@mnci/cli 4.40.0 → 4.40.2

package/dist/cli.js

@@ -283,7 +283,17 @@ function classifyNpmAudit(report) {
   });
   return { blocking, total: all.length, notes };
 }
-function auditNpm(result, log) {
+function planIsEmpty(stdout) {
+  try {
+    const start = stdout.search(/^\{/m);
+    const plan = JSON.parse(start === -1 ? stdout : stdout.slice(start));
+    const lists = [plan.add, plan.change, plan.remove];
+    return lists.every((list) => Array.isArray(list) && list.length === 0);
+  } catch {
+    return false;
+  }
+}
+function auditNpm(result, dryRun, log) {
   let report;
   try {
     report = JSON.parse(result.stdout);
@@ -299,6 +309,13 @@ function auditNpm(result, log) {
     log(`npm audit - ${total} advisory(ies), none actionable at moderate or above.`);
     return 0;
   }
+  if (planIsEmpty(dryRun().stdout)) {
+    for (const advisory of blocking) {
+      log(`  note [${advisory.severity}] ${advisory.name} - npm reports a fix, but npm audit fix has nothing to apply`);
+    }
+    log(`npm audit - ${total} advisory(ies); ${blocking.length} reported as fixable, but no patched release is reachable, so there is nothing to do here.`);
+    return 0;
+  }
   for (const advisory of blocking) {
     log(`  BLOCKING [${advisory.severity}] ${advisory.name} - fix available`);
   }
@@ -325,7 +342,7 @@ function runAudit(workspaceRoot, dependencies = {}) {
     }
   };
   log(groupStart(host, "npm audit"));
-  const npm = auditNpm(processes.capture("npm", ["audit", "--json"]), log);
+  const npm = auditNpm(processes.capture("npm", ["audit", "--json"]), () => processes.capture("npm", ["audit", "fix", "--dry-run", "--json"]), log);
   closeGroup();
   if (npm !== 0) {
     return npm;
@@ -1010,7 +1027,19 @@ function releaseConfig(ci) {
       //
       // A workspace that DOES want the lock file refreshed should commit the
       // bump too (`git.commit: true`), at which point this can be dropped.
-      versionActionsOptions: { skipLockFileUpdate: true }
+      versionActionsOptions: { skipLockFileUpdate: true },
+      // OFF, because under this tag-only model it can only ever refuse a release.
+      //
+      // With it on, nx will not release a package whose internal dependency range
+      // cannot absorb the bump, and `git.commit: false` means the manifests on disk
+      // stay at the scaffold version for ever, so the range is always the one that
+      // was written then. Packages start at 0.0.1 and `npm install <pkg> -w <other>`
+      // writes `^0.0.1`, which on a 0.0.x version matches that version alone: the
+      // first bump to 0.0.2 is outside it, and the release dies in the version phase,
+      // before anything is tagged, with lint, typecheck, test and build all green
+      // (the release runs on the default branch only, so nothing else ever tries it).
+      // Measured on a fresh workspace of two interdependent packages (#345).
+      preserveMatchingDependencyRanges: false
     },
     changelog: githubReleases ? {
       workspaceChangelog: false,
@@ -8164,6 +8193,17 @@ function checkNativeBuildConfig(workspaceRoot) {
     remedy: "fix the entry in the mnci block of nx.json, then run `mnci upgrade`"
   }];
 }
+function checkDependencyRangesNotPreserved(nxJson) {
+  if (nxJson.release === void 0) {
+    return void 0;
+  }
+  return {
+    check: "nx release does not preserve matching dependency ranges",
+    ok: nxJson.release.version?.preserveMatchingDependencyRanges === false,
+    detail: "release.version.preserveMatchingDependencyRanges is not false, so the first release of interdependent packages fails in the version phase, before anything is tagged",
+    remedy: "run `mnci upgrade`, or set release.version.preserveMatchingDependencyRanges to false in nx.json"
+  };
+}
 function collectFindings(workspaceRoot) {
   const nxJsonPath = (0, import_node_path32.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
@@ -8190,7 +8230,8 @@ function collectFindings(workspaceRoot) {
     checkGoWorkInSync(workspaceRoot),
     ...checkNativeApps(workspaceRoot),
     ...checkPipelinePhases(workspaceRoot),
-    ...checkNativeBuildConfig(workspaceRoot)
+    ...checkNativeBuildConfig(workspaceRoot),
+    checkDependencyRangesNotPreserved(nxJson)
   ].filter((finding) => finding !== void 0);
 }
 function runDoctor(workspaceRoot, options = {}) {