🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →
Sign In

@npmcli/package-json

Package Overview
Dependencies
Maintainers
4
Versions
28
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@npmcli/package-json - npm Package Compare versions

Comparing version
7.0.5
 to
8.0.0
+2
-1
lib/index.js

@@ -45,2 +45,3 @@ const { readFile, writeFile } = require('node:fs/promises')

'bundleDependencies',
'overrides',
'optionalDedupe',

@@ -59,4 +60,4 @@ 'scripts',

'bundleDependenciesDeleteFalse',
'overrides',
'gypfile',
'serverjs',
'scriptpath',

@@ -63,0 +64,0 @@ 'authors',

+23
-22
lib/normalize.js

@@ -136,3 +136,3 @@ const valid = require('semver/functions/valid')

// Only steps that can be ran synchronously. There are some object constructors (i.e. Aborist Node) that need synchronous normalization so here we are.
// Only steps that can be ran synchronously. There are some object constructors (i.e. Aborist Node) that need synchronous normalization so here we are.
function syncSteps (pkg, { strict, steps, changes, allowLegacyCase }) {

@@ -241,6 +241,19 @@ const data = pkg.content

// it was once common practice to list deps both in optionalDependencies and
// in dependencies, to support npm versions that did not know about
// optionalDependencies. This is no longer a relevant need, so duplicating
// the deps in two places is unnecessary and excessive.
// normalize the shape of the top-level "overrides" field after this step it is either absent or a non-empty object, so consumers do not need to defensively check the type/size
if (steps.includes('overrides')) {
const ov = data.overrides
if (ov !== undefined) {
const isObject = ov && typeof ov === 'object' && !Array.isArray(ov)
if (!isObject) {
changes?.push(`"overrides" was removed (must be an object)`)
delete data.overrides
} else if (Object.keys(ov).length === 0) {
changes?.push(`Empty "overrides" was removed`)
delete data.overrides
}
}
}
// It was once common practice to list deps both in optionalDependencies and in dependencies, to support npm versions that did not know about optionalDependencies.
// This is no longer a relevant need, so duplicating the deps in two places is unnecessary and excessive.
if (steps.includes('optionalDedupe')) {

@@ -353,4 +366,3 @@ if (data.dependencies &&

}
// normalize-package-data used to put optional dependencies BACK into
// dependencies here, we no longer do this
// normalize-package-data used to put optional dependencies BACK into dependencies here, we no longer do this

@@ -407,14 +419,2 @@ for (const deps of ['dependencies', 'devDependencies']) {

// add "start" attribute if "server.js" exists
if (steps.includes('serverjs') && !scripts.start) {
try {
await fs.access(path.join(pkg.path, 'server.js'))
scripts.start = 'node server.js'
data.scripts = scripts
changes?.push('"scripts.start" was set to "node server.js"')
} catch {
// do nothing
}
}
// populate "authors" attribute

@@ -590,4 +590,4 @@ if (steps.includes('authors') && !data.contributors) {

// Warn if the bin references don't point to anything. This might be better
// in normalize-package-data if it had access to the file path.
// Warn if the bin references don't point to anything.
// This might be better in normalize-package-data if it had access to the file path.
if (steps.includes('binRefs') && data.bin instanceof Object) {

@@ -605,3 +605,4 @@ for (const key in data.bin) {

// We don't want the `changes` array in here by default because this is a hot path for parsing packuments during install. The calling method passes it in if it wants to track changes.
// We don't want the `changes` array in here by default because this is a hot path for parsing packuments during install.
// The calling method passes it in if it wants to track changes.
async function normalize (pkg, opts) {

@@ -608,0 +609,0 @@ if (!pkg.content) {

+11
-10
package.json
{
"name": "@npmcli/package-json",
"version": "7.0.5",
"version": "8.0.0",
"description": "Programmatic API to update package.json",

@@ -32,7 +32,7 @@ "keywords": [

"dependencies": {
"@npmcli/git": "^7.0.0",
"@npmcli/git": "^8.0.0",
"glob": "^13.0.0",
"hosted-git-info": "^9.0.0",
"json-parse-even-better-errors": "^5.0.0",
"proc-log": "^6.0.0",
"hosted-git-info": "^10.1.1",
"json-parse-even-better-errors": "^6.0.0",
"proc-log": "^7.0.0",
"semver": "^7.5.3",

@@ -42,13 +42,14 @@ "spdx-expression-parse": "^4.0.0"

"devDependencies": {
"@npmcli/eslint-config": "^6.0.0",
"@npmcli/template-oss": "4.28.1",
"@npmcli/eslint-config": "^7.0.0",
"@npmcli/template-oss": "5.1.0",
"tap": "^16.0.1"
},
"engines": {
"node": "^20.17.0 || >=22.9.0"
"node": "^22.22.2 || ^24.15.0 || >=26.0.0"
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
"version": "4.28.1",
"publish": "true"
"version": "5.1.0",
"publish": "true",
"updateNpm": false
},

@@ -55,0 +56,0 @@ "tap": {