bare-union-bundle - npm Package Compare versions

Comparing version 1.0.2 to 1.0.3

index.js

@@ -99,6 +99,6 @@ const traverse = require('bare-module-traverse')
       for (const [k, v] of Object.entries(map)) {
-        const nm = new URL('.' + v, root).href
-        if (skipModules && v.startsWith('/node_modules/') && cache[nm]) {
+        const nm = (v.startsWith('/node_modules') && skipModules) ? findModule(cache, v, root) : null
+        if (nm) {
           m[k] = 'bundle://host' + v
-          bundleCache[m[k]] = cache[nm]
+          bundleCache[m[k]] = nm
         } else {
@@ -171,1 +171,17 @@ m[k] = 'bundle://layer' + v
 }
+
+function findModule (cache, v, root) {
+  let s = '.'
+  let prev = null
+
+  while (true) {
+    const cand = new URL(s + v, root).href
+    s += '/..'
+    if (prev === cand) break
+    prev = cand
+    const nm = cache[cand]
+    if (nm) return nm
+  }
+
+  return null
+}

package.json

 {
   "name": "bare-union-bundle",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Union bundle",
@@ -5,0 +5,0 @@ "main": "index.js",

New alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

19656

1.31%

Lines of code

153

9.29%

No dependency changes