@cellajs/cli 0.6.0 → 0.6.1

package/README.md

@@ -414,7 +414,8 @@ previous value, and a package.json without `type` gets upstream's. Set it yourse
 
 1. **Updates.** It lists the outdated packages and runtime pins in one table and asks once which to
    update. Rows with a high or critical advisory start ticked; submitting with nothing ticked skips
-   this layer.
+   this layer. Above the prompt it prints what `pnpm audit` reports right now, including packages
+   that have no row, so a run you cancel has shown them too.
 2. **Security.** It audits the workspace as the picked updates leave it and brings three settings
    in `pnpm-workspace.yaml` in line with that audit.
 

package/dist/index.js

@@ -228,7 +228,7 @@ import process5 from "process";
 // package.json
 var package_default = {
   name: "@cellajs/cli",
-  version: "0.6.0",
+  version: "0.6.1",
   private: false,
   license: "MIT",
   description: "CLI for managing your monorepo and upgrading it with upstream Cella.",
@@ -4466,8 +4466,9 @@ async function runAudit(config) {
     }
     const runtimes = planRuntimeUpdates(pins, feeds, { releaseAgeMinutes, now });
     const localTools = planLocalTools(machine, { releaseAgeMinutes, now });
+    const advisories = auditResult ? advisoriesFromAudit(auditResult) : null;
     const rows = [
-      ...packageRows(outdated, auditResult ? advisoriesFromAudit(auditResult) : []),
+      ...packageRows(outdated, advisories ?? []),
       ...runtimes.updates.map(runtimeRow)
     ];
     if (rows.length === 0) {
@@ -4487,6 +4488,7 @@ async function runAudit(config) {
       await runSecurityPass(forkPath, { apply: false, releaseAgeMinutes });
       return;
     }
+    printReported(advisories);
     const selected = await promptForUpdates(rows);
     if (!selected) return;
     const { edits, bumped } = await planEdits(forkPath, rows, selected, pins.nodeImageSuffixes);
@@ -4495,8 +4497,8 @@ async function runAudit(config) {
     spinner.stop();
   }
 }
+var worstSeverity = (advisories, name) => SEVERITIES.find((severity) => advisories.some((a) => a.module === name && a.severity === severity)) ?? null;
 function packageRows(outdated, advisories) {
-  const severityOf = (name) => SEVERITIES.find((severity) => advisories.some((a) => a.module === name && a.severity === severity)) ?? null;
   const readDependentPkg = createDependentPkgReader();
   const rows = Object.entries(outdated).map(([key, pkg]) => {
     const name = outdatedPackageName(key);
@@ -4520,7 +4522,7 @@ function packageRows(outdated, advisories) {
       pinnedIn,
       repoUrl,
       releasesUrl: getReleasesUrl(repoUrl),
-      severity: severityOf(name)
+      severity: worstSeverity(advisories, name)
     };
   });
   return rows.sort((a, b) => inText(a).localeCompare(inText(b)) || a.name.localeCompare(b.name));
@@ -4626,6 +4628,40 @@ function printLocalTools(checks) {
   }
   console.info();
 }
+function printReported(advisories) {
+  if (!advisories) {
+    console.info(`${warningMark} pnpm audit gave no answer: a row in the table can lack its dot`);
+    console.info();
+    return;
+  }
+  if (advisories.length === 0) {
+    console.info(`${checkMark} pnpm audit reports nothing ${colors_default.dim("\xB7 with the current overrides and ignores")}`);
+    console.info();
+    return;
+  }
+  const modules = [...new Set(advisories.map((a) => a.module))].map((name) => {
+    const own = advisories.filter((a) => a.module === name);
+    return {
+      name,
+      severity: worstSeverity(own, name) ?? own[0].severity,
+      installed: [...new Set(own.flatMap((a) => a.installed))].join(", "),
+      via: formatDependents([...new Set(own.flatMap((a) => a.via))]),
+      direct: own.some((a) => a.direct)
+    };
+  });
+  modules.sort((a, b) => SEVERITIES.indexOf(a.severity) - SEVERITIES.indexOf(b.severity));
+  const nameWidth = Math.min(30, Math.max(...modules.map((m) => m.name.length)));
+  const versionWidth = Math.max(...modules.map((m) => m.installed.length));
+  console.info(`${colors_default.bold("pnpm audit")} ${colors_default.dim("\xB7 with the current overrides and ignores")}`);
+  for (const m of modules) {
+    const name = colors_default.white(middleTruncate(m.name, nameWidth).padEnd(nameWidth));
+    const source = `${m.via}${m.direct ? " (direct)" : ""}`;
+    console.info(
+      `${getVulnIcon(m.severity)} ${name}  ${m.severity.padEnd(8)}  ${m.installed.padEnd(versionWidth)}  ${colors_default.dim(source)}`
+    );
+  }
+  console.info();
+}
 function buildUpdateChoices(rows) {
   const makeChoice = (row) => {
     const devTag = row.isDev ? colors_default.dim(" (dev)") : "";