@renovatebot/osv-offline 3.0.13 → 3.1.0

package/README.md

@@ -4,6 +4,15 @@
 [![Build status](https://img.shields.io/github/actions/workflow/status/renovatebot/osv-offline/build.yml?branch=main&style=for-the-badge)](https://github.com/renovatebot/osv-offline/actions/workflows/build.yml)
 [![MIT license](https://img.shields.io/badge/license-MIT-blue?style=for-the-badge)](./LICENSE)
 
+## Environment variables
+
+| Name                           | Description                                                                                                                             | Default                                                                               |
+| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
+| `OSV_OFFLINE_ROOT_DIR`         | Directory of the downloaded databases                                                                                                   | `<tmpdir>/osv-offline`                                                                |
+| `OSV_OFFLINE_DATABASE_URL`     | URL of the database zip                                                                                                                 | `https://github.com/renovatebot/osv-offline/releases/latest/download/osv-offline.zip` |
+| `OSV_OFFLINE_DISABLE_DOWNLOAD` | Set to `true` to use the databases in `OSV_OFFLINE_ROOT_DIR` without downloading them                                                   | -                                                                                     |
+| `OSV_OFFLINE_MAX_AGE`          | How old the downloaded databases may be before they are downloaded again, as a [`ms`](https://github.com/vercel/ms) duration, e.g. `4h` | `1d`                                                                                  |
+
 ## License
 
 This package is licensed under [the MIT license](https://opensource.org/licenses/MIT).

package/dist/lib/download.js

@@ -4,17 +4,35 @@ import { pipeline } from 'node:stream/promises';
 import { OsvOfflineDb } from '@renovatebot/osv-offline-db';
 import path from 'path';
 import { DateTime } from 'luxon';
+import ms from 'ms';
 import { failure, success } from "./types.js";
 import { extractZip } from "./unzip.js";
 import debug from 'debug';
 const logger = debug('osv-offline:download');
+const defaultMaxAge = '1d';
+/**
+ * Returns how many milliseconds old the local databases may be before they are downloaded again: `OSV_OFFLINE_MAX_AGE` (e.g. `4h`), or one day.
+ */
+function getMaxAge() {
+    const value = process.env.OSV_OFFLINE_MAX_AGE;
+    if (!value) {
+        return ms(defaultMaxAge);
+    }
+    // returns `undefined` for an invalid value, despite the type
+    const maxAge = ms(value);
+    if (maxAge === undefined) {
+        logger(`Invalid OSV_OFFLINE_MAX_AGE '${value}', using ${defaultMaxAge}.`);
+        return ms(defaultMaxAge);
+    }
+    return maxAge;
+}
 export async function tryDownloadDb() {
     await fs.ensureDir(OsvOfflineDb.rootDirectory);
     if (process.env.OSV_OFFLINE_DISABLE_DOWNLOAD?.toLowerCase() === 'true') {
         logger('Skipping database download.');
         return success();
     }
-    // if local database exists and is less than a day old, don't do any network requests
+    // if local database exists and is younger than the maximum age, don't do any network requests
     let stats;
     try {
         stats = await fs.stat(path.join(OsvOfflineDb.rootDirectory, `osv-offline.zip`));
@@ -23,7 +41,8 @@ export async function tryDownloadDb() {
         // ignored
     }
     if (stats !== undefined &&
-        DateTime.utc().diff(DateTime.fromJSDate(stats.mtime)).as('days') < 1) {
+        DateTime.utc().diff(DateTime.fromJSDate(stats.mtime)).toMillis() <
+            getMaxAge()) {
         logger('Skipping download, databases are up-to-date.');
         return success();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@renovatebot/osv-offline",
-  "version": "3.0.13",
+  "version": "3.1.0",
   "main": "dist/index.js",
   "license": "MIT",
   "type": "module",
@@ -12,11 +12,12 @@
     "url": "https://github.com/renovatebot/osv-offline.git"
   },
   "dependencies": {
-    "@renovatebot/osv-offline-db": "3.0.13",
+    "@renovatebot/osv-offline-db": "3.1.0",
     "debug": "^4.4.3",
     "fs-extra": "^11.4.1",
     "got": "^15.1.0",
     "luxon": "^3.7.2",
+    "ms": "^2.1.3",
     "yauzl": "^3.4.0"
   },
   "devDependencies": {
@@ -24,6 +25,7 @@
     "@types/debug": "4.1.13",
     "@types/fs-extra": "11.0.4",
     "@types/luxon": "3.7.6",
+    "@types/ms": "2.1.0",
     "@types/node": "22.20.5",
     "@types/yauzl": "3.4.0",
     "adm-zip": "0.6.1"