node-pre-gyp - npm Package Compare versions

Comparing version 0.6.25 to 0.6.26

CHANGELOG.md

 # node-pre-gyp changelog
 
+## 0.6.27
+
+ - Stopped bundling dependencies
+ - Documented method for module authors to avoid bundling node-pre-gyp
+   - See https://github.com/mapbox/node-pre-gyp/tree/master#configuring for details
+
+## 0.6.26
+
+ - Skip validation for nw runtime (https://github.com/mapbox/node-pre-gyp/pull/181) via @fleg
+
 ## 0.6.25
 
  - Improved support for auto-detection of electron runtime in `node-pre-gyp.find()`
+   - Pull request from @enlight - https://github.com/mapbox/node-pre-gyp/pull/187
  - Add known node version for 4.4.1 and 5.9.1
@@ -7,0 +18,0 @@

lib/testbinary.js

@@ -23,2 +23,11 @@ "use strict";
     var nw = (opts.runtime && opts.runtime === 'node-webkit');
+    if ((process.arch != opts.target_arch) ||
+        (process.platform != opts.target_platform)) {
+        var msg = "skipping validation since host platform/arch (";
+        msg += process.platform+'/'+process.arch+")";
+        msg += " does not match target (";
+        msg += opts.target_platform+'/'+opts.target_arch+")";
+        log.info('validate', msg);
+        return callback();
+    }
     if (nw) {
@@ -56,11 +65,2 @@ options.timeout = 5000;
     }
-    if ((process.arch != opts.target_arch) ||
-        (process.platform != opts.target_platform)) {
-        var msg = "skipping validation since host platform/arch (";
-        msg += process.platform+'/'+process.arch+")";
-        msg += " does not match target (";
-        msg += opts.target_platform+'/'+opts.target_arch+")";
-        log.info('validate', msg);
-        return callback();
-    }
     args.push('--eval');
@@ -67,0 +67,0 @@ args.push("'require(\\'" + binary_module.replace(/\'/g, '\\\'') +"\\')'");

lib/util/abi_crosswalk.json

@@ -786,2 +786,6 @@ {
   },
+  "0.10.44": {
+    "node_abi": 11,
+    "v8": "3.14"
+  },
   "0.11.0": {
@@ -907,2 +911,6 @@ "node_abi": 12,
   },
+  "0.12.13": {
+    "node_abi": 14,
+    "v8": "3.28"
+  },
   "1.0.0": {
@@ -1136,2 +1144,6 @@ "node_abi": 42,
   },
+  "4.4.2": {
+    "node_abi": 46,
+    "v8": "4.5"
+  },
   "5.0.0": {
@@ -1192,3 +1204,11 @@ "node_abi": 47,
     "v8": "4.6"
+  },
+  "5.10.0": {
+    "node_abi": 47,
+    "v8": "4.6"
+  },
+  "5.10.1": {
+    "node_abi": 47,
+    "v8": "4.6"
   }
 }

package.json

 {
   "name": "node-pre-gyp",
   "description": "Node.js native addon binary install tool",
-  "version" : "0.6.25",
+  "version" : "0.6.26",
   "keywords": [
@@ -14,3 +14,3 @@ "native",
   ],
-  "license": "BSD",
+  "license": "BSD-3-Clause",
   "author": "Dane Springmeyer <[e-mail]>",
@@ -24,25 +24,14 @@ "repository": {
   "dependencies": {
+    "mkdirp": "~0.5.0",
     "nopt": "~3.0.1",
     "npmlog": "~2.0.0",
+    "rc": "~1.1.0",
     "request": "2.x",
+    "rimraf": "~2.5.0",
     "semver": "~5.1.0",
     "tar": "~2.2.0",
-    "tar-pack": "~3.1.0",
-    "mkdirp": "~0.5.0",
-    "rc": "~1.1.0",
-    "rimraf": "~2.5.0"
+    "tar-pack": "~3.1.0"
   },
-  "bundledDependencies":[
-    "nopt",
-    "npmlog",
-    "request",
-    "semver",
-    "tar",
-    "tar-pack",
-    "mkdirp",
-    "rc",
-    "rimraf"
-  ],
   "devDependencies": {
-    "aws-sdk":"2.x",
+    "aws-sdk": "2.x",
     "mocha": "2.x",
@@ -61,6 +50,6 @@ "retire": "1.x",
   "scripts": {
-    "prepublish":"retire -n && npm ls && jshint test/build.test.js test/s3_setup.test.js test/versioning.test.js",
-    "update-crosswalk":"node scripts/abi_crosswalk.js",
-    "test":"jshint lib lib/util scripts bin/node-pre-gyp && mocha -R spec --timeout 500000"
+    "prepublish": "retire -n && npm ls && jshint test/build.test.js test/s3_setup.test.js test/versioning.test.js",
+    "update-crosswalk": "node scripts/abi_crosswalk.js",
+    "test": "jshint lib lib/util scripts bin/node-pre-gyp && mocha -R spec --timeout 500000"
   }
 }

README.md

@@ -15,3 +15,3 @@ # node-pre-gyp
 
- - A command line tool called `node-pre-gyp` that can install your package's c++ module from a binary.
+ - A command line tool called `node-pre-gyp` that can install your package's C++ module from a binary.
  - A variety of developer targeted commands for packaging, testing, and publishing binaries.
@@ -75,2 +75,3 @@ - A Javascript module that can dynamically require your installed binary: `require('node-pre-gyp').find`
  - `--build-from-source`: build from source instead of using pre-built binary
+ - `--update-binary`: reinstall by replacing previously installed local binary with remote binary
  - `--runtime=node-webkit`: customize the runtime: `node`, `electron` and `node-webkit` are the valid options
@@ -96,3 +97,3 @@ - `--fallback-to-build`: fallback to building from source if pre-built binary is not available
 
- - Add `node-pre-gyp` to `bundledDependencies`
+ - Add `node-pre-gyp` to `dependencies`
  - Add `aws-sdk` as a `devDependency`
@@ -106,10 +107,10 @@ - Add a custom `install` script
     "dependencies"  : {
-      "node-pre-gyp": "0.5.x"
+      "node-pre-gyp": "0.6.x"
     },
-    "bundledDependencies":["node-pre-gyp"],
     "devDependencies": {
-      "aws-sdk": "~2.0.0-rc.15"
+      "aws-sdk": "2.x"
     }
     "scripts": {
-        "install": "node-pre-gyp install --fallback-to-build",
+        "preinstall": "npm install node-pre-gyp",
+        "install": "node-pre-gyp install --fallback-to-build"
     },
@@ -123,3 +124,3 @@ "binary": {
 
-For a full example see [node-addon-examples's package.json](https://github.com/springmeyer/node-addon-example/blob/2ff60a8ded7f042864ad21db00c3a5a06cf47075/package.json#L11-L22).
+For a full example see [node-addon-examples's package.json](https://github.com/springmeyer/node-addon-example/blob/master/package.json).
 
@@ -149,3 +150,3 @@ ##### The `binary` object has three required properties
   - Various node-pre-gyp commands like `publish` and `info` only work with an S3 host.
-  - S3 is a very solid hosting platform for distributing large files, even [Github recommends using it instead of github](https://help.github.com/articles/distributing-large-binaries).
+  - S3 is a very solid hosting platform for distributing large files.
   - We provide detail documentation for using [S3 hosting](#s3-hosting) with node-pre-gyp.
@@ -282,3 +283,3 @@
 
-You can host wherever you choose but S3 is cheap, `node-pre-gyp publish` expects it, and S3 can be integrated well with [travis.ci](http://travis-ci.org) to automate builds for OS X and Ubuntu. Here is an approach to do this:
+You can host wherever you choose but S3 is cheap, `node-pre-gyp publish` expects it, and S3 can be integrated well with [Travis.ci](http://travis-ci.org) to automate builds for OS X and Ubuntu, and with [Appveyor](http://appveyor.com) to automate builds for Windows. Here is an approach to do this:
 
@@ -402,3 +403,3 @@ First, get setup locally and test the workflow:
 
-NOTE: keys are per account but not per repo (this is difference than travis where keys are per repo but not related to the account used to encrypt them).
+NOTE: keys are per account but not per repo (this is difference than Travis where keys are per repo but not related to the account used to encrypt them).
 
@@ -411,3 +412,3 @@ #### 5) Hook up publishing
 
-You might wish to publish binaries only on a specific commit. To do this you could borrow from the [travis.ci idea of commit keywords](http://about.travis-ci.org/docs/user/how-to-skip-a-build/) and add special handling for commit messages with `[publish binary]`:
+You might wish to publish binaries only on a specific commit. To do this you could borrow from the [Travis.ci idea of commit keywords](http://about.travis-ci.org/docs/user/how-to-skip-a-build/) and add special handling for commit messages with `[publish binary]`:
 
@@ -421,5 +422,4 @@ SET CM=%APPVEYOR_REPO_COMMIT_MESSAGE%
 
-Remember this publishing is not the same as `npm publish`. We're just talking about the binary module here and not your entire npm package. To automate the publishing of your entire package to npm on travis see http://about.travis-ci.org/docs/user/deployment/npm/
+Remember this publishing is not the same as `npm publish`. We're just talking about the binary module here and not your entire npm package.
 
-
 ## Travis Automation
@@ -434,7 +434,7 @@
 
-Note: if you need 32 bit binaries, this can be done from a 64 bit travis machine. See [the node-sqlite3 scripts for an example of doing this](https://github.com/mapbox/node-sqlite3/blob/bae122aa6a2b8a45f6b717fab24e207740e32b5d/scripts/build_against_node.sh#L54-L74).
+Note: if you need 32 bit binaries, this can be done from a 64 bit Travis machine. See [the node-sqlite3 scripts for an example of doing this](https://github.com/mapbox/node-sqlite3/blob/bae122aa6a2b8a45f6b717fab24e207740e32b5d/scripts/build_against_node.sh#L54-L74).
 
 Below is a guide to getting set up:
 
-#### 1) Install the travis gem
+#### 1) Install the Travis gem
 
@@ -461,3 +461,3 @@ gem install travis
 
-More details on travis encryption at http://about.travis-ci.org/docs/user/encryption-keys/.
+More details on Travis encryption at http://about.travis-ci.org/docs/user/encryption-keys/.
 
@@ -540,5 +540,5 @@ #### 3) Hook up publishing
 
-You might wish to publish binaries only on a specific commit. To do this you could borrow from the [travis.ci idea of commit keywords](http://about.travis-ci.org/docs/user/how-to-skip-a-build/) and add special handling for commit messages with `[publish binary]`:
+You might wish to publish binaries only on a specific commit. To do this you could borrow from the [Travis.ci idea of commit keywords](http://about.travis-ci.org/docs/user/how-to-skip-a-build/) and add special handling for commit messages with `[publish binary]`:
 
-    COMMIT_MESSAGE=$(git show -s --format=%B $TRAVIS_COMMIT | tr -d '\n')
+    COMMIT_MESSAGE=$(git log --format=%B --no-merges -n 1 | tr -d '\n')
     if [[ ${COMMIT_MESSAGE} =~ "[publish binary]" ]]; then node-pre-gyp publish; fi;
@@ -554,4 +554,6 @@
 
-Remember this publishing is not the same as `npm publish`. We're just talking about the binary module here and not your entire npm package. To automate the publishing of your entire package to npm on travis see http://about.travis-ci.org/docs/user/deployment/npm/
+WARNING: if you are working in a pull request and publishing binaries from there then you will want to avoid double publishing when Travis.ci builds both the `push` and `pr`. You only want to run the publish on the `push` commit. See https://github.com/Project-OSRM/node-osrm/blob/8eb837abe2e2e30e595093d16e5354bc5c573575/scripts/is_pr_merge.sh which is called from https://github.com/Project-OSRM/node-osrm/blob/8eb837abe2e2e30e595093d16e5354bc5c573575/scripts/publish.sh for an example of how to do this.
 
+Remember this publishing is not the same as `npm publish`. We're just talking about the binary module here and not your entire npm package. To automate the publishing of your entire package to npm on Travis see http://about.travis-ci.org/docs/user/deployment/npm/
+
 # Versioning
@@ -558,0 +560,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Misc. License Issues

License

(Experimental) A package's licensing information has fine-grained problems.

Found 1 instance in 1 package

Network access

Supply chain risk

This module accesses the network.

Found 7 instances in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 21 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 4 instances in 1 package

Minified code

Quality

This package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.

Found 1 instance in 1 package

Mixed license

License

(Experimental) Package contains multiple licenses.

Found 1 instance in 1 package

Non-permissive License

License

(Experimental) A license not known to be considered permissive was found.

Found 2 instances in 1 package

Unidentified License

License

(Experimental) Something that seems like a license was found, but its contents could not be matched with a known license.

Found 1 instance in 1 package

Improved metrics

Number of low license alerts

0

decreased by-100%

Number of medium license alerts

0

decreased by-100%

License quality

100

increased by25%

Number of low quality alerts

2

decreased by-50%

Number of lines in readme file

573

increased by0.35%

Number of low supply chain risk alerts

32

decreased by-84.54%

Number of medium supply chain risk alerts

3

decreased by-90%

Worsened metrics

Total package byte prevSize

111453

decreased by-97.62%

Number of package files

29

decreased by-97.66%

Lines of code

2499

decreased by-96.96%

No dependency changes