rexreplace - npm Package Compare versions

Comparing version 7.1.11 to 7.1.12

bin/rexreplace.cli.js

@@ -71,3 +71,3 @@ #!/usr/bin/env node
 	};
-	const version = '7.1.11';
+	const version = '7.1.12';
 	function engine(config = {
@@ -121,8 +121,4 @@ engine: 'V8'
 	    debug('Work on content from: ' + _file_rr);
-	    // Variables to be accessible from js.
-	    if (_config_rr.replacementJs) {
-	        _config_rr.replacementDynamic = dynamicReplacement(_file_rr, _config_rr, _data_rr);
-	    }
 	    // Main regexp of the whole thing
-	    const result = _data_rr.replace(_config_rr.regex, _config_rr.replacementJs ? _config_rr.replacementDynamic : _config_rr.replacement);
+	    const result = _data_rr.replace(_config_rr.regex, _config_rr.replacementJs ? dynamicReplacement(_file_rr, _config_rr, _data_rr) : _config_rr.replacement);
 	    // The output of matched strings is done from the replacement, so no need to continue
@@ -129,0 +125,0 @@ if (_config_rr.outputMatch) {

bin/rexreplace.cli.min.js

@@ -71,3 +71,3 @@ #!/usr/bin/env node
 	};
-	const version = '7.1.11';
+	const version = '7.1.12';
 	function engine(config = {
@@ -121,8 +121,4 @@ engine: 'V8'
 	    debug('Work on content from: ' + _file_rr);
-	    // Variables to be accessible from js.
-	    if (_config_rr.replacementJs) {
-	        _config_rr.replacementDynamic = dynamicReplacement(_file_rr, _config_rr, _data_rr);
-	    }
 	    // Main regexp of the whole thing
-	    const result = _data_rr.replace(_config_rr.regex, _config_rr.replacementJs ? _config_rr.replacementDynamic : _config_rr.replacement);
+	    const result = _data_rr.replace(_config_rr.regex, _config_rr.replacementJs ? dynamicReplacement(_file_rr, _config_rr, _data_rr) : _config_rr.replacement);
 	    // The output of matched strings is done from the replacement, so no need to continue
@@ -129,0 +125,0 @@ if (_config_rr.outputMatch) {

package.json

 {
 	"name": "rexreplace",
-	"version": "7.1.11",
+	"version": "7.1.12",
 	"description": "Search & replace across files with a CLI tool that makes you trust what you are doing.",
@@ -53,10 +53,10 @@ "author": "Mathias Rangel Wulff",
 	"devDependencies": {
-		"@rollup/plugin-replace": "5",
+		"@rollup/plugin-replace": "6",
 		"@rollup/plugin-swc": "^0.4.0",
-		"@swc/core": "1.7.26",
-		"@types/node": "22.5.4",
+		"@swc/core": "1.10.0",
+		"@types/node": "22.10.1",
 		"assert": "^2.0.0",
-		"mocha": "10.7.3",
-		"prettier": "3.3.3",
-		"rollup": "4.21.3",
+		"mocha": "11.0.1",
+		"prettier": "3.4.2",
+		"rollup": "4.28.1",
 		"yarn": "1.22.22"
@@ -63,0 +63,0 @@ },

src/engine.ts

@@ -90,11 +90,8 @@ const fs = require('fs');
 
-	// Variables to be accessible from js.
-	if (_config_rr.replacementJs) {
-		_config_rr.replacementDynamic = dynamicReplacement(_file_rr, _config_rr, _data_rr);
-	}
-
 	// Main regexp of the whole thing
 	const result = _data_rr.replace(
 		_config_rr.regex,
-		_config_rr.replacementJs ? _config_rr.replacementDynamic : _config_rr.replacement
+		_config_rr.replacementJs
+			? dynamicReplacement(_file_rr, _config_rr, _data_rr)
+			: _config_rr.replacement
 	);
@@ -101,0 +98,0 @@

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 2 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 2 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

175548

-0.38%

Lines of code

2079

-0.48%

Number of lines in readme file

365

-1.62%

No dependency changes