@platformatic/foundation - npm Package Compare versions

Comparing version 3.32.0 to 3.33.0-alpha.1

lib/configuration.js

@@ -535,7 +535,12 @@ import toml from '@iarna/toml'
 
-export function loadConfigurationModule (root, config, pkg) {
+export async function loadConfigurationModule (root, config, pkg) {
   pkg ??= extractModuleFromSchemaUrl(config, true).module
 
-  const require = createRequire(resolve(root, 'noop.js'))
-  return loadModule(require, pkg)
+  try {
+    const require = createRequire(resolve(root, 'noop.js'))
+    return await loadModule(require, pkg)
+  } catch (error) { // Fallback to the one bundled with Platformatic runtime
+    const require = createRequire(import.meta.filename)
+    return loadModule(require, pkg)
+  }
 }

lib/module.js

@@ -176,3 +176,3 @@ import { existsSync } from 'node:fs'
     } catch (err) {
-      /* c8 ignore next 4 */
+      /* c8 ignore next 10 */
       if (err.code === 'ERR_REQUIRE_ESM') {
@@ -179,0 +179,0 @@ const toLoad = require.resolve(path)

package.json

 {
   "name": "@platformatic/foundation",
-  "version": "3.32.0",
+  "version": "3.33.0-alpha.1",
   "description": "Platformatic Foundation",
@@ -5,0 +5,0 @@ "main": "index.js",

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

107748

0.19%

Lines of code

3197

0.16%

Worsened metrics

Number of low quality alerts

1

Infinity%

No dependency changes