@npmcli/arborist 6.1.4 → 6.1.6

package/lib/arborist/build-ideal-tree.js

@@ -12,6 +12,7 @@ const { readdirScoped } = require('@npmcli/fs')
 const { lstat, readlink } = require('fs/promises')
 const { depth } = require('treeverse')
 const log = require('proc-log')
+const { cleanUrl } = require('npm-registry-fetch')
 
 const {
   OK,
@@ -619,14 +620,16 @@ module.exports = cls => class IdealTreeBuilder extends cls {
             continue
           }
 
-          const { isSemVerMajor, version } = fixAvailable
+          // name may be different if parent fixes the dep
+          // see Vuln fixAvailable setter
+          const { isSemVerMajor, version, name: fixName } = fixAvailable
           const breakingMessage = isSemVerMajor
             ? 'a SemVer major change'
             : 'outside your stated dependency range'
-          log.warn('audit', `Updating ${name} to ${version}, ` +
+          log.warn('audit', `Updating ${fixName} to ${version}, ` +
             `which is ${breakingMessage}.`)
 
-          await this[_add](node, { add: [`${name}@${version}`] })
+          await this[_add](node, { add: [`${fixName}@${version}`] })
           nodesTouched.add(node)
         }
       }
@@ -1208,7 +1211,8 @@ This is a one-time fix-up, please be patient...
     if (this[_manifests].has(spec.raw)) {
       return this[_manifests].get(spec.raw)
     } else {
-      log.silly('fetch manifest', spec.raw)
+      const cleanRawSpec = cleanUrl(spec.rawSpec)
+      log.silly('fetch manifest', spec.raw.replace(spec.rawSpec, cleanRawSpec))
       const p = pacote.manifest(spec, options)
         .then(mani => {
           this[_manifests].set(spec.raw, mani)

package/lib/arborist/load-virtual.js

@@ -1,5 +1,6 @@
 // mixin providing the loadVirtual method
 const localeCompare = require('@isaacs/string-locale-compare')('en')
+const mapWorkspaces = require('@npmcli/map-workspaces')
 
 const { resolve } = require('path')
 
@@ -21,7 +22,6 @@ const loadRoot = Symbol('loadRoot')
 const loadNode = Symbol('loadVirtualNode')
 const loadLink = Symbol('loadVirtualLink')
 const loadWorkspaces = Symbol.for('loadWorkspaces')
-const loadWorkspacesVirtual = Symbol.for('loadWorkspacesVirtual')
 const flagsSuspect = Symbol.for('flagsSuspect')
 const reCalcDepFlags = Symbol('reCalcDepFlags')
 const checkRootEdges = Symbol('checkRootEdges')
@@ -157,7 +157,7 @@ module.exports = cls => class VirtualLoader extends cls {
     }
 
     const lockWS = []
-    const workspaces = this[loadWorkspacesVirtual]({
+    const workspaces = mapWorkspaces.virtual({
       cwd: this.path,
       lockfile: s.data,
     })

package/lib/arborist/load-workspaces.js

@@ -1,33 +1,19 @@
 const mapWorkspaces = require('@npmcli/map-workspaces')
 
-const _appendWorkspaces = Symbol('appendWorkspaces')
 // shared ref used by other mixins/Arborist
 const _loadWorkspaces = Symbol.for('loadWorkspaces')
-const _loadWorkspacesVirtual = Symbol.for('loadWorkspacesVirtual')
 
 module.exports = cls => class MapWorkspaces extends cls {
-  [_appendWorkspaces] (node, workspaces) {
-    if (node && workspaces.size) {
-      node.workspaces = workspaces
-    }
-
-    return node
-  }
-
   async [_loadWorkspaces] (node) {
-    if (node.workspaces) {
-      return node
-    }
-
     const workspaces = await mapWorkspaces({
       cwd: node.path,
       pkg: node.package,
     })
 
-    return this[_appendWorkspaces](node, workspaces)
-  }
+    if (node && workspaces.size) {
+      node.workspaces = workspaces
+    }
 
-  [_loadWorkspacesVirtual] (opts) {
-    return mapWorkspaces.virtual(opts)
+    return node
   }
 }

package/lib/override-resolves.js

@@ -1,4 +1,4 @@
-function overrideResolves (resolved, opts = {}) {
+function overrideResolves (resolved, opts) {
   const { omitLockfileRegistryResolved = false } = opts
 
   if (omitLockfileRegistryResolved) {

package/lib/override-set.js

@@ -50,9 +50,36 @@ class OverrideSet {
         continue
       }
 
-      if (semver.intersects(edge.spec, rule.keySpec)) {
+      // if keySpec is * we found our override
+      if (rule.keySpec === '*') {
         return rule
       }
+
+      let spec = npa(`${edge.name}@${edge.spec}`)
+      if (spec.type === 'alias') {
+        spec = spec.subSpec
+      }
+
+      if (spec.type === 'git') {
+        if (spec.gitRange && semver.intersects(spec.gitRange, rule.keySpec)) {
+          return rule
+        }
+
+        continue
+      }
+
+      if (spec.type === 'range' || spec.type === 'version') {
+        if (semver.intersects(spec.fetchSpec, rule.keySpec)) {
+          return rule
+        }
+
+        continue
+      }
+
+      // if we got this far, the spec type is one of tag, directory or file
+      // which means we have no real way to make version comparisons, so we
+      // just accept the override
+      return rule
     }
 
     return this

package/lib/place-dep.js

@@ -9,6 +9,7 @@
 
 const localeCompare = require('@isaacs/string-locale-compare')('en')
 const log = require('proc-log')
+const { cleanUrl } = require('npm-registry-fetch')
 const deepestNestingTarget = require('./deepest-nesting-target.js')
 const CanPlaceDep = require('./can-place-dep.js')
 const {
@@ -187,7 +188,7 @@ class PlaceDep {
       `${this.dep.name}@${this.dep.version}`,
       this.canPlace.description,
       `for: ${this.edge.from.package._id || this.edge.from.location}`,
-      `want: ${this.edge.spec || '*'}`
+      `want: ${cleanUrl(this.edge.spec || '*')}`
     )
 
     const placementType = this.canPlace.canPlace === CONFLICT

package/lib/vuln.js

@@ -65,6 +65,9 @@ class Vuln {
     // - {name, version, isSemVerMajor} fix requires -f, is semver major
     // - {name, version} fix requires -f, not semver major
     // - true: fix does not require -f
+    // TODO: duped entries may require different fixes but the current
+    // structure does not support this, so the case were a top level fix
+    // corrects a duped entry may mean you have to run fix more than once
     for (const v of this.via) {
       // don't blow up on loops
       if (v.fixAvailable === f) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "6.1.4",
+  "version": "6.1.6",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
@@ -14,37 +14,37 @@
     "@npmcli/query": "^3.0.0",
     "@npmcli/run-script": "^6.0.0",
     "bin-links": "^4.0.1",
-    "cacache": "^17.0.2",
+    "cacache": "^17.0.3",
     "common-ancestor-path": "^1.0.1",
     "hosted-git-info": "^6.1.1",
     "json-parse-even-better-errors": "^3.0.0",
     "json-stringify-nice": "^1.1.4",
-    "minimatch": "^5.1.0",
+    "minimatch": "^5.1.1",
     "nopt": "^7.0.0",
     "npm-install-checks": "^6.0.0",
-    "npm-package-arg": "^10.0.0",
+    "npm-package-arg": "^10.1.0",
     "npm-pick-manifest": "^8.0.1",
-    "npm-registry-fetch": "^14.0.2",
+    "npm-registry-fetch": "^14.0.3",
     "npmlog": "^7.0.1",
-    "pacote": "^15.0.2",
+    "pacote": "^15.0.7",
     "parse-conflict-json": "^3.0.0",
     "proc-log": "^3.0.0",
     "promise-all-reject-late": "^1.0.0",
     "promise-call-limit": "^1.0.1",
     "read-package-json-fast": "^3.0.1",
     "semver": "^7.3.7",
-    "ssri": "^10.0.0",
+    "ssri": "^10.0.1",
     "treeverse": "^3.0.0",
     "walk-up-path": "^1.0.0"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.10.0",
+    "@npmcli/template-oss": "4.11.0",
     "benchmark": "^2.1.4",
     "chalk": "^4.1.0",
-    "minify-registry-metadata": "^2.1.0",
+    "minify-registry-metadata": "^3.0.0",
     "nock": "^13.2.0",
-    "tap": "^16.0.1",
+    "tap": "^16.3.2",
     "tcompare": "^5.0.6"
   },
   "scripts": {
@@ -81,7 +81,6 @@
   "tap": {
     "color": true,
     "after": "test/fixtures/cleanup.js",
-    "coverage-map": "map.js",
     "test-env": [
       "NODE_OPTIONS=--no-warnings",
       "LC_ALL=sk"
@@ -101,7 +100,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.10.0",
+    "version": "4.11.0",
     "content": "../../scripts/template-oss/index.js"
   }
 }