Socket
Socket
Sign inDemoInstall

@npmcli/arborist

Package Overview
Dependencies
139
Maintainers
5
Versions
189
Alerts
File Explorer

Advanced tools

npm Scripts

Install Socket

Detect and block malicious and high-risk dependencies

Install

Comparing version 7.4.2 to 7.5.0

9

bin/index.js

@@ -5,2 +5,3 @@ #!/usr/bin/env node

const path = require('path')
const { time } = require('proc-log')

@@ -76,7 +77,7 @@ const { bin, arb: options } = require('./lib/options')

process.emit('time', totalTime)
process.emit('time', scriptTime)
const timeEnd = time.start(totalTime)
const scriptEnd = time.start(scriptTime)
return command(options, (result) => {
process.emit('timeEnd', scriptTime)
scriptEnd()
return {

@@ -100,3 +101,3 @@ result,

.then((r) => {
process.emit('timeEnd', totalTime)
timeEnd()
if (bin.loglevel !== 'silent') {

@@ -103,0 +104,0 @@ console[process.exitCode ? 'error' : 'log'](r)

2

bin/lib/logging.js

@@ -1,2 +0,2 @@

const log = require('proc-log')
const { log } = require('proc-log')
const fs = require('fs')

@@ -3,0 +3,0 @@ const { dirname } = require('path')

32

bin/lib/timers.js

@@ -7,21 +7,21 @@ const { bin: options } = require('./options.js')

process.on('time', name => {
if (timers.has(name)) {
throw new Error('conflicting timer! ' + name)
process.on('time', (level, name) => {
if (level === 'start') {
if (timers.has(name)) {
throw new Error('conflicting timer! ' + name)
}
timers.set(name, process.hrtime.bigint())
} else if (level === 'end') {
if (!timers.has(name)) {
throw new Error('timer not started! ' + name)
}
const elapsed = Number(process.hrtime.bigint() - timers.get(name))
timers.delete(name)
finished.set(name, elapsed)
if (options.timing) {
log.info('timeEnd', `${name} ${elapsed / 1e9}s`, log.meta({ force: options.timing === 'always' }))
}
}
timers.set(name, process.hrtime.bigint())
})
process.on('timeEnd', name => {
if (!timers.has(name)) {
throw new Error('timer not started! ' + name)
}
const elapsed = Number(process.hrtime.bigint() - timers.get(name))
timers.delete(name)
finished.set(name, elapsed)
if (options.timing) {
log.info('timeEnd', `${name} ${elapsed / 1e9}s`, log.meta({ force: options.timing === 'always' }))
}
})
process.on('exit', () => {

@@ -28,0 +28,0 @@ for (const name of timers.keys()) {

2

lib/add-rm-pkg-deps.js
// add and remove dependency specs to/from pkg manifest
const log = require('proc-log')
const { log } = require('proc-log')
const localeCompare = require('@isaacs/string-locale-compare')('en')

@@ -5,0 +5,0 @@

31

lib/arborist/build-ideal-tree.js

@@ -14,3 +14,3 @@ // mixin implementing the buildIdealTree method

const { depth } = require('treeverse')
const log = require('proc-log')
const { log, time } = require('proc-log')
const { redact } = require('@npmcli/redact')

@@ -183,3 +183,3 @@

process.emit('time', 'idealTree')
const timeEnd = time.start('idealTree')

@@ -210,3 +210,3 @@ if (!options.add && !options.rm && !options.update && this.options.global) {

} finally {
process.emit('timeEnd', 'idealTree')
timeEnd()
this.finishTracker('idealTree')

@@ -284,3 +284,3 @@ }

async #initTree () {
process.emit('time', 'idealTree:init')
const timeEnd = time.start('idealTree:init')
let root

@@ -363,3 +363,3 @@ if (this.options.global) {

this.virtualTree = null
process.emit('timeEnd', 'idealTree:init')
timeEnd()
return tree

@@ -428,3 +428,3 @@ })

async #applyUserRequests (options) {
process.emit('time', 'idealTree:userRequests')
const timeEnd = time.start('idealTree:userRequests')
const tree = this.idealTree.target

@@ -445,3 +445,3 @@

process.emit('timeEnd', 'idealTree:userRequests')
timeEnd()
}

@@ -701,3 +701,3 @@

// least it's just a one-time hit.
process.emit('time', 'idealTree:inflate')
const timeEnd = time.start('idealTree:inflate')

@@ -769,3 +769,3 @@ // don't warn if we're not gonna actually write it back anyway.

this.finishTracker('idealTree:inflate')
process.emit('timeEnd', 'idealTree:inflate')
timeEnd()
}

@@ -777,3 +777,3 @@

#buildDeps () {
process.emit('time', 'idealTree:buildDeps')
const timeEnd = time.start('idealTree:buildDeps')
const tree = this.idealTree.target

@@ -786,4 +786,3 @@ tree.assertRootOverrides()

this.addTracker('idealTree', tree.name, '')
return this.#buildDepStep()
.then(() => process.emit('timeEnd', 'idealTree:buildDeps'))
return this.#buildDepStep().then(timeEnd)
}

@@ -795,3 +794,3 @@

const { location, name } = this.#currentDep
process.emit('timeEnd', `idealTree:${location || '#root'}`)
time.end(`idealTree:${location || '#root'}`)
this.finishTracker('idealTree', name, location)

@@ -822,3 +821,3 @@ this.#currentDep = null

this.#currentDep = node
process.emit('time', `idealTree:${node.location || '#root'}`)
time.start(`idealTree:${node.location || '#root'}`)

@@ -1465,3 +1464,3 @@ // if we're loading a _complete_ ideal tree, for a --package-lock-only

#fixDepFlags () {
process.emit('time', 'idealTree:fixDepFlags')
const timeEnd = time.start('idealTree:fixDepFlags')
const metaFromDisk = this.idealTree.meta.loadedFromDisk

@@ -1513,3 +1512,3 @@ const flagsSuspect = this[_flagsSuspect]

process.emit('timeEnd', 'idealTree:fixDepFlags')
timeEnd()
}

@@ -1516,0 +1515,0 @@

10

lib/arborist/index.js

@@ -33,3 +33,3 @@ // The arborist manages three trees:

const mapWorkspaces = require('@npmcli/map-workspaces')
const log = require('proc-log')
const { log, time } = require('proc-log')

@@ -70,3 +70,3 @@ const { saveTypeMap } = require('../add-rm-pkg-deps.js')

constructor (options = {}) {
process.emit('time', 'arborist:ctor')
const timeEnd = time.start('arborist:ctor')
super(options)

@@ -102,3 +102,3 @@ this.options = {

this.path = resolve(this.options.path)
process.emit('timeEnd', 'arborist:ctor')
timeEnd()
}

@@ -229,3 +229,3 @@

process.emit('time', 'audit')
const timeEnd = time.start('audit')
let tree

@@ -253,3 +253,3 @@ if (options.packageLock === false) {

const ret = options.fix ? this.reify(options) : this.auditReport
process.emit('timeEnd', 'audit')
timeEnd()
this.finishTracker('audit')

@@ -256,0 +256,0 @@ return ret

4

lib/arborist/isolated-reifier.js
const _makeIdealGraph = Symbol('makeIdealGraph')
const _createIsolatedTree = Symbol.for('createIsolatedTree')
const _createBundledTree = Symbol('createBundledTree')
const fs = require('fs')
const { mkdirSync } = require('fs')
const pacote = require('pacote')

@@ -111,3 +111,3 @@ const { join } = require('path')

)
fs.mkdirSync(dir, { recursive: true })
mkdirSync(dir, { recursive: true })
// TODO this approach feels wrong

@@ -114,0 +114,0 @@ // and shouldn't be necessary for shrinkwraps

36

lib/arborist/rebuild.js

@@ -12,7 +12,4 @@ // Arborist.rebuild({path = this.path}) will do all the binlinks and

const { resolve } = require('path')
const {
isNodeGypPackage,
defaultGypInstallScript,
} = require('@npmcli/node-gyp')
const log = require('proc-log')
const { isNodeGypPackage, defaultGypInstallScript } = require('@npmcli/node-gyp')
const { log, time } = require('proc-log')

@@ -58,3 +55,3 @@ const boolEnv = b => b ? '1' : ''

// prepare scripts and link bins in the expected order
process.emit('time', 'build')
const timeEnd = time.start('build')

@@ -75,3 +72,3 @@ const {

process.emit('timeEnd', 'build')
timeEnd()
}

@@ -153,3 +150,3 @@

async #build (nodes, { type = 'deps' }) {
process.emit('time', `build:${type}`)
const timeEnd = time.start(`build:${type}`)

@@ -175,7 +172,7 @@ await this.#buildQueues(nodes)

process.emit('timeEnd', `build:${type}`)
timeEnd()
}
async #buildQueues (nodes) {
process.emit('time', 'build:queue')
const timeEnd = time.start('build:queue')
const set = new Set()

@@ -218,3 +215,3 @@

}
process.emit('timeEnd', 'build:queue')
timeEnd()
}

@@ -295,3 +292,3 @@

process.emit('time', `build:run:${event}`)
const timeEnd = time.start(`build:run:${event}`)
const stdio = this.options.foregroundScripts ? 'inherit' : 'pipe'

@@ -319,4 +316,3 @@ const limit = this.options.foregroundScripts ? 1 : undefined

const timer = `build:run:${event}:${location}`
process.emit('time', timer)
const timeEndLocation = time.start(`build:run:${event}:${location}`)
log.info('run', pkg._id, event, location, pkg.scripts[event])

@@ -367,5 +363,5 @@ const env = {

process.emit('timeEnd', timer)
timeEndLocation()
}), { limit })
process.emit('timeEnd', `build:run:${event}`)
timeEnd()
}

@@ -379,3 +375,3 @@

process.emit('time', 'build:link')
const timeEnd = time.start('build:link')
const promises = []

@@ -390,3 +386,3 @@ // sort the queue by node path, so that the module-local collision

await promiseAllRejectLate(promises)
process.emit('timeEnd', 'build:link')
timeEnd()
}

@@ -399,3 +395,3 @@

process.emit('time', `build:link:${node.location}`)
const timeEnd = time.start(`build:link:${node.location}`)

@@ -414,4 +410,4 @@ const p = binLinks({

process.emit('timeEnd', `build:link:${node.location}`)
timeEnd()
}
}

89

lib/arborist/reify.js

@@ -10,3 +10,3 @@ // mixin implementing the reify method

const { walkUp } = require('walk-up-path')
const log = require('proc-log')
const { log, time } = require('proc-log')
const hgi = require('hosted-git-info')

@@ -153,3 +153,3 @@ const rpj = require('read-package-json-fast')

this.addTracker('reify')
process.emit('time', 'reify')
const timeEnd = time.start('reify')
await this[_validatePath]()

@@ -179,3 +179,3 @@ await this[_loadTrees](options)

this.finishTracker('reify')
process.emit('timeEnd', 'reify')
timeEnd()
return treeCheck(this.actualTree)

@@ -275,3 +275,3 @@ }

[_loadTrees] (options) {
process.emit('time', 'reify:loadTrees')
const timeEnd = time.start('reify:loadTrees')
const bitOpt = {

@@ -284,4 +284,3 @@ ...options,

if (this[_packageLockOnly]) {
return this.buildIdealTree(bitOpt)
.then(() => process.emit('timeEnd', 'reify:loadTrees'))
return this.buildIdealTree(bitOpt).then(timeEnd)
}

@@ -320,3 +319,3 @@

this.buildIdealTree(bitOpt),
]).then(() => process.emit('timeEnd', 'reify:loadTrees'))
]).then(timeEnd)
}

@@ -331,3 +330,3 @@

.then(() => this.loadActual(actualOpt))
.then(() => process.emit('timeEnd', 'reify:loadTrees'))
.then(timeEnd)
}

@@ -340,3 +339,3 @@

process.emit('time', 'reify:diffTrees')
const timeEnd = time.start('reify:diffTrees')
// XXX if we have an existing diff already, there should be a way

@@ -408,3 +407,3 @@ // to just invalidate the parts that changed, but avoid walking the

process.emit('timeEnd', 'reify:diffTrees')
timeEnd()
}

@@ -434,3 +433,3 @@

[_retireShallowNodes] () {
process.emit('time', 'reify:retireShallow')
const timeEnd = time.start('reify:retireShallow')
const moves = this[_retiredPaths] = {}

@@ -446,4 +445,3 @@ for (const diff of this.diff.children) {

.map(([from, to]) => this[_renamePath](from, to))
return promiseAllRejectLate(movePromises)
.then(() => process.emit('timeEnd', 'reify:retireShallow'))
return promiseAllRejectLate(movePromises).then(timeEnd)
}

@@ -470,3 +468,3 @@

[_rollbackRetireShallowNodes] (er) {
process.emit('time', 'reify:rollback:retireShallow')
const timeEnd = time.start('reify:rollback:retireShallow')
const moves = this[_retiredPaths]

@@ -478,3 +476,3 @@ const movePromises = Object.entries(moves)

.catch(er => {})
.then(() => process.emit('timeEnd', 'reify:rollback:retireShallow'))
.then(timeEnd)
.then(() => {

@@ -492,3 +490,3 @@ throw er

process.emit('time', 'reify:trashOmits')
const timeEnd = time.start('reify:trashOmits')

@@ -520,7 +518,7 @@ for (const node of this.idealTree.inventory.values()) {

process.emit('timeEnd', 'reify:trashOmits')
timeEnd()
}
[_createSparseTree] () {
process.emit('time', 'reify:createSparse')
const timeEnd = time.start('reify:createSparse')
// if we call this fn again, we look for the previous list

@@ -568,8 +566,7 @@ // so that we can avoid making the same directory multiple times

}
}))
.then(() => process.emit('timeEnd', 'reify:createSparse'))
})).then(timeEnd)
}
[_rollbackCreateSparseTree] (er) {
process.emit('time', 'reify:rollback:createSparse')
const timeEnd = time.start('reify:rollback:createSparse')
// cut the roots of the sparse tree that were created, not the leaves

@@ -588,3 +585,3 @@ const roots = this[_sparseTreeRoots]

})
.then(() => process.emit('timeEnd', 'reify:rollback:createSparse'))
.then(timeEnd)
.then(() => this[_rollbackRetireShallowNodes](er))

@@ -607,3 +604,3 @@ }

process.emit('time', 'reify:loadShrinkwraps')
const timeEnd = time.start('reify:loadShrinkwraps')

@@ -625,3 +622,3 @@ const Arborist = this.constructor

.then(() => this[_loadShrinkwrapsAndUpdateTrees]())
.then(() => process.emit('timeEnd', 'reify:loadShrinkwraps'))
.then(timeEnd)
}

@@ -641,4 +638,3 @@

const timer = `reifyNode:${node.location}`
process.emit('time', timer)
const timeEnd = time.start(`reifyNode:${node.location}`)
this.addTracker('reify', node.name, node.location)

@@ -666,3 +662,3 @@

this.finishTracker('reify', node.name, node.location)
process.emit('timeEnd', timer)
timeEnd()
return node

@@ -810,3 +806,3 @@ })

if (depth === 0) {
process.emit('time', 'reify:loadBundles')
time.start('reify:loadBundles')
}

@@ -821,3 +817,3 @@

}
process.emit('timeEnd', 'reify:loadBundles')
time.end('reify:loadBundles')
return

@@ -1007,3 +1003,3 @@ }

// with the reification, and be resolved at a later time.
process.emit('time', 'reify:audit')
const timeEnd = time.start('reify:audit')
const options = { ...this.options }

@@ -1022,3 +1018,3 @@ const tree = this.idealTree

this.auditReport = AuditReport.load(tree, options).then(res => {
process.emit('timeEnd', 'reify:audit')
timeEnd()
return res

@@ -1033,3 +1029,3 @@ })

[_unpackNewModules] () {
process.emit('time', 'reify:unpack')
const timeEnd = time.start('reify:unpack')
const unpacks = []

@@ -1067,4 +1063,3 @@ dfwalk({

})
return promiseAllRejectLate(unpacks)
.then(() => process.emit('timeEnd', 'reify:unpack'))
return promiseAllRejectLate(unpacks).then(timeEnd)
}

@@ -1084,3 +1079,3 @@

// shallowest nodes that we moved aside in the first place.
process.emit('time', 'reify:unretire')
const timeEnd = time.start('reify:unretire')
const moves = this[_retiredPaths]

@@ -1133,4 +1128,3 @@ this[_retiredUnchanged] = {}

}))
}))
.then(() => process.emit('timeEnd', 'reify:unretire'))
})).then(timeEnd)
}

@@ -1167,3 +1161,3 @@

[_build] () {
process.emit('time', 'reify:build')
const timeEnd = time.start('reify:build')

@@ -1200,4 +1194,3 @@ // for all the things being installed, run their appropriate scripts

return this.rebuild({ nodes, handleOptionalFailure: true })
.then(() => process.emit('timeEnd', 'reify:build'))
return this.rebuild({ nodes, handleOptionalFailure: true }).then(timeEnd)
}

@@ -1210,3 +1203,3 @@

async [_removeTrash] () {
process.emit('time', 'reify:trash')
const timeEnd = time.start('reify:trash')
const promises = []

@@ -1224,3 +1217,4 @@ const failures = []

}
process.emit('timeEnd', 'reify:trash')
timeEnd()
}

@@ -1258,3 +1252,3 @@

process.emit('time', 'reify:save')
const timeEnd = time.start('reify:save')

@@ -1497,3 +1491,3 @@ const updatedTrees = new Set()

process.emit('timeEnd', 'reify:save')
timeEnd()
return true

@@ -1609,6 +1603,4 @@ }

if (Object.prototype.hasOwnProperty.call(scripts, event)) {
const timer = `reify:run:${event}`
process.emit('time', timer)
log.info('run', pkg._id, event, scripts[event])
await runScript({
await time.start(`reify:run:${event}`, () => runScript({
event,

@@ -1619,4 +1611,3 @@ path,

scriptShell: this.options.scriptShell,
})
process.emit('timeEnd', timer)
}))
}

@@ -1623,0 +1614,0 @@ }

11

lib/audit-report.js

@@ -16,3 +16,3 @@ // an object representing the set of vulnerabilities in a tree

const _omit = Symbol('omit')
const log = require('proc-log')
const { log, time } = require('proc-log')

@@ -121,3 +121,3 @@ const fetch = require('npm-registry-fetch')

async [_init] () {
process.emit('time', 'auditReport:init')
const timeEnd = time.start('auditReport:init')

@@ -215,3 +215,4 @@ const promises = []

}
process.emit('timeEnd', 'auditReport:init')
timeEnd()
}

@@ -312,3 +313,3 @@

process.emit('time', 'auditReport:getReport')
const timeEnd = time.start('auditReport:getReport')
try {

@@ -354,3 +355,3 @@ try {

} finally {
process.emit('timeEnd', 'auditReport:getReport')
timeEnd()
}

@@ -357,0 +358,0 @@ }

2

lib/place-dep.js

@@ -11,3 +11,3 @@ // Given a dep, a node that depends on it, and the edge representing that

const localeCompare = require('@isaacs/string-locale-compare')('en')
const log = require('proc-log')
const { log } = require('proc-log')
const { redact } = require('@npmcli/redact')

@@ -14,0 +14,0 @@ const deepestNestingTarget = require('./deepest-nesting-target.js')

2

lib/query-selector-all.js

@@ -6,3 +6,3 @@ 'use strict'

const localeCompare = require('@isaacs/string-locale-compare')('en')
const log = require('proc-log')
const { log } = require('proc-log')
const { minimatch } = require('minimatch')

@@ -9,0 +9,0 @@ const npa = require('npm-package-arg')

4

lib/shrinkwrap.js

@@ -36,3 +36,3 @@ // a module that manages a shrinkwrap file (npm-shrinkwrap.json or

const log = require('proc-log')
const { log } = require('proc-log')
const YarnLock = require('./yarn-lock.js')

@@ -1149,2 +1149,3 @@ const {

// This must be called before the lockfile conversion check below since it sets properties as part of `commit()`
const json = this.toString(options)

@@ -1160,2 +1161,3 @@ if (

}
return Promise.all([

@@ -1162,0 +1164,0 @@ writeFile(this.filename, json).catch(er => {

41

lib/tracker.js

@@ -1,10 +0,10 @@

const npmlog = require('npmlog')
const proggy = require('proggy')
module.exports = cls => class Tracker extends cls {
#progress = new Map()
#setProgress
constructor (options = {}) {
super(options)
this.#setProgress = !!options.progress
#createTracker (key, name) {
const tracker = new proggy.Tracker(name ?? key)
tracker.on('done', () => this.#progress.delete(key))
this.#progress.set(key, tracker)
}

@@ -29,9 +29,4 @@

// 1. no existing tracker, no subsection
// Create a new tracker from npmlog
// starts progress bar
if (this.#setProgress && this.#progress.size === 0) {
npmlog.enableProgress()
}
this.#progress.set(section, npmlog.newGroup(section))
// Create a new progress tracker
this.#createTracker(section)
} else if (!hasTracker && subsection !== null) {

@@ -42,6 +37,6 @@ // 2. no parent tracker and subsection

// 3. existing parent tracker, no subsection tracker
// Create a new subtracker in this.#progress from parent tracker
this.#progress.set(`${section}:${key}`,
this.#progress.get(section).newGroup(`${section}:${subsection}`)
)
// Create a new subtracker and update parents
const parentTracker = this.#progress.get(section)
parentTracker.update(parentTracker.value, parentTracker.total + 1)
this.#createTracker(`${section}:${key}`, `${section}:${subsection}`)
}

@@ -75,12 +70,4 @@ // 4. existing parent tracker, existing subsection tracker

}
// remove parent tracker
this.#progress.get(section).finish()
this.#progress.delete(section)
// remove progress bar if all
// trackers are finished
if (this.#setProgress && this.#progress.size === 0) {
npmlog.disableProgress()
}
} else if (!hasTracker && subsection === null) {

@@ -92,4 +79,5 @@ // 1. no existing parent tracker, no subsection

// Finish subtracker and remove from this.#progress
const parentTracker = this.#progress.get(section)
parentTracker.update(parentTracker.value + 1)
this.#progress.get(`${section}:${key}`).finish()
this.#progress.delete(`${section}:${key}`)
}

@@ -100,7 +88,4 @@ // 3. existing parent tracker, no subsection

#onError (msg) {
if (this.#setProgress) {
npmlog.disableProgress()
}
throw new Error(msg)
}
}

20

package.json
{
"name": "@npmcli/arborist",
"version": "7.4.2",
"version": "7.5.0",
"description": "Manage node_modules trees",

@@ -8,11 +8,11 @@ "dependencies": {

"@npmcli/fs": "^3.1.0",
"@npmcli/installed-package-contents": "^2.0.2",
"@npmcli/installed-package-contents": "^2.1.0",
"@npmcli/map-workspaces": "^3.0.2",
"@npmcli/metavuln-calculator": "^7.0.0",
"@npmcli/metavuln-calculator": "^7.1.0",
"@npmcli/name-from-folder": "^2.0.0",
"@npmcli/node-gyp": "^3.0.0",
"@npmcli/package-json": "^5.0.0",
"@npmcli/package-json": "^5.1.0",
"@npmcli/query": "^3.1.0",
"@npmcli/redact": "^1.1.0",
"@npmcli/run-script": "^7.0.2",
"@npmcli/run-script": "^8.0.0",
"bin-links": "^4.0.1",

@@ -27,9 +27,9 @@ "cacache": "^18.0.0",

"npm-install-checks": "^6.2.0",
"npm-package-arg": "^11.0.1",
"npm-package-arg": "^11.0.2",
"npm-pick-manifest": "^9.0.0",
"npm-registry-fetch": "^16.2.0",
"npmlog": "^7.0.1",
"pacote": "^17.0.4",
"npm-registry-fetch": "^16.2.1",
"pacote": "^18.0.1",
"parse-conflict-json": "^3.0.0",
"proc-log": "^3.0.0",
"proc-log": "^4.2.0",
"proggy": "^2.0.0",
"promise-all-reject-late": "^1.0.0",

@@ -36,0 +36,0 @@ "promise-call-limit": "^3.0.1",

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

About

Packages

Stay in touch

Get open source security insights delivered straight into your inbox.

  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc