@vercel/python-analysis - npm Package Compare versions

Comparing version 0.8.1 to 0.8.2

dist/index.d.ts

@@ -17,4 +17,4 @@ /**
 export { classifyPackages, isPrivatePackageSource, normalizePackageName, parseUvLock, } from './manifest/uv-lock-parser';
-export type { PythonSelectionResult } from './manifest/python-selector';
-export { selectPython } from './manifest/python-selector';
+export type { PythonSelectionResult, PythonVersionSelectionResult, } from './manifest/python-selector';
+export { selectPython, selectPythonVersion } from './manifest/python-selector';
 export { PythonAnalysisError } from './util/error';
@@ -21,0 +21,0 @@ export { LicenseObjectSchema, LicenseSchema, PersonSchema, PyProjectBuildSystemSchema, PyProjectDependencyGroupsSchema, PyProjectProjectSchema, PyProjectToolSectionSchema, PyProjectTomlSchema, ReadmeObjectSchema, ReadmeSchema, } from './manifest/pyproject/schema';

dist/manifest/python-selector.d.ts

@@ -24,2 +24,43 @@ import type { Pep440Constraint } from './pep440';
 /**
+ * Result of the higher-level selectPythonVersion function.
+ */
+export interface PythonVersionSelectionResult {
+    /** The selected build. Falls back to defaultBuild if no constraints match. */
+    build: PythonBuild;
+    /** Source file where the constraint originated (e.g. "pyproject.toml"). */
+    source?: string;
+    /** Diagnostic indicating the constraint was found but the build isn't in availableBuilds. */
+    notAvailable?: {
+        build: PythonBuild;
+        /** The version string of the unavailable build. */
+        version: string;
+    };
+    /** Diagnostic indicating no build matches the constraint at all. */
+    invalidConstraint?: {
+        /** Human-readable version string from the constraint. */
+        versionString: string;
+    };
+}
+/**
+ * Higher-level Python version selection with two-pass matching and diagnostics.
+ *
+ * First tries to match constraints against availableBuilds. If no match,
+ * tries against allBuilds to produce diagnostic information. Falls back
+ * to defaultBuild if no constraints are provided or no match is found.
+ */
+export declare function selectPythonVersion({ constraints, availableBuilds, allBuilds, defaultBuild, majorMinorOnly, legacyTildeEquals, }: {
+    constraints?: PythonConstraint[];
+    availableBuilds: PythonBuild[];
+    allBuilds: PythonBuild[];
+    defaultBuild: PythonBuild;
+    majorMinorOnly?: boolean;
+    /**
+     * When true, treat 2-part compatible-release specifiers (`~=X.Y`) as
+     * pinning to exactly that minor version (`==X.Y.*`) rather than the
+     * PEP 440 correct `>=X.Y, <(X+1).0`.  This preserves the historical
+     * behaviour of the Python builder prior to the python-analysis migration.
+     */
+    legacyTildeEquals?: boolean;
+}): PythonVersionSelectionResult;
+/**
  * Convert a PythonVersion to a string suitable for PEP 440 comparison.
@@ -26,0 +67,0 @@ *

dist/manifest/python-specifiers.d.ts

@@ -54,4 +54,6 @@ /**
     request: PythonRequest[];
+    /** Config file name where this constraint originated (e.g. "pyproject.toml", ".python-version"). */
+    source: string;
     /** Human-readable description of where this constraint came from. */
-    source: string;
+    prettySource: string;
 }
@@ -58,0 +60,0 @@ export type PythonVersion = {

package.json

 {
   "name": "@vercel/python-analysis",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "main": "./dist/index.cjs",
@@ -5,0 +5,0 @@ "module": "./dist/index.js",

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

2016217

0.75%

Lines of code

12871

3.72%

Worsened metrics

Number of low supply chain risk alerts

29

3.57%

No dependency changes