@pgpmjs/core 7.27.1 → 7.27.2

package/core/class/pgpm.js

@@ -46,7 +46,6 @@ const validators_1 = require("@pgpmjs/ast/files/plan/validators");
 const env_1 = require("@pgpmjs/env");
 const logger_1 = require("@pgpmjs/logger");
 const types_1 = require("@pgpmjs/types");
-const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const glob = __importStar(require("glob"));
 const os_1 = __importDefault(require("os"));
@@ -67,6 +66,7 @@ const sync_versions_1 = require("../../packaging/sync-versions");
 const deps_1 = require("../../resolution/deps");
 const fs_2 = require("../../utils/fs");
 const glob_1 = require("../../utils/glob");
+const spawn_1 = require("../../utils/spawn");
 const target_utils_1 = require("../../utils/target-utils");
 const template_scaffold_1 = require("../template-scaffold");
 const logger = new logger_1.Logger('pgpm');
@@ -899,7 +899,13 @@ ${dependencies.length > 0 ? dependencies.map(dep => `-- requires: ${dep}`).join(
             const tempDir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'pgpm-install-'));
             try {
                 process.chdir(tempDir);
-                (0, child_process_1.execSync)(`npm install ${pkgstr} --production --prefix ./${this.extensionsDir}`, {
+                (0, spawn_1.spawnSyncChecked)('npm', [
+                    'install',
+                    pkgstr,
+                    '--production',
+                    '--prefix',
+                    `./${this.extensionsDir}`
+                ], {
                     stdio: 'inherit'
                 });
                 const matches = glob.sync((0, glob_1.globPattern)('.', this.extensionsDir, '**/pgpm.plan'));
@@ -1138,10 +1144,7 @@ ${dependencies.length > 0 ? dependencies.map(dep => `-- requires: ${dep}`).join(
             const oldVersion = installedVersions[moduleName];
             let newVersion = null;
             try {
-                const result = (0, child_process_1.execSync)(`npm view ${moduleName} version`, {
-                    encoding: 'utf-8',
-                    stdio: ['pipe', 'pipe', 'pipe']
-                }).trim();
+                const result = (0, spawn_1.spawnSyncOutput)('npm', ['view', moduleName, 'version']);
                 newVersion = result || null;
             }
             catch {

package/esm/core/class/pgpm.js

@@ -7,7 +7,6 @@ import { isValidChangeName, isValidTagName, parseReference } from '@pgpmjs/ast/f
 import { getExtensionsDir, loadConfigSyncFromDir, resolvePgpmPath, walkUp } from '@pgpmjs/env';
 import { Logger } from '@pgpmjs/logger';
 import { DEFAULT_EXTENSIONS_DIR, errors } from '@pgpmjs/types';
-import { execSync } from 'child_process';
 import fs from 'fs';
 import * as glob from 'glob';
 import os from 'os';
@@ -28,6 +27,7 @@ import { syncModuleVersions } from '../../packaging/sync-versions';
 import { resolveDependencies, resolveExtensionDependencies } from '../../resolution/deps';
 import { movePath } from '../../utils/fs';
 import { globPaths, globPattern, toPosixPath } from '../../utils/glob';
+import { spawnSyncChecked, spawnSyncOutput } from '../../utils/spawn';
 import { parseTarget } from '../../utils/target-utils';
 import { DEFAULT_TEMPLATE_REPO, DEFAULT_TEMPLATE_TOOL_NAME, DEFAULT_TEMPLATE_TTL_MS, scaffoldTemplate } from '../template-scaffold';
 const logger = new Logger('pgpm');
@@ -860,7 +860,13 @@ ${dependencies.length > 0 ? dependencies.map(dep => `-- requires: ${dep}`).join(
             const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pgpm-install-'));
             try {
                 process.chdir(tempDir);
-                execSync(`npm install ${pkgstr} --production --prefix ./${this.extensionsDir}`, {
+                spawnSyncChecked('npm', [
+                    'install',
+                    pkgstr,
+                    '--production',
+                    '--prefix',
+                    `./${this.extensionsDir}`
+                ], {
                     stdio: 'inherit'
                 });
                 const matches = glob.sync(globPattern('.', this.extensionsDir, '**/pgpm.plan'));
@@ -1099,10 +1105,7 @@ ${dependencies.length > 0 ? dependencies.map(dep => `-- requires: ${dep}`).join(
             const oldVersion = installedVersions[moduleName];
             let newVersion = null;
             try {
-                const result = execSync(`npm view ${moduleName} version`, {
-                    encoding: 'utf-8',
-                    stdio: ['pipe', 'pipe', 'pipe']
-                }).trim();
+                const result = spawnSyncOutput('npm', ['view', moduleName, 'version']);
                 newVersion = result || null;
             }
             catch {

package/esm/index.js

@@ -14,6 +14,7 @@ export * from './packaging/transform';
 export * from './rebundle';
 export * from './resolution/deps';
 export * from './resolution/resolve';
+export * from './utils/spawn';
 export * from './workspace/minimal';
 export * from './workspace/paths';
 export * from './workspace/utils';

package/esm/utils/spawn.js

@@ -0,0 +1,20 @@
+import spawn from 'cross-spawn';
+export const spawnSyncChecked = (file, args, options = {}) => {
+    const result = spawn.sync(file, args, options);
+    if (result.error)
+        throw result.error;
+    if (result.signal) {
+        throw new Error(`${file} was terminated by signal ${result.signal}`);
+    }
+    if (result.status !== 0) {
+        const stderr = result.stderr ? String(result.stderr) : '';
+        throw new Error(`${file} exited with code ${result.status}${stderr ? `: ${stderr}` : ''}`);
+    }
+    return result;
+};
+/** Run a command and return its stdout, trimmed. */
+export const spawnSyncOutput = (file, args, options = {}) => String(spawnSyncChecked(file, args, {
+    ...options,
+    encoding: 'utf-8',
+    stdio: ['pipe', 'pipe', 'pipe']
+}).stdout ?? '').trim();

package/index.d.ts

@@ -14,6 +14,7 @@ export * from './packaging/transform';
 export * from './rebundle';
 export * from './resolution/deps';
 export * from './resolution/resolve';
+export * from './utils/spawn';
 export * from './workspace/minimal';
 export * from './workspace/paths';
 export * from './workspace/utils';

package/index.js

@@ -31,6 +31,7 @@ __exportStar(require("./packaging/transform"), exports);
 __exportStar(require("./rebundle"), exports);
 __exportStar(require("./resolution/deps"), exports);
 __exportStar(require("./resolution/resolve"), exports);
+__exportStar(require("./utils/spawn"), exports);
 __exportStar(require("./workspace/minimal"), exports);
 __exportStar(require("./workspace/paths"), exports);
 __exportStar(require("./workspace/utils"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpmjs/core",
-  "version": "7.27.1",
+  "version": "7.27.2",
   "author": "Constructive <developers@constructive.io>",
   "description": "PGPM Package and Migration Tools",
   "main": "index.js",
@@ -42,6 +42,7 @@
   ],
   "devDependencies": {
     "@pgsql/types": "^18.0.0",
+    "@types/cross-spawn": "^6.0.6",
     "@types/pg": "^8.20.4",
     "copyfiles": "^2.4.1",
     "inquirerer": "^4.9.3",
@@ -57,6 +58,7 @@
     "@pgpmjs/slice": "^0.16.1",
     "@pgpmjs/transform": "^0.25.1",
     "@pgpmjs/types": "^2.52.1",
+    "cross-spawn": "^7.0.6",
     "csv-to-pg": "^4.12.0",
     "genomic": "^5.6.5",
     "git-changed": "^0.4.0",
@@ -69,5 +71,5 @@
     "pgsql-parser": "^18.2.6",
     "yanse": "^0.2.2"
   },
-  "gitHead": "77d58bb93796be91d4e00156bb6847392584d3bc"
+  "gitHead": "608acc891de5197ad3cb4bfd0babe1050dbec24a"
 }

package/utils/spawn.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Synchronous process execution with an argv array instead of a command string.
+ *
+ * `execFileSync` would do, except that on Windows `npm`/`npx` are `.cmd` shims
+ * and those cannot be spawned without a shell (CVE-2024-27980 made it EINVAL),
+ * while `shell: true` concatenates argv back into one shell string. `cross-spawn`
+ * runs them through `cmd.exe` with each argument escaped individually, so a value
+ * containing a space or a shell metacharacter stays a single argument on both
+ * platforms.
+ */
+import type { SpawnSyncOptions, SpawnSyncReturns } from 'child_process';
+export declare const spawnSyncChecked: (file: string, args: string[], options?: SpawnSyncOptions) => SpawnSyncReturns<string | Buffer>;
+/** Run a command and return its stdout, trimmed. */
+export declare const spawnSyncOutput: (file: string, args: string[], options?: SpawnSyncOptions) => string;

package/utils/spawn.js

@@ -0,0 +1,28 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spawnSyncOutput = exports.spawnSyncChecked = void 0;
+const cross_spawn_1 = __importDefault(require("cross-spawn"));
+const spawnSyncChecked = (file, args, options = {}) => {
+    const result = cross_spawn_1.default.sync(file, args, options);
+    if (result.error)
+        throw result.error;
+    if (result.signal) {
+        throw new Error(`${file} was terminated by signal ${result.signal}`);
+    }
+    if (result.status !== 0) {
+        const stderr = result.stderr ? String(result.stderr) : '';
+        throw new Error(`${file} exited with code ${result.status}${stderr ? `: ${stderr}` : ''}`);
+    }
+    return result;
+};
+exports.spawnSyncChecked = spawnSyncChecked;
+/** Run a command and return its stdout, trimmed. */
+const spawnSyncOutput = (file, args, options = {}) => String((0, exports.spawnSyncChecked)(file, args, {
+    ...options,
+    encoding: 'utf-8',
+    stdio: ['pipe', 'pipe', 'pipe']
+}).stdout ?? '').trim();
+exports.spawnSyncOutput = spawnSyncOutput;