pacote - npm Package Compare versions

Comparing version 2.0.2 to 2.0.3

CHANGELOG.md

@@ -5,2 +5,15 @@ # Change Log
 
+<a name="2.0.3"></a>
+## [2.0.3](https://github.com/zkat/pacote/compare/v2.0.2...v2.0.3) (2017-04-15)
+
+
+### Bug Fixes
+
+* **manifest:** meh just shove _from in there ([4396f09](https://github.com/zkat/pacote/commit/4396f09))
+* **registry:** include CI header ([86ad911](https://github.com/zkat/pacote/commit/86ad911))
+* **registry:** include npm-scope header ([574cd93](https://github.com/zkat/pacote/commit/574cd93))
+* **registry:** make sure to send referer header ([2d3aaac](https://github.com/zkat/pacote/commit/2d3aaac))
+
+
+
 <a name="2.0.2"></a>
@@ -7,0 +20,0 @@ ## [2.0.2](https://github.com/zkat/pacote/compare/v2.0.1...v2.0.2) (2017-04-15)

lib/registry/manifest.js

@@ -92,5 +92,8 @@ 'use strict'
       authorization: (auth && auth.token && `Bearer ${auth.token}`) || '',
+      'npm-in-ci': opts.isFromCI,
+      'npm-scope': opts.projectScope,
       'user-agent': opts.userAgent,
       'pacote-req-type': 'packument',
-      'pacote-pkg-id': `registry:${manifest.name}`
+      'pacote-pkg-id': `registry:${manifest.name}`,
+      'referer': opts.refer
     },
@@ -97,0 +100,0 @@ proxy: opts.proxy,

lib/registry/tarball.js

@@ -57,6 +57,9 @@ 'use strict'
       authorization: (auth && auth.token && `Bearer ${auth.token}`) || '',
+      'npm-in-ci': opts.isFromCI,
+      'npm-scope': opts.projectScope,
       'user-agent': opts.userAgent,
       'pacote-req-type': 'tarball',
       'pacote-pkg-id': `registry:${manifest.name}@${manifest.version}`,
-      'pacote-pkg-manifest': JSON.stringify(manifest)
+      'pacote-pkg-manifest': JSON.stringify(manifest),
+      'referer': opts.refer
     },
@@ -63,0 +66,0 @@ integrity: manifest._integrity,

lib/util/opt-check.js

@@ -28,2 +28,11 @@ 'use strict'
   this.preferOnline = opts.preferOnline
+  this.isFromCI = !!(
+    opts.isFromCI ||
+    process.env['CI'] === 'true' ||
+    process.env['TDDIUM'] ||
+    process.env['JENKINS_URL'] ||
+    process.env['bamboo.buildKey']
+  )
+  this.refer = opts.referer || opts.refer
+  this.projectScope = opts.projectScope
 
@@ -30,0 +39,0 @@ this.dirPacker = opts.dirPacker || null

manifest.js

@@ -39,2 +39,3 @@ 'use strict'
         manifest._spec = spec.raw
+        manifest._from = spec.raw
         manifest._where = opts.where
@@ -41,0 +42,0 @@ }

package.json

 {
   "name": "pacote",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "JavaScript package downloader",
@@ -5,0 +5,0 @@ "main": "index.js",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

63143

increased by1.65%

Lines of code

1415

increased by1.14%

Worsened metrics

Number of low supply chain risk alerts

13

increased by44.44%

No dependency changes