@mnci/cli 1.19.6 → 1.19.8

package/dist/cli.js

@@ -1411,6 +1411,10 @@ function devcontainerJson(workspaceName, linter) {
     // `npm ci` first: every guard after it runs through the workspace's own
     // scripts and Nx, which do not exist until the install completes.
     postCreateCommand: [
+      // Same pin the workflow applies, for the same reason — a container whose
+      // npm major differs from CI's resolves dependencies differently, which is
+      // precisely the drift this file exists to remove.
+      `npm install -g npm@${NPM_VERSION}`,
       "npm ci",
       "npm run python:install",
       GOLANGCI_LINT_INSTALL_GUARD,
@@ -1441,7 +1445,24 @@ var ROOT_LINT_TARGET = {
 };
 var ESLINT_PEER_OVERRIDES = {
   "eslint-plugin-jsx-a11y": { eslint: "$eslint" },
+  // Scoped to EACH named parent, not top-level and not `nx` alone.
+  //
+  // `nx` alone was the first attempt and it did not work: the e2e's audit step
+  // still reported all six advisories in a freshly generated workspace, because
+  // `@nx/js`, `@nx/eslint`, `@nx/eslint-plugin` and `@nx/workspace` are their own
+  // dependents there, and an override scoped to `nx` never reaches a sibling's
+  // dependencies. Those four are exactly the packages npm audit named.
+  //
+  // Top-level would be worse than wrong. A tree with `minimatch@3` legitimately
+  // carries `brace-expansion@1.1.18` (and `@2.1.4` elsewhere) — this repo has
+  // both — and forcing those to v5 breaks them. So the blast radius is one
+  // dependency edge per named parent, and a test asserts there is no top-level
+  // entry.
   nx: { "brace-expansion": "^5.0.9" },
+  "@nx/js": { "brace-expansion": "^5.0.9" },
+  "@nx/eslint": { "brace-expansion": "^5.0.9" },
+  "@nx/eslint-plugin": { "brace-expansion": "^5.0.9" },
+  "@nx/workspace": { "brace-expansion": "^5.0.9" },
   // `postcss` → `nanoid` reaches a generated workspace through `@nx/rollup`,
   // which every publishable `npm-lib` gets. GHSA-2v37-7h3g-55p8 is high, fixed in
   // 3.3.18, and the fix is a patch — so unlike the entry above this one is not
@@ -1767,6 +1788,7 @@ var GO_TOOL_PATH_AZURE = `node -e "${GO_TOOL_PATH_PRELUDE}console.log('##vso[tas
 var GO_TOOL_PATH_GITHUB = `node -e "${GO_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
 var FLUTTER_SDK_VERSION = "3.44.8";
 var NODE_VERSION = "24";
+var NPM_VERSION = "11";
 var FLUTTER_SDK_DIRECTORY_EXPRESSION = `require('node:path').join(require('node:os').homedir(),'.mnci-flutter-${FLUTTER_SDK_VERSION}')`;
 var FLUTTER_SDK_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}if(cp.spawnSync('flutter',['--version'],{stdio:'ignore',shell:process.platform==='win32'}).status===0){console.log('Flutter SDK already on PATH - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(fs.existsSync(sdk)){console.log('Flutter SDK already installed at '+sdk+' - skipping.');process.exit(0)}process.exit(cp.spawnSync('git',['clone','--depth','1','--branch','${FLUTTER_SDK_VERSION}','https://github.com/flutter/flutter.git',sdk],{stdio:'inherit'}).status ?? 1)"`;
 var FLUTTER_TOOL_PATH_PRELUDE = `const fs=require('node:fs'),path=require('node:path');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(!fs.existsSync(sdk)){console.log('Flutter SDK was not installed by mnci (already on PATH) - skipping.');process.exit(0)}const bin=path.join(sdk,'bin');`;
@@ -2071,6 +2093,13 @@ jobs:
           # dependency change misses the cache and a no-op change hits it.
           cache: npm
 
+      # setup-node installs whatever npm the Node image bundles, and npm's major
+      # is part of the contract: npm 11 reuses an already-installed tree instead
+      # of re-resolving, so it applies \`overrides\` differently from npm 10. See
+      # NPM_VERSION's remarks for the measurement.
+      - run: npm install -g npm@${NPM_VERSION}
+        name: Pin npm to the major mnci verifies against
+
       - run: npm ci
         name: Install dependencies
         env:
@@ -2582,6 +2611,7 @@ var import_node_path15 = require("path");
 var import_prompts8 = require("@inquirer/prompts");
 
 // src/commands/new.ts
+var import_node_fs8 = require("fs");
 var import_node_path13 = require("path");
 function nxCloudProviderValue(ci) {
   return ci === "azure" ? "azure" : "github";
@@ -2654,6 +2684,8 @@ async function runNew(name, options) {
     "Applying MoNecromanCI overlay (VS Code workspace, release config, .npmrc, commitlint, pipeline, stack)"
   );
   applyOverlay(workspaceRoot, { workspaceName, scope, registry, agent, variableGroup, ci, stack });
+  (0, import_node_fs8.rmSync)((0, import_node_path13.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
+  (0, import_node_fs8.rmSync)((0, import_node_path13.join)(workspaceRoot, "package-lock.json"), { force: true });
   logger.step("Installing the toolchain (commitlint + husky + linting/formatting)");
   const installStatus = runShell(
     "npm",
@@ -2685,7 +2717,7 @@ async function runNew(name, options) {
 }
 
 // src/commands/upgrade.ts
-var import_node_fs8 = require("fs");
+var import_node_fs9 = require("fs");
 var import_node_path14 = require("path");
 function resolveRegistry2(options, persisted) {
   if (options.registry === "azure-artifacts" || options.organization && options.artifactsFeed) {
@@ -2715,7 +2747,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     return persisted.workspaceName;
   }
   try {
-    const existing = (0, import_node_fs8.readdirSync)(workspaceRoot).find(
+    const existing = (0, import_node_fs9.readdirSync)(workspaceRoot).find(
       (file) => file.endsWith(".code-workspace") && file !== "undefined.code-workspace"
     );
     if (existing) {
@@ -2800,7 +2832,7 @@ async function runInteractive() {
 }
 
 // src/util/versionChecker.ts
-var import_node_fs9 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_path16 = require("path");
 var import_cross_spawn2 = __toESM(require("cross-spawn"));
 var PACKAGE_NAME = "@mnci/cli";
@@ -2858,7 +2890,7 @@ function releaseTriple(version) {
 function readCliVersion(packageDirectory) {
   try {
     const manifestPath = (0, import_node_path16.join)(packageDirectory, "..", "package.json");
-    const manifest = JSON.parse((0, import_node_fs9.readFileSync)(manifestPath, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs10.readFileSync)(manifestPath, "utf8"));
     return manifest.version ?? "0.0.0";
   } catch {
     return "0.0.0";