@dependably/npm-check 1.8.0 → 1.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dependably/npm-check",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "A comprehensive tool for validating, migrating, and updating npm package-lock.json files across versions 1, 2, and 3.",
   "main": "src/index.js",
   "type": "module",
@@ -80,7 +80,7 @@
     "eslint": "10.5.0",
     "globals": "17.6.0",
     "jest": "29.7.0",
-    "sonarqube-scanner": "3.5.0"
+    "sonarqube-scanner": "5.0.0"
   },
   "allowScripts": {
     "fsevents": true,
@@ -89,15 +89,16 @@
   "overrides": {
     "@babel/plugin-transform-modules-systemjs": "7.29.7",
     "@ungap/structured-clone": "1.3.1",
-    "js-yaml": "4.2.0",
+    "brace-expansion": "5.0.9",
+    "js-yaml": "4.3.1",
     "picomatch": "4.0.4",
     "glob": {
       "minimatch": "3.1.5",
-      "brace-expansion": "1.1.15"
+      "brace-expansion": "1.1.18"
     },
     "test-exclude": {
       "minimatch": "3.1.5",
-      "brace-expansion": "1.1.15"
+      "brace-expansion": "1.1.18"
     }
   }
 }

package/src/audit-config.js

@@ -16,7 +16,8 @@ export const CONFIG_FILENAMES = ['.npm-checkrc.json', 'npm-check.config.json'];
 
 // Shared, cross-tool config file (JSON, no extension) discovered by walking up
 // from the working directory. `.dependably` is canonical; `.dependably-check` is
-// a deprecated alias kept for the migration window (docs/dependably-config-spec.md §7).
+// a deprecated alias kept for the migration window (config spec §7, at
+// https://gitlab.northwardlabs.ca/moonlitlabs/dependably-spec).
 export const SHARED_CONFIG_FILENAME = '.dependably';
 export const DEPRECATED_SHARED_CONFIG_FILENAME = '.dependably-check';
 // Checked in this order at each directory level (canonical wins).
@@ -34,8 +35,9 @@ export const SUPPORTED_CONFIG_VERSION = 1;
 // own section but tolerated (ignored) in `common`.
 export const APPLICABLE_SELECTORS = ['package', 'id'];
 
-// Keys npm-check recognizes inside `common` / its own section. Unknown keys warn.
-const KNOWN_SECTION_KEYS = new Set([
+// Keys npm-check recognizes inside its own section. An unrecognized key there warns;
+// the same key in `common` is ignored, since it may belong to a sibling tool.
+export const KNOWN_SECTION_KEYS = new Set([
   'rules', 'exceptions', 'exclude', 'failOn',
   'allowedRegistryHosts', 'allowedLocalFeeds', 'maxWarnings'
 ]);
@@ -58,6 +60,12 @@ export const DEFAULT_CONFIG = {
     'install-scripts': ['warn', { allow: [] }],
     'no-git-deps': 'warn',
     'no-remote-deps': ['warn', { allowedHosts: ['registry.npmjs.org', 'npm.pkg.github.com'] }],
+    // Lockfile portability, distinct from the trust question the two rules above
+    // ask. Empty `hosts` == off: pinning is a per-project decision (a project
+    // that genuinely installs from a private registry must not be flagged), and
+    // unlike `allowedRegistryHosts` this list is NOT unioned from shared config —
+    // a pin that only ever widens would not be a pin.
+    'resolved-registry-pin': ['error', { hosts: [] }],
     'pinned-versions': ['error', {
       sections: ['dependencies', 'devDependencies', 'optionalDependencies'],
       ignore: []
@@ -188,11 +196,26 @@ function unionList(a, b) {
 // id replaces common's wholesale (no cross-section option deep-merge, §B.3).
 function mergeRuleMaps(commonRules, toolRules) {
   if (!commonRules && !toolRules) return undefined;
-  return { ...(commonRules && typeof commonRules === 'object' ? commonRules : {}),
-    ...(toolRules && typeof toolRules === 'object' ? toolRules : {}) };
+
+  // A rule id in `common` that npm-check does not know belongs to a sibling tool, so it is
+  // dropped rather than merged (§8). Without this it reached mergeConfig's registry check and
+  // raised UNKNOWN_RULE, which made a shared config unusable the moment any sibling configured
+  // one of its own rules. Ids from the tool's own section are passed through untouched, so an
+  // unknown id there still errors — that one is a typo, not a sibling's.
+  const fromCommon = {};
+  if (commonRules && typeof commonRules === 'object') {
+    for (const [ruleId, value] of Object.entries(commonRules)) {
+      if (KNOWN_RULES.includes(ruleId)) fromCommon[ruleId] = value;
+    }
+  }
+
+  return { ...fromCommon, ...(toolRules && typeof toolRules === 'object' ? toolRules : {}) };
 }
 
-// Warn about keys npm-check does not recognize inside a read section (§8).
+// Warn about keys npm-check does not recognize inside its own section (§8). `common`
+// is deliberately not checked: it is shared with the sibling tools, so a key npm-check
+// does not know there belongs to one of them, not to a typo. This matches how unknown
+// rule ids are already treated — tolerated in `common`, an error in the own section.
 function unknownKeyWarnings(section, label, warnings) {
   if (!section || typeof section !== 'object') return;
   for (const key of Object.keys(section)) {
@@ -218,7 +241,6 @@ function resolveToolSection(parsed, warnings) {
     warnings.push({ code: 'DEPRECATED_ALIAS_SECTION', message: `both "${SECTION_KEY}" and "${DEPRECATED_SECTION_KEY}" sections present; using "${SECTION_KEY}"` });
   }
 
-  unknownKeyWarnings(common, 'common', warnings);
   unknownKeyWarnings(tool, SECTION_KEY, warnings);
 
   const settings = {};

package/src/audit.js

@@ -666,6 +666,65 @@ const validPnpmFieldRule = {
   }
 };
 
+/**
+ * Lockfile portability: every `resolved` URL must point at a host this project
+ * pins to.
+ *
+ * This is deliberately NOT the same question as `secure-resolved` /
+ * `no-remote-deps`, which both consult `allowedRegistryHosts` to ask "is this
+ * host a legitimate, trusted registry?". Trust and portability are orthogonal:
+ * an org's own private mirror is entirely trusted, yet a lockfile resolving
+ * from it cannot be installed by anyone outside that network (a public CI
+ * runner, an external contributor, a GitHub build). A shared
+ * `allowedRegistryHosts` also unions across config levels, so it can only ever
+ * grow more permissive — correct for a trust allowlist, but useless as a pin,
+ * which must be able to narrow.
+ *
+ * Opt-in: with no `hosts` configured the rule is a no-op, so projects that
+ * genuinely install from a private registry are unaffected.
+ */
+const resolvedRegistryPinRule = {
+  id: 'resolved-registry-pin',
+  description: 'Resolved URLs must point only at the registry hosts this project pins to',
+  defaultSeverity: 'error',
+  // pnpm lockfiles carry no `resolved` URLs (the registry is implied by config),
+  // so there is nothing to pin.
+  flavors: ['npm'],
+  check({ lockfile, options }) {
+    const { hosts = [] } = options;
+    const findings = [];
+    // Unconfigured == off. Pinning is a per-project decision, not a default.
+    if (!Array.isArray(hosts) || hosts.length === 0) return findings;
+    if (!lockfile.packages) return findings;
+
+    const pinned = hosts
+      .filter((h) => typeof h === 'string' && h.trim())
+      .map((h) => h.trim().toLowerCase());
+    if (pinned.length === 0) return findings;
+
+    forEachPackageEntry(lockfile, ({ key, entry, name, isRoot, isWorkspaceSource, isLink, isGitDep, isFileDep }) => {
+      // Git/file/link/workspace entries resolve outside the registry by
+      // definition — no-git-deps / secure-resolved own those.
+      if (isRoot || isWorkspaceSource || isLink || isGitDep || isFileDep) return;
+      const resolved = entry && entry.resolved;
+      if (!resolved || !/^https?:/i.test(resolved)) return;
+      let hostname;
+      try {
+        hostname = new URL(resolved).hostname.toLowerCase();
+      } catch {
+        // Unparseable URL — secure-resolved flags it; not this rule's job.
+        return;
+      }
+      if (pinned.includes(hostname)) return;
+      findings.push({
+        packagePath: key,
+        message: `${name || key} resolves from "${hostname}", which is not a pinned registry host (${pinned.join(', ')}) — the lockfile will not install where that host is unreachable`
+      });
+    });
+    return findings;
+  }
+};
+
 export const rules = [
   lockfileVersionRule,
   validStructureRule,
@@ -675,6 +734,7 @@ export const rules = [
   installScriptsRule,
   noGitDepsRule,
   noRemoteDepsRule,
+  resolvedRegistryPinRule,
   pinnedVersionsRule,
   lockfileSyncRule,
   noOrphanPackagesRule,

package/src/exceptions.js

@@ -1,9 +1,10 @@
 // src/exceptions.js
 //
-// Reference implementation of the `.dependably` exception grammar
-// (docs/dependably-config-spec.md §6). This is the module the C# and Python
-// ports mirror; keep it behavior-compatible with the conformance fixtures under
-// conformance/dependably/.
+// Reference implementation of the `.dependably` exception grammar, specified in
+// §6 of the config spec at
+// https://gitlab.northwardlabs.ca/moonlitlabs/dependably-spec. This is the module
+// the C# and Python ports mirror; keep it behavior-compatible with the vendored
+// conformance fixtures under conformance/dependably/.
 //
 // An exception suppresses SPECIFIC findings so a run does not fail on them,
 // without excluding whole files (`exclude`) or disabling a rule globally

package/src/npmrc-validator.js

@@ -59,7 +59,7 @@ const KNOWN_KEYS = new Set([
   'fetch-retry-maxtimeout', 'fetch-timeout', 'access', 'tag', 'lockfile-version',
   'omit', 'include', 'ignore-scripts', 'foreground-scripts', 'node-options',
   'progress', 'prefer-offline', 'prefer-online', 'offline', 'global', 'unsafe-perm',
-  'user-agent', 'maxsockets', 'before', 'workspaces', 'workspace'
+  'update-notifier', 'user-agent', 'maxsockets', 'before', 'workspaces', 'workspace'
 ]);
 
 // Plaintext-credential keys: bare `_auth`/`_authtoken`/`_password`, or the

package/src/report.js

@@ -43,6 +43,7 @@ const RULE_SECTION = {
   'install-scripts': 'install-scripts',
   'no-git-deps': 'git',
   'no-remote-deps': 'remote',
+  'resolved-registry-pin': 'registry-pin',
   'pinned-versions': 'pinned',
   'no-orphan-packages': 'orphans',
   'unused-dependencies': 'unused',
@@ -72,6 +73,7 @@ const SECTIONS = [
   { id: 'install-scripts', title: 'Install scripts' },
   { id: 'git', title: 'Git dependencies' },
   { id: 'remote', title: 'Remote-URL deps' },
+  { id: 'registry-pin', title: 'Registry pin' },
   { id: 'pinned', title: 'Pinned versions' },
   { id: 'orphans', title: 'Orphaned packages' },
   { id: 'unused', title: 'Unused dependencies' },