@rspack-debug/cli - npm Package Compare versions

Comparing version 2.0.4 to 2.0.5

compiled/jiti/index.d.ts

@@ -240,2 +240,23 @@ /**
   /**
+   * Always use a temp file (instead of a `data:` URL) for the ESM
+   * evaluation fallback path.
+   *
+   * jiti automatically falls back to a temp file when the `data:` URL
+   * import fails with `ENAMETOOLONG` — which happens on filesystems with
+   * a strict `NAME_MAX` limit (e.g. ecryptfs-encrypted home directories
+   * on Linux, some macOS configurations) once the base64-encoded source
+   * exceeds the limit. Setting this to `true` forces the temp-file path
+   * up front, skipping the `data:` URL attempt.
+   *
+   * The temp file is written to `{TMP_DIR}/jiti-esm/` and cleaned up
+   * after import.
+   *
+   * Can also be enabled using the `JITI_ESM_EVAL_TEMP_FILE=true`
+   * environment variable.
+   *
+   * @default false
+   */
+  esmEvalTempFile?: boolean;
+
+  /**
    * Enable JSX support Enable JSX support using
@@ -249,2 +270,38 @@ * {@link https://babeljs.io/docs/babel-plugin-transform-react-jsx | `@babel/plugin-transform-react-jsx`}.
   jsx?: boolean | JSXOptions;
+
+  /**
+   * Virtual modules - pre-loaded module objects that bypass filesystem resolution.
+   * Useful for bundled modules in compiled binaries (e.g., Bun).
+   *
+   * When a module ID matches a key in this map, the corresponding value is
+   * returned directly without any filesystem resolution or transformation.
+   *
+   * @example
+   * ```ts
+   * import * as typebox from "@sinclair/typebox";
+   *
+   * const jiti = createJiti(import.meta.url, {
+   *   virtualModules: {
+   *     "@sinclair/typebox": typebox,
+   *   },
+   * });
+   * ```
+   */
+  virtualModules?: Record<string, unknown>;
+
+  /**
+   * Enable tsconfig paths resolution.
+   *
+   * - `true`: auto-discover `tsconfig.json` by walking up from the
+   *   jiti instance's parent path
+   * - `string`: explicit path to a `tsconfig.json` file
+   * - `false` (default): disabled
+   *
+   * When enabled, jiti uses
+   * {@link https://github.com/privatenumber/get-tsconfig | get-tsconfig}
+   * to resolve TypeScript path aliases defined in `compilerOptions.paths`.
+   *
+   * @default false
+   */
+  tsconfigPaths?: boolean | string;
 }
@@ -251,0 +308,0 @@

compiled/jiti/package.json

@@ -1,1 +0,1 @@
-{"name":"jiti","version":"2.6.1","license":"MIT","types":"index.d.ts","type":"commonjs"}
+{"name":"jiti","version":"2.7.0","license":"MIT","types":"index.d.ts","type":"commonjs"}

dist/index.js

@@ -603,4 +603,9 @@ import node_path from "node:path";
     const envName = `RSPACK_${envNameSuffix}`;
-    if (!(envName in env)) env[envName] = value;
+    if (!Object.prototype.hasOwnProperty.call(env, envName)) env[envName] = value;
 }
+const DANGEROUS_ENV_KEYS = new Set([
+    '__proto__',
+    'constructor',
+    'prototype'
+]);
 function normalizeEnvToObject(options) {
@@ -610,2 +615,3 @@ function parseValue(previous, value) {
         const splitKeys = allKeys.split(/\.(?!$)/);
+        if (splitKeys.some((k)=>DANGEROUS_ENV_KEYS.has(k.replace(/=$/, '')))) return previous;
         let prevRef = previous;
@@ -1148,3 +1154,3 @@ splitKeys.forEach((key, index)=>{
         program.help();
-        program.version("2.0.4");
+        program.version("2.0.5");
     }
@@ -1151,0 +1157,0 @@ wrapAction(fn) {

package.json

 {
   "name": "@rspack-debug/cli",
-  "version": "2.0.4",
+  "version": "2.0.5",
   "description": "CLI for rspack",
@@ -40,8 +40,8 @@ "homepage": "https://rspack.rs",
     "exit-hook": "^5.1.0",
-    "jiti": "^2.6.1",
+    "jiti": "^2.7.0",
     "prebundle": "^1.6.4",
     "rspack-merge": "0.1.1",
     "typescript": "^6.0.3",
-    "@rspack/core": "npm:@rspack-debug/core@2.0.4",
-    "@rspack/test-tools": "npm:@rspack-debug/test-tools@2.0.4"
+    "@rspack/core": "npm:@rspack-debug/core@2.0.5",
+    "@rspack/test-tools": "npm:@rspack-debug/test-tools@2.0.5"
   },
@@ -48,0 +48,0 @@ "peerDependencies": {

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

High entropy strings

Supply chain risk

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

Found 1 instance in 1 package

Fixed alerts

High entropy strings

Supply chain risk

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1810686

2.78%

Lines of code

8436

1.64%

Number of low supply chain risk alerts

17

-5.56%

No dependency changes