@n8n/eslint-plugin-community-nodes 0.30.0 → 0.31.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/rules/no-overrides-field.d.ts.map +1 -1
  2. package/dist/rules/no-overrides-field.js +12 -8
  3. package/dist/rules/no-overrides-field.js.map +1 -1
  4. package/package.json +4 -4
  5. package/src/rules/no-overrides-field.test.ts +17 -0
  6. package/src/rules/no-overrides-field.ts +12 -9
package/dist/rules/no-overrides-field.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"no-overrides-field.d.ts","sourceRoot":"","sources":["../../src/rules/no-overrides-field.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,oBAAoB,uJAqC/B,CAAC"}
1
+ {"version":3,"file":"no-overrides-field.d.ts","sourceRoot":"","sources":["../../src/rules/no-overrides-field.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,oBAAoB,uJAwC/B,CAAC"}
package/dist/rules/no-overrides-field.js CHANGED
@@ -8,7 +8,7 @@ export const NoOverridesFieldRule = createRule({
8
8
  description: 'Ban the "overrides" field in community node package.json',
9
9
  },
10
10
  messages: {
11
- overridesForbidden: 'The "overrides" field is not allowed in community node packages. Each community package installs into an isolated dependency tree, so overrides do not affect other nodes or n8n core — in practice they are copy-pasted boilerplate with no useful effect. Use the helpers on the execute context (this.helpers.httpRequest, etc.) instead; most community nodes do not need third-party runtime libraries.',
11
+ overridesForbidden: 'The "overrides"/"resolutions" fields are not allowed in community node packages. Each community package installs into an isolated dependency tree, so overrides do not affect other nodes or n8n core — in practice they are copy-pasted boilerplate with no useful effect, and can silently force a transitive dependency to an arbitrary version or tarball. Use the helpers on the execute context (this.helpers.httpRequest, etc.) instead; most community nodes do not need third-party runtime libraries.',
12
12
  },
13
13
  schema: [],
14
14
  },
@@ -22,14 +22,18 @@ export const NoOverridesFieldRule = createRule({
22
22
  if (node.parent?.type !== AST_NODE_TYPES.ExpressionStatement) {
23
23
  return;
24
24
  }
25
- const overridesProp = findJsonProperty(node, 'overrides');
26
- if (!overridesProp) {
27
- return;
25
+ // `resolutions` is the Yarn equivalent of npm's `overrides`; both force
26
+ // a transitive dependency to an arbitrary version/tarball, so treat them
27
+ // the same way.
28
+ for (const field of ['overrides', 'resolutions']) {
29
+ const prop = findJsonProperty(node, field);
30
+ if (prop) {
31
+ context.report({
32
+ node: prop,
33
+ messageId: 'overridesForbidden',
34
+ });
35
+ }
28
36
  }
29
- context.report({
30
- node: overridesProp,
31
- messageId: 'overridesForbidden',
32
- });
33
37
  },
34
38
  };
35
39
  },
package/dist/rules/no-overrides-field.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"no-overrides-field.js","sourceRoot":"","sources":["../../src/rules/no-overrides-field.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;IAC9C,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE;QACL,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACL,WAAW,EAAE,0DAA0D;SACvE;QACD,QAAQ,EAAE;YACT,kBAAkB,EACjB,8YAA8Y;SAC/Y;QACD,MAAM,EAAE,EAAE;KACV;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACb,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;QACX,CAAC;QAED,OAAO;YACN,gBAAgB,CAAC,IAA+B;gBAC/C,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,cAAc,CAAC,mBAAmB,EAAE,CAAC;oBAC9D,OAAO;gBACR,CAAC;gBAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAC1D,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpB,OAAO;gBACR,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACd,IAAI,EAAE,aAAa;oBACnB,SAAS,EAAE,oBAAoB;iBAC/B,CAAC,CAAC;YACJ,CAAC;SACD,CAAC;IACH,CAAC;CACD,CAAC,CAAC"}
1
+ {"version":3,"file":"no-overrides-field.js","sourceRoot":"","sources":["../../src/rules/no-overrides-field.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;IAC9C,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE;QACL,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACL,WAAW,EAAE,0DAA0D;SACvE;QACD,QAAQ,EAAE;YACT,kBAAkB,EACjB,ifAAif;SAClf;QACD,MAAM,EAAE,EAAE;KACV;IACD,cAAc,EAAE,EAAE;IAClB,MAAM,CAAC,OAAO;QACb,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;QACX,CAAC;QAED,OAAO;YACN,gBAAgB,CAAC,IAA+B;gBAC/C,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,cAAc,CAAC,mBAAmB,EAAE,CAAC;oBAC9D,OAAO;gBACR,CAAC;gBAED,wEAAwE;gBACxE,yEAAyE;gBACzE,gBAAgB;gBAChB,KAAK,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC3C,IAAI,IAAI,EAAE,CAAC;wBACV,OAAO,CAAC,MAAM,CAAC;4BACd,IAAI,EAAE,IAAI;4BACV,SAAS,EAAE,oBAAoB;yBAC/B,CAAC,CAAC;oBACJ,CAAC;gBACF,CAAC;YACF,CAAC;SACD,CAAC;IACH,CAAC;CACD,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@n8n/eslint-plugin-community-nodes",
3
3
  "type": "module",
4
- "version": "0.30.0",
4
+ "version": "0.31.0",
5
5
  "main": "./dist/plugin.js",
6
6
  "types": "./dist/plugin.d.ts",
7
7
  "exports": {
@@ -25,9 +25,9 @@
25
25
  "typescript": "npm:@typescript/typescript6@6.0.2",
26
26
  "vite": "^8.0.2",
27
27
  "vitest": "^4.1.9",
28
- "@n8n/typescript-config": "1.10.0",
29
- "@n8n/vitest-config": "1.21.0",
30
- "n8n-workflow": "2.37.0"
28
+ "@n8n/typescript-config": "1.11.0",
29
+ "n8n-workflow": "2.38.0",
30
+ "@n8n/vitest-config": "1.21.0"
31
31
  },
32
32
  "peerDependencies": {
33
33
  "eslint": "9.29.0",
package/src/rules/no-overrides-field.test.ts CHANGED
@@ -46,5 +46,22 @@ ruleTester.run('no-overrides-field', NoOverridesFieldRule, {
46
46
  code: '{ "name": "n8n-nodes-sinch", "overrides": { "axios": "1.7.0", "fast-xml-parser": "4.4.0", "minimatch": "9.0.5", "@langchain/core": "0.3.0", "qs": "6.13.0" } }',
47
47
  errors: [{ messageId: 'overridesForbidden' }],
48
48
  },
49
+ // CE-2377: `resolutions` is the Yarn equivalent of npm's `overrides` — it
50
+ // forces/replaces a transitive dependency to a maintainer-controlled
51
+ // version or an arbitrary tarball/git URL that never appears in the node's
52
+ // readable source. Community node vetting must flag it for the same
53
+ // supply-chain reason it flags `overrides`, but the rule ignores it today.
54
+ {
55
+ name: 'resolutions as object is forbidden',
56
+ filename: 'package.json',
57
+ code: '{ "name": "n8n-nodes-example", "resolutions": { "axios": "1.0.0" } }',
58
+ errors: [{ messageId: 'overridesForbidden' }],
59
+ },
60
+ {
61
+ name: 'resolutions pinning a transitive dep to an arbitrary tarball is forbidden',
62
+ filename: 'package.json',
63
+ code: '{ "name": "n8n-nodes-example", "resolutions": { "minimatch": "https://example.com/evil.tgz" } }',
64
+ errors: [{ messageId: 'overridesForbidden' }],
65
+ },
49
66
  ],
50
67
  });
package/src/rules/no-overrides-field.ts CHANGED
@@ -12,7 +12,7 @@ export const NoOverridesFieldRule = createRule({
12
12
  },
13
13
  messages: {
14
14
  overridesForbidden:
15
- 'The "overrides" field is not allowed in community node packages. Each community package installs into an isolated dependency tree, so overrides do not affect other nodes or n8n core — in practice they are copy-pasted boilerplate with no useful effect. Use the helpers on the execute context (this.helpers.httpRequest, etc.) instead; most community nodes do not need third-party runtime libraries.',
15
+ 'The "overrides"/"resolutions" fields are not allowed in community node packages. Each community package installs into an isolated dependency tree, so overrides do not affect other nodes or n8n core — in practice they are copy-pasted boilerplate with no useful effect, and can silently force a transitive dependency to an arbitrary version or tarball. Use the helpers on the execute context (this.helpers.httpRequest, etc.) instead; most community nodes do not need third-party runtime libraries.',
16
16
  },
17
17
  schema: [],
18
18
  },
@@ -28,15 +28,18 @@ export const NoOverridesFieldRule = createRule({
28
28
  return;
29
29
  }
30
30
 
31
- const overridesProp = findJsonProperty(node, 'overrides');
32
- if (!overridesProp) {
33
- return;
31
+ // `resolutions` is the Yarn equivalent of npm's `overrides`; both force
32
+ // a transitive dependency to an arbitrary version/tarball, so treat them
33
+ // the same way.
34
+ for (const field of ['overrides', 'resolutions']) {
35
+ const prop = findJsonProperty(node, field);
36
+ if (prop) {
37
+ context.report({
38
+ node: prop,
39
+ messageId: 'overridesForbidden',
40
+ });
41
+ }
34
42
  }
35
-
36
- context.report({
37
- node: overridesProp,
38
- messageId: 'overridesForbidden',
39
- });
40
43
  },
41
44
  };
42
45
  },