builder - npm Package Compare versions

Comparing version 2.1.1 to 2.1.2

HISTORY.md

 History
 =======
 
+## 2.1.2
+
+* Allow archetype discovery from siblings for any npm version. #30
+
 ## 2.1.1
@@ -5,0 +9,0 @@

lib/config.js

@@ -23,2 +23,7 @@ "use strict";
 var Config = module.exports = function (cfg) {
+  log.info("config:environment", JSON.stringify({
+    cwd: process.cwd(),
+    dir: __dirname
+  }));
+
   this.cfg = this._loadConfig(cfg);
@@ -32,6 +37,5 @@ this.archetypes = this.cfg.archetypes || [];
 
-  // State: Is this a "from NPM" installation on v3+?
+  // State: Information about the installation environment.
   // (State is set on `_loadScripts`)
   this._isFromNpm = false;
-  this._isNpmV3 = false;
 
@@ -70,3 +74,3 @@ // Array of [name, scripts array] pairs.
 /**
- * Archetype scripts.
+ * Load a single archetype's package.json.
  *
@@ -76,4 +80,6 @@ * @param   {String} name   Archetype name
  */
-Config.prototype._loadArchetypeScripts = function (name) {
+Config.prototype._loadArchetypePackage = function (name) {
   /*eslint-disable global-require*/
+  var pkgPath;
+
   // Scripts can be contained (npm v2) or siblings (npm v3).
@@ -88,12 +94,40 @@ //
   // https://github.com/FormidableLabs/builder/issues/25
-  var pkg;
   try {
-    // Contained.
-    pkg = require(path.join(process.cwd(), "node_modules", name, "package.json"));
+    // Contained in the "usual place"
+    pkgPath = path.join(process.cwd(), "node_modules", name, "package.json");
+    return require(pkgPath);
   } catch (err) {
-    // NPM-installed **and** v3 is a sibling.
-    if (this._isFromNpm && this._isNpmV3) {
-      pkg = require(path.join(process.cwd(), "..", name, "package.json"));
+    /*eslint-disable no-empty*/
+  }
+
+  if (this._isFromNpm) {
+    try {
+      // NPM-installed (sometimes on v2, always on v3)
+      pkgPath = path.join(process.cwd(), "..", name, "package.json");
+      return require(pkgPath);
+    } catch (err) {
+      /*eslint-disable no-empty*/
     }
   }
+
+  try {
+    // Require resolve it
+    var modPath = require.resolve(name);
+    pkgPath = path.join(modPath, "package.json");
+    return require(pkgPath);
+  } catch (err) {
+    /*eslint-disable no-empty*/
+  }
+
+  return undefined;
+};
+
+/**
+ * Archetype scripts.
+ *
+ * @param   {String} name   Archetype name
+ * @returns {Object}        Package.json scripts object
+ */
+Config.prototype._loadArchetypeScripts = function (name) {
+  var pkg = this._loadArchetypePackage(name);
   if (!pkg) {
@@ -130,13 +164,2 @@ throw new Error("Unable to find package.json for: " + name);
 
-  // HACK: Detect if NPM v3 from user agent.
-  var match = (process.env.npm_config_user_agent || "").match(/npm\/([0-9]+)/);
-  if (match && match[1]) {
-    try {
-      // Version 3 or greater.
-      this._isNpmV3 = parseInt(match[1], 10) >= 3;
-    } catch (err) {
-      // pass through.
-    }
-  }
-
   return [["ROOT", CWD_SCRIPTS]].concat(_(archetypes)
@@ -143,0 +166,0 @@ .map(function (name) {

package.json

 {
   "name": "builder",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "An NPM-based task runner",
@@ -5,0 +5,0 @@ "repository": {

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

34163

increased by1.55%

Lines of code

612

increased by3.03%

Worsened metrics

Number of low supply chain risk alerts

7

increased by16.67%

No dependency changes