rewire - npm Package Compare versions

Comparing version 5.0.0 to 6.0.0

CHANGELOG.md

 Changelog
 ---------
 
+### 6.0.0
+- **Breaking**: Remove Node v8 support. We had to do this because one of our dependencies had security issues and the version with the fix dropped Node v8 as well.
+- Update dependencies [#193](https://github.com/jhnns/rewire/issues/193)
+- Fix Modifying globals within module leaks to global with Node >=10 [#167](https://github.com/jhnns/rewire/issues/167)
+- Fixed import errors on modules with shebang declarations [#179](https://github.com/jhnns/rewire/pull/179)
+
 ### 5.0.0
@@ -5,0 +11,0 @@ - **Breaking**: Remove Node v6 support. We had to do this because one of our dependencies had security issues and the version with the fix dropped Node v6 as well.

lib/__get__.js

@@ -0,0 +0,0 @@ /**

lib/detectStrictMode.js

@@ -0,0 +0,0 @@ var multiLineComment = /^\s*\/\*.*?\*\//;

lib/getImportGlobalsSrc.js

@@ -12,3 +12,2 @@ /**
     var key,
-        value,
         src = "",
@@ -18,14 +17,25 @@ globalObj = typeof global === "undefined"? window: global;
     ignore = ignore || [];
-    // global itself can't be overridden because it's the only reference to our real global objects
-    ignore.push("global");
-    // ignore 'module', 'exports' and 'require' on the global scope, because otherwise our code would
-    // shadow the module-internal variables
-    // @see https://github.com/jhnns/rewire-webpack/pull/6
-    ignore.push("module", "exports", "require");
+    ignore.push(
+        // global itself can't be overridden because it's the only reference to our real global objects
+        "global",
+        // ignore 'module', 'exports' and 'require' on the global scope, because otherwise our code would
+        // shadow the module-internal variables
+        // @see https://github.com/jhnns/rewire-webpack/pull/6
+        "module", "exports", "require",
+        // strict mode doesn't allow to (re)define 'undefined', 'eval' & 'arguments'
+        "undefined", "eval", "arguments",
+        // 'GLOBAL' and 'root' are deprecated in Node
+        // (assigning them causes a DeprecationWarning)
+        "GLOBAL", "root",
+        // 'NaN' and 'Infinity' are immutable
+        // (doesn't throw an error if you set 'var NaN = ...', but doesn't work either)
+        "NaN", "Infinity",
+    );
 
-    for (key in globalObj) { /* jshint forin: false */
+    const globals = Object.getOwnPropertyNames(globalObj);
+
+    for (key of globals) {
         if (ignore.indexOf(key) !== -1) {
             continue;
         }
-        value = globalObj[key];
 
@@ -32,0 +42,0 @@ // key may be an invalid variable name (e.g. 'a-b')

lib/moduleEnv.js

@@ -46,2 +46,4 @@ "use strict";
     matchConst = /(^|\s|\}|;)const(\/\*|\s|{)/gm,
+    // Required for importing modules with shebang declarations, since NodeJS 12.16.0
+    shebang = /^#!.+/,
     nodeRequire,
@@ -127,3 +129,5 @@ currentModule;
             module,
-            content.replace(matchConst, "$1let  $2"), // replace const with let, while maintaining the column width
+            content
+                .replace(shebang, '') // Remove shebang declarations
+                .replace(matchConst, "$1let  $2"), // replace const with let, while maintaining the column width
             filename
@@ -130,0 +134,0 @@ );

package.json

 {
   "name": "rewire",
-  "version": "5.0.0",
+  "version": "6.0.0",
   "description": "Easy dependency injection for node.js unit testing",
@@ -35,3 +35,4 @@ "keywords": [
     "expect.js": "^0.3.1",
-    "mocha": "^7.1.0",
+    "mocha": "^9.1.2",
+    "nyc": "^15.1.0",
     "rewire": "file://."
@@ -41,8 +42,7 @@ },
   "scripts": {
-    "test": "mocha -R spec",
-    "coverage": "istanbul cover ./node_modules/mocha/bin/_mocha"
+    "test": "nyc --reporter=html --reporter=lcov mocha -R spec"
   },
   "dependencies": {
-    "eslint": "^6.8.0"
+    "eslint": "^7.32.0"
   }
 }

testLib/sharedTestCases.js

@@ -180,7 +180,3 @@ // Don't run code in ES5 strict mode.
 
-    // This test fails on modern Node versions since they started to configure some
-    // global variables to be non-enumerable. This means that rewire() does in fact
-    // modify the global console object in newer Node versions.
-    // There is a work in progress fix at https://github.com/jhnns/rewire/tree/fix-globals
-    it.skip("should provide the ability to mock global objects just within the module", function () {
+    it("should provide the ability to mock global objects just within the module", function () {
         var rewiredModuleA = rewire("./moduleA.js"),
@@ -288,3 +284,14 @@ rewiredModuleB = rewire("./moduleB.js"),
         } catch (err) {
-            expect(err.stack.split("\n")[1]).to.match(/:6:26/);
+
+            // Firefox implements a different error-stack format,
+            // but does offer line and column numbers on errors: we use
+            // those instead.
+            if (err.lineNumber !== undefined && err.columnNumber !== undefined) {
+                expect(err.lineNumber).to.equal(6)
+                expect(err.columnNumber).to.equal(26)
+            }
+            // This is for the V8 stack trace format (Node, Chrome)
+            else {
+                expect(err.stack.split("\n")[1]).to.match(/:6:26/);
+            }
         }
@@ -413,2 +420,9 @@ });
 
+    it("should be possible to rewire shebang modules", function () {
+        var shebangModule = rewire("./shebangModule");
+        var shebangs = shebangModule.__get__("shebangs");
+
+        expect(typeof shebangs).to.be("function");
+        expect(shebangModule.shebangs()).to.be(true);
+    });
 };

New alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Improved metrics

Number of low supply chain risk alerts

4

decreased by-75%

Number of medium supply chain risk alerts

3

decreased by-82.35%

Worsened metrics

Total package byte prevSize

120347

decreased by-54.59%

Dev dependency count

5

increased by25%

Number of package files

41

decreased by-57.29%

Lines of code

1109

decreased by-78.24%

Dependency changes

• + Added@babel/code-frame@7.12.11(transitive)

• + Added@eslint/eslintrc@0.4.3(transitive)

• + Added@humanwhocodes/config-array@0.5.0(transitive)

• + Added@humanwhocodes/object-schema@1.2.1(transitive)

• + Addedajv@8.13.0(transitive)

• + Addedansi-colors@4.1.3(transitive)

• + Addedastral-regex@2.0.0(transitive)

• + Addedcross-spawn@7.0.3(transitive)

• + Addedenquirer@2.4.1(transitive)

• + Addedescape-string-regexp@4.0.0(transitive)

• + Addedeslint@7.32.0(transitive)

• + Addedeslint-utils@2.1.0(transitive)

• + Addedeslint-visitor-keys@2.1.0(transitive)

• + Addedespree@7.3.1(transitive)

• + Addedfile-entry-cache@6.0.1(transitive)

• + Addedflat-cache@3.2.0(transitive)

• + Addedflatted@3.3.1(transitive)

• + Addedglobals@13.24.0(transitive)

• + Addedjson-buffer@3.0.1(transitive)

• + Addedjson-schema-traverse@1.0.0(transitive)

• + Addedkeyv@4.5.4(transitive)

• + Addedlevn@0.4.1(transitive)

• + Addedlodash.merge@4.6.2(transitive)

• + Addedlodash.truncate@4.4.2(transitive)

• + Addedoptionator@0.9.4(transitive)

• + Addedpath-key@3.1.1(transitive)

• + Addedprelude-ls@1.2.1(transitive)

• + Addedregexpp@3.2.0(transitive)

• + Addedrequire-from-string@2.0.2(transitive)

• + Addedrimraf@3.0.2(transitive)

• + Addedsemver@7.6.2(transitive)

• + Addedshebang-command@2.0.0(transitive)

• + Addedshebang-regex@3.0.0(transitive)

• + Addedslice-ansi@4.0.0(transitive)

• + Addedtable@6.8.2(transitive)

• + Addedtype-check@0.4.0(transitive)

• + Addedtype-fest@0.20.2(transitive)

• + Addedwhich@2.0.2(transitive)

• - Removed@babel/code-frame@7.24.2(transitive)

• - Removedansi-escapes@4.3.2(transitive)

• - Removedansi-regex@4.1.1(transitive)

• - Removedastral-regex@1.0.0(transitive)

• - Removedchardet@0.7.0(transitive)

• - Removedcli-cursor@3.1.0(transitive)

• - Removedcli-width@3.0.0(transitive)

• - Removedcross-spawn@6.0.5(transitive)

• - Removedemoji-regex@7.0.3(transitive)

• - Removedeslint@6.8.0(transitive)

• - Removedeslint-utils@1.4.3(transitive)

• - Removedespree@6.2.1(transitive)

• - Removedexternal-editor@3.1.0(transitive)

• - Removedfigures@3.2.0(transitive)

• - Removedfile-entry-cache@5.0.1(transitive)

• - Removedflat-cache@2.0.1(transitive)

• - Removedflatted@2.0.2(transitive)

• - Removedglobals@12.4.0(transitive)

• - Removediconv-lite@0.4.24(transitive)

• - Removedinquirer@7.3.3(transitive)

• - Removedis-fullwidth-code-point@2.0.0(transitive)

• - Removedlevn@0.3.0(transitive)

• - Removedlodash@4.17.21(transitive)

• - Removedmimic-fn@2.1.0(transitive)

• - Removedminimist@1.2.8(transitive)

• - Removedmkdirp@0.5.6(transitive)

• - Removedmute-stream@0.0.8(transitive)

• - Removednice-try@1.0.5(transitive)

• - Removedonetime@5.1.2(transitive)

• - Removedoptionator@0.8.3(transitive)

• - Removedos-tmpdir@1.0.2(transitive)

• - Removedpath-key@2.0.1(transitive)

• - Removedprelude-ls@1.1.2(transitive)

• - Removedregexpp@2.0.1(transitive)

• - Removedrestore-cursor@3.1.0(transitive)

• - Removedrimraf@2.6.3(transitive)

• - Removedrun-async@2.4.1(transitive)

• - Removedrxjs@6.6.7(transitive)

• - Removedsafer-buffer@2.1.2(transitive)

• - Removedsemver@5.7.26.3.1(transitive)

• - Removedshebang-command@1.2.0(transitive)

• - Removedshebang-regex@1.0.0(transitive)

• - Removedsignal-exit@3.0.7(transitive)

• - Removedslice-ansi@2.1.0(transitive)

• - Removedstring-width@3.1.0(transitive)

• - Removedstrip-ansi@5.2.0(transitive)

• - Removedtable@5.4.6(transitive)

• - Removedthrough@2.3.8(transitive)

• - Removedtmp@0.0.33(transitive)

• - Removedtslib@1.14.1(transitive)

• - Removedtype-check@0.3.2(transitive)

• - Removedtype-fest@0.21.30.8.1(transitive)

• - Removedwhich@1.3.1(transitive)

• - Removedwrite@1.0.3(transitive)

• Updatedeslint@^7.32.0