Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More →
Socket
Sign inDemoInstall
Socket
Sign inDemoInstall

bower

Package Overview
Dependencies
Maintainers
4
Versions
99
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

bower - npm Package Compare versions

Comparing version 1.2.7 to 1.2.8

14

CHANGELOG.md
# Changelog
##1.2.8 - 2013-12-02
- Fix absolute paths ending with / not going through the FsResolver, ([#898](https://github.com/bower/bower/issues/898))
- Allow query string parameters in package URLs
- Swapped 'unzip' module for 'decompress-zip', and some other small unzipping fixes([#873](https://github.com/bower/bower/issues/873), [#896](https://github.com/bower/bower/issues/896))
- Allow the root-check to be overidden when calling bower programmatically.
- Fixed some bugs relating to packages with a very large dependency tree
- Fix a bug caused by a recent change to semver
## 1.2.7 - 2013-09-29

@@ -11,3 +21,3 @@

- Add configured directory in `.bowerrc` to the ignores in `bower init` ([#854](https://github.com/bower/bower/issues/854))
- Fix some casing sensitive issues with data stored in registry cache (e.g.: jquery/jQuery, [#859](https://github.com/bower/bower/issues/859))
- Fix some case sensitive issues with data stored in registry cache (e.g.: jquery/jQuery, [#859](https://github.com/bower/bower/issues/859))
- Fix bower not checking out a tag if it looks like a semver (e.g.: 1.0, [#872](https://github.com/bower/bower/issues/872))

@@ -17,3 +27,5 @@ - Fix install & update commands printing the wrong versions in some cases ([#879](https://github.com/bower/bower/issues/879))

_NOTE_: It's advisable that users run `bower cache clean`.
## 1.2.6 - 2013-09-04

@@ -20,0 +32,0 @@

2

lib/commands/home.js

@@ -34,3 +34,3 @@ var mout = require('mout');

promise = project.getPackageRepository().fetch(decEndpoint)
.spread(function (canonicalDir, pkgMeta) {
.spread(function (canonicalDir, pkgMeta) {
return pkgMeta;

@@ -37,0 +37,0 @@ });

25

lib/core/Manager.js

@@ -174,4 +174,4 @@ var Q = require('q');

mout.object.forOwn(pkg.dependencies, function (dependency, name) {
var dissected = this._dissected[name];
pkg.dependencies[name] = dissected || dependency;
var dissected = this._dissected[name] || (this._resolved[name] ? this._resolved[name][0] : dependency);
pkg.dependencies[name] = dissected;
}, this);

@@ -181,3 +181,6 @@

pkg.dependants = pkg.dependants.map(function (dependant) {
return this._dissected[dependant.name] || dependant;
var name = dependant.name;
var dissected = this._dissected[name] || (this._resolved[name] ? this._resolved[name][0] : dependant);
return dissected;
}, this);

@@ -373,2 +376,4 @@ }, that);

Manager.prototype._parseDependencies = function (decEndpoint, pkgMeta, jsonKey) {
var pending = [];
decEndpoint.dependencies = decEndpoint.dependencies || {};

@@ -429,6 +434,3 @@

if (compatible) {
compatible.promise
.then(function () {
this._parseDependencies(decEndpoint, pkgMeta, jsonKey);
}.bind(this));
pending.push(compatible.promise);
return;

@@ -446,2 +448,9 @@ }

}, this);
if (pending.length > 0) {
Q.all(pending)
.then(function () {
this._parseDependencies(decEndpoint, pkgMeta, jsonKey);
}.bind(this));
}
};

@@ -796,3 +805,3 @@

// and if the resolved version satisfies the candidate target
if (semver.validRange(candidate.target)) {
if (semver.validRange(candidate.target) && semver.validRange(resolved.target)) {
highestCandidate = this._getCap(semver.toComparators(candidate.target), 'highest');

@@ -799,0 +808,0 @@ highestResolved = this._getCap(semver.toComparators(resolved.target), 'highest');

2

lib/core/resolverFactory.js

@@ -63,3 +63,3 @@ var Q = require('q');

if (/^\.\.?[\/\\]/.test(source) || /^~\//.test(source) || path.normalize(source) === absolutePath) {
if (/^\.\.?[\/\\]/.test(source) || /^~\//.test(source) || path.normalize(source).replace(/[\/\\]+$/, '') === absolutePath) {
promise = Q.nfcall(fs.stat, path.join(absolutePath, '.git'))

@@ -66,0 +66,0 @@ .then(function (stats) {

6

lib/core/resolvers/FsResolver.js

@@ -22,2 +22,8 @@ var util = require('util');

}
// If the name was guessed
if (this._guessedName) {
// Remove extension
this._name = this._name.substr(0, this._name.length - path.extname(this._name).length);
}
}

@@ -24,0 +30,0 @@

17

lib/core/resolvers/UrlResolver.js

@@ -15,4 +15,2 @@ var util = require('util');

function UrlResolver(decEndpoint, config, logger) {
var pos;
Resolver.call(this, decEndpoint, config, logger);

@@ -25,8 +23,8 @@

// If the name was guessed, remove the ? part
// If the name was guessed
if (this._guessedName) {
pos = this._name.indexOf('?');
if (pos !== -1) {
this._name = path.basename(this._name.substr(0, pos));
}
// Remove the ?xxx part
this._name = this._name.replace(/\?.*$/, '');
// Remove extension
this._name = this._name.substr(0, this._name.length - path.extname(this._name).length);
}

@@ -112,3 +110,4 @@

UrlResolver.prototype._download = function () {
var file = path.join(this._tempDir, path.basename(this._source));
var fileName = url.parse(path.basename(this._source)).pathname;
var file = path.join(this._tempDir, fileName);
var reqHeaders = {};

@@ -205,2 +204,4 @@ var that = this;

mimeType = mimeType.split(';')[0].trim();
// Some servers add quotes around the content-type, so we trim that also
mimeType = mout.string.trim(mimeType, ['"', '\'']);
}

@@ -207,0 +208,0 @@

2

lib/renderers/StandardRenderer.js

@@ -417,3 +417,3 @@ var cardinal = require('cardinal');

if (node.missing) {
label += chalk.red(' missing');
label += chalk.red(' not installed');
return label;

@@ -420,0 +420,0 @@ }

13

lib/util/cmd.js

@@ -6,4 +6,11 @@ var cp = require('child_process');

var which = require('which');
var PThrottler = require('p-throttler');
var createError = require('./createError');
// The concurrency limit here is kind of magic. You don't really gain a lot from
// having a large number of commands spawned at once, so it isn't super
// important for this number to be large. However, it would still be nice to
// *know* how high this number can be, rather than having to guess low.
var throttler = new PThrottler(50);
var winBatchExtensions;

@@ -48,3 +55,3 @@ var winWhichCache;

// or rejected if it fails
function cmd(command, args, options) {
function executeCmd(command, args, options) {
var process;

@@ -108,2 +115,6 @@ var stderr = '';

function cmd(command, args, options) {
return throttler.enqueue(executeCmd.bind(null, command, args, options));
}
module.exports = cmd;

12

lib/util/extract.js
var path = require('path');
var fs = require('graceful-fs');
var zlib = require('zlib');
var unzip = require('unzip');
var DecompressZip = require('decompress-zip');
var tar = require('tar');

@@ -25,2 +25,3 @@ var Q = require('q');

'application/zip': extractZip,
'application/x-zip': extractZip,
'application/x-tar': extractTar,

@@ -36,11 +37,10 @@ 'application/x-tgz': extractTarGz,

fs.createReadStream(archive)
new DecompressZip(archive)
.on('error', deferred.reject)
.pipe(unzip.Extract({
.on('extract', deferred.resolve.bind(deferred, dst))
.extract({
path: dst,
follow: false, // Do not follow symlinks (#699)
filter: filterSymlinks // Filter symlink files
}))
.on('error', deferred.reject)
.on('close', deferred.resolve.bind(deferred, dst));
});

@@ -47,0 +47,0 @@ return deferred.promise;

2

lib/util/rootCheck.js

@@ -13,3 +13,3 @@ /*jshint multistr:true*/

// Allow running the command as root
if (options.allowRoot) {
if (options.allowRoot || config.allowRoot) {
return;

@@ -16,0 +16,0 @@ }

7

package.json
{
"name": "bower",
"version": "1.2.7",
"version": "1.2.8",
"description": "The browser package manager.",

@@ -32,2 +32,3 @@ "author": "Twitter",

"chmodr": "~0.1.0",
"decompress-zip": "~0.0.3",
"fstream": "~0.1.22",

@@ -57,5 +58,5 @@ "fstream-ignore": "~0.0.6",

"tmp": "~0.0.20",
"unzip": "~0.1.7",
"update-notifier": "~0.1.3",
"which": "~1.0.5"
"which": "~1.0.5",
"p-throttler": "~0.0.1"
},

@@ -62,0 +63,0 @@ "devDependencies": {

124

README.md

@@ -1,3 +0,7 @@

# BOWER [![Build Status](https://secure.travis-ci.org/bower/bower.png?branch=master)](http://travis-ci.org/bower/bower)
# Bower
[![Build Status](https://secure.travis-ci.org/bower/bower.png?branch=master)](http://travis-ci.org/bower/bower) [![Views in the last 24 hours](https://sourcegraph.com/api/repos/github.com/bower/bower/counters/views-24h.png)](https://sourcegraph.com/github.com/bower/bower)
<img align="right" height="300" src="http://bower.io/img/bower-logo.png">
Bower is a package manager for the web. It offers a generic, unopinionated

@@ -34,11 +38,2 @@ solution to the problem of **front-end package management**, while exposing the

#### Warning
On `prezto` or `oh-my-zsh`, do not forget to `alias bower='noglob bower'` or `bower install jquery\#1.9.1`
#### Running commands with sudo
Bower is a user command, there is no need to execute it with superuser permissions.
However, if you still want to run commands with sudo, use `--allow-root` option.
### Installing packages and dependencies

@@ -48,10 +43,16 @@

#####Using the dependencies listed in the current directory's bower.json
```
# Using the dependencies listed in the current directory's bower.json
bower install
# Using a local or remote package
```
##### Using a local or remote package
```
bower install <package>
# Using a specific version of a package
```
##### Using a specific version of a package
```
bower install <package>#<version>
# Using a different name and a specific version of a package
```
##### Using a different name and a specific version of a package
```
bower install <name>=<package>#<version>

@@ -80,4 +81,4 @@ ```

**N.B.** If you aren't authoring a package that is intended to be consumed by
others (e.g., you're building a web app), you should always check installed
packages into source control.
others (e.g., you're building a web app), you should always [check installed
packages into source control](http://addyosmani.com/blog/checking-in-front-end-dependencies/).

@@ -108,34 +109,48 @@ ### Finding packages

### Registering packages
### Uninstalling packages
To register a new package:
To uninstall a locally installed package:
* There **must** be a valid manifest JSON in the current working directory.
* Your package should use [semver](http://semver.org/) Git tags.
* Your package **must** be available at a Git endpoint (e.g., GitHub); remember
to push your Git tags!
Then use the following command:
```
bower register <my-package-name> <git-endpoint>
bower uninstall <package-name>
```
The Bower registry does not have authentication or user management at this point
in time. It's on a first come, first served basis. Think of it like a URL
shortener. Now anyone can run `bower install <my-package-name>`, and get your
library installed.
There is no direct way to unregister a package yet. For now, you can [request a
package be unregistered](https://github.com/bower/bower/issues/120).
#### Warning
### Uninstalling packages
On `prezto` or `oh-my-zsh`, do not forget to `alias bower='noglob bower'` or `bower install jquery\#1.9.1`
To uninstall a locally installed package:
#### Running commands with sudo
Bower is a user command, there is no need to execute it with superuser permissions.
However, if you still want to run commands with sudo, use `--allow-root` option.
#### A note for Windows users
To use Bower on Windows, you must install
[msysgit](http://code.google.com/p/msysgit/) correctly. Be sure to check the
option shown below:
![msysgit](http://f.cl.ly/items/2V2O3i1p3R2F1r2v0a12/mysgit.png)
Note that if you use TortoiseGit and if Bower keeps asking for your SSH
password, you should add the following environment variable: `GIT_SSH -
C:\Program Files\TortoiseGit\bin\TortoisePlink.exe`. Adjust the `TortoisePlink`
path if needed.
### Using bower's cache
Bower supports installing packages from its local cache (without internet connection), if the packages were installed before.
```
bower uninstall <package-name>
bower install <package-name> --offline
```
The content of the cache can be listed with:
```
bower cache list
```
The cache can be cleaned with:
```
bower cache clean
```
## Configuration

@@ -200,3 +215,26 @@

### Registering packages
To register a new package:
* There **must** be a valid manifest JSON in the current working directory.
* Your package should use [semver](http://semver.org/) Git tags.
* Your package **must** be available at a Git endpoint (e.g., GitHub); remember
to push your Git tags!
Then use the following command:
```
bower register <my-package-name> <git-endpoint>
```
The Bower registry does not have authentication or user management at this point
in time. It's on a first come, first served basis. Think of it like a URL
shortener. Now anyone can run `bower install <my-package-name>`, and get your
library installed.
There is no direct way to unregister a package yet. For now, you can [request a
package be unregistered](https://github.com/bower/bower/issues/120).
## Consuming a package

@@ -285,16 +323,2 @@

## A note for Windows users
To use Bower on Windows, you must install
[msysgit](http://code.google.com/p/msysgit/) correctly. Be sure to check the
option shown below:
![msysgit](http://f.cl.ly/items/2V2O3i1p3R2F1r2v0a12/mysgit.png)
Note that if you use TortoiseGit and if Bower keeps asking for your SSH
password, you should add the following environment variable: `GIT_SSH -
C:\Program Files\TortoiseGit\bin\TortoisePlink.exe`. Adjust the `TortoisePlink`
path if needed.
## Contact

@@ -301,0 +325,0 @@

5

test/core/resolverFactory.js

@@ -306,2 +306,7 @@ var expect = require('expect.js');

// Absolute path that ends with a /
// See: https://github.com/bower/bower/issues/898
temp = path.resolve(__dirname, '../assets/package-a') + '/';
endpoints[temp] = temp;
// Relative path

@@ -308,0 +313,0 @@ endpoints[__dirname + '/../assets/package-a'] = temp;

4

test/core/resolvers/fsResolver.js

@@ -48,5 +48,5 @@ var expect = require('expect.js');

it('should guess the name from the path', function () {
var resolver = create(testPackage);
var resolver = create(path.resolve('../../assets/package-zip.zip'));
expect(resolver.getName()).to.equal('package-a');
expect(resolver.getName()).to.equal('package-zip');
});

@@ -53,0 +53,0 @@

48

test/core/resolvers/urlResolver.js

@@ -46,3 +46,3 @@ var expect = require('expect.js');

expect(resolver.getName()).to.equal('foo.txt');
expect(resolver.getName()).to.equal('foo');
});

@@ -53,3 +53,3 @@

expect(resolver.getName()).to.equal('foo.txt');
expect(resolver.getName()).to.equal('foo');
});

@@ -435,2 +435,7 @@

.get('/package-zip4')
.replyWithFile(200, path.resolve(__dirname, '../../assets/package-zip.zip'), {
'Content-Type': '"application/x-zip"' // Test with quotes
})
.get('/package-tar')

@@ -468,3 +473,3 @@ .replyWithFile(200, path.resolve(__dirname, '../../assets/package-tar.tar.gz'), {

expect(fs.existsSync(path.join(dir, 'package-zip'))).to.be(false);
expect(fs.existsSync(path.join(dir, 'package-zip2.zip'))).to.be(false);
expect(fs.existsSync(path.join(dir, 'package-zip3.zip'))).to.be(false);

@@ -479,4 +484,13 @@ resolver = create('http://bower.io/package-zip3');

expect(fs.existsSync(path.join(dir, 'package-zip'))).to.be(false);
expect(fs.existsSync(path.join(dir, 'package-zip3.zip'))).to.be(false);
expect(fs.existsSync(path.join(dir, 'package-zip4.zip'))).to.be(false);
resolver = create('http://bower.io/package-zip4');
return resolver.resolve();
})
.then(function (dir) {
expect(fs.existsSync(path.join(dir, 'foo.js'))).to.be(true);
expect(fs.existsSync(path.join(dir, 'bar.js'))).to.be(true);
expect(fs.existsSync(path.join(dir, 'package-tar'))).to.be(false);
resolver = create('http://bower.io/package-tar');

@@ -562,2 +576,28 @@

it('should allow for query strings in URL', function (next) {
var resolver;
nock('http://bower.io')
.get('/foo.js?bar=baz')
.reply(200, 'foo contents');
resolver = create('http://bower.io/foo.js?bar=baz');
resolver.resolve()
.then(function (dir) {
var contents;
expect(fs.existsSync(path.join(dir, 'index.js'))).to.be(true);
expect(fs.existsSync(path.join(dir, 'foo.js'))).to.be(false);
expect(fs.existsSync(path.join(dir, 'foo.js?bar=baz'))).to.be(false);
contents = fs.readFileSync(path.join(dir, 'index.js')).toString();
expect(contents).to.equal('foo contents');
assertMain(dir, 'index.js')
.then(next.bind(next, null));
})
.done();
});
it('should save cache headers', function (next) {

@@ -564,0 +604,0 @@ var resolver;

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

About

Packages

npm

Go

Maven

PyPI

Rubygems

Stay in touch

Get open source security insights delivered straight into your inbox.

  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc