node-pre-gyp
Advanced tools
Comparing version 0.6.25 to 0.6.26
# node-pre-gyp changelog | ||
## 0.6.27 | ||
- Stopped bundling dependencies | ||
- Documented method for module authors to avoid bundling node-pre-gyp | ||
- See https://github.com/mapbox/node-pre-gyp/tree/master#configuring for details | ||
## 0.6.26 | ||
- Skip validation for nw runtime (https://github.com/mapbox/node-pre-gyp/pull/181) via @fleg | ||
## 0.6.25 | ||
- Improved support for auto-detection of electron runtime in `node-pre-gyp.find()` | ||
- Pull request from @enlight - https://github.com/mapbox/node-pre-gyp/pull/187 | ||
- Add known node version for 4.4.1 and 5.9.1 | ||
@@ -7,0 +18,0 @@ |
@@ -23,2 +23,11 @@ "use strict"; | ||
var nw = (opts.runtime && opts.runtime === 'node-webkit'); | ||
if ((process.arch != opts.target_arch) || | ||
(process.platform != opts.target_platform)) { | ||
var msg = "skipping validation since host platform/arch ("; | ||
msg += process.platform+'/'+process.arch+")"; | ||
msg += " does not match target ("; | ||
msg += opts.target_platform+'/'+opts.target_arch+")"; | ||
log.info('validate', msg); | ||
return callback(); | ||
} | ||
if (nw) { | ||
@@ -56,11 +65,2 @@ options.timeout = 5000; | ||
} | ||
if ((process.arch != opts.target_arch) || | ||
(process.platform != opts.target_platform)) { | ||
var msg = "skipping validation since host platform/arch ("; | ||
msg += process.platform+'/'+process.arch+")"; | ||
msg += " does not match target ("; | ||
msg += opts.target_platform+'/'+opts.target_arch+")"; | ||
log.info('validate', msg); | ||
return callback(); | ||
} | ||
args.push('--eval'); | ||
@@ -67,0 +67,0 @@ args.push("'require(\\'" + binary_module.replace(/\'/g, '\\\'') +"\\')'"); |
@@ -786,2 +786,6 @@ { | ||
}, | ||
"0.10.44": { | ||
"node_abi": 11, | ||
"v8": "3.14" | ||
}, | ||
"0.11.0": { | ||
@@ -907,2 +911,6 @@ "node_abi": 12, | ||
}, | ||
"0.12.13": { | ||
"node_abi": 14, | ||
"v8": "3.28" | ||
}, | ||
"1.0.0": { | ||
@@ -1136,2 +1144,6 @@ "node_abi": 42, | ||
}, | ||
"4.4.2": { | ||
"node_abi": 46, | ||
"v8": "4.5" | ||
}, | ||
"5.0.0": { | ||
@@ -1192,3 +1204,11 @@ "node_abi": 47, | ||
"v8": "4.6" | ||
}, | ||
"5.10.0": { | ||
"node_abi": 47, | ||
"v8": "4.6" | ||
}, | ||
"5.10.1": { | ||
"node_abi": 47, | ||
"v8": "4.6" | ||
} | ||
} |
{ | ||
"name": "node-pre-gyp", | ||
"description": "Node.js native addon binary install tool", | ||
"version" : "0.6.25", | ||
"version" : "0.6.26", | ||
"keywords": [ | ||
@@ -14,3 +14,3 @@ "native", | ||
], | ||
"license": "BSD", | ||
"license": "BSD-3-Clause", | ||
"author": "Dane Springmeyer <dane@mapbox.com>", | ||
@@ -24,25 +24,14 @@ "repository": { | ||
"dependencies": { | ||
"mkdirp": "~0.5.0", | ||
"nopt": "~3.0.1", | ||
"npmlog": "~2.0.0", | ||
"rc": "~1.1.0", | ||
"request": "2.x", | ||
"rimraf": "~2.5.0", | ||
"semver": "~5.1.0", | ||
"tar": "~2.2.0", | ||
"tar-pack": "~3.1.0", | ||
"mkdirp": "~0.5.0", | ||
"rc": "~1.1.0", | ||
"rimraf": "~2.5.0" | ||
"tar-pack": "~3.1.0" | ||
}, | ||
"bundledDependencies":[ | ||
"nopt", | ||
"npmlog", | ||
"request", | ||
"semver", | ||
"tar", | ||
"tar-pack", | ||
"mkdirp", | ||
"rc", | ||
"rimraf" | ||
], | ||
"devDependencies": { | ||
"aws-sdk":"2.x", | ||
"aws-sdk": "2.x", | ||
"mocha": "2.x", | ||
@@ -61,6 +50,6 @@ "retire": "1.x", | ||
"scripts": { | ||
"prepublish":"retire -n && npm ls && jshint test/build.test.js test/s3_setup.test.js test/versioning.test.js", | ||
"update-crosswalk":"node scripts/abi_crosswalk.js", | ||
"test":"jshint lib lib/util scripts bin/node-pre-gyp && mocha -R spec --timeout 500000" | ||
"prepublish": "retire -n && npm ls && jshint test/build.test.js test/s3_setup.test.js test/versioning.test.js", | ||
"update-crosswalk": "node scripts/abi_crosswalk.js", | ||
"test": "jshint lib lib/util scripts bin/node-pre-gyp && mocha -R spec --timeout 500000" | ||
} | ||
} |
@@ -15,3 +15,3 @@ # node-pre-gyp | ||
- A command line tool called `node-pre-gyp` that can install your package's c++ module from a binary. | ||
- A command line tool called `node-pre-gyp` that can install your package's C++ module from a binary. | ||
- A variety of developer targeted commands for packaging, testing, and publishing binaries. | ||
@@ -75,2 +75,3 @@ - A Javascript module that can dynamically require your installed binary: `require('node-pre-gyp').find` | ||
- `--build-from-source`: build from source instead of using pre-built binary | ||
- `--update-binary`: reinstall by replacing previously installed local binary with remote binary | ||
- `--runtime=node-webkit`: customize the runtime: `node`, `electron` and `node-webkit` are the valid options | ||
@@ -96,3 +97,3 @@ - `--fallback-to-build`: fallback to building from source if pre-built binary is not available | ||
- Add `node-pre-gyp` to `bundledDependencies` | ||
- Add `node-pre-gyp` to `dependencies` | ||
- Add `aws-sdk` as a `devDependency` | ||
@@ -106,10 +107,10 @@ - Add a custom `install` script | ||
"dependencies" : { | ||
"node-pre-gyp": "0.5.x" | ||
"node-pre-gyp": "0.6.x" | ||
}, | ||
"bundledDependencies":["node-pre-gyp"], | ||
"devDependencies": { | ||
"aws-sdk": "~2.0.0-rc.15" | ||
"aws-sdk": "2.x" | ||
} | ||
"scripts": { | ||
"install": "node-pre-gyp install --fallback-to-build", | ||
"preinstall": "npm install node-pre-gyp", | ||
"install": "node-pre-gyp install --fallback-to-build" | ||
}, | ||
@@ -123,3 +124,3 @@ "binary": { | ||
For a full example see [node-addon-examples's package.json](https://github.com/springmeyer/node-addon-example/blob/2ff60a8ded7f042864ad21db00c3a5a06cf47075/package.json#L11-L22). | ||
For a full example see [node-addon-examples's package.json](https://github.com/springmeyer/node-addon-example/blob/master/package.json). | ||
@@ -149,3 +150,3 @@ ##### The `binary` object has three required properties | ||
- Various node-pre-gyp commands like `publish` and `info` only work with an S3 host. | ||
- S3 is a very solid hosting platform for distributing large files, even [Github recommends using it instead of github](https://help.github.com/articles/distributing-large-binaries). | ||
- S3 is a very solid hosting platform for distributing large files. | ||
- We provide detail documentation for using [S3 hosting](#s3-hosting) with node-pre-gyp. | ||
@@ -282,3 +283,3 @@ | ||
You can host wherever you choose but S3 is cheap, `node-pre-gyp publish` expects it, and S3 can be integrated well with [travis.ci](http://travis-ci.org) to automate builds for OS X and Ubuntu. Here is an approach to do this: | ||
You can host wherever you choose but S3 is cheap, `node-pre-gyp publish` expects it, and S3 can be integrated well with [Travis.ci](http://travis-ci.org) to automate builds for OS X and Ubuntu, and with [Appveyor](http://appveyor.com) to automate builds for Windows. Here is an approach to do this: | ||
@@ -402,3 +403,3 @@ First, get setup locally and test the workflow: | ||
NOTE: keys are per account but not per repo (this is difference than travis where keys are per repo but not related to the account used to encrypt them). | ||
NOTE: keys are per account but not per repo (this is difference than Travis where keys are per repo but not related to the account used to encrypt them). | ||
@@ -411,3 +412,3 @@ #### 5) Hook up publishing | ||
You might wish to publish binaries only on a specific commit. To do this you could borrow from the [travis.ci idea of commit keywords](http://about.travis-ci.org/docs/user/how-to-skip-a-build/) and add special handling for commit messages with `[publish binary]`: | ||
You might wish to publish binaries only on a specific commit. To do this you could borrow from the [Travis.ci idea of commit keywords](http://about.travis-ci.org/docs/user/how-to-skip-a-build/) and add special handling for commit messages with `[publish binary]`: | ||
@@ -421,5 +422,4 @@ SET CM=%APPVEYOR_REPO_COMMIT_MESSAGE% | ||
Remember this publishing is not the same as `npm publish`. We're just talking about the binary module here and not your entire npm package. To automate the publishing of your entire package to npm on travis see http://about.travis-ci.org/docs/user/deployment/npm/ | ||
Remember this publishing is not the same as `npm publish`. We're just talking about the binary module here and not your entire npm package. | ||
## Travis Automation | ||
@@ -434,7 +434,7 @@ | ||
Note: if you need 32 bit binaries, this can be done from a 64 bit travis machine. See [the node-sqlite3 scripts for an example of doing this](https://github.com/mapbox/node-sqlite3/blob/bae122aa6a2b8a45f6b717fab24e207740e32b5d/scripts/build_against_node.sh#L54-L74). | ||
Note: if you need 32 bit binaries, this can be done from a 64 bit Travis machine. See [the node-sqlite3 scripts for an example of doing this](https://github.com/mapbox/node-sqlite3/blob/bae122aa6a2b8a45f6b717fab24e207740e32b5d/scripts/build_against_node.sh#L54-L74). | ||
Below is a guide to getting set up: | ||
#### 1) Install the travis gem | ||
#### 1) Install the Travis gem | ||
@@ -461,3 +461,3 @@ gem install travis | ||
More details on travis encryption at http://about.travis-ci.org/docs/user/encryption-keys/. | ||
More details on Travis encryption at http://about.travis-ci.org/docs/user/encryption-keys/. | ||
@@ -540,5 +540,5 @@ #### 3) Hook up publishing | ||
You might wish to publish binaries only on a specific commit. To do this you could borrow from the [travis.ci idea of commit keywords](http://about.travis-ci.org/docs/user/how-to-skip-a-build/) and add special handling for commit messages with `[publish binary]`: | ||
You might wish to publish binaries only on a specific commit. To do this you could borrow from the [Travis.ci idea of commit keywords](http://about.travis-ci.org/docs/user/how-to-skip-a-build/) and add special handling for commit messages with `[publish binary]`: | ||
COMMIT_MESSAGE=$(git show -s --format=%B $TRAVIS_COMMIT | tr -d '\n') | ||
COMMIT_MESSAGE=$(git log --format=%B --no-merges -n 1 | tr -d '\n') | ||
if [[ ${COMMIT_MESSAGE} =~ "[publish binary]" ]]; then node-pre-gyp publish; fi; | ||
@@ -554,4 +554,6 @@ | ||
Remember this publishing is not the same as `npm publish`. We're just talking about the binary module here and not your entire npm package. To automate the publishing of your entire package to npm on travis see http://about.travis-ci.org/docs/user/deployment/npm/ | ||
WARNING: if you are working in a pull request and publishing binaries from there then you will want to avoid double publishing when Travis.ci builds both the `push` and `pr`. You only want to run the publish on the `push` commit. See https://github.com/Project-OSRM/node-osrm/blob/8eb837abe2e2e30e595093d16e5354bc5c573575/scripts/is_pr_merge.sh which is called from https://github.com/Project-OSRM/node-osrm/blob/8eb837abe2e2e30e595093d16e5354bc5c573575/scripts/publish.sh for an example of how to do this. | ||
Remember this publishing is not the same as `npm publish`. We're just talking about the binary module here and not your entire npm package. To automate the publishing of your entire package to npm on Travis see http://about.travis-ci.org/docs/user/deployment/npm/ | ||
# Versioning | ||
@@ -558,0 +560,0 @@ |
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
Major refactor
Supply chain riskPackage has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.
Found 1 instance in 1 package
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
Misc. License Issues
License(Experimental) A package's licensing information has fine-grained problems.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 7 instances in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Uses eval
Supply chain riskPackage uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 21 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 4 instances in 1 package
Minified code
QualityThis package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.
Found 1 instance in 1 package
Mixed license
License(Experimental) Package contains multiple licenses.
Found 1 instance in 1 package
Non-permissive License
License(Experimental) A license not known to be considered permissive was found.
Found 2 instances in 1 package
Unidentified License
License(Experimental) Something that seems like a license was found, but its contents could not be matched with a known license.
Found 1 instance in 1 package
0
0
100
2
573
32
3
111453
29
2499