node-gyp - npm Package Compare versions

Comparing version 12.1.0 to 12.2.0

.release-please-manifest.json

 {
-    ".": "12.1.0"
+    ".": "12.2.0"
 }

bin/node-gyp.js

@@ -128,2 +128,9 @@ #!/usr/bin/env node
   log.error('node-gyp -v', 'v' + prog.package.version)
+  // print the npm package version
+  for (const env of ['npm_package_name', 'npm_package_version']) {
+    const value = process.env[env]
+    if (value != null) {
+      log.error(`$${env}`, value)
+    }
+  }
 }
@@ -130,0 +137,0 @@

CONTRIBUTING.md

 # Contributing to node-gyp
 
+## Making changes to gyp-next
+
+Changes in the subfolder `gyp/` should be submitted to the
+[`gyp-next`][] repository first. The `gyp/` folder is regularly
+synced from [`gyp-next`][] with GitHub Actions workflow
+[`update-gyp-next.yml`](.github/workflows/update-gyp-next.yml),
+and any changes in this folder would be overridden by the workflow.
+
 ## Code of Conduct
@@ -35,1 +43,3 @@
   this project or the open source license(s) involved.
+
+[`gyp-next`]: https://github.com/nodejs/gyp-next

gyp/.release-please-manifest.json

 {
-    ".": "0.21.0"
+    ".": "0.21.1"
 }

gyp/pylib/gyp/MSVSNew.py

@@ -37,3 +37,3 @@ # Copyright (c) 2012 Google Inc. All rights reserved.
       name: Target name.
-      seed: Seed for MD5 hash.
+      seed: Seed for SHA-256 hash.
     Returns:
@@ -48,4 +48,4 @@ A GUID-line string calculated from the name and seed.
     """
-    # Calculate a MD5 signature for the seed and name.
-    d = hashlib.md5((str(seed) + str(name)).encode("utf-8")).hexdigest().upper()
+    # Calculate a SHA-256 signature for the seed and name.
+    d = hashlib.sha256((str(seed) + str(name)).encode("utf-8")).hexdigest().upper()
     # Convert most of the signature to GUID form (discard the rest)
@@ -52,0 +52,0 @@ guid = (

gyp/pyproject.toml

@@ -7,3 +7,3 @@ [build-system]
 name = "gyp-next"
-version = "0.21.0"
+version = "0.21.1"
 authors = [
@@ -10,0 +10,0 @@ { name="Node.js contributors", email="[e-mail]" },

lib/build.js

@@ -166,3 +166,3 @@ 'use strict'
         } else if (jobs.toUpperCase() === 'MAX') {
-          argv.push('/m:' + require('os').cpus().length)
+          argv.push('/m:' + require('os').availableParallelism())
         }
@@ -182,3 +182,3 @@ }
           argv.push('--jobs')
-          argv.push(require('os').cpus().length)
+          argv.push(require('os').availableParallelism())
         }
@@ -185,0 +185,0 @@ }

lib/find-python.js

@@ -89,10 +89,6 @@ 'use strict'
             if (!this.configPython) {
-              this.addLog(
-                'Python is not set from command line or npm configuration')
+              this.addLog('--python was not set on the command line')
               return SKIP
             }
-            this.addLog('checking Python explicitly set from command line or ' +
-              'npm configuration')
-            this.addLog('- "--python=" or "npm config get python" is ' +
-              `"${this.configPython}"`)
+            this.addLog(`--python=${this.configPython} was set on the command line`)
           },
@@ -299,4 +295,2 @@ check: () => this.checkCommand(this.configPython)
       '- Set the environment variable PYTHON',
-      '- Set the npm configuration variable python:',
-      `  npm config set python "${pathExample}"`,
       'For more information consult the documentation at:',
@@ -303,0 +297,0 @@ 'https://github.com/nodejs/node-gyp#installation',

lib/find-visualstudio.js

@@ -33,3 +33,3 @@ 'use strict'
     if (this.configMsvsVersion) {
-      this.addLog('msvs_version was set from command line or npm config')
+      this.addLog(`--msvs_version=${this.configMsvsVersion} was set on the command line`)
       if (this.configMsvsVersion.match(/^\d{4}$/)) {
@@ -45,3 +45,3 @@ this.configVersionYear = parseInt(this.configMsvsVersion, 10)
     } else {
-      this.addLog('msvs_version not set from command line or npm config')
+      this.addLog('--msvs_version was not set on the command line')
     }
@@ -48,0 +48,0 @@

lib/install.js

@@ -201,3 +201,3 @@ 'use strict'
     // download the tarball and extract!
-    // Ommited on Windows if only new node.lib is required
+    // Omitted on Windows if only new node.lib is required
 
@@ -204,0 +204,0 @@ // there can be file errors from tar if parallel installs

lib/process-release.js

@@ -112,11 +112,11 @@ /* eslint-disable n/no-deprecated-api */
       libUrl: libUrl32,
-      libPath: normalizePath(path.relative(url.parse(baseUrl).path, url.parse(libUrl32).path))
+      libPath: normalizePath(path.relative(new URL(baseUrl).pathname, new URL(libUrl32).pathname))
     },
     x64: {
       libUrl: libUrl64,
-      libPath: normalizePath(path.relative(url.parse(baseUrl).path, url.parse(libUrl64).path))
+      libPath: normalizePath(path.relative(new URL(baseUrl).pathname, new URL(libUrl64).pathname))
     },
     arm64: {
       libUrl: libUrlArm64,
-      libPath: normalizePath(path.relative(url.parse(baseUrl).path, url.parse(libUrlArm64).path))
+      libPath: normalizePath(path.relative(new URL(baseUrl).pathname, new URL(libUrlArm64).pathname))
     }
@@ -123,0 +123,0 @@ }

package.json

@@ -14,3 +14,3 @@ {
   ],
-  "version": "12.1.0",
+  "version": "12.2.0",
   "installVersion": 11,
@@ -33,3 +33,3 @@ "author": "Nathan Rajlich <[e-mail]> (http://tootallnate.net)",
     "semver": "^7.3.5",
-    "tar": "^7.5.2",
+    "tar": "^7.5.4",
     "tinyglobby": "^0.2.12",
@@ -36,0 +36,0 @@ "which": "^6.0.0"

README.md

@@ -58,9 +58,7 @@ # `node-gyp` - Node.js native addon build tool
 
-  * Install the current [version of Python](https://devguide.python.org/versions/) from the
-  [Microsoft Store](https://apps.microsoft.com/store/search?publisher=Python+Software+Foundation).
+  * Follow the instructions in [Using Python on Windows](https://docs.python.org/3/using/windows.html) to install
+    the current [version of Python](https://www.python.org/downloads/).
 
    * Install Visual C++ Build Environment: For Visual Studio 2019 or later, use the `Desktop development with C++` workload from [Visual Studio Community](https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=Community).  For a version older than Visual Studio 2019, install [Visual Studio Build Tools](https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=BuildTools) with the `Visual C++ build tools` option.
 
-   If the above steps didn't work for you, please visit [Microsoft's Node.js Guidelines for Windows](https://github.com/Microsoft/nodejs-guidelines/blob/master/windows-environment.md#compiling-native-addon-modules) for additional tips.
-
    To target native ARM64 Node.js on Windows on ARM, add the components "Visual C++ compilers and libraries for ARM64" and "Visual C++ ATL for ARM64".
@@ -70,4 +68,4 @@
 
-It's advised to install following Powershell module: [VSSetup](https://github.com/microsoft/vssetup.powershell) using `Install-Module VSSetup -Scope CurrentUser`.
-This will make Visual Studio detection logic to use more flexible and accessible method, avoiding Powershell's `ConstrainedLanguage` mode.
+It's advised to install the following PowerShell module: [VSSetup](https://github.com/microsoft/vssetup.powershell) using `Install-Module VSSetup -Scope CurrentUser`.
+This will make Visual Studio detection logic use a more flexible and accessible method, avoiding PowerShell's `ConstrainedLanguage` mode.
 
@@ -275,4 +273,4 @@ ### Configuring Python Dependency
 Note that in versions of npm before v11 it was possible to use the prefix `npm_config_` for
-environement variables. This was deprecated in npm@11 and will be removed in npm@12 so it
-is recommened to convert your environment variables to the above format.
+environment variables. This was deprecated in npm@11 and will be removed in npm@12 so it
+is recommended to convert your environment variables to the above format.
 
@@ -279,0 +277,0 @@ ### `npm` configuration for npm versions before v9

New alerts

Potential vulnerability

Supply chain risk

Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.

Found 2 instances

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Potential vulnerability

Supply chain risk

Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1873194

0.15%

Worsened metrics

Number of lines in readme file

291

-0.68%

Number of low supply chain risk alerts

38

2.7%

Number of medium supply chain risk alerts

6

20%

Dependency changes

• Updated

  tar@^7.5.4