@socketsecurity/registry - npm Package Compare versions

Comparing version 1.0.170 to 1.0.171

lib/npm.d.ts

@@ -25,2 +25,3 @@ import { Options as WhichOptions } from 'which'
   isLoglevelFlag(cmdArg: string): boolean
+  isNodeOptionsFlag(cmdArg: string): boolean
   isProgressFlag(cmdArg: string): boolean
@@ -27,0 +28,0 @@ realExecPathSync(npmOrNpxExecPath: string): string

lib/npm.js

 'use strict'
 
 const { isDebug } = /*@__PURE__*/ require('./debug')
+const { isRelative } = /*@__PURE__*/ require('./path')
 const { spawn } = /*@__PURE__*/ require('./spawn')
@@ -124,2 +125,8 @@
 /*@__NO_SIDE_EFFECTS__*/
+function isNodeOptionsFlag(cmdArg) {
+  // https://docs.npmjs.com/cli/v9/using-npm/config#node-options
+  return cmdArg.startsWith('--node-options=')
+}
+
+/*@__NO_SIDE_EFFECTS__*/
 function isProgressFlag(cmdArg) {
@@ -310,3 +317,3 @@ return progressFlags.has(cmdArg)
       .../*@__PURE__*/ require('./constants/node-no-warnings-flags'),
-      binPath.includes('/') || binPath.includes('\\')
+      isRelative(binPath) || getPath().isAbsolute(binPath)
         ? resolveBinPath(binPath)
@@ -360,2 +367,3 @@ : whichBinSync(binPath),
   isLoglevelFlag,
+  isNodeOptionsFlag,
   isProgressFlag,
@@ -362,0 +370,0 @@ realExecPathSync,

lib/spawn.js

@@ -31,3 +31,3 @@ 'use strict'
   const isSpinning = !!spinner?.isSpinning
-  const { stdio } = spawnOptions
+  const { env, stdio } = spawnOptions
   // The stdio option can be a string or an array.
@@ -50,3 +50,9 @@ // https://nodejs.org/api/child_process.html#optionsstdio
       signal: /*@__PURE__*/ require('./constants/abort-signal'),
-      ...spawnOptions
+      ...spawnOptions,
+      // Node includes inherited properties of options.env when it normalizes
+      // it due to backwards compatibility. However, this is a prototype sink and
+      // undesired behavior so to prevent it we spread options.env onto a fresh
+      // object with a null [[Prototype]].
+      // https://github.com/nodejs/node/blob/v24.0.1/lib/child_process.js#L674-L678
+      env: { __proto__: null, ...env }
     },
@@ -53,0 +59,0 @@ extra

package.json

 {
   "name": "@socketsecurity/registry",
-  "version": "1.0.170",
+  "version": "1.0.171",
   "license": "MIT",
@@ -5,0 +5,0 @@ "description": "Socket.dev registry helpers methods and metadata",

No alert changes

Improved metrics

Total package byte prevSize

52927421

0

Lines of code

341313

0

No dependency changes