standard-version - npm Package Compare versions

Comparing version 2.3.0 to 2.3.1

CHANGELOG.md

@@ -5,2 +5,12 @@ # Change Log
 
+<a name="2.3.1"></a>
+## [2.3.1](https://github.com/conventional-changelog/standard-version/compare/v2.3.0...v2.3.1) (2016-06-15)
+
+
+### Bug Fixes
+
+* **commit:** fix windows by separating add and commit exec ([#55](https://github.com/conventional-changelog/standard-version/issues/55)) ([f361c46](https://github.com/conventional-changelog/standard-version/commit/f361c46)), closes [#55](https://github.com/conventional-changelog/standard-version/issues/55) [#49](https://github.com/conventional-changelog/standard-version/issues/49)
+
+
+
 <a name="2.3.0"></a>
@@ -7,0 +17,0 @@ # [2.3.0](https://github.com/conventional-changelog/standard-version/compare/v2.2.1...v2.3.0) (2016-06-02)

index.js

@@ -124,6 +124,6 @@ #!/usr/bin/env node
   checkpoint(msg, args)
-  exec('git add package.json ' + argv.infile + ';git commit ' + verify + (argv.sign ? '-S ' : '') + 'package.json ' + argv.infile + ' -m "' + formatCommitMessage(argv.message, newVersion) + '"', function (err, stdout, stderr) {
-    var errMessage = null
-    if (err) errMessage = err.message
-    if (stderr) errMessage = stderr
+
+  function handleExecError (err, stderr) {
+    // If exec returns an error or content in stderr, log it and exit with return code 1
+    var errMessage = stderr || (err && err.message)
     if (errMessage) {
@@ -133,3 +133,9 @@ console.log(chalk.red(errMessage))
     }
-    return cb()
+  }
+  exec('git add package.json ' + argv.infile, function (err, stdout, stderr) {
+    handleExecError(err, stderr)
+    exec('git commit ' + verify + (argv.sign ? '-S ' : '') + 'package.json ' + argv.infile + ' -m "' + formatCommitMessage(argv.message, newVersion) + '"', function (err, stdout, stderr) {
+      handleExecError(err, stderr)
+      return cb()
+    })
   })
@@ -136,0 +142,0 @@ }

package.json

 {
   "name": "standard-version",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "replacement for `npm version` with automatic CHANGELOG generation",
@@ -5,0 +5,0 @@ "bin": "index.js",

test.js

@@ -17,2 +17,6 @@ /* global describe it beforeEach afterEach */
 
+function execCli (argString) {
+  return shell.exec('node ' + cliPath + (argString != null ? ' ' + argString : ''))
+}
+
 function writePackageJson (version) {
@@ -52,3 +56,3 @@ fs.writeFileSync('package.json', JSON.stringify({
 
-      shell.exec(cliPath).code.should.equal(0)
+      execCli().code.should.equal(0)
 
@@ -65,3 +69,3 @@ var content = fs.readFileSync('CHANGELOG.md', 'utf-8')
       commit('fix: patch release')
-      shell.exec(cliPath + ' --first-release').code.should.equal(0)
+      execCli('--first-release').code.should.equal(0)
 
@@ -84,3 +88,3 @@ var content = fs.readFileSync('CHANGELOG.md', 'utf-8')
 
-      shell.exec(cliPath).code.should.equal(0)
+      execCli().code.should.equal(0)
       var content = fs.readFileSync('CHANGELOG.md', 'utf-8')
@@ -95,7 +99,7 @@ content.should.match(/1\.0\.1/)
       // mock git with file that writes args to gitcapture.log
-      mockGit('require("fs").appendFileSync("gitcapture.log", JSON.stringify(process.argv.splice(2)) + "\\n")')
+      return mockGit('require("fs").appendFileSync("gitcapture.log", JSON.stringify(process.argv.splice(2)) + "\\n")')
         .then(function (unmock) {
           writePackageJson('1.0.0')
 
-          shell.exec(cliPath + ' --sign').code.should.equal(0)
+          execCli('--sign').code.should.equal(0)
 
@@ -114,7 +118,7 @@ var captured = shell.cat('gitcapture.log').stdout.split('\n').map(function (line) {
       // mock git by throwing on attempt to commit
-      mockGit('console.error("commit yourself"); process.exit(128);', 'commit')
+      return mockGit('console.error("commit yourself"); process.exit(128);', 'commit')
         .then(function (unmock) {
           writePackageJson('1.0.0')
 
-          var result = shell.exec(cliPath)
+          var result = execCli()
           result.code.should.equal(1)
@@ -127,2 +131,16 @@ result.stdout.should.match(/commit yourself/)
 
+    it('exits with error code if git add fails', function () {
+      // mock git by throwing on attempt to add
+      return mockGit('console.error("addition is hard"); process.exit(128);', 'add')
+        .then(function (unmock) {
+          writePackageJson('1.0.0')
+
+          var result = execCli()
+          result.code.should.equal(1)
+          result.stdout.should.match(/addition is hard/)
+
+          unmock()
+        })
+    })
+
     it('exits with error code if git tag fails', function () {
@@ -134,3 +152,3 @@ // mock git by throwing on attempt to commit
 
-          var result = shell.exec(cliPath)
+          var result = execCli()
           result.code.should.equal(1)
@@ -151,3 +169,3 @@ result.stdout.should.match(/tag, you're it/)
 
-    shell.exec(cliPath).code.should.equal(0)
+    execCli().code.should.equal(0)
 
@@ -165,3 +183,3 @@ var content = fs.readFileSync('CHANGELOG.md', 'utf-8')
 
-    shell.exec(cliPath).code.should.equal(0)
+    execCli().code.should.equal(0)
 
@@ -177,3 +195,3 @@ // check last commit message
 
-    shell.exec(cliPath).code.should.equal(0)
+    execCli().code.should.equal(0)
 
@@ -189,6 +207,6 @@ var pkgJson = fs.readFileSync('package.json', 'utf-8')
     commit('feat: first commit')
-    shell.exec(cliPath + ' --no-verify').code.should.equal(0)
+    execCli('--no-verify').code.should.equal(0)
     commit('feat: second commit')
-    shell.exec(cliPath + ' -n').code.should.equal(0)
+    execCli('-n').code.should.equal(0)
   })
 })

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances in 1 package

Fixed alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances in 1 package

Improved metrics

Total package byte prevSize

26343

4.69%

Lines of code

327

6.17%

Worsened metrics

Number of medium supply chain risk alerts

2

100%

No dependency changes