oss-mariner
Advanced tools
Comparing version 0.0.1 to 0.1.0
{ | ||
"name": "oss-mariner", | ||
"version": "0.0.1", | ||
"version": "0.1.0", | ||
"description": "A node.js library for analyzing open source library dependencies", | ||
@@ -9,6 +9,27 @@ "main": "dist/mariner.js", | ||
"license": "Apache-2.0", | ||
"publishConfig": {"registry": "https://registry.npmjs.org "}, | ||
"dependencies": {}, | ||
"scripts": { | ||
"test": "echo \"Error: no test specified\" && exit 1", | ||
"check": "npx eslint --print-config src/* | npx eslint-config-prettier-check", | ||
"lint": "npx eslint src/ --ext .js,.ts && echo 'Lint complete'", | ||
"lint:fix": "npx eslint src/ --fix . --ext .js,.ts && echo 'Fixed errors'", | ||
"build": "tsc", | ||
"prepublish": "tsc", | ||
"NOTYET-prepublishOnly": "npm test && npm run lint", | ||
"preversion": "npm run lint", | ||
"NOTYET-version": "npm run format && git add -A src", | ||
"NOTYET-postversion": "git push && git push --tags", | ||
"prepare": "npm run build" | ||
}, | ||
"dependencies": { | ||
"typescript": "^3.8.3", | ||
"@types/moment": "^2.13.0", | ||
"@types/node-fetch": "^2.5.5", | ||
"moment": "^2.24.0", | ||
"node-fetch": "^2.6.0" | ||
}, | ||
"publishConfig": { | ||
"registry": "https://registry.npmjs.org " | ||
}, | ||
"devDependencies": { | ||
"@types/node": "^13.11.1", | ||
"@types/node": "^13.13.2", | ||
"@typescript-eslint/eslint-plugin": "^2.28.0", | ||
@@ -22,15 +43,2 @@ "@typescript-eslint/parser": "^2.28.0", | ||
}, | ||
"scripts": { | ||
"test": "echo \"Error: no test specified\" && exit 1", | ||
"check": "npx eslint --print-config src/* | npx eslint-config-prettier-check", | ||
"lint": "npx eslint . --ext .js,.ts && echo 'Lint complete'", | ||
"lint:fix": "npx eslint . --fix . --ext .js,.ts && echo 'Fixed errors'", | ||
"build": "tsc", | ||
"prepublish": "tsc", | ||
"NOTYET-prepublishOnly" : "npm test && npm run lint", | ||
"preversion" : "npm run lint", | ||
"NOTYET-version" : "npm run format && git add -A src", | ||
"NOTYET-postversion" : "git push && git push --tags", | ||
"prepare": "npm run build" | ||
}, | ||
"keywords": [ | ||
@@ -37,0 +45,0 @@ "nodejs", |
@@ -1,32 +0,90 @@ | ||
# Indeed Open Source Repository Template | ||
# Mariner | ||
![OSS Lifecycle](https://img.shields.io/osslifecycle/indeedeng/default-template.svg) | ||
![OSS Lifecycle](https://img.shields.io/osslifecycle/indeedeng/Mariner.svg) | ||
A node.js library for analyzing open source library dependencies. | ||
A default template repository we can use to bootstrap new open source projects. Replace this text with an overview of your project and what it does. | ||
Mariner takes an input list of dependencies, fetches details about them from GitHub, | ||
and outputs a file containing funding information for each project owner, and a list | ||
of issues for each project. | ||
Update the OSSLifeCycle shield above with the name of your repository (i.e. replace `default-template.svg` with `YOUR-REPOSITORY-NAME.svg`) | ||
## Getting Started Using Mariner | ||
Your README.md should contain the following sections: | ||
If you just want to USE Mariner, you don't need to do a git clone. | ||
Instead, create your own new node project, and install the oss-mariner package via npm: | ||
```npm install oss-mariner``` | ||
## Getting Started | ||
Mariner can be called from Javascript or from Typescript. You can see an example here: | ||
https://github.com/indeedeng/Mariner/blob/master/src/indexExample.ts | ||
How does a user get started using this project? | ||
In your code, invoke the DependencyDetailsRetriever.run() method, passing appropriate parameters: | ||
``` | ||
const ddr = new DependencyDetailsRetriever(); | ||
const githubToken = Process.env.GITHUB_TOKEN; // from an environment variable | ||
const inputFilePath = '<full path to your input file>'; | ||
const outputFilePath = '<full path to the file that ddr should create>'; | ||
const abbreviated = false; // OPTIONAL; default is false; true will exclude some dependencies | ||
ddr.run(githubToken, inputFilePath, outputFilePath, abbreviated); | ||
``` | ||
The GitHub token must be a valid personal access token. It does not require any permissions beyond | ||
the default, so when you create it you can leave all the boxes unchecked. Be careful not to | ||
share your token with anyone. If it gets exposed, revoke it and create a replacement. | ||
See https://github.com/settings/tokens/new for how to create a token. | ||
The input file is a JSON file in the format: | ||
- (We'll add a definition of the format later. | ||
For now, you can look at exampleData/mini.json for an example) | ||
The output file is a JSON file in the format: | ||
- (We'll add a definition of the format later. | ||
For now, you can look at exampleData/analysisOutputRaw.json after running the app) | ||
We don't recommend using the ```abbreviated``` feature. | ||
It will omit entries that have fewer than a hard-coded number of projects that depend on them. | ||
## Getting Help | ||
How does a user ask questions if they are stuck? | ||
The [Open Source team at Indeed](https://opensource.indeedeng.io/), who can be reached at opensource@indeed.com. | ||
## How To Contribute | ||
What does a user need to know if they want to start contributing? If this information is extensive, capture it in a CONTRIBUTING.md file and link to that file here. | ||
Read the Code of Conduct and Contact the Maintainers before making any changes or a PR. | ||
If an issue doesn’t already exist that describes the change you want to make, we recommend | ||
creating one. If an issue does exist, please comment on it saying that you are starting to | ||
work on it, to avoid duplicating effort. | ||
## Getting Started Developing Mariner | ||
Clone the repository from GitHub. | ||
Run ```npm ci``` to install the libraries used in the project. Read more about [npm ci here.](https://blog.npmjs.org/post/171556855892/introducing-npm-ci-for-faster-more-reliable) | ||
Follow the instructions in indexExample.ts to configure the input and output files. | ||
NOTE that an example input file is included, in the exampleData directory. | ||
Run ```npm run build``` to compile the code to Javascript. | ||
Run ```node dist/indexExample.js``` to run the example program. It requires internet access, | ||
since it calls the GitHub API. It will take a couple minutes to complete. | ||
Some of the output includes the word "ERROR", so don't panic. | ||
## Project Maintainers | ||
Who are the project maintainers, and how can they be reached? | ||
The [Open Source team at Indeed](https://opensource.indeedeng.io/), who can be reached at opensource@indeed.com. | ||
## How to Publish | ||
1. If you are a maintainer, you can follow these steps to publish a new version of the package: | ||
1. Be sure the version number in package.json is correct | ||
1. Login to npm if you haven’t already: npm login | ||
1. Do a dry run to make sure the package looks good: npm publish --dry-run | ||
1. Publish: npm publish | ||
1. Verify: https://www.npmjs.com/package/oss-mariner | ||
## Code of Conduct | ||
This project is governed by the [Contributor Covenant v 1.4.1](CODE_OF_CONDUCT.md). (Review the Code of Conduct and remove this sentence before publishing your project.) | ||
This project is governed by the [Contributor Covenant v 1.4.1](CODE_OF_CONDUCT.md). | ||
## License | ||
This project uses the [Apache 2.0](LICENSE) license. (Update this and the LICENSE file if your project uses a different license.) | ||
This project uses the [Apache 2.0](LICENSE) license. |
Major refactor
Supply chain riskPackage has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 1 instance in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Trivial Package
Supply chain riskPackages less than 10 lines of code are easily copied into your own project and may not warrant the additional supply chain risk of an external dependency.
Found 1 instance in 1 package
67717
21
1088
91
5
2
+ Added@types/moment@^2.13.0
+ Added@types/node-fetch@^2.5.5
+ Addedmoment@^2.24.0
+ Addednode-fetch@^2.6.0
+ Addedtypescript@^3.8.3
+ Added@types/moment@2.13.0(transitive)
+ Added@types/node@22.13.4(transitive)
+ Added@types/node-fetch@2.6.12(transitive)
+ Addedasynckit@0.4.0(transitive)
+ Addedcall-bind-apply-helpers@1.0.2(transitive)
+ Addedcombined-stream@1.0.8(transitive)
+ Addeddelayed-stream@1.0.0(transitive)
+ Addeddunder-proto@1.0.1(transitive)
+ Addedes-define-property@1.0.1(transitive)
+ Addedes-errors@1.3.0(transitive)
+ Addedes-object-atoms@1.1.1(transitive)
+ Addedes-set-tostringtag@2.1.0(transitive)
+ Addedform-data@4.0.2(transitive)
+ Addedfunction-bind@1.1.2(transitive)
+ Addedget-intrinsic@1.2.7(transitive)
+ Addedget-proto@1.0.1(transitive)
+ Addedgopd@1.2.0(transitive)
+ Addedhas-symbols@1.1.0(transitive)
+ Addedhas-tostringtag@1.0.2(transitive)
+ Addedhasown@2.0.2(transitive)
+ Addedmath-intrinsics@1.1.0(transitive)
+ Addedmime-db@1.52.0(transitive)
+ Addedmime-types@2.1.35(transitive)
+ Addedmoment@2.30.1(transitive)
+ Addednode-fetch@2.7.0(transitive)
+ Addedtr46@0.0.3(transitive)
+ Addedtypescript@3.9.10(transitive)
+ Addedundici-types@6.20.0(transitive)
+ Addedwebidl-conversions@3.0.1(transitive)
+ Addedwhatwg-url@5.0.0(transitive)