@npmcli/package-json - npm Package Compare versions

Comparing version 6.1.1 to 6.2.0

lib/index.js

@@ -44,2 +44,3 @@ const { readFile, writeFile } = require('node:fs/promises')
     'bundleDependenciesFalse',
+    'fixName',
     'fixNameField',
@@ -46,0 +47,0 @@ 'fixVersionField',

lib/normalize.js

@@ -6,2 +6,3 @@ const valid = require('semver/functions/valid')
 const { log } = require('proc-log')
+const moduleBuiltin = require('node:module')
 
@@ -148,3 +149,3 @@ /**
   // name and version are load bearing so we have to clean them up first
-  if (steps.includes('fixNameField') || steps.includes('normalizeData')) {
+  if (steps.includes('fixName') || steps.includes('fixNameField') || steps.includes('normalizeData')) {
     if (!data.name && !strict) {
@@ -175,2 +176,9 @@ changes?.push('Missing "name" field was set to an empty string')
 
+  if (steps.includes('fixName')) {
+    // Check for conflicts with builtin modules
+    if (moduleBuiltin.builtinModules.includes(data.name)) {
+      log.warn('package-json', pkgId, `Package name "${data.name}" conflicts with a Node.js built-in module name`)
+    }
+  }
+
   if (steps.includes('fixVersionField') || steps.includes('normalizeData')) {
@@ -177,0 +185,0 @@ // allow "loose" semver 1.0 versions in non-strict mode

package.json

 {
   "name": "@npmcli/package-json",
-  "version": "6.1.1",
+  "version": "6.2.0",
   "description": "Programmatic API to update package.json",
@@ -5,0 +5,0 @@ "keywords": [

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

51137

0.71%

Lines of code

1292

0.62%

No dependency changes