@mnci/cli 4.40.8 → 4.41.0

package/dist/cli.js

@@ -299,27 +299,35 @@ function planIsEmpty(stdout) {
     return false;
   }
 }
-function auditNpm(result, dryRun, log) {
+function auditNpm(result, production, dryRun, log) {
   let report;
+  let shipped;
   try {
     report = JSON.parse(result.stdout);
+    shipped = JSON.parse(production.stdout);
   } catch {
     log(`npm audit produced no JSON (exit ${result.status}) - not blocking on a broken audit.`);
     return 0;
   }
-  const { blocking, total, notes } = classifyNpmAudit(report);
+  const { notes } = classifyNpmAudit(report);
+  const { blocking, total } = classifyNpmAudit(shipped);
+  const productionNames = new Set(Object.keys(shipped.vulnerabilities ?? {}));
+  const developmentOnly = classifyNpmAudit(report).blocking.filter((advisory) => !productionNames.has(advisory.name));
   for (const note of notes) {
     log(note);
   }
+  for (const advisory of developmentOnly) {
+    log(`  note [${advisory.severity}] ${advisory.name} - reaches only dev dependencies, which no consumer receives, so it does not block`);
+  }
   if (blocking.length === 0) {
-    log(`npm audit - ${total} advisory(ies), none actionable at moderate or above.`);
+    log(`npm audit - ${Object.keys(report.vulnerabilities ?? {}).length} advisory(ies), none actionable at moderate or above in production dependencies.`);
     return 0;
   }
   if (planIsEmpty(dryRun().stdout)) {
     for (const advisory of blocking) {
       log(`  note [${advisory.severity}] ${advisory.name} - npm reports a fix, but npm audit fix has nothing to apply`);
     }
-    log(`npm audit - ${total} advisory(ies); ${blocking.length} reported as fixable, but no patched release is reachable, so there is nothing to do here.`);
+    log(`npm audit - ${total} production advisory(ies); ${blocking.length} reported as fixable, but no patched release is reachable, so there is nothing to do here.`);
     return 0;
   }
   for (const advisory of blocking) {
@@ -348,7 +356,12 @@ function runAudit(workspaceRoot, dependencies = {}) {
     }
   };
   log(groupStart(host, "npm audit"));
-  const npm = auditNpm(processes.capture("npm", ["audit", "--json"]), () => processes.capture("npm", ["audit", "fix", "--dry-run", "--json"]), log);
+  const npm = auditNpm(
+    processes.capture("npm", ["audit", "--json"]),
+    processes.capture("npm", ["audit", "--omit=dev", "--json"]),
+    () => processes.capture("npm", ["audit", "fix", "--omit=dev", "--dry-run", "--json"]),
+    log
+  );
   closeGroup();
   if (npm !== 0) {
     return npm;
@@ -7885,6 +7898,33 @@ function runKinds(options) {
 var import_node_child_process = require("child_process");
 var import_node_fs29 = require("fs");
 var import_node_path34 = require("path");
+
+// src/workspace-diagnostics/stranded-release-tags.algorithm.ts
+function compareVersions2(left, right) {
+  const a = left.split(".").map(Number);
+  const b = right.split(".").map(Number);
+  return a[0] - b[0] || a[1] - b[1] || a[2] - b[2] || 0;
+}
+function versionsOf(tags, name) {
+  return tags.filter((tag) => tag.startsWith(`${name}@`)).map((tag) => tag.slice(name.length + 1)).filter((version) => /^\d+\.\d+\.\d+$/.test(version));
+}
+function findStrandedReleaseTags(projects, tags) {
+  const stranded = [];
+  for (const project of projects) {
+    const unscoped = /^@[^/]+\/(.+)$/.exec(project)?.[1];
+    if (unscoped === void 0) {
+      continue;
+    }
+    const current = versionsOf(tags, project).sort(compareVersions2).at(-1);
+    const newest = versionsOf(tags, unscoped).sort(compareVersions2).at(-1);
+    if (newest !== void 0 && (current === void 0 || compareVersions2(newest, current) > 0)) {
+      stranded.push({ project, oldTag: `${unscoped}@${newest}`, newTag: `${project}@${newest}` });
+    }
+  }
+  return stranded;
+}
+
+// src/workspace-diagnostics/check-invariants.use-case.ts
 var SUPPORTED_ESLINT_MAJOR = ESLINT_VERSION.replace(/^\D*/, "").split(".", 1)[0];
 function toPosix2(path) {
   return path.replaceAll("\\", "/");
@@ -8353,6 +8393,24 @@ function checkLockfileHasNoLocalRegistry(workspaceRoot) {
     remedy: "run `mnci upgrade`, which removes it, then commit package-lock.json"
   };
 }
+function checkReleaseTagsResolve(workspaceRoot, nxJson) {
+  const pattern = nxJson.release?.releaseTag?.pattern;
+  if (pattern !== void 0 && pattern !== "{projectName}@{version}") {
+    return void 0;
+  }
+  const listed = runCapture("git", ["tag", "--list"], workspaceRoot);
+  if (listed.status !== 0) {
+    return void 0;
+  }
+  const projects = (0, import_node_fs29.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot }).map((path) => readJson((0, import_node_path34.join)(workspaceRoot, path))).filter((manifest) => manifest.private !== true && manifest.name !== void 0).map((manifest) => manifest.name);
+  const stranded = findStrandedReleaseTags(projects, listed.stdout.split(/\r?\n/).filter(Boolean));
+  return {
+    check: "release tags resolve under each project's current name",
+    ok: stranded.length === 0,
+    detail: `${stranded.map((entry) => `${entry.project} has only ${entry.oldTag}`).join("; ")} - nx release finds no tag under the new name and would release from the disk version, a downgrade`,
+    remedy: `on the commit of each old tag run: ${stranded.map((entry) => `git tag ${entry.newTag} ${entry.oldTag}^{commit}`).join(" ; ")} - then push the tags`
+  };
+}
 function collectFindings(workspaceRoot) {
   const nxJsonPath = (0, import_node_path34.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
@@ -8381,7 +8439,8 @@ function collectFindings(workspaceRoot) {
     ...checkPipelinePhases(workspaceRoot),
     ...checkNativeBuildConfig(workspaceRoot),
     checkDependencyRangesNotPreserved(nxJson),
-    checkLockfileHasNoLocalRegistry(workspaceRoot)
+    checkLockfileHasNoLocalRegistry(workspaceRoot),
+    checkReleaseTagsResolve(workspaceRoot, nxJson)
   ].filter((finding) => finding !== void 0);
 }
 function runDoctor(workspaceRoot, options = {}) {