nsp-preprocessor-yarn - npm Package Compare versions

Comparing version 1.1.0 to 1.1.1

index.js

@@ -6,28 +6,31 @@ const Fs = require('fs');
 module.exports = {
-	check: function (args) {
-		let pkg;
-		try {
-			let pkgfile = 'package.json';
-			if (args.packagejsonfile) {
-				pkgfile = args.packagejsonfile;
-			}
-			pkg = args.pkg || JSON.parse(Fs.readFileSync(Path.join(args.path, pkgfile)));
-		} catch (err) {
-			return Promise.reject(new Error(`Unable to load package.json for project: ${Path.basename(args.path)}`));
-		}
+  check: function (args) {
+    let pkg;
+    try {
+      let pkgfile = 'package.json';
+      if (args.packagejsonfile) {
+        pkgfile = args.packagejsonfile;
+      }
+      pkg = args.pkg || JSON.parse(Fs.readFileSync(Path.join(args.path, pkgfile)));
+    } catch (err) {
+      return Promise.reject(new Error(`Unable to load package.json for project: ${Path.basename(args.path)}`));
+    }
 
-		let lock;
-		try {
-			let lockfile = 'yarn.lock';
-			if (args.lockfile) {
-				lockfile = args.lockfile;
-			}
-			const lockContents = Fs.readFileSync(Path.join(args.path, lockfile), { encoding: "utf-8" });
-			lock = Lib.parse(lockContents, pkg);
-		} catch (err) {
-			return Promise.reject(new Error(`Unable to load yarn.lock for project "${Path.basename(args.path)}". ${err}`));
-		}
+    let lock;
+    try {
+      let lockfile = 'yarn.lock';
+      if (args.lockfile) {
+        lockfile = args.lockfile;
+      }
+      const lockContents = Fs.readFileSync(Path.join(args.path, lockfile), { encoding: "utf-8" });
+      if (!args.preprocessSilently) {
+        console.log(`Preprocessing the lock file '${lockfile}'.`);
+      }
+      lock = Lib.parse(lockContents, pkg);
+    } catch (err) {
+      return Promise.reject(new Error(`Unable to load yarn.lock for project "${Path.basename(args.path)}". ${err}`));
+    }
 
-		return Object.assign(args, { pkg: pkg, shrinkwrap: lock });
-	}
+    return Object.assign(args, { pkg: pkg, shrinkwrap: lock });
+  }
 };

package.json

 {
   "name": "nsp-preprocessor-yarn",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "",
@@ -5,0 +5,0 @@ "main": "index.js",

README.md

@@ -28,2 +28,18 @@ # Yarn.lock preprocessor for NSP
 
+If it logs `Preprocessing the lock file 'yarn.lock'.` this means you're covered.
+
+## Why
+**TLDR**: if you use Yarn and NSP you need a preprocessor like nsp-preprocessor-yarn, to ensure all your dependencies are checked.
+
+NSP works by uploading (parts of) your package.json and npm-shrinkwrap/package-lock to it's vulnerabillity-checking servers.
+If you don't have a npm-shrinkwrap/package-lock (hello there, Yarn users!) this means NSP only uploads a package.json.
+Therefore NSP reconstructs your dependency tree on their servers, in the NPM fashion: *undeterministically*.
+
+There will eventually be inconsistencies between what Yarn installed and what NSP thinks you have installed.
+As the yarn.lock precisely states what is installed, the nsp-preprocessor-yarn transforms that into a format NSP understands.
+
+## Silent
+This preprocessor logs a short message, to indicate the processor has run, to let you know you're safe.
+If you're parsing the output of the nsp run, and this message is annoying, you can disable the message by setting `--preprocess--silently`.
+
 ## Workspaces
@@ -30,0 +46,0 @@ This preprocessor supports workspaces too: specify the `--lockfile` flag:

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

11775

increased by13.98%

Number of package files

13

increased by8.33%

Lines of code

175

increased by1.74%

Number of lines in readme file

52

increased by44.44%

Number of medium supply chain risk alerts

1

decreased by-50%

No dependency changes