cmake-js - npm Package Compare versions

Comparing version 7.4.0 to 8.0.0

lib/logger.js

+const util = require('util')
+
+const levels = {
+	silly: -Infinity,
+	verbose: 1000,
+	info: 2000,
+	http: 3000,
+	warn: 4000,
+	error: 5000,
+	silent: Infinity,
+}
+
+const colors = {
+	silly: 'inverse',
+	verbose: 'blue',
+	info: 'green',
+	http: 'green',
+	warn: 'yellow',
+	error: 'red',
+}
+
+let currentLevel = levels.info
+
+function log(level, prefix, message, ...args) {
+	if (currentLevel <= levels[level]) {
+		const stream = level === 'error' ? process.stderr : process.stdout
+		const color = colors[level]
+		let levelStr = level.toUpperCase()
+		if (process.stdout.isTTY && util.styleText) {
+			// util.styleText is available in Node.js >= 20.12.0
+			levelStr = util.styleText(color, levelStr)
+			if (prefix) prefix = util.styleText('magenta', prefix)
+		}
+
+		const formattedMessage = util.format(message, ...args)
+		const line = prefix
+			? util.format('%s %s %s', levelStr, prefix, formattedMessage)
+			: util.format('%s %s', levelStr, formattedMessage)
+
+		stream.write(line + '\n')
+	}
+}
+
+const logger = {
+	get level() {
+		return Object.keys(levels).find((key) => levels[key] === currentLevel)
+	},
+	set level(newLevel) {
+		if (levels[newLevel] !== undefined) {
+			currentLevel = levels[newLevel]
+		}
+	},
+}
+
+for (const level of Object.keys(colors)) {
+	logger[level] = (prefix, message, ...args) => log(level, prefix, message, ...args)
+}
+
+module.exports = logger

changelog.md

@@ -0,1 +1,6 @@
+# v8.0.0 - 27/01/26
+
+- feat: require nodejs 20 or later
+- feat: update deprecated dependencies
+
 # v7.4.0 - 14/11/25
@@ -2,0 +7,0 @@

lib/cmLog.js

 'use strict'
-const log = require('npmlog')
+const log = require('./logger')
 
@@ -4,0 +4,0 @@ class CMLog {

lib/downloader.js

 'use strict'
 const crypto = require('crypto')
-const axios = require('axios')
-const MemoryStream = require('memory-stream')
+const { Readable } = require('node:stream')
 const zlib = require('zlib')
@@ -22,11 +21,14 @@ const tar = require('tar')
 			let lastPercent = 0
-			axios
-				.get(url, { responseType: 'stream' })
+			fetch(url)
 				.then(function (response) {
-					length = parseInt(response.headers['content-length'])
-					if (typeof length !== 'number') {
+					if (!response.ok) {
+						throw new Error(response.statusText || 'Request failed')
+					}
+					length = parseInt(response.headers.get('content-length'))
+					if (Number.isNaN(length)) {
 						length = 0
 					}
 
-					response.data.on('data', function (chunk) {
+					const readable = Readable.fromWeb(response.body)
+					readable.on('data', function (chunk) {
 						if (shasum) {
@@ -46,3 +48,6 @@ shasum.update(chunk)
 
-					response.data.pipe(stream)
+					readable.pipe(stream)
+					readable.on('error', function (err) {
+						reject(err)
+					})
 				})
@@ -63,5 +68,7 @@ .catch(function (err) {
 	async downloadString(url) {
-		const result = new MemoryStream()
-		await this.downloadToStream(url, result)
-		return result.toString()
+		const response = await fetch(url)
+		if (!response.ok) {
+			throw new Error(response.statusText || 'Request failed')
+		}
+		return response.text()
 	}
@@ -68,0 +75,0 @@ async downloadFile(url, options) {

lib/import/find-visualstudio.js

 'use strict'
 
-const log = require('npmlog')
+const log = require('../logger')
 const { existsSync } = require('fs')
@@ -5,0 +5,0 @@ const { win32: path } = require('path')

lib/import/util.js

 'use strict'
 
-const log = require('npmlog')
+const log = require('../logger')
 const cp = require('child_process')
@@ -5,0 +5,0 @@ const path = require('path')

package.json

@@ -24,3 +24,3 @@ {
 	"main": "lib",
-	"version": "7.4.0",
+	"version": "8.0.0",
 	"author": "Gábor Mező aka unbornchikken",
@@ -42,16 +42,13 @@ "maintainers": [
 	"engines": {
-		"node": ">= 14.15.0"
+		"node": "^20.17.0 || >=22.9.0"
 	},
 	"dependencies": {
-		"axios": "^1.6.5",
-		"debug": "^4",
-		"fs-extra": "^11.2.0",
-		"memory-stream": "^1.0.0",
-		"node-api-headers": "^1.1.0",
-		"npmlog": "^6.0.2",
-		"rc": "^1.2.7",
-		"semver": "^7.5.4",
-		"tar": "^6.2.0",
+		"debug": "^4.4.3",
+		"fs-extra": "^11.3.3",
+		"node-api-headers": "^1.8.0",
+		"rc": "1.2.8",
+		"semver": "^7.7.3",
+		"tar": "^7.5.6",
 		"url-join": "^4.0.1",
-		"which": "^2.0.2",
+		"which": "^6.0.0",
 		"yargs": "^17.7.2"
@@ -63,5 +60,5 @@ },
 		"mocha": "*",
-		"nan": "^2.22.2",
+		"nan": "^2.25.0",
 		"node-addon-api": "^6.1.0",
-		"prettier": "^3.2.2"
+		"prettier": "^3.8.1"
 	},
@@ -68,0 +65,0 @@ "scripts": {

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 7 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 7 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

106505

1.49%

Dependency count

9

-25%

Number of package files

27

3.85%

Lines of code

2039

2.88%

Worsened metrics

Number of medium supply chain risk alerts

5

66.67%

Dependency changes

• + Added

  @isaacs/fs-minipass@4.0.1
  (transitive)

• + Added

  chownr@3.0.0
  (transitive)

• + Added

  isexe@4.0.0
  (transitive)

• + Added

  minipass@7.1.3
  (transitive)

• + Added

  minizlib@3.1.0
  (transitive)

• + Added

  tar@7.5.13
  (transitive)

• + Added

  which@6.0.1
  (transitive)

• + Added

  yallist@5.0.0
  (transitive)

• - Removed

  axios@^1.6.5

• - Removed

  memory-stream@^1.0.0

• - Removed

  npmlog@^6.0.2

• - Removed

  aproba@2.1.0
  (transitive)

• - Removed

  are-we-there-yet@3.0.1
  (transitive)

• - Removed

  async-function@1.0.0
  (transitive)

• - Removed

  async-generator-function@1.0.0
  (transitive)

• - Removed

  asynckit@0.4.0
  (transitive)

• - Removed

  axios@1.13.6
  (transitive)

• - Removed

  call-bind-apply-helpers@1.0.2
  (transitive)

• - Removed

  chownr@2.0.0
  (transitive)

• - Removed

  color-support@1.1.3
  (transitive)

• - Removed

  combined-stream@1.0.8
  (transitive)

• - Removed

  console-control-strings@1.1.0
  (transitive)

• - Removed

  delayed-stream@1.0.0
  (transitive)

• - Removed

  delegates@1.0.0
  (transitive)

• - Removed

  dunder-proto@1.0.1
  (transitive)

• - Removed

  es-define-property@1.0.1
  (transitive)

• - Removed

  es-errors@1.3.0
  (transitive)

• - Removed

  es-object-atoms@1.1.1
  (transitive)

• - Removed

  es-set-tostringtag@2.1.0
  (transitive)

• - Removed

  follow-redirects@1.15.11
  (transitive)

• - Removed

  form-data@4.0.5
  (transitive)

• - Removed

  fs-minipass@2.1.0
  (transitive)

• - Removed

  function-bind@1.1.2
  (transitive)

• - Removed

  gauge@4.0.4
  (transitive)

• - Removed

  generator-function@2.0.1
  (transitive)

• - Removed

  get-intrinsic@1.3.1
  (transitive)

• - Removed

  get-proto@1.0.1
  (transitive)

• - Removed

  gopd@1.2.0
  (transitive)

• - Removed

  has-symbols@1.1.0
  (transitive)

• - Removed

  has-tostringtag@1.0.2
  (transitive)

• - Removed

  has-unicode@2.0.1
  (transitive)

• - Removed

  hasown@2.0.2
  (transitive)

• - Removed

  inherits@2.0.4
  (transitive)

• - Removed

  isexe@2.0.0
  (transitive)

• - Removed

  math-intrinsics@1.1.0
  (transitive)

• - Removed

  memory-stream@1.0.0
  (transitive)

• - Removed

  mime-db@1.52.0
  (transitive)

• - Removed

  mime-types@2.1.35
  (transitive)

• - Removed

  minipass@3.3.65.0.0
  (transitive)

• - Removed

  minizlib@2.1.2
  (transitive)

• - Removed

  mkdirp@1.0.4
  (transitive)

• - Removed

  npmlog@6.0.2
  (transitive)

• - Removed

  proxy-from-env@1.1.0
  (transitive)

• - Removed

  readable-stream@3.6.2
  (transitive)

• - Removed

  safe-buffer@5.2.1
  (transitive)

• - Removed

  set-blocking@2.0.0
  (transitive)

• - Removed

  signal-exit@3.0.7
  (transitive)

• - Removed

  string_decoder@1.3.0
  (transitive)

• - Removed

  tar@6.2.1
  (transitive)

• - Removed

  util-deprecate@1.0.2
  (transitive)

• - Removed

  which@2.0.2
  (transitive)

• - Removed

  wide-align@1.1.5
  (transitive)

• - Removed

  yallist@4.0.0
  (transitive)

• Updated

  debug@^4.4.3

• Updated

  fs-extra@^11.3.3

• Updated

  node-api-headers@^1.8.0

• Updated

  rc@1.2.8

• Updated

  semver@^7.7.3

• Updated

  tar@^7.5.6

• Updated

  which@^6.0.0