@snyk/dep-graph - npm Package Compare versions

Comparing version 2.3.0 to 2.4.0

dist/core/builder.js

@@ -6,2 +6,3 @@ "use strict";
 const dep_graph_1 = require("./dep-graph");
+const validate_graph_1 = require("./validate-graph");
 class DepGraphBuilder {
@@ -44,2 +45,3 @@ constructor(pkgManager, rootPkg) {
         }
+        (0, validate_graph_1.validatePackageURL)(pkgInfo);
         const pkgId = DepGraphBuilder._getPkgId(pkgInfo);
@@ -46,0 +48,0 @@ this._pkgs[pkgId] = pkgInfo;

dist/core/dep-graph.js

@@ -278,3 +278,3 @@ "use strict";
 exports.DepGraphImpl = DepGraphImpl;
-DepGraphImpl.SCHEMA_VERSION = '1.2.0';
+DepGraphImpl.SCHEMA_VERSION = '1.3.0';
 //# sourceMappingURL=dep-graph.js.map

dist/core/types.d.ts

@@ -5,5 +5,7 @@ export interface Pkg {
 }
+export declare type PurlString = string;
 export interface PkgInfo {
     name: string;
     version?: string;
+    purl?: PurlString;
 }
@@ -10,0 +12,0 @@ export interface VersionProvenance {

dist/core/validate-graph.d.ts

 import * as graphlib from '../graphlib';
+import * as types from './types';
 export declare function validateGraph(graph: graphlib.Graph, rootNodeId: string, pkgs: {
@@ -7,1 +8,2 @@ [pkgId: string]: any;
 }): void;
+export declare function validatePackageURL(pkg: types.PkgInfo): void;

dist/core/validate-graph.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateGraph = void 0;
+exports.validatePackageURL = exports.validateGraph = void 0;
 const graphlib = require("../graphlib");
+const packageurl_js_1 = require("packageurl-js");
 const errors_1 = require("./errors");
@@ -19,4 +20,34 @@ function assert(condition, msg) {
     assert(pkgsWithoutInstances.length === 0, 'not all pkgs have instance nodes');
+    for (const pkgId in pkgs) {
+        try {
+            validatePackageURL(pkgs[pkgId]);
+        }
+        catch (e) {
+            throw new errors_1.ValidationError(`invalid pkg ${pkgId}: ${e}`);
+        }
+    }
 }
 exports.validateGraph = validateGraph;
+function validatePackageURL(pkg) {
+    if (!pkg.purl) {
+        return;
+    }
+    try {
+        const purlPkg = packageurl_js_1.PackageURL.fromString(pkg.purl);
+        switch (purlPkg.type) {
+            // Within Snyk, maven packages use <namespace>:<name> as their *name*, but
+            // we expect those to be separated correctly in the PackageURL.
+            case 'maven':
+                assert(pkg.name === purlPkg.namespace + ':' + purlPkg.name, `name and packageURL name do not match`);
+                break;
+            default:
+                assert(pkg.name === purlPkg.name, `name and packageURL name do not match`);
+        }
+        assert(pkg.version === purlPkg.version, `version and packageURL version do not match`);
+    }
+    catch (e) {
+        throw new errors_1.ValidationError(`packageURL validation failed: ${e}`);
+    }
+}
+exports.validatePackageURL = validatePackageURL;
 //# sourceMappingURL=validate-graph.js.map

package.json

@@ -67,6 +67,7 @@ {
     "object-hash": "^3.0.0",
+    "packageurl-js": "^1.0.0",
     "semver": "^7.0.0",
     "tslib": "^2"
   },
-  "version": "2.3.0"
+  "version": "2.4.0"
 }

README.md

@@ -53,2 +53,3 @@ ![Snyk logo](https://snyk.io/style/asset/logo/snyk-print.svg)
     version?: string;
+    purl?: string;
   };
@@ -59,2 +60,3 @@ // all unique packages in the graph (including root package)
     version?: string;
+    purl?: string;
   }>;
@@ -65,2 +67,3 @@ // all unique packages in the graph, except the root package
     version?: string;
+    purl?: string;
   }>;
@@ -70,2 +73,3 @@ pkgPathsToRoot(pkg: Pkg): Array<Array<{
     version?: string;
+    purl?: string;
   }>>;
@@ -75,2 +79,3 @@ directDepsLeadingTo(pkg: Pkg): Array<{
     version?: string;
+    purl?: string;
   }>;
@@ -102,2 +107,3 @@ countPathsToRoot(pkg: Pkg): number;
       version?: string;
+    purl?: string;
     };
@@ -104,0 +110,0 @@ }>;

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

121381

increased by2.09%

Lines of code

1824

increased by2.07%

Number of lines in readme file

199

increased by3.11%

Worsened metrics

Dependency count

19

increased by5.56%

Dependency changes

• + Addedpackageurl-js@^1.0.0

• + Addedpackageurl-js@1.2.1(transitive)