@sasjs/lint 2.5.0 → 2.6.0

package/.github/workflows/build.yml

@@ -25,7 +25,11 @@ jobs:
       - name: Install Dependencies
         run: npm ci
       - name: Security Audit
-        run: npm audit --audit-level=low
+        # `npm audit` fails on advisories inside the `npm` package bundled by
+        # @semantic-release/npm, which no overrides entry can reach. The audit
+        # script names those and fails on everything else, so a new advisory
+        # anywhere in the tree still fails the build.
+        run: npm run audit
       - name: Check Code Style
         run: npm run lint
       - name: Run Unit Tests

package/lint/lintText.d.ts

@@ -1,6 +1,10 @@
+import { Diagnostic, LintConfig } from '../types';
 /**
  * Analyses and produces a set of diagnostics for the given text content.
  * @param {string} text - the text content to be linted.
- * @returns {Diagnostic[]} array of diagnostic objects, each containing a warning, line number and column number.
+ * @param {LintConfig} configuration - an optional lint configuration. The
+ * nearest `.sasjslint` file provides the configuration when it is omitted.
+ * @returns {Diagnostic[]} array of diagnostic objects, each containing a
+ * warning, line number and column number.
  */
-export declare const lintText: (text: string) => Promise<import("..").Diagnostic[]>;
+export declare const lintText: (text: string, configuration?: LintConfig) => Promise<Diagnostic[]>;

package/lint/lintText.js

@@ -10,15 +10,18 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lintText = void 0;
-const getLintConfig_1 = require("../utils/getLintConfig");
+const utils_1 = require("../utils");
 const shared_1 = require("./shared");
 /**
  * Analyses and produces a set of diagnostics for the given text content.
  * @param {string} text - the text content to be linted.
- * @returns {Diagnostic[]} array of diagnostic objects, each containing a warning, line number and column number.
+ * @param {LintConfig} configuration - an optional lint configuration. The
+ * nearest `.sasjslint` file provides the configuration when it is omitted.
+ * @returns {Diagnostic[]} array of diagnostic objects, each containing a
+ * warning, line number and column number.
  */
-const lintText = (text) => __awaiter(void 0, void 0, void 0, function* () {
-    const config = yield (0, getLintConfig_1.getLintConfig)();
+const lintText = (text, configuration) => __awaiter(void 0, void 0, void 0, function* () {
+    const config = configuration || (yield (0, utils_1.getLintConfig)());
     return (0, shared_1.processText)(text, config);
 });
 exports.lintText = lintText;

package/lint/lintText.js.map

@@ -1 +1 @@
-{"version":3,"file":"lintText.js","sourceRoot":"","sources":["../../src/lint/lintText.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0DAAsD;AACtD,qCAAsC;AAEtC;;;;GAIG;AACI,MAAM,QAAQ,GAAG,CAAO,IAAY,EAAE,EAAE;IAC7C,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAa,GAAE,CAAA;IACpC,OAAO,IAAA,oBAAW,EAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAClC,CAAC,CAAA,CAAA;AAHY,QAAA,QAAQ,YAGpB"}
+{"version":3,"file":"lintText.js","sourceRoot":"","sources":["../../src/lint/lintText.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAAwC;AACxC,qCAAsC;AAEtC;;;;;;;GAOG;AACI,MAAM,QAAQ,GAAG,CACtB,IAAY,EACZ,aAA0B,EACH,EAAE;IACzB,MAAM,MAAM,GAAG,aAAa,IAAI,CAAC,MAAM,IAAA,qBAAa,GAAE,CAAC,CAAA;IACvD,OAAO,IAAA,oBAAW,EAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAClC,CAAC,CAAA,CAAA;AANY,QAAA,QAAQ,YAMpB"}

package/package.json

@@ -10,7 +10,8 @@
     "package:lib": "npm run build && cp ./package.json ./checkNodeVersion.js build && cp README.md build && cd build && npm version \"5.0.0\" && npm pack",
     "lint:fix": "npx prettier --write \"{src,test}/**/*.{ts,tsx,js,jsx,html,css,sass,less,json,yml,md,graphql}\"",
     "lint": "npx prettier --check \"{src,test}/**/*.{ts,tsx,js,jsx,html,css,sass,less,json,yml,md,graphql}\"",
-    "prepare": "git rev-parse --git-dir && git config core.hooksPath ./.git-hooks || true"
+    "prepare": "git rev-parse --git-dir && git config core.hooksPath ./.git-hooks || true",
+    "audit": "node scripts/audit.mjs"
   },
   "publishConfig": {
     "access": "public"
@@ -71,5 +72,5 @@
     "@sasjs/utils": "3.6.2",
     "ignore": "7.0.8"
   },
-  "version": "2.5.0"
+  "version": "2.6.0"
 }

package/scripts/audit.mjs

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+/**
+ * A strict dependency audit.
+ *
+ * `npm audit` fails on ANY advisory, which cannot pass in this repo: the
+ * advisories below sit inside the `npm` package that `@semantic-release/npm`
+ * depends on, in its bundled tree, where no `overrides` entry can reach them.
+ * npm 12.1.0 bundles the same versions as 11.20.0, so no upgrade clears them.
+ * They are unreachable from this package's own code and its runtime
+ * dependencies.
+ *
+ * Lowering the threshold for everything would hide a new advisory anywhere
+ * else, so instead they are named below and every other advisory fails the
+ * build - including one of the same severity. If one disappears upstream, this
+ * script says so, so the exemption does not outlive its reason.
+ *
+ * Run with `npm run audit`.
+ */
+import { execFileSync } from 'node:child_process'
+
+/**
+ * Advisories that cannot be fixed from this repo, and why.
+ */
+const EXEMPT = new Map([
+  ['GHSA-rpw4-54j3-4h4q', 'ip-address, inside the npm package bundled by @semantic-release/npm'],
+  ['GHSA-2vr4-cq9g-pvrc', 'ip-address, inside the npm package bundled by @semantic-release/npm'],
+  ['GHSA-3wwx-pv8p-q78v', 'undici, inside the npm package bundled by @semantic-release/npm'],
+  // The advisories below landed upstream after the exemptions above were
+  // written, against the same bundled copies. npm 12.1.0 bundles identical
+  // versions of all three packages, so an upgrade clears none of them.
+  ['GHSA-j6r3-76f7-8jcv', 'ip-address, inside the npm package bundled by @semantic-release/npm'],
+  ['GHSA-h3mg-xc3c-68pw', 'ip-address, inside the npm package bundled by @semantic-release/npm'],
+  ['GHSA-r53p-7pc4-xj5r', 'undici, inside the npm package bundled by @semantic-release/npm'],
+  ['GHSA-rfgv-xxqx-mfg5', 'undici, inside the npm package bundled by @semantic-release/npm'],
+  [
+    'GHSA-q2hr-2g5m-vwhr',
+    'brace-expansion, inside the npm package bundled by @semantic-release/npm'
+  ],
+  [
+    'GHSA-qhr7-859c-m2p7',
+    'brace-expansion, inside the npm package bundled by @semantic-release/npm'
+  ],
+  [
+    'GHSA-6j4f-fj2g-mc7p',
+    'brace-expansion, inside the npm package bundled by @semantic-release/npm'
+  ]
+])
+
+const run = () => {
+  try {
+    return execFileSync('npm', ['audit', '--json'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore']
+    })
+  } catch (error) {
+    // npm audit exits non-zero when it finds anything, which is the case we are
+    // here to read, so the report on stdout is the payload either way.
+    if (error.stdout) return error.stdout
+    throw error
+  }
+}
+
+let report
+try {
+  report = JSON.parse(run())
+} catch {
+  console.error('could not read the npm audit report')
+  process.exit(1)
+}
+
+const ghsaOf = (via) => {
+  if (typeof via === 'string') return undefined
+  const match = /GHSA-[a-z0-9-]+/i.exec(via?.url ?? '')
+  return match ? match[0] : undefined
+}
+
+const found = new Map()
+for (const vulnerability of Object.values(report.vulnerabilities ?? {})) {
+  for (const via of vulnerability.via ?? []) {
+    const id = ghsaOf(via)
+    if (!id) continue
+    if (!found.has(id)) {
+      found.set(id, {
+        id,
+        title: via.title ?? '',
+        severity: via.severity ?? vulnerability.severity,
+        packages: new Set()
+      })
+    }
+    found.get(id).packages.add(vulnerability.name)
+  }
+}
+
+const exempt = [...found.keys()].filter((id) => EXEMPT.has(id))
+const failing = [...found.values()].filter((entry) => !EXEMPT.has(entry.id))
+const stale = [...EXEMPT.keys()].filter((id) => !found.has(id))
+
+console.log(`advisories found: ${found.size}`)
+for (const entry of found.values()) {
+  const mark = EXEMPT.has(entry.id) ? 'exempt' : 'FAIL  '
+  console.log(
+    `  ${mark} ${entry.severity.padEnd(8)} ${entry.id}  ${[...entry.packages].join(', ')}`
+  )
+}
+
+for (const id of stale) {
+  console.log(`  GONE    ${id}  no longer reported - remove its exemption`)
+}
+
+if (failing.length === 0 && stale.length === 0) {
+  console.log(
+    `audit clean: ${exempt.length} exempt, ${stale.length} stale, ${failing.length} failing`
+  )
+  process.exit(0)
+}
+
+if (stale.length > 0) {
+  console.error(
+    `${stale.length} exemption(s) no longer match a reported advisory.`
+  )
+}
+
+if (failing.length > 0) {
+  console.error(`${failing.length} advisory(ies) are NOT exempt:`)
+  for (const entry of failing) {
+    console.error(`  ${entry.severity} ${entry.id} ${entry.title}`)
+    console.error(`    ${[...entry.packages].join(', ')}`)
+  }
+}
+
+process.exit(1)