@posthog/cli - npm Package Compare versions

Comparing version 0.7.12 to 0.7.13

binary-install.js

@@ -1,2 +0,8 @@
-const { createWriteStream, existsSync, mkdirSync, mkdtemp } = require("fs");
+const {
+  createWriteStream,
+  existsSync,
+  mkdirSync,
+  mkdtemp,
+  rmSync,
+} = require("fs");
 const { join, sep } = require("path");
@@ -6,4 +12,5 @@ const { spawnSync } = require("child_process");
 
-const axios = require("axios");
-const rimraf = require("rimraf");
+const https = require("node:https");
+const http = require("node:http");
+
 const tmpDir = tmpdir();
@@ -16,2 +23,131 @@
 
+function getProxyForUrl(urlString) {
+  const url = new URL(urlString);
+  const isHttps = url.protocol === "https:";
+
+  const noProxy = process.env.NO_PROXY || process.env.no_proxy || "";
+  if (noProxy === "*") return null;
+  if (noProxy) {
+    const hostname = url.hostname.toLowerCase();
+    const noProxyList = noProxy.split(",").map((s) => s.trim().toLowerCase());
+    for (const entry of noProxyList) {
+      if (hostname === entry || hostname.endsWith("." + entry)) {
+        return null;
+      }
+    }
+  }
+
+  const proxyEnv = isHttps
+    ? process.env.HTTPS_PROXY || process.env.https_proxy
+    : process.env.HTTP_PROXY || process.env.http_proxy;
+
+  if (!proxyEnv) return null;
+
+  const proxyUrl = new URL(proxyEnv);
+
+  let auth = null;
+  if (proxyUrl.username || proxyUrl.password) {
+    auth = `${proxyUrl.username}:${proxyUrl.password}`;
+  }
+
+  return {
+    hostname: proxyUrl.hostname,
+    port: proxyUrl.port || (proxyUrl.protocol === "https:" ? 443 : 80),
+    auth: auth,
+  };
+}
+
+function connectThroughProxy(proxy, target) {
+  return new Promise((resolve, reject) => {
+    const headers = {};
+    if (proxy.auth) {
+      headers["Proxy-Authorization"] =
+        "Basic " + Buffer.from(proxy.auth).toString("base64");
+    }
+
+    const connectReq = http.request({
+      hostname: proxy.hostname,
+      port: proxy.port,
+      method: "CONNECT",
+      path: `${target.hostname}:${target.port || 443}`,
+      headers,
+    });
+    connectReq.on("connect", (res, socket) => {
+      if (res.statusCode === 200) {
+        resolve(socket);
+      } else {
+        reject(new Error(`Proxy CONNECT failed with status ${res.statusCode}`));
+      }
+    });
+    connectReq.on("error", reject);
+    connectReq.end();
+  });
+}
+
+function download(urlString, maxRedirects) {
+  if (maxRedirects === undefined) maxRedirects = 5;
+  return new Promise((resolve, reject) => {
+    if (maxRedirects < 0) {
+      return reject(new Error("Too many redirects"));
+    }
+
+    const parsed = new URL(urlString);
+    const isHttps = parsed.protocol === "https:";
+    const mod = isHttps ? https : http;
+    const proxy = getProxyForUrl(urlString);
+
+    const doRequest = (extraOptions) => {
+      const options = Object.assign(
+        {
+          hostname: parsed.hostname,
+          port: parsed.port || (isHttps ? 443 : 80),
+          path: parsed.pathname + parsed.search,
+          method: "GET",
+          headers: { "User-Agent": "cargo-dist-npm-installer" },
+        },
+        extraOptions || {},
+      );
+
+      if (proxy && !isHttps) {
+        // HTTP through HTTP proxy: request the full URL via the proxy
+        options.hostname = proxy.hostname;
+        options.port = proxy.port;
+        options.path = urlString;
+        if (proxy.auth) {
+          options.headers["Proxy-Authorization"] =
+            "Basic " + Buffer.from(proxy.auth).toString("base64");
+        }
+      }
+
+      const req = mod.request(options, (res) => {
+        if (
+          res.statusCode >= 300 &&
+          res.statusCode < 400 &&
+          res.headers.location
+        ) {
+          res.resume();
+          const nextUrl = new URL(res.headers.location, urlString).toString();
+          return download(nextUrl, maxRedirects - 1).then(resolve, reject);
+        }
+        if (res.statusCode < 200 || res.statusCode >= 300) {
+          res.resume();
+          return reject(new Error(`HTTP ${res.statusCode} from ${urlString}`));
+        }
+        resolve(res);
+      });
+      req.on("error", reject);
+      req.end();
+    };
+
+    if (proxy && isHttps) {
+      connectThroughProxy(proxy, parsed).then(
+        (socket) => doRequest({ socket, agent: false }),
+        reject,
+      );
+    } else {
+      doRequest();
+    }
+  });
+}
+
 class Package {
@@ -77,3 +213,3 @@ constructor(platform, name, url, filename, zipExt, binaries) {
 
-  install(fetchOptions, suppressLogs = false) {
+  install(suppressLogs = false) {
     if (this.exists()) {
@@ -88,4 +224,6 @@ if (!suppressLogs) {
 
-    if (existsSync(this.installDirectory)) {
-      rimraf.sync(this.installDirectory);
+    try {
+      rmSync(this.installDirectory, { recursive: true, force: true });
+    } catch {
+      // ignore - directory may not exist
     }
@@ -99,8 +237,9 @@
 
-    return axios({ ...fetchOptions, url: this.url, responseType: "stream" })
+    return download(this.url)
       .then((res) => {
         return new Promise((resolve, reject) => {
           mkdtemp(`${tmpDir}${sep}`, (err, directory) => {
+            if (err) return reject(err);
             let tempFile = join(directory, this.filename);
-            const sink = res.data.pipe(createWriteStream(tempFile));
+            const sink = res.pipe(createWriteStream(tempFile));
             sink.on("error", (err) => reject(err));
@@ -186,6 +325,4 @@ sink.on("close", () => {
 
-  run(binaryName, fetchOptions) {
-    const promise = !this.exists()
-      ? this.install(fetchOptions, true)
-      : Promise.resolve();
+  run(binaryName) {
+    const promise = !this.exists() ? this.install(true) : Promise.resolve();
 
@@ -213,3 +350,2 @@ promise
         error(e.message);
-        process.exit(1);
       });
@@ -216,0 +352,0 @@ }

binary.js

 const { Package } = require("./binary-install");
 const os = require("os");
-const cTable = require("console.table");
 const libc = require("detect-libc");
-const { configureProxy } = require("axios-proxy-builder");
 
@@ -14,3 +12,3 @@ const error = (msg) => {
   name,
-  artifactDownloadUrl,
+  artifactDownloadUrls,
   supportedPlatforms,
@@ -20,2 +18,4 @@ glibcMinimum,
 
+// FIXME: implement NPM installer handling of fallback download URLs
+const artifactDownloadUrl = artifactDownloadUrls[0];
 const builderGlibcMajorVersion = glibcMinimum.major;
@@ -111,13 +111,11 @@ const builderGlibcMinorVersion = glibcMinimum.series;
   }
-  const package = getPackage();
-  const proxy = configureProxy(package.url);
+  const pkg = getPackage();
 
-  return package.install(proxy, suppressLogs);
+  return pkg.install(suppressLogs);
 };
 
 const run = (binaryName) => {
-  const package = getPackage();
-  const proxy = configureProxy(package.url);
+  const pkg = getPackage();
 
-  package.run(binaryName, proxy);
+  pkg.run(binaryName);
 };
@@ -124,0 +122,0 @@

CHANGELOG.md

 # posthog-cli
 
+# 0.7.13
+
+- chore: bump `cargo-dist` to 0.32.0; the new npm installer drops the bundled transitive deps that were carrying open CVEs (`axios`, `follow-redirects`, `minimatch`, `brace-expansion`)
+
 # 0.7.12
@@ -4,0 +8,0 @@

npm-shrinkwrap.json

@@ -10,13 +10,9 @@ {
       "dependencies": {
-        "axios": "^1.13.5",
-        "axios-proxy-builder": "^0.1.2",
-        "console.table": "^0.10.0",
-        "detect-libc": "^2.1.2",
-        "rimraf": "^6.1.3"
+        "detect-libc": "^2.1.2"
       },
       "devDependencies": {
-        "prettier": "^3.8.1"
+        "prettier": "^3.8.3"
       },
       "engines": {
-        "node": ">=14",
+        "node": ">=14.14",
         "npm": ">=6"
@@ -27,132 +23,4 @@ },
       "name": "@posthog/cli",
-      "version": "0.7.12"
+      "version": "0.7.13"
     },
-    "node_modules/@isaacs/cliui": {
-      "engines": {
-        "node": ">=18"
-      },
-      "integrity": "sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg==",
-      "license": "BlueOak-1.0.0",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-9.0.0.tgz",
-      "version": "9.0.0"
-    },
-    "node_modules/asynckit": {
-      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
-      "version": "0.4.0"
-    },
-    "node_modules/axios": {
-      "dependencies": {
-        "follow-redirects": "^1.15.11",
-        "form-data": "^4.0.5",
-        "proxy-from-env": "^1.1.0"
-      },
-      "integrity": "sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.5.tgz",
-      "version": "1.13.5"
-    },
-    "node_modules/axios-proxy-builder": {
-      "dependencies": {
-        "tunnel": "^0.0.6"
-      },
-      "integrity": "sha512-6uBVsBZzkB3tCC8iyx59mCjQckhB8+GQrI9Cop8eC7ybIsvs/KtnNgEBfRMSEa7GqK2VBGUzgjNYMdPIfotyPA==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/axios-proxy-builder/-/axios-proxy-builder-0.1.2.tgz",
-      "version": "0.1.2"
-    },
-    "node_modules/balanced-match": {
-      "dependencies": {
-        "jackspeak": "^4.2.3"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "integrity": "sha512-x0K50QvKQ97fdEz2kPehIerj+YTeptKF9hyYkKf6egnwmMWAkADiO0QCzSp0R5xN8FTZgYaBfSaue46Ej62nMg==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.2.tgz",
-      "version": "4.0.2"
-    },
-    "node_modules/brace-expansion": {
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "integrity": "sha512-Pdk8c9poy+YhOgVWw1JNN22/HcivgKWwpxKq04M/jTmHyCZn12WPJebZxdjSa5TmBqISrUSgNYU3eRORljfCCw==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.2.tgz",
-      "version": "5.0.2"
-    },
-    "node_modules/call-bind-apply-helpers": {
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "function-bind": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
-      "version": "1.0.2"
-    },
-    "node_modules/clone": {
-      "engines": {
-        "node": ">=0.8"
-      },
-      "integrity": "sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==",
-      "license": "MIT",
-      "optional": true,
-      "resolved": "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz",
-      "version": "1.0.4"
-    },
-    "node_modules/combined-stream": {
-      "dependencies": {
-        "delayed-stream": "~1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      },
-      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
-      "version": "1.0.8"
-    },
-    "node_modules/console.table": {
-      "dependencies": {
-        "easy-table": "1.1.0"
-      },
-      "engines": {
-        "node": "> 0.10"
-      },
-      "integrity": "sha512-dPyZofqggxuvSf7WXvNjuRfnsOk1YazkVP8FdxH4tcH2c37wc79/Yl6Bhr7Lsu00KMgy2ql/qCMuNu8xctZM8g==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/console.table/-/console.table-0.10.0.tgz",
-      "version": "0.10.0"
-    },
-    "node_modules/defaults": {
-      "dependencies": {
-        "clone": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      },
-      "integrity": "sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==",
-      "license": "MIT",
-      "optional": true,
-      "resolved": "https://registry.npmjs.org/defaults/-/defaults-1.0.4.tgz",
-      "version": "1.0.4"
-    },
-    "node_modules/delayed-stream": {
-      "engines": {
-        "node": ">=0.4.0"
-      },
-      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
-      "version": "1.0.0"
-    },
     "node_modules/detect-libc": {
@@ -167,320 +35,2 @@ "engines": {
     },
-    "node_modules/dunder-proto": {
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "gopd": "^1.2.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
-      "version": "1.0.1"
-    },
-    "node_modules/easy-table": {
-      "integrity": "sha512-oq33hWOSSnl2Hoh00tZWaIPi1ievrD9aFG82/IgjlycAnW9hHx5PkJiXpxPsgEE+H7BsbVQXFVFST8TEXS6/pA==",
-      "license": "MIT",
-      "optionalDependencies": {
-        "wcwidth": ">=1.0.1"
-      },
-      "resolved": "https://registry.npmjs.org/easy-table/-/easy-table-1.1.0.tgz",
-      "version": "1.1.0"
-    },
-    "node_modules/es-define-property": {
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
-      "version": "1.0.1"
-    },
-    "node_modules/es-errors": {
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
-      "version": "1.3.0"
-    },
-    "node_modules/es-object-atoms": {
-      "dependencies": {
-        "es-errors": "^1.3.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "version": "1.1.1"
-    },
-    "node_modules/es-set-tostringtag": {
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.6",
-        "has-tostringtag": "^1.0.2",
-        "hasown": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
-      "version": "2.1.0"
-    },
-    "node_modules/follow-redirects": {
-      "engines": {
-        "node": ">=4.0"
-      },
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/RubenVerborgh"
-        }
-      ],
-      "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
-      "license": "MIT",
-      "peerDependenciesMeta": {
-        "debug": {
-          "optional": true
-        }
-      },
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
-      "version": "1.15.11"
-    },
-    "node_modules/form-data": {
-      "dependencies": {
-        "asynckit": "^0.4.0",
-        "combined-stream": "^1.0.8",
-        "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
-      },
-      "engines": {
-        "node": ">= 6"
-      },
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "version": "4.0.5"
-    },
-    "node_modules/function-bind": {
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      },
-      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
-      "version": "1.1.2"
-    },
-    "node_modules/get-intrinsic": {
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.2",
-        "es-define-property": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "es-object-atoms": "^1.1.1",
-        "function-bind": "^1.1.2",
-        "get-proto": "^1.0.1",
-        "gopd": "^1.2.0",
-        "has-symbols": "^1.1.0",
-        "hasown": "^2.0.2",
-        "math-intrinsics": "^1.1.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      },
-      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
-      "version": "1.3.0"
-    },
-    "node_modules/get-proto": {
-      "dependencies": {
-        "dunder-proto": "^1.0.1",
-        "es-object-atoms": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
-      "version": "1.0.1"
-    },
-    "node_modules/glob": {
-      "dependencies": {
-        "minimatch": "^10.2.0",
-        "minipass": "^7.1.2",
-        "path-scurry": "^2.0.0"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "integrity": "sha512-/g3B0mC+4x724v1TgtBlBtt2hPi/EWptsIAmXUx9Z2rvBYleQcsrmaOzd5LyL50jf/Soi83ZDJmw2+XqvH/EeA==",
-      "license": "BlueOak-1.0.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.3.tgz",
-      "version": "13.0.3"
-    },
-    "node_modules/gopd": {
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      },
-      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
-      "version": "1.2.0"
-    },
-    "node_modules/has-symbols": {
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      },
-      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
-      "version": "1.1.0"
-    },
-    "node_modules/has-tostringtag": {
-      "dependencies": {
-        "has-symbols": "^1.0.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      },
-      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
-      "version": "1.0.2"
-    },
-    "node_modules/hasown": {
-      "dependencies": {
-        "function-bind": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "version": "2.0.2"
-    },
-    "node_modules/jackspeak": {
-      "dependencies": {
-        "@isaacs/cliui": "^9.0.0"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "integrity": "sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg==",
-      "license": "BlueOak-1.0.0",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-4.2.3.tgz",
-      "version": "4.2.3"
-    },
-    "node_modules/lru-cache": {
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "integrity": "sha512-ESL2CrkS/2wTPfuend7Zhkzo2u0daGJ/A2VucJOgQ/C48S/zB8MMeMHSGKYpXhIjbPxfuezITkaBH1wqv00DDQ==",
-      "license": "BlueOak-1.0.0",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.6.tgz",
-      "version": "11.2.6"
-    },
-    "node_modules/math-intrinsics": {
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
-      "version": "1.1.0"
-    },
-    "node_modules/mime-db": {
-      "engines": {
-        "node": ">= 0.6"
-      },
-      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
-      "version": "1.52.0"
-    },
-    "node_modules/mime-types": {
-      "dependencies": {
-        "mime-db": "1.52.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      },
-      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-      "version": "2.1.35"
-    },
-    "node_modules/minimatch": {
-      "dependencies": {
-        "brace-expansion": "^5.0.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "integrity": "sha512-ugkC31VaVg9cF0DFVoADH12k6061zNZkZON+aX8AWsR9GhPcErkcMBceb6znR8wLERM2AkkOxy2nWRLpT9Jq5w==",
-      "license": "BlueOak-1.0.0",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.0.tgz",
-      "version": "10.2.0"
-    },
-    "node_modules/minipass": {
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      },
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-      "license": "ISC",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "version": "7.1.2"
-    },
-    "node_modules/package-json-from-dist": {
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
-      "license": "BlueOak-1.0.0",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "version": "1.0.1"
-    },
-    "node_modules/path-scurry": {
-      "dependencies": {
-        "lru-cache": "^11.0.0",
-        "minipass": "^7.1.2"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "integrity": "sha512-oWyT4gICAu+kaA7QWk/jvCHWarMKNs6pXOGWKDTr7cw4IGcUbW+PeTfbaQiLGheFRpjo6O9J0PmyMfQPjH71oA==",
-      "license": "BlueOak-1.0.0",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.1.tgz",
-      "version": "2.0.1"
-    },
     "node_modules/prettier": {
@@ -497,54 +47,10 @@ "bin": {
       },
-      "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
+      "integrity": "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==",
       "license": "MIT",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz",
-      "version": "3.8.1"
-    },
-    "node_modules/proxy-from-env": {
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "version": "1.1.0"
-    },
-    "node_modules/rimraf": {
-      "bin": {
-        "rimraf": "dist/esm/bin.mjs"
-      },
-      "dependencies": {
-        "glob": "^13.0.3",
-        "package-json-from-dist": "^1.0.1"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "integrity": "sha512-LKg+Cr2ZF61fkcaK1UdkH2yEBBKnYjTyWzTJT6KNPcSPaiT7HSdhtMXQuN5wkTX0Xu72KQ1l8S42rlmexS2hSA==",
-      "license": "BlueOak-1.0.0",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-6.1.3.tgz",
-      "version": "6.1.3"
-    },
-    "node_modules/tunnel": {
-      "engines": {
-        "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
-      },
-      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
-      "license": "MIT",
-      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
-      "version": "0.0.6"
-    },
-    "node_modules/wcwidth": {
-      "dependencies": {
-        "defaults": "^1.0.3"
-      },
-      "integrity": "sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==",
-      "license": "MIT",
-      "optional": true,
-      "resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
-      "version": "1.0.1"
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.3.tgz",
+      "version": "3.8.3"
     }
   },
   "requires": true,
-  "version": "0.7.12"
+  "version": "0.7.13"
 }

package.json

 {
-  "artifactDownloadUrl": "https://github.com/PostHog/posthog/releases/download/posthog-cli/v0.7.12",
+  "artifactDownloadUrls": [
+    "https://github.com/PostHog/posthog/releases/download/posthog-cli/v0.7.13"
+  ],
   "bin": {
@@ -12,14 +14,10 @@ "posthog-cli": "run-posthog-cli.js"
   "dependencies": {
-    "axios": "^1.13.5",
-    "axios-proxy-builder": "^0.1.2",
-    "console.table": "^0.10.0",
-    "detect-libc": "^2.1.2",
-    "rimraf": "^6.1.3"
+    "detect-libc": "^2.1.2"
   },
   "description": "The command line interface for PostHog 🦔",
   "devDependencies": {
-    "prettier": "^3.8.1"
+    "prettier": "^3.8.3"
   },
   "engines": {
-    "node": ">=14",
+    "node": ">=14.14",
     "npm": ">=6"
@@ -120,3 +118,3 @@ },
   },
-  "version": "0.7.12",
+  "version": "0.7.13",
   "volta": {
@@ -123,0 +121,0 @@ "node": "18.14.1",

New alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 6 instances in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 2 instances in 1 package

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Improved metrics

Dependency count

1

-80%

Worsened metrics

Total package byte prevSize

27916

-33.41%

Lines of code

476

-44.13%

Number of low supply chain risk alerts

11

175%

Number of medium supply chain risk alerts

2

100%

Dependency changes

• - Removed

  axios@^1.13.5

• - Removed

  axios-proxy-builder@^0.1.2

• - Removed

  console.table@^0.10.0

• - Removed

  rimraf@^6.1.3

• - Removed

  @isaacs/cliui@9.0.0
  (transitive)

• - Removed

  asynckit@0.4.0
  (transitive)

• - Removed

  axios@1.13.5
  (transitive)

• - Removed

  axios-proxy-builder@0.1.2
  (transitive)

• - Removed

  balanced-match@4.0.2
  (transitive)

• - Removed

  brace-expansion@5.0.2
  (transitive)

• - Removed

  call-bind-apply-helpers@1.0.2
  (transitive)

• - Removed

  clone@1.0.4
  (transitive)

• - Removed

  combined-stream@1.0.8
  (transitive)

• - Removed

  console.table@0.10.0
  (transitive)

• - Removed

  defaults@1.0.4
  (transitive)

• - Removed

  delayed-stream@1.0.0
  (transitive)

• - Removed

  dunder-proto@1.0.1
  (transitive)

• - Removed

  easy-table@1.1.0
  (transitive)

• - Removed

  es-define-property@1.0.1
  (transitive)

• - Removed

  es-errors@1.3.0
  (transitive)

• - Removed

  es-object-atoms@1.1.1
  (transitive)

• - Removed

  es-set-tostringtag@2.1.0
  (transitive)

• - Removed

  follow-redirects@1.15.11
  (transitive)

• - Removed

  form-data@4.0.5
  (transitive)

• - Removed

  function-bind@1.1.2
  (transitive)

• - Removed

  get-intrinsic@1.3.0
  (transitive)

• - Removed

  get-proto@1.0.1
  (transitive)

• - Removed

  glob@13.0.3
  (transitive)

• - Removed

  gopd@1.2.0
  (transitive)

• - Removed

  has-symbols@1.1.0
  (transitive)

• - Removed

  has-tostringtag@1.0.2
  (transitive)

• - Removed

  hasown@2.0.2
  (transitive)

• - Removed

  jackspeak@4.2.3
  (transitive)

• - Removed

  lru-cache@11.2.6
  (transitive)

• - Removed

  math-intrinsics@1.1.0
  (transitive)

• - Removed

  mime-db@1.52.0
  (transitive)

• - Removed

  mime-types@2.1.35
  (transitive)

• - Removed

  minimatch@10.2.0
  (transitive)

• - Removed

  minipass@7.1.2
  (transitive)

• - Removed

  package-json-from-dist@1.0.1
  (transitive)

• - Removed

  path-scurry@2.0.1
  (transitive)

• - Removed

  proxy-from-env@1.1.0
  (transitive)

• - Removed

  rimraf@6.1.3
  (transitive)

• - Removed

  tunnel@0.0.6
  (transitive)

• - Removed

  wcwidth@1.0.1
  (transitive)