shortstop - npm Package Compare versions

Comparing version 1.0.1 to 1.0.2

CHANGELOG.md

@@ -0,1 +1,7 @@
+##### v1.0.2 - 20230213
+
+**Security**
+
+- upgrade async module to resolve vulnerability. https://github.com/krakenjs/shortstop/issues/28
+
 ##### v0.0.1 - 2013xxxx
@@ -2,0 +8,0 @@ **Bugs**

index.js

 /*───────────────────────────────────────────────────────────────────────────*\
-│  Copyright (C) 2014 eBay Software Foundation                                │
+│  Copyright (C) 2023 PayPal                                                  │
 │                                                                             │
@@ -29,3 +29,5 @@ │hh ,'""`.                                                                    │
     var ext = path.extname(file);
-    return ext === '' || require.extensions.hasOwnProperty(ext);
+    // in order for this to work after deprecation of module.extensions
+    var extensions = {'.js': true, '.json': true, '.node': true}
+    return ext === '' || extensions.hasOwnProperty(ext);
 }
@@ -43,3 +45,3 @@
                 if (isModule(file)) {
-                    resolve(require(file), callback);
+                    resolve(require(file), file, callback);
                     return;
@@ -56,3 +58,3 @@ }
                         data = JSON.parse(data);
-                        resolve(data, callback);
+                        resolve(data, file, callback);
                     } catch (err) {
@@ -67,2 +69,2 @@ callback(err);
 
-};
+};

lib/resolver.js

 /*───────────────────────────────────────────────────────────────────────────*\
-│  Copyright (C) 2014 eBay Software Foundation                                │
+│  Copyright (C) 2023 PayPal                                                  │
 │                                                                             │
@@ -139,5 +139,10 @@ │hh ,'""`.                                                                    │
          */
-        resolve: function resolve(data, callback) {
+        resolve: function resolve(data, filename, callback) {
             var self, tasks, handler;
 
+            if (!callback) {
+                callback = filename;
+                filename = null;
+            }
+
             self = this;
@@ -150,3 +155,3 @@
                     tasks = data.map(function (val) {
-                        return resolve.bind(self, val);
+                        return resolve.bind(self, val, filename);
                     });
@@ -157,3 +162,3 @@
                     Object.keys(data).forEach(function (key) {
-                        tasks[key] = resolve.bind(self, data[key]);
+                        tasks[key] = resolve.bind(self, data[key], filename);
                     });
@@ -181,2 +186,4 @@ }
                     if (handler.length < 2) {
+                        // If the handler is single argument, expect its return value to be useful,
+                        // so we wrap it up in continuation-passing style
                         return function wrapper(input, done) {
@@ -198,4 +205,6 @@ var data, error;
 
-                tasks.unshift(function init(done) {
+                tasks.unshift(tasks[0].length == 2 ? function init(done) {
                     done(null, data);
+                } : function init(done) {
+                    done(null, data, filename);
                 });
@@ -202,0 +211,0 @@

LICENSE.txt

 /*───────────────────────────────────────────────────────────────────────────*\
-│  Copyright (C) 2014 eBay Software Foundation                                │
+│  Copyright (C) 2023 PayPal                                                  │
 │                                                                             │
@@ -17,2 +17,2 @@ │hh ,'""`.                                                                    │
 │   limitations under the License.                                            │
-\*───────────────────────────────────────────────────────────────────────────*/
+\*───────────────────────────────────────────────────────────────────────────*/

package.json

 {
   "name": "shortstop",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Enable use of protocols (such as file:, buffer:, or method:) in configuration files.",
@@ -36,5 +36,5 @@ "main": "index.js",
   "dependencies": {
-    "core-util-is": "~1.0.1",
-    "async": "~0.2.10"
+    "async": "^3.2.4",
+    "core-util-is": "~1.0.1"
   }
 }

README.md

 # shortstop
 
+[![Build Status](https://travis-ci.org/krakenjs/shortstop.svg?branch=master)](https://travis-ci.org/krakenjs/shortstop)  
+
 Sometimes JSON just isn't enough for configuration needs. Occasionally it would be nice to use arbitrary types as values,
@@ -7,4 +9,2 @@ but JSON is necessarily a subset of all available JS types. `shortstop` enables the use of protocols and handlers to
 
-[![Build Status](https://travis-ci.org/krakenjs/shortstop.png?branch=master)](https://travis-ci.org/krakenjs/shortstop)
-
 ```javascript
@@ -11,0 +11,0 @@ var fs = require('fs');

SECURITY.md

@@ -7,3 +7,3 @@ # Security Policy
 ## Contact us
-If you think you may have found a security bug we ask that you privately send the details to [e-mail]. Please make sure to use a descriptive title in the email.
+If you think you may have found a security bug we ask that you privately send the details to [e-mail]. Please make sure to use a descriptive title in the email.
 
@@ -10,0 +10,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

19509

increased by3.02%

Lines of code

217

increased by5.34%

Worsened metrics

Number of package files

9

decreased by-10%

Number of medium supply chain risk alerts

1

increased byInfinity%

Dependency changes

• + Addedasync@3.2.6(transitive)

• - Removedasync@0.2.10(transitive)

• Updatedasync@^3.2.4