pkgscan - npm Package Compare versions

Comparing version 1.0.23 to 1.0.24

dist/cli.js

@@ -377,2 +377,13 @@ #! /usr/bin/env node
 
+// src/utils/stripBOM.ts
+var stripBom = (content) => {
+  if (typeof content !== "string") {
+    throw new TypeError(`Expected a string, got ${typeof content}`);
+  }
+  if (content.charCodeAt(0) === 65279) {
+    return content.slice(1);
+  }
+  return content;
+};
+
 // src/package-manager/modules/pnpm/read.ts
@@ -385,3 +396,3 @@ function readWantedLockfile(pkgPath, opts) {
   try {
-    lockfileRawContent = require("strip-bom").default(import_fs3.default.readFileSync(lockfilePath, "utf8"));
+    lockfileRawContent = stripBom(import_fs3.default.readFileSync(lockfilePath, "utf8"));
   } catch (err) {
@@ -614,3 +625,3 @@ if (err.code !== "ENOENT") {
 // package.json
-var version = "1.0.22";
+var version = "1.0.23";
 
@@ -617,0 +628,0 @@ // src/cli.ts

dist/index.js

@@ -379,2 +379,13 @@ "use strict";
 
+// src/utils/stripBOM.ts
+var stripBom = (content) => {
+  if (typeof content !== "string") {
+    throw new TypeError(`Expected a string, got ${typeof content}`);
+  }
+  if (content.charCodeAt(0) === 65279) {
+    return content.slice(1);
+  }
+  return content;
+};
+
 // src/package-manager/modules/pnpm/read.ts
@@ -387,3 +398,3 @@ function readWantedLockfile(pkgPath, opts) {
   try {
-    lockfileRawContent = require("strip-bom").default(import_fs3.default.readFileSync(lockfilePath, "utf8"));
+    lockfileRawContent = stripBom(import_fs3.default.readFileSync(lockfilePath, "utf8"));
   } catch (err) {
@@ -390,0 +401,0 @@ if (err.code !== "ENOENT") {

package.json

@@ -5,3 +5,3 @@ {
     "description": "Retrieve information on installed packages across npm, pnpm and yarn",
-    "version": "1.0.23",
+    "version": "1.0.24",
     "main": "./dist/index.js",
@@ -95,3 +95,2 @@ "module": "./dist/index.mjs",
         "semver": "^7.5.2",
-        "strip-bom": "4.0.0",
         "yargs": "^17.7.2"
@@ -98,0 +97,0 @@ },

Fixed alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

308581

increased by0.88%

Dependency count

13

decreased by-7.14%

Lines of code

2499

increased by1.05%

Number of low supply chain risk alerts

20

decreased by-23.08%

Dependency changes

• - Removedstrip-bom@4.0.0

• - Removedstrip-bom@4.0.0(transitive)