@nuxtjp/dependency-security 0.1.0 → 0.1.2

package/README.md

@@ -7,7 +7,7 @@ It does not inspect arbitrary source, monitor endpoints, install dependencies,
 contact a registry or silently modify a project during installation.
 
 ```sh
-pnpm add -D @nuxtjp/dependency-security@0.1.0
+pnpm add -D @nuxtjp/dependency-security
 pnpm exec nuxtjp-security-config --project-root . --apply
 pnpm install --no-frozen-lockfile
 pnpm install --frozen-lockfile
@@ -15,9 +15,12 @@ pnpm exec nuxtjp-security-check --project-root .
 pnpm audit --json
 ```
 
-The preset requires an installed Nuxt host with the selected braces, node-forge
-and simple-git targets. A bare core-only library graph does not need these
-backports, and an absent target remains an error rather than a passing check.
+The preset requires an installed Nuxt host with the selected braces and node-forge
+targets. The simple-git compatibility patch applies only when that dependency is
+active. Newer DevTools no longer needs it; absence is not a reason to install an
+unused Git process library. Present targets still require the reviewed fixed
+versions and malformed/escaping graphs fail closed. A bare core-only library
+graph does not need these backports.
 Use an initial install with `--ignore-scripts` before configuring a new host.
 
 Commit the generated `.nuxtjp-security` patches, manifest and lockfile. Run the

package/dependency-security.check.cjs

@@ -52,8 +52,7 @@ test('active dependency graph uses every required upstream security version', ()
   const policy = JSON.parse(fs.readFileSync(path.join(__dirname, 'dependency-versions.json'), 'utf8'));
   const { installedDependencies } = require('./resolved-dependency.cjs');
   for (const [name, version] of Object.entries(policy.overrides)) {
-    const matches = installedDependencies(process.cwd(), name);
-    assert.ok(matches.length > 0, 'Required dependency is absent: ' + name);
+    const matches = installedDependencies(process.cwd(), name, undefined, { allowMissing: true });
     for (const manifest of matches) assert.equal(JSON.parse(fs.readFileSync(manifest, 'utf8')).version, version, name);
   }
 });
@@ -62,7 +61,7 @@ test('active dependency graph uses every required upstream security version', ()
 test('fixed simple-git retains named and legacy ESM factory exports', async () => {
   const { pathToFileURL } = require('node:url');
   const { installedDependencies } = require('./resolved-dependency.cjs');
-  for (const manifest of installedDependencies(process.cwd(), 'simple-git', '4.0.2')) {
+  for (const manifest of installedDependencies(process.cwd(), 'simple-git', '4.0.2', { allowMissing: true })) {
     const module = await import(pathToFileURL(path.join(path.dirname(manifest), 'dist/index.mjs')).href);
     assert.equal(typeof module.simpleGit, 'function');
     assert.equal(module.default, module.simpleGit);

package/package.json

@@ -1,13 +1,12 @@
 {
   "name": "@nuxtjp/dependency-security",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Explicit pnpm backport configuration and active dependency regression checks without Nuxt peers",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=22.19.0"
   },
-  "packageManager": "pnpm@10.29.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nuxtjp/nuxtjp-ui.git",
@@ -48,13 +47,20 @@
     "nuxtjp-security-config": "./apply.mjs",
     "nuxtjp-security-check": "./check.mjs"
   },
+  "devDependencies": {
+    "typescript": "5.9.3",
+    "@types/node": "24.12.0"
+  },
+  "keywords": [
+    "dependency-security",
+    "supply-chain-security",
+    "pnpm",
+    "security",
+    "nuxt"
+  ],
   "scripts": {
     "build": "node --check index.mjs && node --check project.mjs && node --check apply.mjs && node --check check.mjs && node --check resolved-dependency.cjs",
     "test": "node --test test/*.test.mjs",
     "typecheck": "tsc --strict --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 test/public-types.mts"
-  },
-  "devDependencies": {
-    "typescript": "5.9.3",
-    "@types/node": "24.12.0"
   }
-}
+}

package/project.mjs

@@ -2,6 +2,7 @@
 import { existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync, unlinkSync, realpathSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { randomUUID } from 'node:crypto'
+import resolver from './resolved-dependency.cjs'
 
 const patches = ['braces@3.0.3', 'node-forge@1.4.0', 'simple-git@4.0.2']
 function regular(path) {
@@ -50,6 +51,7 @@ export function applySecurityPatches(project, source) {
   if (existsSync(dir) && (lstatSync(dir).isSymbolicLink() || !lstatSync(dir).isDirectory())) {
     throw new Error('Security patch directory must be a real directory')
   }
+  const activeSimpleGit = resolver.installedDependencies(root, 'simple-git', undefined, { allowMissing: true }).length > 0
   const inputs = patches.map(name => {
     const relative = `.nuxtjp-security/${name.replace('@', '-')}.patch`
     if (existing[name] !== undefined && existing[name] !== relative) {
@@ -60,11 +62,15 @@ export function applySecurityPatches(project, source) {
     if (existsSync(target) && !regular(target).equals(bytes)) {
       throw new Error('An existing patch differs; no files were overwritten')
     }
-    return { name, relative, bytes, target }
+    return { name, relative, bytes, target, required: name !== 'simple-git@4.0.2' || activeSimpleGit }
   })
   if (!readFileSync(manifest).equals(original)) throw new Error('Manifest changed during preparation')
   mkdirSync(dir, { recursive: true })
   for (const patch of inputs) {
+    if (!patch.required) {
+      delete existing[patch.name]
+      continue
+    }
     if (!existsSync(patch.target)) writeFileSync(patch.target, patch.bytes, { flag: 'wx' })
     existing[patch.name] = patch.relative
   }

package/resolved-dependency.cjs

@@ -3,7 +3,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { createRequire } = require('node:module');
 
-function installedDependencies(root, target, version) {
+function installedDependencies(root, target, version, options = {}) {
   root = fs.realpathSync(root);
   const pending = [path.join(root, 'package.json')];
   const seen = new Set();
@@ -37,7 +37,7 @@ function installedDependencies(root, target, version) {
       }
     }
   }
-  if (found.size === 0) throw new Error('Dependency not present in the installed application graph');
+  if (found.size === 0 && options.allowMissing !== true) throw new Error('Dependency not present in the installed application graph');
   return [...found].sort();
 }
 module.exports = { installedDependencies };

package/resolved-dependency.d.cts

@@ -1,2 +1,2 @@
 /** Traverse only the selected installed application graph, with a finite budget. */
-export function installedDependencies(root: string, target: string, version?: string): string[];
+export function installedDependencies(root: string, target: string, version?: string, options?: { allowMissing?: boolean }): string[];