node-gyp - npm Package Compare versions

Comparing version 12.2.0 to 12.3.0

.release-please-manifest.json

 {
-    ".": "12.2.0"
+    ".": "12.3.0"
 }

gyp/.release-please-manifest.json

 {
-    ".": "0.21.1"
+    ".": "0.22.1"
 }

gyp/pylib/gyp/__init__.py

@@ -16,2 +16,3 @@ #!/usr/bin/env python3
 import traceback
+from importlib.metadata import version
 
@@ -495,5 +496,3 @@ import gyp.input
     if options.version:
-        import pkg_resources  # noqa: PLC0415
-
-        print(f"v{pkg_resources.get_distribution('gyp-next').version}")
+        print(f"v{version('gyp-next')}")
         return 0
@@ -500,0 +499,0 @@ build_files = build_files_arg

gyp/pylib/gyp/generator/ninja_test.py

@@ -14,22 +14,32 @@ #!/usr/bin/env python3
 from gyp.generator import ninja
+from gyp.MSVSVersion import SelectVisualStudioVersion
 
 
+def _has_visual_studio():
+    """Check if Visual Studio can be detected by gyp's registry-based detection."""
+    if not sys.platform.startswith("win"):
+        return False
+    try:
+        SelectVisualStudioVersion("auto", allow_fallback=False)
+        return True
+    except ValueError:
+        return False
+
+
 class TestPrefixesAndSuffixes(unittest.TestCase):
+    @unittest.skipUnless(
+        _has_visual_studio(),
+        "requires Windows with a Visual Studio installation detected via the registry",
+    )
     def test_BinaryNamesWindows(self):
-        # These cannot run on non-Windows as they require a VS installation to
-        # correctly handle variable expansion.
-        if sys.platform.startswith("win"):
-            writer = ninja.NinjaWriter(
-                "foo", "wee", ".", ".", "build.ninja", ".", "build.ninja", "win"
-            )
-            spec = {"target_name": "wee"}
-            self.assertTrue(
-                writer.ComputeOutputFileName(spec, "executable").endswith(".exe")
-            )
-            self.assertTrue(
-                writer.ComputeOutputFileName(spec, "shared_library").endswith(".dll")
-            )
-            self.assertTrue(
-                writer.ComputeOutputFileName(spec, "static_library").endswith(".lib")
-            )
+        writer = ninja.NinjaWriter(
+            "foo", "wee", ".", ".", "build.ninja", ".", "build.ninja", "win"
+        )
+        spec = {"target_name": "wee"}
+        for key, ext in {
+            "executable": ".exe",
+            "shared_library": ".dll",
+            "static_library": ".lib",
+        }.items():
+            self.assertTrue(writer.ComputeOutputFileName(spec, key).endswith(ext))
 
@@ -36,0 +46,0 @@ def test_BinaryNamesLinux(self):

gyp/pylib/gyp/mac_tool.py

@@ -548,3 +548,3 @@ #!/usr/bin/env python3
         # provisioning profile whose pattern is the longest).
-        selected_key = max(valid_provisioning_profiles, key=lambda v: len(v))
+        selected_key = max(valid_provisioning_profiles, key=len)
         return valid_provisioning_profiles[selected_key]
@@ -551,0 +551,0 @@

gyp/pylib/gyp/msvs_emulation.py

@@ -1177,3 +1177,3 @@ # Copyright (c) 2012 Google Inc. All rights reserved.
     generation and use custom environment files prepared by yourself."""
-    archs = ("x86", "x64")
+    archs = ("x86", "x64", "arm64")
     if generator_flags.get("ninja_use_custom_environment_files", 0):
@@ -1180,0 +1180,0 @@ cl_paths = {}

gyp/pylib/gyp/MSVSVersion.py

@@ -90,3 +90,3 @@ # Copyright (c) 2013 Google Inc. All rights reserved.
         environment."""
-        assert target_arch in ("x86", "x64"), "target_arch not supported"
+        assert target_arch in ("x86", "x64", "arm64"), "target_arch not supported"
         # If WindowsSDKDir is set and SetEnv.Cmd exists then we are using the
@@ -113,4 +113,12 @@ # depot_tools build tools and should run SetEnv.Cmd to set up the
             # Always use a native executable, cross-compiling if necessary.
-            host_arch = "amd64" if is_host_arch_x64 else "x86"
-            msvc_target_arch = "amd64" if target_arch == "x64" else "x86"
+            host_arch = (
+                "amd64"
+                if is_host_arch_x64
+                else (
+                    "arm64"
+                    if os.environ.get("PROCESSOR_ARCHITECTURE") == "ARM64"
+                    else "x86"
+                )
+            )
+            msvc_target_arch = {"x64": "amd64"}.get(target_arch, target_arch)
             arg = host_arch
@@ -117,0 +125,0 @@ if host_arch != msvc_target_arch:

gyp/pylib/gyp/simple_copy.py

@@ -27,4 +27,4 @@ # Copyright 2014 Google Inc. All rights reserved.
         raise Error(
-            "Unsupported type %s for deepcopy. Use copy.deepcopy "
-            + "or expand simple_copy support." % type(x)
+            f"Unsupported type {type(x)} for deepcopy. Use copy.deepcopy "
+            + "or expand simple_copy support."
         )
@@ -31,0 +31,0 @@

gyp/pylib/packaging/metadata.py

@@ -24,23 +24,6 @@ import email.feedparser
 T = typing.TypeVar("T")
-if sys.version_info[:2] >= (3, 8):  # pragma: no cover
-    from typing import Literal, TypedDict
-else:  # pragma: no cover
-    if typing.TYPE_CHECKING:
-        from typing_extensions import Literal, TypedDict
-    else:
-        try:
-            from typing_extensions import Literal, TypedDict
-        except ImportError:
+from typing import Literal, TypedDict
 
-            class Literal:
-                def __init_subclass__(*_args, **_kwargs):
-                    pass
-
-            class TypedDict:
-                def __init_subclass__(*_args, **_kwargs):
-                    pass
-
-
 try:
-    ExceptionGroup
+    ExceptionGroup  # Added in Python 3.11+
 except NameError:  # pragma: no cover
@@ -508,3 +491,3 @@
     def __get__(self, instance: "Metadata", _owner: Type["Metadata"]) -> T:
-        # With Python 3.8, the caching can be replaced with functools.cached_property().
+        # With Python 3.8+, the caching can be replaced with functools.cached_property().
         # No need to check the cache as attribute lookup will resolve into the
@@ -511,0 +494,0 @@ # instance's __dict__ before __get__ is called.

gyp/pylib/packaging/tags.py

@@ -130,6 +130,4 @@ # This file is dual licensed under the terms of the Apache License, Version
     Determine if the Python version supports abi3.
-
-    PEP 384 was first implemented in Python 3.2.
     """
-    return len(python_version) > 1 and tuple(python_version) >= (3, 2)
+    return len(python_version) > 1
 
@@ -150,13 +148,3 @@
         debug = "d"
-    if py_version < (3, 8):
-        with_pymalloc = _get_config_var("WITH_PYMALLOC", warn)
-        if with_pymalloc or with_pymalloc is None:
-            pymalloc = "m"
-        if py_version < (3, 3):
-            unicode_size = _get_config_var("Py_UNICODE_SIZE", warn)
-            if unicode_size == 4 or (
-                unicode_size is None and sys.maxunicode == 0x10FFFF
-            ):
-                ucs4 = "u"
-    elif debug:
+    if debug:
         # Debug builds can also load "normal" extension modules.
@@ -163,0 +151,0 @@ # We can also assume no UCS-4 or pymalloc requirement.

gyp/pyproject.toml

@@ -7,3 +7,3 @@ [build-system]
 name = "gyp-next"
-version = "0.21.1"
+version = "0.22.1"
 authors = [
@@ -15,3 +15,3 @@ { name="Node.js contributors", email="[e-mail]" },
 license = { file="LICENSE" }
-requires-python = ">=3.8"
+requires-python = ">=3.9"
 dependencies = ["packaging>=24.0", "setuptools>=69.5.1"]
@@ -26,6 +26,8 @@ classifiers = [
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.8",
     "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
 ]
@@ -32,0 +34,0 @@

lib/download.js

@@ -1,2 +0,3 @@
-const fetch = require('make-fetch-happen')
+const { Readable } = require('stream')
+const { EnvHttpProxyAgent } = require('undici')
 const { promises: fs } = require('graceful-fs')
@@ -13,17 +14,63 @@ const log = require('./log')
     },
-    proxy: gyp.opts.proxy,
-    noProxy: gyp.opts.noproxy
+    dispatcher: await createDispatcher(gyp)
   }
 
-  const cafile = gyp.opts.cafile
-  if (cafile) {
-    requestOpts.ca = await readCAFile(cafile)
+  let res
+  try {
+    res = await fetch(url, requestOpts)
+  } catch (err) {
+    // Built-in fetch wraps low-level errors in "TypeError: fetch failed" with
+    // the underlying error on .cause. Callers inspect .code (e.g. ENOTFOUND).
+    if (err.cause) {
+      throw err.cause
+    }
+    throw err
   }
 
-  const res = await fetch(url, requestOpts)
   log.http(res.status, res.url)
 
-  return res
+  const body = res.body ? Readable.fromWeb(res.body) : Readable.from([])
+  return {
+    status: res.status,
+    url: res.url,
+    body,
+    text: async () => {
+      let data = ''
+      body.setEncoding('utf8')
+      for await (const chunk of body) {
+        data += chunk
+      }
+      return data
+    }
+  }
 }
 
+async function createDispatcher (gyp) {
+  const env = process.env
+  const hasProxyEnv = env.http_proxy || env.HTTP_PROXY || env.https_proxy || env.HTTPS_PROXY
+  if (!gyp.opts.proxy && !gyp.opts.cafile && !hasProxyEnv) {
+    return undefined
+  }
+
+  const opts = {}
+  if (gyp.opts.cafile) {
+    const ca = await readCAFile(gyp.opts.cafile)
+    // EnvHttpProxyAgent forwards opts to both its internal Agent (direct) and
+    // ProxyAgent (proxied). Agent reads TLS config from `connect`; ProxyAgent
+    // reads it from `requestTls` (origin) / `proxyTls` (proxy). Set all three
+    // so the custom CA is applied regardless of which path a request takes.
+    opts.connect = { ca }
+    opts.requestTls = { ca }
+    opts.proxyTls = { ca }
+  }
+  if (gyp.opts.proxy) {
+    opts.httpProxy = gyp.opts.proxy
+    opts.httpsProxy = gyp.opts.proxy
+  }
+  if (gyp.opts.noproxy) {
+    opts.noProxy = gyp.opts.noproxy
+  }
+  return new EnvHttpProxyAgent(opts)
+}
+
 async function readCAFile (filename) {
@@ -30,0 +77,0 @@ // The CA file can contain multiple certificates so split on certificate

lib/find-visualstudio.js

@@ -250,3 +250,3 @@ 'use strict'
       '-Command',
-      '&{Add-Type -Path \'' + csFile + '\';' + '[VisualStudioConfiguration.Main]::PrintJson()}'
+      '&{Add-Type -IgnoreWarnings -Path \'' + csFile + '\';' + '[VisualStudioConfiguration.Main]::PrintJson()}'
     ]
@@ -253,0 +253,0 @@

lib/process-release.js

@@ -1,7 +0,4 @@
-/* eslint-disable n/no-deprecated-api */
-
 'use strict'
 
 const semver = require('semver')
-const url = require('url')
 const path = require('path')
@@ -77,7 +74,7 @@ const log = require('./log')
   }
-  distBaseUrl += '/v' + version + '/'
+  distBaseUrl = new URL(distBaseUrl + '/v' + version + '/')
 
   // new style, based on process.release so we have a lot of the data we need
   if (defaultRelease && defaultRelease.headersUrl && !overrideDistUrl) {
-    baseUrl = url.resolve(defaultRelease.headersUrl, './')
+    baseUrl = new URL('./', defaultRelease.headersUrl)
     libUrl32 = resolveLibUrl(name, defaultRelease.libUrl || baseUrl || distBaseUrl, 'x86', versionSemver.major)
@@ -100,3 +97,3 @@ libUrl64 = resolveLibUrl(name, defaultRelease.libUrl || baseUrl || distBaseUrl, 'x64', versionSemver.major)
     canGetHeaders = semver.satisfies(versionSemver, headersTarballRange)
-    tarballUrl = url.resolve(baseUrl, name + '-v' + version + (canGetHeaders ? '-headers' : '') + '.tar.gz')
+    tarballUrl = new URL(name + '-v' + version + (canGetHeaders ? '-headers' : '') + '.tar.gz', baseUrl).href
   }
@@ -108,17 +105,17 @@
     name,
-    baseUrl,
+    baseUrl: baseUrl.href,
     tarballUrl,
-    shasumsUrl: url.resolve(baseUrl, 'SHASUMS256.txt'),
+    shasumsUrl: new URL('SHASUMS256.txt', baseUrl).href,
     versionDir: (name !== 'node' ? name + '-' : '') + version,
     ia32: {
-      libUrl: libUrl32,
-      libPath: normalizePath(path.relative(new URL(baseUrl).pathname, new URL(libUrl32).pathname))
+      libUrl: libUrl32.href,
+      libPath: normalizePath(path.relative(baseUrl.pathname, libUrl32.pathname))
     },
     x64: {
-      libUrl: libUrl64,
-      libPath: normalizePath(path.relative(new URL(baseUrl).pathname, new URL(libUrl64).pathname))
+      libUrl: libUrl64.href,
+      libPath: normalizePath(path.relative(baseUrl.pathname, libUrl64.pathname))
     },
     arm64: {
-      libUrl: libUrlArm64,
-      libPath: normalizePath(path.relative(new URL(baseUrl).pathname, new URL(libUrlArm64).pathname))
+      libUrl: libUrlArm64.href,
+      libPath: normalizePath(path.relative(baseUrl.pathname, libUrlArm64.pathname))
     }
@@ -133,4 +130,5 @@ }
 function resolveLibUrl (name, defaultUrl, arch, versionMajor) {
-  const base = url.resolve(defaultUrl, './')
-  const hasLibUrl = bitsre.test(defaultUrl) || (versionMajor === 3 && bitsreV3.test(defaultUrl))
+  if (!defaultUrl.pathname) defaultUrl = new URL(defaultUrl)
+  const base = new URL('./', defaultUrl)
+  const hasLibUrl = bitsre.test(defaultUrl.pathname) || (versionMajor === 3 && bitsreV3.test(defaultUrl.pathname))
 
@@ -140,12 +138,12 @@ if (!hasLibUrl) {
     if (versionMajor >= 1) {
-      return url.resolve(base, 'win-' + arch + '/' + name + '.lib')
+      return new URL('win-' + arch + '/' + name + '.lib', base)
     }
     // prior to io.js@1.0.0 32-bit node.lib lives in /, 64-bit lives in /x64/
-    return url.resolve(base, (arch === 'x86' ? '' : arch + '/') + name + '.lib')
+    return new URL((arch === 'x86' ? '' : arch + '/') + name + '.lib', base)
   }
 
   // else we have a proper url to a .lib, just make sure it's the right arch
-  return defaultUrl.replace(versionMajor === 3 ? bitsreV3 : bitsre, '/win-' + arch + '/')
+  return new URL(defaultUrl.pathname.replace(versionMajor === 3 ? bitsreV3 : bitsre, '/win-' + arch + '/'), defaultUrl)
 }
 
 module.exports = processRelease

package.json

@@ -14,3 +14,3 @@ {
   ],
-  "version": "12.2.0",
+  "version": "12.3.0",
   "installVersion": 11,
@@ -29,3 +29,2 @@ "author": "Nathan Rajlich <[e-mail]> (http://tootallnate.net)",
     "graceful-fs": "^4.2.6",
-    "make-fetch-happen": "^15.0.0",
     "nopt": "^9.0.0",
@@ -36,2 +35,3 @@ "proc-log": "^6.0.0",
     "tinyglobby": "^0.2.12",
+    "undici": "^6.25.0",
     "which": "^6.0.0"
@@ -48,3 +48,3 @@ },
     "nan": "^2.23.1",
-    "neostandard": "^0.12.2",
+    "neostandard": "^0.13.0",
     "require-inject": "^1.4.4"
@@ -51,0 +51,0 @@ },

New alerts

Potential vulnerability

Supply chain risk

Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.

Found 2 instances

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Fixed alerts

Potential vulnerability

Supply chain risk

Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.

Found 2 instances

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

1875365

0.12%

Lines of code

35668

0.1%

Number of medium supply chain risk alerts

5

-16.67%

Worsened metrics

Number of low supply chain risk alerts

39

2.63%

Dependency changes

• + Added

  undici@^6.25.0

• + Added

  undici@6.27.0
  (transitive)

• - Removed

  make-fetch-happen@^15.0.0

• - Removed

  @gar/promise-retry@1.0.3
  (transitive)

• - Removed

  @npmcli/agent@4.0.2
  (transitive)

• - Removed

  @npmcli/fs@5.0.0
  (transitive)

• - Removed

  @npmcli/redact@4.0.0
  (transitive)

• - Removed

  agent-base@7.1.4
  (transitive)

• - Removed

  balanced-match@4.0.4
  (transitive)

• - Removed

  brace-expansion@5.0.7
  (transitive)

• - Removed

  cacache@20.0.4
  (transitive)

• - Removed

  debug@4.4.3
  (transitive)

• - Removed

  fs-minipass@3.0.3
  (transitive)

• - Removed

  glob@13.0.6
  (transitive)

• - Removed

  http-cache-semantics@4.2.0
  (transitive)

• - Removed

  http-proxy-agent@7.0.2
  (transitive)

• - Removed

  https-proxy-agent@7.0.6
  (transitive)

• - Removed

  iconv-lite@0.7.2
  (transitive)

• - Removed

  ip-address@10.2.0
  (transitive)

• - Removed

  lru-cache@11.5.1
  (transitive)

• - Removed

  make-fetch-happen@15.0.6
  (transitive)

• - Removed

  minimatch@10.2.5
  (transitive)

• - Removed

  minipass@3.3.6
  (transitive)

• - Removed

  minipass-collect@2.0.1
  (transitive)

• - Removed

  minipass-fetch@5.0.2
  (transitive)

• - Removed

  minipass-flush@1.0.7
  (transitive)

• - Removed

  minipass-pipeline@1.2.4
  (transitive)

• - Removed

  minipass-sized@2.0.0
  (transitive)

• - Removed

  ms@2.1.3
  (transitive)

• - Removed

  negotiator@1.0.0
  (transitive)

• - Removed

  p-map@7.0.5
  (transitive)

• - Removed

  path-scurry@2.0.2
  (transitive)

• - Removed

  safer-buffer@2.1.2
  (transitive)

• - Removed

  smart-buffer@4.2.0
  (transitive)

• - Removed

  socks@2.8.9
  (transitive)

• - Removed

  socks-proxy-agent@8.0.5
  (transitive)

• - Removed

  ssri@13.0.1
  (transitive)

• - Removed

  yallist@4.0.0
  (transitive)