@sentry/cli 1.74.6 → 1.75.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 "You know what they say. Fool me once, strike one, but fool me twice... strike three." — Michael Scott
 
+## 1.75.0
+
+- feat(backport): Replace `npmlog` dependency in order to avoid vulnerability (#1445)
+
 ## 1.74.6
 
 ### Various fixes & improvements

package/checksums.txt

@@ -1,9 +1,9 @@
-sentry-cli-Darwin-arm64=0b0f0bfc1c7a5115c869b054291787a942a82e9c9a7bbca43f425e4f1f6d8e28
-sentry-cli-Darwin-universal=fd667d9f5f89f2e5f2b7bb0287a009cadddb3d200bffa09c1fa8b0887c207fc3
-sentry-cli-Darwin-x86_64=ec23e87d4c7eb7ed9cb42082f9a65d046fb62eb3c4005f360db721344cf63dcd
-sentry-cli-Linux-aarch64=fc6c4c0fbe2d2aad4fa8a65f363665e16ced56a3372e09d6c51ff080c2472a76
-sentry-cli-Linux-armv7=84d9b76284c6c9ef1950dadfa0c2aa0e8f77be083536117082c9da81457eb9e3
-sentry-cli-Linux-i686=d75b8c876ee86718c918c47b72c86c21db14598ce2d953e73d7f94e02e54043b
-sentry-cli-Linux-x86_64=ee4bd836f4fcc51bb3d7a05003d42e04f874e6ae1578877112acdb97181efd71
-sentry-cli-Windows-i686.exe=0a84ea06a83d40aa0f85e54e72d6596b65f672f5eb51e57cd3cb25ebeca28837
-sentry-cli-Windows-x86_64.exe=284e25b1bf8f5c14262baca5e315613c3856e71eff4f85c3f99483cf1c37582f
+sentry-cli-Darwin-arm64=6b7cc7d3579ba5ff1595517ac665eafd21c749713f4569aad623acd464fc4804
+sentry-cli-Darwin-universal=b64d948db80b4a462e54b869ea9e258c62d1a9facbfaa57c68756695dad9f41c
+sentry-cli-Darwin-x86_64=5f7f8a35d36f96fb5c354a6b0c668cb6707a4ed5d535c155f9dcfb324cc76035
+sentry-cli-Linux-aarch64=c93f55cae48e91495b0f13bc50ae8a057f76452b73c40752ab4aab30f4ef19ce
+sentry-cli-Linux-armv7=c81b622bd11cf01228ece983f538ac2689b2dd49bf3ebb44ff605bf9e254ca32
+sentry-cli-Linux-i686=b1a1ea42ed158935f84d783fe7c8efbb6ebc8615f441e6dd93380d3d4bc93257
+sentry-cli-Linux-x86_64=19b4c6d3bcb65df151a22aa188bae4804c8a7b8dcd4051893125781188b43f5f
+sentry-cli-Windows-i686.exe=2040dc25c0349d7d542a53a2a4d83a249873b07980c6a384ac91c4d265ffbb43
+sentry-cli-Windows-x86_64.exe=691d7e2bf77b1ac097d9f3c31be7478e7ae936383d5e2704cfdc884ffcdaf8d3

package/js/logger.js

@@ -0,0 +1,14 @@
+'use strict';
+
+const format = require('util').format;
+
+module.exports = class Logger {
+  constructor(stream) {
+    this.stream = stream;
+  }
+
+  log() {
+    const message = format(...arguments);
+    this.stream.write(`[sentry-cli] ${message}\n`);
+  }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/cli",
-  "version": "1.74.6",
+  "version": "1.75.0",
   "description": "A command line utility to work with Sentry. https://docs.sentry.io/hosted/learn/cli/",
   "homepage": "https://docs.sentry.io/hosted/learn/cli/",
   "license": "BSD-3-Clause",
@@ -39,7 +39,6 @@
     "https-proxy-agent": "^5.0.0",
     "mkdirp": "^0.5.5",
     "node-fetch": "^2.6.7",
-    "npmlog": "^4.1.2",
     "progress": "^2.0.3",
     "proxy-from-env": "^1.1.0",
     "which": "^2.0.2"
@@ -54,14 +53,15 @@
     "npm-run-all": "^4.1.5",
     "prettier": "^1.19.1"
   },
-  "resolutions": {
-    "npmlog/**/ansi-regex": "^3.0.1"
-  },
   "jest": {
     "collectCoverage": true,
     "testEnvironment": "node",
     "testPathIgnorePatterns": [
       "src/utils"
     ]
+  },
+  "volta": {
+    "node": "10.24.1",
+    "yarn": "1.22.19"
   }
 }

package/scripts/install.js

@@ -17,17 +17,11 @@ const ProgressBar = require('progress');
 const Proxy = require('proxy-from-env');
 // NOTE: Can be dropped in favor of `fs.mkdirSync(path, { recursive: true })` once we stop supporting Node 8.x
 const mkdirp = require('mkdirp');
-const npmLog = require('npmlog');
 const which = require('which');
 
 const helper = require('../js/helper');
 const pkgInfo = require('../package.json');
-
-const CDN_URL =
-  process.env.SENTRYCLI_LOCAL_CDNURL ||
-  process.env.npm_config_sentrycli_cdnurl ||
-  process.env.SENTRYCLI_CDNURL ||
-  'https://downloads.sentry-cdn.com/sentry-cli';
+const Logger = require('../js/logger');
 
 function getLogStream(defaultStream) {
   const logStream = process.env.SENTRYCLI_LOG_STREAM || defaultStream;
@@ -45,6 +39,14 @@ function getLogStream(defaultStream) {
   );
 }
 
+const logger = new Logger(getLogStream('stderr'));
+
+const CDN_URL =
+  process.env.SENTRYCLI_LOCAL_CDNURL ||
+  process.env.npm_config_sentrycli_cdnurl ||
+  process.env.SENTRYCLI_CDNURL ||
+  'https://downloads.sentry-cdn.com/sentry-cli';
+
 function shouldRenderProgressBar() {
   const silentFlag = process.argv.some(v => v === '--silent');
   const silentConfig = process.env.npm_config_loglevel === 'silent';
@@ -165,14 +167,14 @@ function validateChecksum(tempPath, name) {
       }
     }
   } catch (e) {
-    npmLog.info(
+    logger.log(
       'Checksums are generated when the package is published to npm. They are not available directly in the source repository. Skipping validation.'
     );
     return;
   }
 
   if (!storedHash) {
-    npmLog.info(`Checksum for ${name} not found, skipping validation.`);
+    logger.log(`Checksum for ${name} not found, skipping validation.`);
     return;
   }
 
@@ -187,7 +189,7 @@ function validateChecksum(tempPath, name) {
       `Checksum validation for ${name} failed.\nExpected: ${storedHash}\nReceived: ${currentHash}`
     );
   } else {
-    npmLog.info('Checksum validation passed.');
+    logger.log('Checksum validation passed.');
   }
 }
 
@@ -199,7 +201,7 @@ function downloadBinary() {
   if (process.env.SENTRYCLI_USE_LOCAL === '1') {
     try {
       const binPath = which.sync('sentry-cli');
-      npmLog.info('sentry-cli', `Using local binary: ${binPath}`);
+      logger.log(`Using local binary: ${binPath}`);
       fs.copyFileSync(binPath, outputPath);
       return Promise.resolve();
     } catch (e) {
@@ -217,7 +219,7 @@ function downloadBinary() {
 
   const cachedPath = getCachedPath(downloadUrl);
   if (fs.existsSync(cachedPath)) {
-    npmLog.info('sentry-cli', `Using cached binary: ${cachedPath}`);
+    logger.log(`Using cached binary: ${cachedPath}`);
     fs.copyFileSync(cachedPath, outputPath);
     return Promise.resolve();
   }
@@ -225,10 +227,10 @@ function downloadBinary() {
   const proxyUrl = Proxy.getProxyForUrl(downloadUrl);
   const agent = proxyUrl ? new HttpsProxyAgent(proxyUrl) : null;
 
-  npmLog.info('sentry-cli', `Downloading from ${downloadUrl}`);
+  logger.log(`Downloading from ${downloadUrl}`);
 
   if (proxyUrl) {
-    npmLog.info('sentry-cli', `Using proxy URL: ${proxyUrl}`);
+    logger.log(`Using proxy URL: ${proxyUrl}`);
   }
 
   return fetch(downloadUrl, {
@@ -316,10 +318,8 @@ if (process.env.SENTRYCLI_LOCAL_CDNURL) {
   process.on('exit', () => server.close());
 }
 
-npmLog.stream = getLogStream('stderr');
-
 if (process.env.SENTRYCLI_SKIP_DOWNLOAD === '1') {
-  npmLog.info('sentry-cli', `Skipping download because SENTRYCLI_SKIP_DOWNLOAD=1 detected.`);
+  logger.log(`Skipping download because SENTRYCLI_SKIP_DOWNLOAD=1 detected.`);
   process.exit(0);
 }