snyk-gradle-plugin - npm Package Compare versions

Comparing version 3.26.2 to 3.26.3

dist/sub-process.d.ts

@@ -0,3 +1,5 @@
+/// <reference types="node" />
 export declare function execute(command: string, args: string[], options: {
     cwd?: string;
+    env?: NodeJS.ProcessEnv;
 }, perLineCallback?: (s: string) => Promise<void>): Promise<string>;

dist/sub-process.js

@@ -10,7 +10,24 @@ "use strict";
 function execute(command, args, options, perLineCallback) {
-    const spawnOptions = { shell: true };
-    if (options && options.cwd) {
+    const spawnOptions = {
+        shell: true,
+        env: { ...process.env },
+    };
+    if (options === null || options === void 0 ? void 0 : options.cwd) {
         spawnOptions.cwd = options.cwd;
     }
+    if (options === null || options === void 0 ? void 0 : options.env) {
+        spawnOptions.env = { ...process.env, ...options.env };
+    }
     args = (0, shescape_1.quoteAll)(args, spawnOptions);
+    // Before spawning an external process, we look if we need to restore the system proxy configuration,
+    // which overides the cli internal proxy configuration.
+    if (process.env.SNYK_SYSTEM_HTTP_PROXY !== undefined) {
+        spawnOptions.env.HTTP_PROXY = process.env.SNYK_SYSTEM_HTTP_PROXY;
+    }
+    if (process.env.SNYK_SYSTEM_HTTPS_PROXY !== undefined) {
+        spawnOptions.env.HTTPS_PROXY = process.env.SNYK_SYSTEM_HTTPS_PROXY;
+    }
+    if (process.env.SNYK_SYSTEM_NO_PROXY !== undefined) {
+        spawnOptions.env.NO_PROXY = process.env.SNYK_SYSTEM_NO_PROXY;
+    }
     return new Promise((resolve, reject) => {
@@ -17,0 +34,0 @@ let stdout = '';

package.json

@@ -57,3 +57,3 @@ {
   },
-  "version": "3.26.2"
+  "version": "3.26.3"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

86334

increased by1.74%

Lines of code

868

increased by2.24%

Worsened metrics

Number of low supply chain risk alerts

11

increased by266.67%

No dependency changes