yarn-deduplicate - npm Package Compare versions

Comparing version 4.0.0 to 5.0.0

CHANGELOG.md

@@ -8,8 +8,21 @@ # Changelog
 
-## master
+## [Unreleased]
 
-## 4.0.0 - 2022-03-21
+## [5.0.0] - 2022-04-23
 
 ### Breaking
 
+- Migration to TypeScript. This is a breacking changes because previously we provided TypeScript
+  types, and those have changed. If you were not using the exported types, this change should be
+  transparent for you.
+
+### Chores
+
+- Configured which files goes into npm package
+- Updated dependencies
+
+## [4.0.0] - 2022-03-21
+
+### Breaking
+
 - Dropped support for Node 10
@@ -200,1 +213,4 @@
 - Cleaned Markdown files.
+
+[unreleased]: https://github.com/scinos/yarn-deduplicate/compare/v5.0.0...HEAD
+[5.0.0]: https://github.com/scinos/yarn-deduplicate/compare/v4.0.0...v5.0.0

package.json

 {
   "name": "yarn-deduplicate",
-  "version": "4.0.0",
-  "bin": "./src/cli.js",
+  "version": "5.0.0",
+  "bin": "./dist/cli.js",
   "description": "Deduplication tool for yarn.lock files",
@@ -16,4 +16,10 @@ "keywords": [
   "scripts": {
-    "test": "jest",
-    "lint": "eslint ."
+    "clean": "yarn tsc --build --clean",
+    "test": "yarn build && jest",
+    "lint": "eslint .",
+    "typecheck": "yarn tsc --build tsconfig.json --force && yarn tsc --build tests/tsconfig.json --force",
+    "validate": "yarn test && yarn lint && yarn typecheck",
+    "prepack": "yarn build",
+    "build": "yarn clean && yarn tsc --build",
+    "release": "release-it"
   },
@@ -24,5 +30,13 @@ "homepage": "https://github.com/scinos/yarn-deduplicate#readme",
   "author": "Sergio Cinos <[e-mail]>",
-  "main": "src/index.js",
-  "types": "src/index.d.ts",
-  "files": ["src"],
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "AUTHORS.md",
+    "CHANGELOG.md",
+    "CODE_OF_CONDUCT.md",
+    "LICENSE.txt",
+    "README.md",
+    "dist/*",
+    "!dist/tsconfig.tsbuildinfo"
+  ],
   "repository": {
@@ -38,9 +52,18 @@ "type": "git",
     "@yarnpkg/lockfile": "^1.1.0",
-    "commander": "^9.0.0",
-    "semver": "^7.3.2"
+    "commander": "^9.2.0",
+    "semver": "^7.3.2",
+    "tslib": "^2.3.1"
   },
   "devDependencies": {
-    "eslint": "^8.11.0",
+    "@babel/core": "^7.17.9",
+    "@babel/preset-env": "^7.16.11",
+    "@babel/preset-typescript": "^7.16.7",
+    "@release-it/keep-a-changelog": "^2.5.0",
+    "@tsconfig/node12": "^1.0.9",
+    "@types/jest": "^27.4.1",
+    "@types/semver": "^7.3.9",
+    "@types/yarnpkg__lockfile": "^1.1.5",
+    "eslint": "^8.13.0",
     "eslint-config-prettier": "^8.5.0",
-    "eslint-plugin-jest": "^26.1.1",
+    "eslint-plugin-jest": "^26.1.4",
     "eslint-plugin-md": "^1.0.19",
@@ -50,10 +73,12 @@ "eslint-plugin-prettier": "^4.0.0",
     "outdent": "^0.8.0",
-    "prettier": "^2.5.1",
-    "typescript": "^4.6.2"
+    "prettier": "^2.6.2",
+    "release-it": "^14.14.2",
+    "typescript": "^4.6.3"
   },
   "jest": {
     "testMatch": [
-      "<rootDir>/tests/*.js"
+      "<rootDir>/tests/*.ts"
     ]
-  }
+  },
+  "packageManager": "yarn@3.2.0"
 }

README.md

 # yarn-deduplicate
 
+Cleans up `yarn.lock` by removing duplicates.
+
 Builds:
-![Node.js CI](https://github.com/atlassian/yarn-deduplicate/workflows/Node.js%20CI/badge.svg)
+[![Node.js CI](https://github.com/scinos/yarn-deduplicate/actions/workflows/node.js.yml/badge.svg)](https://github.com/scinos/yarn-deduplicate/actions/workflows/node.js.yml)
 
@@ -9,4 +11,2 @@ This package only works with Yarn v1. Yarn v2 supports package deduplication
 
-Cleans up `yarn.lock` by removing duplicates.
-
 A duplicate package is when two dependencies are resolved to a different version, even when a single
@@ -270,29 +270,5 @@ version matches the range specified in the dependencies. See the
 
-## Contributors
-
-Pull requests, issues and comments welcome. For pull requests:
-
-- Add tests for new features and bug fixes
-- Follow the existing style
-- Separate unrelated changes into multiple pull requests
-
-See the existing issues for things to start contributing.
-
-For bigger changes, make sure you start a discussion first by creating an issue and explaining the
-intended change.
-
-Atlassian requires contributors to sign a Contributor License Agreement, known as a CLA. This serves
-as a record stating that the contributor is entitled to contribute the
-code/documentation/translation to the project and is willing to have it used in distributions and
-derivative works (or is willing to transfer ownership).
-
-Prior to accepting your contributions we ask that you please follow the appropriate link below to
-digitally sign the CLA. The Corporate CLA is for those who are contributing as a member of an
-organization and the individual CLA is for those contributing as an individual.
-
-- [CLA for corporate contributors](https://opensource.atlassian.com/corporate)
-- [CLA for individuals](https://opensource.atlassian.com/individual)
-
 ## License
 
-Copyright (c) 2017 Atlassian and others. Apache 2.0 licensed, see [LICENSE.txt](LICENSE.txt) file.
+Copyright (c) 2022 Sergio Cinos and others. Apache 2.0 licensed, see [LICENSE.txt](LICENSE.txt)
+file.

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Number of package files

14

increased by16.67%

Number of low supply chain risk alerts

1

decreased by-50%

Number of medium supply chain risk alerts

1

decreased by-50%

Worsened metrics

Total package byte prevSize

50236

decreased by-21.34%

Dependency count

4

increased by33.33%

Dev dependency count

18

increased by100%

Lines of code

245

decreased by-71.41%

Number of lines in readme file

273

decreased by-8.08%

Dependency changes

• + Addedtslib@^2.3.1

• + Addedtslib@2.7.0(transitive)

• Updatedcommander@^9.2.0