@code-pushup/js-packages-plugin 0.44.2 → 0.44.4

package/README.md

@@ -59,7 +59,7 @@ It supports the following package managers:
      // ...
      plugins: [
        // ...
-       await jsPackagesPlugin({ packageManager: ['yarn'], checks: ['audit'] }),
+       await jsPackagesPlugin({ packageManager: ['yarn-classic'], checks: ['audit'], dependencyGroups: ['prod'] }),
      ],
    };
    ```
@@ -112,11 +112,12 @@ The plugin accepts the following parameters:
 
 - `packageManager`: The package manager you are using. Supported values: `npm`, `yarn-classic` (v1), `yarn-modern` (v2+), `pnpm`.
 - (optional) `checks`: Array of checks to be run. Supported commands: `audit`, `outdated`. Both are configured by default.
+- (optional) `dependencyGroups`: Array of dependency groups to be checked. `prod` and `dev` are configured by default. `optional` are opt-in.
 - (optional) `auditLevelMapping`: If you wish to set a custom level of issue severity based on audit vulnerability level, you may do so here. Any omitted values will be filled in by defaults. Audit levels are: `critical`, `high`, `moderate`, `low` and `info`. Issue severities are: `error`, `warn` and `info`. By default the mapping is as follows: `critical` and `high` → `error`; `moderate` and `low` → `warning`; `info` → `info`.
 
 ### Audits and group
 
-This plugin provides a group per check for a convenient declaration in your config. Each group contains audits for all supported groups of dependencies (`prod`, `dev` and `optional`).
+This plugin provides a group per check for a convenient declaration in your config. Each group contains audits for all selected groups of dependencies that are supported (`prod`, `dev` or `optional`).
 
 ```ts
      // ...
@@ -144,7 +145,7 @@ This plugin provides a group per check for a convenient declaration in your conf
      ],
 ```
 
-Each dependency group has its own audit. If you want to check only a subset of dependencies (e.g. run audit and outdated for production dependencies) or assign different weights to them, you can do so in the following way:
+Each dependency group has its own audit. If you want to assign different weights to the audits or record different dependency groups for different checks (the bigger set needs to be included in the plugin configuration), you can do so in the following way:
 
 ```ts
      // ...

package/bin.js

@@ -1186,6 +1186,7 @@ var dependencyGroupToLong = {
 
 // packages/plugin-js-packages/src/lib/config.ts
 var dependencyGroups = ["prod", "dev", "optional"];
+var dependencyGroupSchema = z16.enum(dependencyGroups);
 var packageCommandSchema = z16.enum(["audit", "outdated"]);
 var packageManagerIdSchema = z16.enum([
   "npm",
@@ -1217,6 +1218,7 @@ var jsPackagesPluginConfigSchema = z16.object({
   packageManager: packageManagerIdSchema.describe(
     "Package manager to be used."
   ),
+  dependencyGroups: z16.array(dependencyGroupSchema).min(1).default(["prod", "dev"]),
   auditLevelMapping: z16.record(packageAuditLevelSchema, issueSeveritySchema, {
     description: "Mapping of audit levels to issue severity. Custom mapping or overrides may be entered manually, otherwise has a default preset."
   }).default(defaultAuditLevelMapping).transform(fillAuditLevelMapping)
@@ -1354,11 +1356,16 @@ var npmPackageManager = {
     ],
     unifyResult: npmToAuditResult,
     // prod dependencies need to be filtered out manually since v10
-    postProcessResult: (results) => ({
-      prod: results.prod,
-      dev: filterAuditResult(results.dev, "name", results.prod),
-      optional: filterAuditResult(results.optional, "name", results.prod)
-    })
+    postProcessResult: (results) => {
+      const depGroups = objectToKeys(results);
+      const devFilter = results.dev && results.prod ? filterAuditResult(results.dev, "name", results.prod) : results.dev;
+      const optionalFilter = results.optional && results.prod ? filterAuditResult(results.optional, "name", results.prod) : results.optional;
+      return {
+        ...depGroups.includes("prod") && { prod: results.prod },
+        ...depGroups.includes("dev") && { dev: devFilter },
+        ...depGroups.includes("optional") && { optional: optionalFilter }
+      };
+    }
   },
   outdated: {
     commandArgs: [...COMMON_OUTDATED_ARGS, "--long"],
@@ -1451,15 +1458,16 @@ var pnpmPackageManager = {
     ignoreExitCode: true,
     unifyResult: pnpmToAuditResult,
     // optional dependencies don't have an exclusive option so they need duplicates filtered out
-    postProcessResult: (results) => ({
-      prod: results.prod,
-      dev: results.dev,
-      optional: filterAuditResult(
-        filterAuditResult(results.optional, "id", results.prod),
-        "id",
-        results.dev
-      )
-    })
+    postProcessResult: (results) => {
+      const depGroups = objectToKeys(results);
+      const prodFilter = results.optional && results.prod ? filterAuditResult(results.optional, "id", results.prod) : results.optional;
+      const devFilter = prodFilter && results.dev ? filterAuditResult(prodFilter, "id", results.dev) : results.optional;
+      return {
+        ...depGroups.includes("prod") && { prod: results.prod },
+        ...depGroups.includes("dev") && { dev: results.dev },
+        ...results.optional && { optional: devFilter }
+      };
+    }
   },
   outdated: {
     commandArgs: COMMON_OUTDATED_ARGS,
@@ -1853,14 +1861,19 @@ function outdatedToIssues(dependencies) {
 
 // packages/plugin-js-packages/src/lib/runner/index.ts
 async function executeRunner() {
-  const { packageManager, checks, auditLevelMapping } = await readJsonFile(PLUGIN_CONFIG_PATH);
-  const auditResults = checks.includes("audit") ? await processAudit(packageManager, auditLevelMapping) : [];
-  const outdatedResults = checks.includes("outdated") ? await processOutdated(packageManager) : [];
+  const {
+    packageManager,
+    checks,
+    auditLevelMapping,
+    dependencyGroups: depGroups
+  } = await readJsonFile(PLUGIN_CONFIG_PATH);
+  const auditResults = checks.includes("audit") ? await processAudit(packageManager, auditLevelMapping, depGroups) : [];
+  const outdatedResults = checks.includes("outdated") ? await processOutdated(packageManager, depGroups) : [];
   const checkResults = [...auditResults, ...outdatedResults];
   await ensureDirectoryExists(dirname(RUNNER_OUTPUT_PATH));
   await writeFile(RUNNER_OUTPUT_PATH, JSON.stringify(checkResults));
 }
-async function processOutdated(id) {
+async function processOutdated(id, depGroups) {
   const pm = packageManagers[id];
   const { stdout } = await executeProcess({
     command: pm.command,
@@ -1870,15 +1883,18 @@ async function processOutdated(id) {
     // outdated returns exit code 1 when outdated dependencies are found
   });
   const normalizedResult = pm.outdated.unifyResult(stdout);
-  return dependencyGroups.map(
+  return depGroups.map(
     (depGroup) => outdatedResultToAuditOutput(normalizedResult, id, depGroup)
   );
 }
-async function processAudit(id, auditLevelMapping) {
+async function processAudit(id, auditLevelMapping, depGroups) {
   const pm = packageManagers[id];
-  const supportedDepGroups = pm.audit.supportedDepGroups ?? dependencyGroups;
+  const supportedAuditDepGroups = pm.audit.supportedDepGroups ?? dependencyGroups;
+  const compatibleAuditDepGroups = depGroups.filter(
+    (group) => supportedAuditDepGroups.includes(group)
+  );
   const auditResults = await Promise.allSettled(
-    supportedDepGroups.map(
+    compatibleAuditDepGroups.map(
       async (depGroup) => {
         const { stdout } = await executeProcess({
           command: pm.command,
@@ -1901,8 +1917,9 @@ async function processAudit(id, auditLevelMapping) {
     auditResults.filter(isPromiseFulfilledResult).map((x) => x.value)
   );
   const uniqueResults = pm.audit.postProcessResult?.(fulfilled) ?? fulfilled;
-  return supportedDepGroups.map(
+  return compatibleAuditDepGroups.map(
     (depGroup) => auditResultToAuditOutput(
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
       uniqueResults[depGroup],
       id,
       depGroup,

package/index.js

@@ -4,7 +4,7 @@ import { fileURLToPath } from "node:url";
 
 // packages/plugin-js-packages/package.json
 var name = "@code-pushup/js-packages-plugin";
-var version = "0.44.2";
+var version = "0.44.4";
 
 // packages/plugin-js-packages/src/lib/config.ts
 import { z as z16 } from "zod";
@@ -717,10 +717,9 @@ var dependencyGroupToLong = {
   optional: "optionalDependencies"
 };
 var dependencyGroupWeights = {
-  // eslint-disable-next-line no-magic-numbers
-  prod: 3,
-  dev: 1,
-  optional: 1
+  prod: 80,
+  dev: 15,
+  optional: 5
 };
 var dependencyDocs = {
   prod: "https://classic.yarnpkg.com/docs/dependency-types#toc-dependencies",
@@ -730,6 +729,7 @@ var dependencyDocs = {
 
 // packages/plugin-js-packages/src/lib/config.ts
 var dependencyGroups = ["prod", "dev", "optional"];
+var dependencyGroupSchema = z16.enum(dependencyGroups);
 var packageCommandSchema = z16.enum(["audit", "outdated"]);
 var packageManagerIdSchema = z16.enum([
   "npm",
@@ -761,47 +761,12 @@ var jsPackagesPluginConfigSchema = z16.object({
   packageManager: packageManagerIdSchema.describe(
     "Package manager to be used."
   ),
+  dependencyGroups: z16.array(dependencyGroupSchema).min(1).default(["prod", "dev"]),
   auditLevelMapping: z16.record(packageAuditLevelSchema, issueSeveritySchema, {
     description: "Mapping of audit levels to issue severity. Custom mapping or overrides may be entered manually, otherwise has a default preset."
   }).default(defaultAuditLevelMapping).transform(fillAuditLevelMapping)
 });
 
-// packages/plugin-js-packages/src/lib/runner/utils.ts
-function filterAuditResult(result, key, referenceResult) {
-  if (result.vulnerabilities.length === 0) {
-    return result;
-  }
-  const uniqueResult = result.vulnerabilities.reduce(
-    (acc, ref) => {
-      const matchReference = referenceResult ?? acc;
-      const isMatch = matchReference.vulnerabilities.map((vulnerability) => vulnerability[key]).includes(ref[key]);
-      if (isMatch) {
-        return {
-          vulnerabilities: acc.vulnerabilities,
-          summary: {
-            ...acc.summary,
-            [ref.severity]: acc.summary[ref.severity] - 1,
-            total: acc.summary.total - 1
-          }
-        };
-      }
-      return {
-        vulnerabilities: [...acc.vulnerabilities, ref],
-        summary: acc.summary
-      };
-    },
-    { vulnerabilities: [], summary: result.summary }
-  );
-  return {
-    vulnerabilities: uniqueResult.vulnerabilities,
-    summary: uniqueResult.summary
-  };
-}
-
-// packages/plugin-js-packages/src/lib/package-managers/constants.ts
-var COMMON_AUDIT_ARGS = ["audit", "--json"];
-var COMMON_OUTDATED_ARGS = ["outdated", "--json"];
-
 // packages/utils/src/lib/text-formats/constants.ts
 var NEW_LINE = "\n";
 var TAB = "  ";
@@ -1187,6 +1152,42 @@ var { details: details3 } = html;
 // packages/utils/src/lib/reports/log-stdout-summary.ts
 import chalk4 from "chalk";
 
+// packages/plugin-js-packages/src/lib/runner/utils.ts
+function filterAuditResult(result, key, referenceResult) {
+  if (result.vulnerabilities.length === 0) {
+    return result;
+  }
+  const uniqueResult = result.vulnerabilities.reduce(
+    (acc, ref) => {
+      const matchReference = referenceResult ?? acc;
+      const isMatch = matchReference.vulnerabilities.map((vulnerability) => vulnerability[key]).includes(ref[key]);
+      if (isMatch) {
+        return {
+          vulnerabilities: acc.vulnerabilities,
+          summary: {
+            ...acc.summary,
+            [ref.severity]: acc.summary[ref.severity] - 1,
+            total: acc.summary.total - 1
+          }
+        };
+      }
+      return {
+        vulnerabilities: [...acc.vulnerabilities, ref],
+        summary: acc.summary
+      };
+    },
+    { vulnerabilities: [], summary: result.summary }
+  );
+  return {
+    vulnerabilities: uniqueResult.vulnerabilities,
+    summary: uniqueResult.summary
+  };
+}
+
+// packages/plugin-js-packages/src/lib/package-managers/constants.ts
+var COMMON_AUDIT_ARGS = ["audit", "--json"];
+var COMMON_OUTDATED_ARGS = ["outdated", "--json"];
+
 // packages/plugin-js-packages/src/lib/package-managers/npm/audit-result.ts
 function npmToAuditResult(output) {
   const npmAudit = JSON.parse(output);
@@ -1283,11 +1284,16 @@ var npmPackageManager = {
     ],
     unifyResult: npmToAuditResult,
     // prod dependencies need to be filtered out manually since v10
-    postProcessResult: (results) => ({
-      prod: results.prod,
-      dev: filterAuditResult(results.dev, "name", results.prod),
-      optional: filterAuditResult(results.optional, "name", results.prod)
-    })
+    postProcessResult: (results) => {
+      const depGroups = objectToKeys(results);
+      const devFilter = results.dev && results.prod ? filterAuditResult(results.dev, "name", results.prod) : results.dev;
+      const optionalFilter = results.optional && results.prod ? filterAuditResult(results.optional, "name", results.prod) : results.optional;
+      return {
+        ...depGroups.includes("prod") && { prod: results.prod },
+        ...depGroups.includes("dev") && { dev: devFilter },
+        ...depGroups.includes("optional") && { optional: optionalFilter }
+      };
+    }
   },
   outdated: {
     commandArgs: [...COMMON_OUTDATED_ARGS, "--long"],
@@ -1380,15 +1386,16 @@ var pnpmPackageManager = {
     ignoreExitCode: true,
     unifyResult: pnpmToAuditResult,
     // optional dependencies don't have an exclusive option so they need duplicates filtered out
-    postProcessResult: (results) => ({
-      prod: results.prod,
-      dev: results.dev,
-      optional: filterAuditResult(
-        filterAuditResult(results.optional, "id", results.prod),
-        "id",
-        results.dev
-      )
-    })
+    postProcessResult: (results) => {
+      const depGroups = objectToKeys(results);
+      const prodFilter = results.optional && results.prod ? filterAuditResult(results.optional, "id", results.prod) : results.optional;
+      const devFilter = prodFilter && results.dev ? filterAuditResult(prodFilter, "id", results.dev) : results.optional;
+      return {
+        ...depGroups.includes("prod") && { prod: results.prod },
+        ...depGroups.includes("dev") && { dev: results.dev },
+        ...results.optional && { optional: devFilter }
+      };
+    }
   },
   outdated: {
     commandArgs: COMMON_OUTDATED_ARGS,
@@ -1669,6 +1676,7 @@ async function createRunnerConfig(scriptPath, config) {
 async function jsPackagesPlugin(config) {
   const jsPackagesPluginConfig = jsPackagesPluginConfigSchema.parse(config);
   const checks = [...new Set(jsPackagesPluginConfig.checks)];
+  const depGroups = [...new Set(jsPackagesPluginConfig.dependencyGroups)];
   const id = jsPackagesPluginConfig.packageManager;
   const pm = packageManagers[id];
   const runnerScriptPath = join3(
@@ -1683,21 +1691,24 @@ async function jsPackagesPlugin(config) {
     docsUrl: pm.docs.homepage,
     packageName: name,
     version,
-    audits: createAudits(id, checks),
-    groups: createGroups(id, checks),
+    audits: createAudits(id, checks, depGroups),
+    groups: createGroups(id, checks, depGroups),
     runner: await createRunnerConfig(runnerScriptPath, jsPackagesPluginConfig)
   };
 }
-function createGroups(id, checks) {
+function createGroups(id, checks, depGroups) {
   const pm = packageManagers[id];
   const supportedAuditDepGroups = pm.audit.supportedDepGroups ?? dependencyGroups;
+  const compatibleAuditDepGroups = depGroups.filter(
+    (group) => supportedAuditDepGroups.includes(group)
+  );
   const groups = {
     audit: {
       slug: `${pm.slug}-audit`,
       title: `${pm.name} audit`,
       description: `Group containing ${pm.name} vulnerabilities.`,
       docsUrl: pm.docs.audit,
-      refs: supportedAuditDepGroups.map((depGroup) => ({
+      refs: compatibleAuditDepGroups.map((depGroup) => ({
         slug: `${pm.slug}-audit-${depGroup}`,
         weight: dependencyGroupWeights[depGroup]
       }))
@@ -1707,7 +1718,7 @@ function createGroups(id, checks) {
       title: `${pm.name} outdated dependencies`,
       description: `Group containing outdated ${pm.name} dependencies.`,
       docsUrl: pm.docs.outdated,
-      refs: dependencyGroups.map((depGroup) => ({
+      refs: depGroups.map((depGroup) => ({
         slug: `${pm.slug}-outdated-${depGroup}`,
         weight: dependencyGroupWeights[depGroup]
       }))
@@ -1715,11 +1726,12 @@ function createGroups(id, checks) {
   };
   return checks.map((check) => groups[check]);
 }
-function createAudits(id, checks) {
+function createAudits(id, checks, depGroups) {
   const { slug } = packageManagers[id];
   return checks.flatMap((check) => {
-    const supportedDepGroups = check === "audit" ? packageManagers[id].audit.supportedDepGroups ?? dependencyGroups : dependencyGroups;
-    return supportedDepGroups.map((depGroup) => ({
+    const supportedAuditDepGroups = packageManagers[id].audit.supportedDepGroups ?? dependencyGroups;
+    const compatibleDepGroups = check === "audit" ? depGroups.filter((group) => supportedAuditDepGroups.includes(group)) : depGroups;
+    return compatibleDepGroups.map((depGroup) => ({
       slug: `${slug}-${check}-${depGroup}`,
       title: getAuditTitle(slug, check, depGroup),
       description: getAuditDescription(check, depGroup),

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@code-pushup/js-packages-plugin",
-  "version": "0.44.2",
+  "version": "0.44.4",
   "dependencies": {
-    "@code-pushup/models": "0.44.2",
-    "@code-pushup/utils": "0.44.2",
+    "@code-pushup/models": "0.44.4",
+    "@code-pushup/utils": "0.44.4",
     "semver": "^7.6.0",
     "zod": "^3.22.4"
   },

package/src/lib/config.d.ts

@@ -14,14 +14,17 @@ export declare function fillAuditLevelMapping(mapping: Partial<AuditSeverity>):
 export declare const jsPackagesPluginConfigSchema: z.ZodObject<{
     checks: z.ZodDefault<z.ZodArray<z.ZodEnum<["audit", "outdated"]>, "many">>;
     packageManager: z.ZodEnum<["npm", "yarn-classic", "yarn-modern", "pnpm"]>;
+    dependencyGroups: z.ZodDefault<z.ZodArray<z.ZodEnum<["prod", "dev", "optional"]>, "many">>;
     auditLevelMapping: z.ZodEffects<z.ZodDefault<z.ZodRecord<z.ZodEnum<["critical", "high", "moderate", "low", "info"]>, z.ZodEnum<["info", "warning", "error"]>>>, AuditSeverity, Partial<Record<"info" | "critical" | "high" | "moderate" | "low", "error" | "info" | "warning">> | undefined>;
 }, "strip", z.ZodTypeAny, {
     checks: ("audit" | "outdated")[];
     packageManager: "npm" | "pnpm" | "yarn-classic" | "yarn-modern";
+    dependencyGroups: ("prod" | "dev" | "optional")[];
     auditLevelMapping: AuditSeverity;
 }, {
     packageManager: "npm" | "pnpm" | "yarn-classic" | "yarn-modern";
     checks?: ("audit" | "outdated")[] | undefined;
+    dependencyGroups?: ("prod" | "dev" | "optional")[] | undefined;
     auditLevelMapping?: Partial<Record<"info" | "critical" | "high" | "moderate" | "low", "error" | "info" | "warning">> | undefined;
 }>;
 export type JSPackagesPluginConfig = z.input<typeof jsPackagesPluginConfigSchema>;

package/src/lib/package-managers/types.d.ts

@@ -2,6 +2,7 @@ import type { MaterialIcon } from '@code-pushup/models';
 import { DependencyGroup, PackageManagerId } from '../config';
 import { AuditResult } from '../runner/audit/types';
 import { OutdatedResult } from '../runner/outdated/types';
+export type AuditResults = Partial<Record<DependencyGroup, AuditResult>>;
 export type PackageManager = {
     slug: PackageManagerId;
     name: string;
@@ -17,7 +18,7 @@ export type PackageManager = {
         ignoreExitCode?: boolean;
         supportedDepGroups?: DependencyGroup[];
         unifyResult: (output: string) => AuditResult;
-        postProcessResult?: (result: Record<DependencyGroup, AuditResult>) => Record<DependencyGroup, AuditResult>;
+        postProcessResult?: (result: AuditResults) => AuditResults;
     };
     outdated: {
         commandArgs: string[];