changelog-view - npm Package Compare versions

Comparing version 1.0.3 to 1.1.0

src/packageInfo.js

+const GITHUB_REPO_REGEX = /github(?:.com)?[\/:](.*\/[^.]*)/;
+
+export default function getPackageInfo(packageString) {
+  let out = getPackageInfoFromString(packageString);
+
+  if (out) {
+    return out;
+  }
+
+  out = getPackageInfoFromPackage(packageString);
+
+  return out;
+}
+
+function getPackageInfoFromPackage(packageString) {
+  const packageInfo = require(`${packageString}/package.json`);
+
+  if (packageInfo) {
+    const repository = packageInfo.repository;
+    if (!repository) {
+      return null;
+    }
+    const url = typeof repository === 'string' ? repository : repository.url;
+
+    const repo = url.match(GITHUB_REPO_REGEX);
+
+    return {
+      version: packageInfo.version,
+      packageName: repo && repo[1],
+    };
+  }
+
+  return null;
+}
+
+function getPackageInfoFromString(packageString) {
+  const matches = packageString.match(/(.*)@(\d+\.\d+\.\d+)/);
+  if (matches) {
+    const [match, packageName, version] = matches;
+
+    return {
+      packageName,
+      version,
+    };
+  }
+}

src/packageInfo.test.js

+import getPackageInfo from './packageInfo';
+
+describe('package info', () => {
+  test('get package info from string', () => {
+    const packageInfo = getPackageInfo('foo/bar@1.0.0');
+
+    expect(packageInfo).toEqual({ packageName: 'foo/bar', version: '1.0.0' });
+  });
+
+  test('get package info from package.json', () => {
+    // complete repository info
+    jest.mock(
+      'fullrepo/package.json',
+      () => ({
+        version: '2.0.0',
+        repository: {
+          url: 'git+https://github.com/fullrepo/foo.git',
+        },
+      }),
+      { virtual: true }
+    );
+
+    // string repository info
+    expect(getPackageInfo('fullrepo')).toEqual({
+      packageName: 'fullrepo/foo',
+      version: '2.0.0',
+    });
+
+    jest.mock(
+      'stringrepo/package.json',
+      () => ({
+        version: '2.0.0',
+        repository: 'git+https://github.com/stringrepo/foo',
+      }),
+      { virtual: true }
+    );
+
+    expect(getPackageInfo('stringrepo')).toEqual({
+      packageName: 'stringrepo/foo',
+      version: '2.0.0',
+    });
+
+    // short repository info
+    expect(getPackageInfo('fullrepo')).toEqual({
+      packageName: 'fullrepo/foo',
+      version: '2.0.0',
+    });
+
+    jest.mock(
+      'shortrepo/package.json',
+      () => ({
+        version: '2.0.0',
+        repository: 'github:shortrepo/foo',
+      }),
+      { virtual: true }
+    );
+
+    expect(getPackageInfo('shortrepo')).toEqual({
+      packageName: 'shortrepo/foo',
+      version: '2.0.0',
+    });
+  });
+
+  test('package without repository info', () => {
+    jest.mock(
+      'norepo/package.json',
+      () => ({
+        version: '2.0.0',
+      }),
+      { virtual: true }
+    );
+
+    expect(getPackageInfo('norepo')).toEqual(null);
+  });
+});

package.json

 {
   "name": "changelog-view",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "Tool to view changelog of package in console",
@@ -5,0 +5,0 @@ "bin": {

README.md

@@ -19,3 +19,3 @@ Changelog view
 
-or you can use `npx` to automatically run the program
+~~or you can use `npx` to automatically run the program~~ npx does not seems to work with it, maybe an issue with the `@`
 
@@ -26,8 +26,3 @@ ## Usage
 changelog-view <package@currentVersion> [<package@currentVersion> ...]
-
 ```
-With npx:
-```sh
-npx changelog-view <package@currentVersion> [<package@currentVersion> ...]
-```
 
@@ -39,2 +34,31 @@ Example
 
+### In a npm / yarn project ?
+`changelog-view` tries to detect automatically the current version of your lock npm / yarn dependencies, so you can just do:
+
+Imagine you have this package.json:
+```json
+{
+  "dependencies": {
+    "rest-client-sdk": "^1.0.0"
+  }
+}
+```
+
+The following command:
+```sh
+changelog-view rest-client-sdk
+```
+
+Will ouput:
+```md
+... other version
+## [1.0.1] - 2017-07-03 - [YANKED]
+
+### Changed
+
+    * Make urijs implementation work again but might be breaking
+    * Url constructor passed with noTransform = true for better perf and avoid potential bugs
+```
+
+
 ### Features
@@ -49,3 +73,6 @@ The package checks on github if a file named `CHANGELOG.md` or `HISTORY.md` is present.
 
-  * [] read yarn / npm / composer lockfiles to guess the package url
-  * [] read yarn / npm / composer lockfiles to guess the current version
+  * [x] read npm / yarn lockfiles to guess the package url
+  * [x] read npm / yarn lockfiles to guess the current version
+  * [ ] read composer lockfiles to guess the package url
+  * [ ] read composer lockfiles to guess the current version
+  * [ ] make `npx` work

src/index.js

 import marked from 'marked';
 import TerminalRenderer from 'marked-terminal';
 import { getVersionListForPackage } from './file';
+import getPackageInfo from './packageInfo';
 
 function changelogView(packageString) {
-  const matches = packageString.match(/(.*)@(\d+\.\d+\.\d+)/);
+  const packageInfo = getPackageInfo(packageString);
 
-  if (!matches) {
+  if (!packageInfo) {
     console.error(`package "${packageString}" version is not well formatted`);
@@ -13,3 +14,3 @@ process.exit(1);
 
-  const [match, packageName, version] = matches;
+  const { packageName, version } = packageInfo;
 
@@ -16,0 +17,0 @@ getVersionListForPackage(packageName, version)

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1327150

0.34%

Number of package files

25

8.7%

Lines of code

1823

5.8%

Number of lines in readme file

75

56.25%

No dependency changes