.keySpec) ||
semver.satisfies(node.version, rule.value)) {

@@ -87,4 +85,3 @@ return rule

if (rule.keySpec === '' ||
semver.satisfies(node.version, rule.keySpec) ||
if (semver.satisfies(node.version, rule.keySpec) ||
semver.satisfies(node.version, rule.value)) {

@@ -91,0 +88,0 @@ return rule

15

lib/place-dep.js

@@ -46,7 +46,6 @@ // Given a dep, a node that depends on it, and the edge representing that

auditReport,
legacyBundling,
strictPeerDeps,
installLinks,
legacyPeerDeps,
globalStyle,
installStrategy,
} = parent || options

@@ -59,7 +58,6 @@ Object.assign(this, {

auditReport,
legacyBundling,
strictPeerDeps,
installLinks,
installStrategy,
legacyPeerDeps,
globalStyle,
})

@@ -83,6 +81,5 @@

preferDedupe,
globalStyle,
legacyBundling,
explicitRequest,
updateNames,
installStrategy,
checks,

@@ -176,3 +173,3 @@ } = this

// very disk-inefficient
if (legacyBundling) {
if (installStrategy === 'nested') {
break

@@ -183,3 +180,3 @@ }

// deps above the first level.
if (globalStyle) {
if (installStrategy === 'shallow') {
const rp = target.resolveParent

@@ -471,3 +468,3 @@ if (rp && rp.isProjectRoot) {

// is another satisfying node further up the tree, and if so, dedupes.
// Even in legacyBundling mode, we do this amount of deduplication.
// Even in installStategy is nested, we do this amount of deduplication.
pruneDedupable (node, descend = true) {

@@ -474,0 +471,0 @@ if (node.canDedupe(this.preferDedupe)) {

8

lib/query-selector-all.js

@@ -123,9 +123,9 @@ 'use strict'

// name selectors (i.e. #foo, #foo@1.0.0)
// name selectors (i.e. #foo)
// css calls this id, we interpret it as name
idType () {
const spec = npa(this.currentAstNode.value)
const name = this.currentAstNode.value
const nextResults = this.initialItems.filter(node =>
(node.name === spec.name || node.package.name === spec.name) &&
(semver.satisfies(node.version, spec.fetchSpec) || !spec.rawSpec))
(name === node.name) || (name === node.package.name)
)
this.processPendingCombinator(nextResults)

@@ -132,0 +132,0 @@ }

5

lib/realpath.js

@@ -8,6 +8,3 @@ // look up the realpath, but cache stats to minimize overhead

const fs = require('fs')
const promisify = require('util').promisify
const readlink = promisify(fs.readlink)
const lstat = promisify(fs.lstat)
const { lstat, readlink } = require('fs/promises')
const { resolve, basename, dirname } = require('path')

@@ -14,0 +11,0 @@

34

lib/shrinkwrap.js

@@ -38,27 +38,11 @@ // a module that manages a shrinkwrap file (npm-shrinkwrap.json or

const YarnLock = require('./yarn-lock.js')
const { promisify } = require('util')
const rimraf = promisify(require('rimraf'))
const fs = require('fs')
const readFile = promisify(fs.readFile)
const writeFile = promisify(fs.writeFile)
const stat = promisify(fs.stat)
const readdir_ = promisify(fs.readdir)
const readlink = promisify(fs.readlink)
const {
readFile,
readdir,
readlink,
rm,
stat,
writeFile,
} = require('fs/promises')
// XXX remove when drop support for node v10
const lstat = promisify(fs.lstat)
/* istanbul ignore next - version specific polyfill */
const readdir = async (path, opt) => {
if (!opt || !opt.withFileTypes) {
return readdir_(path, opt)
}
const ents = await readdir_(path, opt)
if (typeof ents[0] === 'string') {
return Promise.all(ents.map(async ent => {
return Object.assign(await lstat(path + '/' + ent), { name: ent })
}))
}
return ents
}
const { resolve, basename, relative } = require('path')

@@ -1157,3 +1141,3 @@ const specFromLock = require('./spec-from-lock.js')

// failed to update the file for some reason, it's not out of sync.
return rimraf(this.filename)
return rm(this.filename, { recursive: true, force: true })
}

@@ -1160,0 +1144,0 @@ throw er

55

package.json
{
"name": "@npmcli/arborist",
"version": "6.0.0-pre.4",
"version": "6.0.0-pre.5",
"description": "Manage node_modules trees",
"dependencies": {
"@isaacs/string-locale-compare": "^1.1.0",
"@npmcli/installed-package-contents": "^1.0.7",
"@npmcli/map-workspaces": "^2.0.3",
"@npmcli/metavuln-calculator": "^4.0.0",
"@npmcli/move-file": "^2.0.0",
"@npmcli/installed-package-contents": "^2.0.0",
"@npmcli/map-workspaces": "^3.0.0",
"@npmcli/metavuln-calculator": "^5.0.0",
"@npmcli/move-file": "^3.0.0",
"@npmcli/name-from-folder": "^1.0.1",
"@npmcli/node-gyp": "^2.0.0",
"@npmcli/package-json": "^2.0.0",
"@npmcli/query": "^2.0.0",
"@npmcli/run-script": "^4.1.3",
"bin-links": "^3.0.3",
"cacache": "^16.1.3",
"@npmcli/node-gyp": "^3.0.0",
"@npmcli/package-json": "^3.0.0",
"@npmcli/query": "^3.0.0",
"@npmcli/run-script": "^5.0.0",
"bin-links": "^4.0.1",
"cacache": "^17.0.1",
"common-ancestor-path": "^1.0.1",
"json-parse-even-better-errors": "^2.3.1",
"json-parse-even-better-errors": "^3.0.0",
"json-stringify-nice": "^1.1.4",
"minimatch": "^5.1.0",
"mkdirp": "^1.0.4",
"mkdirp-infer-owner": "^2.0.0",
"nopt": "^6.0.0",
"npm-install-checks": "^5.0.0",
"npm-package-arg": "^9.0.0",
"npm-pick-manifest": "^7.0.2",
"npm-registry-fetch": "^13.0.0",
"npmlog": "^6.0.2",
"pacote": "^14.0.0",
"parse-conflict-json": "^2.0.1",
"proc-log": "^2.0.0",
"npm-install-checks": "^6.0.0",
"npm-package-arg": "^10.0.0",
"npm-pick-manifest": "^8.0.1",
"npm-registry-fetch": "^14.0.2",
"npmlog": "^7.0.1",
"pacote": "^15.0.2",
"parse-conflict-json": "^3.0.0",
"proc-log": "^3.0.0",
"promise-all-reject-late": "^1.0.0",
"promise-call-limit": "^1.0.1",
"read-package-json-fast": "^2.0.2",
"read-package-json-fast": "^3.0.1",
"readdir-scoped-modules": "^1.1.0",
"rimraf": "^3.0.2",
"semver": "^7.3.7",
"ssri": "^9.0.0",
"treeverse": "^2.0.0",
"ssri": "^10.0.0",
"treeverse": "^3.0.0",
"walk-up-path": "^1.0.0"
},
"devDependencies": {
"@npmcli/eslint-config": "^3.1.0",
"@npmcli/template-oss": "4.5.0",
"@npmcli/eslint-config": "^4.0.0",
"@npmcli/template-oss": "4.6.2",
"benchmark": "^2.1.4",

@@ -107,5 +104,5 @@ "chalk": "^4.1.0",

"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
"version": "4.5.0",
"version": "4.6.2",
"content": "../../scripts/template-oss/index.js"
}
}
SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

About

Packages

npm

Go

Maven

PyPI

Rubygems

Stay in touch

Get open source security insights delivered straight into your inbox.

  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc