sort-package-json - npm Package Compare versions

Comparing version 3.5.0 to 3.5.1

index.js

@@ -6,3 +6,4 @@ import sortObjectKeys from 'sort-object-keys'
 import isPlainObject from 'is-plain-obj'
-import semver from 'semver'
+import semverCompare from 'semver/functions/compare.js'
+import semverMinVersion from 'semver/ranges/min-version.js'
 
@@ -101,3 +102,3 @@ const pipe =
   }
-  return semver.compare(semver.minVersion(aRange), semver.minVersion(bRange))
+  return semverCompare(semverMinVersion(aRange), semverMinVersion(bRange))
 })
@@ -131,33 +132,10 @@
  */
-const sortWorkspaces = (workspaces) => {
-  if (!isPlainObject(workspaces)) {
-    return workspaces
-  }
+const sortWorkspaces = onObject(
+  pipe([
+    sortObjectBy(['packages', 'catalog']),
+    overProperty('packages', uniqAndSortArray),
+    overProperty('catalog', sortDependenciesLikeNpm),
+  ]),
+)
 
-  // Sort known properties in a specific order
-  const sortedWorkspaces = {}
-
-  // First add packages if it exists
-  if (workspaces.packages) {
-    sortedWorkspaces.packages = uniqAndSortArray(workspaces.packages)
-  }
-
-  // Then add catalog if it exists and sort it like dependencies
-  if (workspaces.catalog) {
-    sortedWorkspaces.catalog = sortDependenciesLikeNpm(workspaces.catalog)
-  }
-
-  // Add any other properties in alphabetical order
-  const knownKeys = ['packages', 'catalog']
-  const otherKeys = Object.keys(workspaces)
-    .filter((key) => !knownKeys.includes(key))
-    .sort()
-
-  for (const key of otherKeys) {
-    sortedWorkspaces[key] = workspaces[key]
-  }
-
-  return sortedWorkspaces
-}
-
 // https://github.com/eslint/eslint/blob/acc0e47572a9390292b4e313b4a4bf360d236358/conf/config-schema.js
@@ -301,7 +279,39 @@ const eslintBaseConfigProperties = [
 
+function sortScriptNames(keys, prefix = '') {
+  const groupMap = new Map()
+  for (const key of keys) {
+    const rest = prefix ? key.slice(prefix.length + 1) : key
+    const idx = rest.indexOf(':')
+    if (idx !== -1) {
+      const base = key.slice(0, (prefix ? prefix.length + 1 : 0) + idx)
+      if (!groupMap.has(base)) groupMap.set(base, [])
+      groupMap.get(base).push(key)
+    } else {
+      if (!groupMap.has(key)) groupMap.set(key, [])
+      groupMap.get(key).push(key)
+    }
+  }
+  return Array.from(groupMap.keys())
+    .sort()
+    .flatMap((groupKey) => {
+      const children = groupMap.get(groupKey)
+      if (
+        children.length > 1 &&
+        children.some((k) => k !== groupKey && k.startsWith(groupKey + ':'))
+      ) {
+        const direct = children
+          .filter((k) => k === groupKey || !k.startsWith(groupKey + ':'))
+          .sort()
+        const nested = children.filter((k) => k.startsWith(groupKey + ':'))
+        return [...direct, ...sortScriptNames(nested, groupKey)]
+      }
+      return children.sort()
+    })
+}
+
 const sortScripts = onObject((scripts, packageJson) => {
-  const names = Object.keys(scripts)
+  let names = Object.keys(scripts)
   const prefixable = new Set()
 
-  const keys = names.map((name) => {
+  names = names.map((name) => {
     const omitted = name.replace(/^(?:pre|post)/, '')
@@ -316,10 +326,8 @@ if (defaultNpmScripts.has(omitted) || names.includes(omitted)) {
   if (!hasSequentialScript(packageJson)) {
-    keys.sort()
+    names = sortScriptNames(names)
   }
-
-  const order = keys.flatMap((key) =>
+  names = names.flatMap((key) =>
     prefixable.has(key) ? [`pre${key}`, key, `post${key}`] : [key],
   )
-
-  return sortObjectKeys(scripts, order)
+  return sortObjectKeys(scripts, names)
 })
@@ -532,11 +540,2 @@
 
-const isPrivateKey = (key) => key[0] === '_'
-const partition = (array, predicate) =>
-  array.reduce(
-    (result, value) => {
-      result[predicate(value) ? 0 : 1].push(value)
-      return result
-    },
-    [[], []],
-  )
 function sortPackageJson(jsonIsh, options = {}) {
@@ -550,3 +549,6 @@ return editStringJSON(
         const keys = Object.keys(json)
-        const [privateKeys, publicKeys] = partition(keys, isPrivateKey)
+        const { privateKeys = [], publicKeys = [] } = objectGroupBy(
+          keys,
+          (key) => (key[0] === '_' ? 'privateKeys' : 'publicKeys'),
+        )
         sortOrder = [
@@ -553,0 +555,0 @@ ...sortOrder,

package.json

 {
   "name": "sort-package-json",
-  "version": "3.5.0",
+  "version": "3.5.1",
   "description": "Sort an Object or package.json based on the well-known package.json keys",
@@ -43,3 +43,3 @@ "keywords": [
   "scripts": {
-    "build": "esbuild index.js --bundle --platform=node --outfile=index.cjs",
+    "build": "esbuild index.js --bundle --platform=node --outfile=index.cjs --external:semver",
     "fix": "eslint . --fix && prettier . --write && node cli.js \"package.json\"",
@@ -78,29 +78,29 @@ "lint": "eslint . && prettier . \"!**/*.js\" --check && node cli.js \"package.json\" --check",
   "dependencies": {
-    "detect-indent": "^7.0.1",
+    "detect-indent": "^7.0.2",
     "detect-newline": "^4.0.1",
-    "git-hooks-list": "^4.0.0",
+    "git-hooks-list": "^4.1.1",
     "is-plain-obj": "^4.1.0",
-    "semver": "^7.7.1",
-    "sort-object-keys": "^2.0.0",
-    "tinyglobby": "^0.2.12"
+    "semver": "^7.7.3",
+    "sort-object-keys": "^2.0.1",
+    "tinyglobby": "^0.2.15"
   },
   "devDependencies": {
-    "@commitlint/cli": "^19.7.1",
-    "@commitlint/config-conventional": "^19.7.1",
-    "@eslint/js": "^9.21.0",
-    "ava": "^6.2.0",
+    "@commitlint/cli": "^20.1.0",
+    "@commitlint/config-conventional": "^20.0.0",
+    "@eslint/js": "^9.39.1",
+    "ava": "^6.4.1",
     "c8": "^10.1.3",
-    "dot-prop": "^9.0.0",
-    "esbuild": "^0.25.0",
-    "eslint": "^9.21.0",
-    "eslint-config-prettier": "^10.0.2",
-    "eslint-plugin-n": "^17.15.1",
+    "dot-prop": "^10.1.0",
+    "esbuild": "^0.27.0",
+    "eslint": "^9.39.1",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-n": "^17.23.1",
     "eslint-plugin-promise": "^7.2.1",
-    "globals": "^16.0.0",
+    "globals": "^16.5.0",
     "husky": "^9.1.7",
-    "lint-staged": "^15.4.3",
-    "prettier": "^3.5.2",
-    "semantic-release": "^24.2.3",
+    "lint-staged": "^16.2.7",
+    "prettier": "^3.7.1",
+    "semantic-release": "^25.0.2",
     "tempy": "^3.1.0",
-    "tstyche": "^4.0.0"
+    "tstyche": "^5.0.1"
   },
@@ -107,0 +107,0 @@ "engines": {

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Number of low supply chain risk alerts

1

-83.33%

Worsened metrics

Total package byte prevSize

60116

-50.27%

Lines of code

1438

-55.63%

Dependency changes

• Updated

  detect-indent@^7.0.2

• Updated

  git-hooks-list@^4.1.1

• Updated

  semver@^7.7.3

• Updated

  sort-object-keys@^2.0.1

• Updated

  tinyglobby@^0.2.15