@socketsecurity/cli-with-sentry 0.15.6 → 0.15.8

package/dist/cli.js

@@ -19,11 +19,13 @@ const arrays = require('../external/@socketsecurity/registry/lib/arrays')
 const registry = require('../external/@socketsecurity/registry')
 const npm = require('../external/@socketsecurity/registry/lib/npm')
 const packages = require('../external/@socketsecurity/registry/lib/packages')
+const sorts = require('../external/@socketsecurity/registry/lib/sorts')
 const path$1 = require('../external/@socketsecurity/registry/lib/path')
 const regexps = require('../external/@socketsecurity/registry/lib/regexps')
 const spawn = require('../external/@socketsecurity/registry/lib/spawn')
 const fs$2 = require('../external/@socketsecurity/registry/lib/fs')
 const shadowInject = require('./shadow-inject.js')
+const strings = require('../external/@socketsecurity/registry/lib/strings')
 const objects = require('../external/@socketsecurity/registry/lib/objects')
 const registryConstants = require('../external/@socketsecurity/registry/lib/constants')
 const promises = require('../external/@socketsecurity/registry/lib/promises')
@@ -4048,16 +4050,16 @@ function normalizeFixOptions(options_) {
 }
 
 const { DRY_RUN_NOT_SAVING: DRY_RUN_NOT_SAVING$1, NPM: NPM$a } = constants
-async function install$1(idealTree, options) {
+async function install$1(arb, options) {
   const { cwd = process.cwd() } = {
     __proto__: null,
     ...options
   }
-  const arb = new shadowInject.Arborist({
+  const newArb = new shadowInject.Arborist({
     path: cwd
   })
-  arb.idealTree = idealTree
-  await arb.reify()
+  newArb.idealTree = await arb.buildIdealTree()
+  return await newArb.reify()
 }
 async function npmFix(
   pkgEnvDetails,
@@ -4075,8 +4077,9 @@ async function npmFix(
     path: rootPath,
     ...shadowInject.SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES
   })
-  // Calling arb.reify() creates the arb.diff object and nulls-out arb.idealTree.
-  await arb.reify()
+  // Calling arb.reify() creates the arb.diff object, nulls-out arb.idealTree,
+  // and populates arb.actualTree.
+  let actualTree = await arb.reify()
   const alertsMap = purls.length
     ? await utils.getAlertsMapFromPurls(
         purls,
@@ -4113,7 +4116,10 @@ async function npmFix(
   ]
   spinner?.stop()
   let count = 0
-  infoByPkgNameLoop: for (const { 0: name, 1: infos } of infoByPkgName) {
+  const sortedInfoEntries = [...infoByPkgName.entries()].sort((a, b) =>
+    sorts.naturalCompare(a[0], b[0])
+  )
+  infoByPkgNameLoop: for (const { 0: name, 1: infos } of sortedInfoEntries) {
     logger.logger.log(`Processing vulnerable package: ${name}`)
     logger.logger.indent()
     spinner?.indent()
@@ -4140,12 +4146,14 @@ async function npmFix(
         ? 'root'
         : path.relative(rootPath, pkgPath)
       logger.logger.log(`Checking workspace: ${workspaceName}`)
-      arb.idealTree = null
+
       // eslint-disable-next-line no-await-in-loop
-      await arb.buildIdealTree()
+      actualTree = await install$1(arb, {
+        cwd
+      })
       const oldVersions = arrays.arrayUnique(
         shadowInject
-          .findPackageNodes(arb.idealTree, name)
+          .findPackageNodes(actualTree, name)
           .map(n => n.target?.version ?? n.version)
           .filter(Boolean)
       )
@@ -4153,6 +4161,11 @@ async function npmFix(
         logger.logger.warn(
           `Unexpected condition: Lockfile entries not found for ${name}.\n`
         )
+        if (debug.isDebug()) {
+          console.dir(actualTree, {
+            depth: 999
+          })
+        }
         continue
       }
 
@@ -4165,11 +4178,7 @@ async function npmFix(
       for (const oldVersion of oldVersions) {
         const oldId = `${name}@${oldVersion}`
         const oldPurl = utils.idToPurl(oldId)
-        const node = shadowInject.findPackageNode(
-          arb.idealTree,
-          name,
-          oldVersion
-        )
+        const node = shadowInject.findPackageNode(actualTree, name, oldVersion)
         if (!node) {
           logger.logger.warn(
             `Unexpected condition: Arborist node not found, skipping ${oldId}`
@@ -4220,7 +4229,8 @@ async function npmFix(
           shadowInject.updateNode(node, newVersion, newVersionPackument)
           shadowInject.updatePackageJsonFromNode(
             editablePkgJson,
-            arb.idealTree,
+            // eslint-disable-next-line no-await-in-loop
+            await arb.buildIdealTree(),
             node,
             newVersion,
             rangeStyle
@@ -4247,7 +4257,7 @@ async function npmFix(
           let errored = false
           try {
             // eslint-disable-next-line no-await-in-loop
-            await install$1(arb.idealTree, {
+            actualTree = await install$1(arb, {
               cwd
             })
             if (test) {
@@ -4347,10 +4357,6 @@ async function npmFix(
           if (isCi) {
             // eslint-disable-next-line no-await-in-loop
             await gitResetAndClean(baseBranch, cwd)
-            // eslint-disable-next-line no-await-in-loop
-            await install$1(arb.idealTree, {
-              cwd
-            })
           }
           if (errored) {
             if (!isCi) {
@@ -4362,10 +4368,6 @@ async function npmFix(
                   ignoreWhitespace: true
                 })
               ])
-              // eslint-disable-next-line no-await-in-loop
-              await install$1(arb.idealTree, {
-                cwd
-              })
             }
             spinner?.failAndStop(
               `Update failed for ${oldId} in ${workspaceName}`,
@@ -4404,6 +4406,13 @@ async function getActualTree(cwd = process.cwd()) {
   })
   return await arb.loadActual()
 }
+async function readLockfile(lockfilePath) {
+  return fs$1.existsSync(lockfilePath)
+    ? vendor.jsYaml.load(
+        strings.stripBom(await utils.readFileUtf8(lockfilePath))
+      )
+    : null
+}
 async function install(pkgEnvDetails, options) {
   const { args, cwd, spinner } = {
     __proto__: null,
@@ -4424,11 +4433,6 @@ async function install(pkgEnvDetails, options) {
   })
   return await getActualTree(cwd)
 }
-async function readLockfile(pkgPath) {
-  return await vendor.libExports$4.readWantedLockfile(pkgPath, {
-    ignoreIncompatible: false
-  })
-}
 async function pnpmFix(
   pkgEnvDetails,
   { autoMerge, cwd, dryRun, limit, purls, rangeStyle, test, testScript }
@@ -4441,15 +4445,17 @@ async function pnpmFix(
   const { spinner } = constants
   const { pkgPath: rootPath } = pkgEnvDetails
   spinner?.start()
-  let lockfile = await readLockfile(rootPath)
+  let actualTree
+  const lockfilePath = path.join(rootPath, 'pnpm-lock.yaml')
+  let lockfile = await readLockfile(lockfilePath)
 
   // If pnpm-lock.yaml does NOT exist then install with pnpm to create it.
   if (!lockfile) {
-    await install(pkgEnvDetails, {
+    actualTree = await install(pkgEnvDetails, {
       cwd,
       spinner
     })
-    lockfile = await readLockfile(rootPath)
+    lockfile = await readLockfile(lockfilePath)
   }
   // Update pnpm-lock.yaml if its version is older than what the installed pnpm
   // produces.
@@ -4458,12 +4464,12 @@ async function pnpmFix(
     pkgEnvDetails.agentVersion.major >= 10 &&
     utils.parsePnpmLockfileVersion(lockfile.lockfileVersion).major <= 6
   ) {
-    await install(pkgEnvDetails, {
+    actualTree = await install(pkgEnvDetails, {
       args: ['--lockfile-only'],
       cwd,
       spinner
     })
-    lockfile = await readLockfile(rootPath)
+    lockfile = await readLockfile(lockfilePath)
   }
   // Exit early if pnpm-lock.yaml is not found.
   if (!lockfile) {
@@ -4507,7 +4513,10 @@ async function pnpmFix(
   ]
   spinner?.stop()
   let count = 0
-  infoByPkgNameLoop: for (const { 0: name, 1: infos } of infoByPkgName) {
+  const sortedInfoEntries = [...infoByPkgName.entries()].sort((a, b) =>
+    sorts.naturalCompare(a[0], b[0])
+  )
+  infoByPkgNameLoop: for (const { 0: name, 1: infos } of sortedInfoEntries) {
     logger.logger.log(`Processing vulnerable package: ${name}`)
     logger.logger.indent()
     spinner?.indent()
@@ -4536,17 +4545,25 @@ async function pnpmFix(
       logger.logger.log(`Checking workspace: ${workspaceName}`)
 
       // eslint-disable-next-line no-await-in-loop
-      let actualTree = await getActualTree(cwd)
+      actualTree = await install(pkgEnvDetails, {
+        cwd,
+        spinner
+      })
       const oldVersions = arrays.arrayUnique(
         shadowInject
           .findPackageNodes(actualTree, name)
-          .map(n => n.target?.version ?? n.version)
+          .map(n => n.version)
           .filter(Boolean)
       )
       if (!oldVersions.length) {
         logger.logger.warn(
           `Unexpected condition: Lockfile entries not found for ${name}.\n`
         )
+        if (debug.isDebug()) {
+          console.dir(actualTree, {
+            depth: 999
+          })
+        }
         continue
       }
 
@@ -4769,11 +4786,6 @@ async function pnpmFix(
           if (isCi) {
             // eslint-disable-next-line no-await-in-loop
             await gitResetAndClean(baseBranch, cwd)
-            // eslint-disable-next-line no-await-in-loop
-            actualTree = await install(pkgEnvDetails, {
-              cwd,
-              spinner
-            })
           }
           if (errored) {
             if (!isCi) {
@@ -4785,11 +4797,6 @@ async function pnpmFix(
                   ignoreWhitespace: true
                 })
               ])
-              // eslint-disable-next-line no-await-in-loop
-              actualTree = await install(pkgEnvDetails, {
-                cwd,
-                spinner
-              })
             }
             spinner?.failAndStop(
               `Update failed for ${oldId} in ${workspaceName}`,
@@ -12359,5 +12366,5 @@ void (async () => {
     await utils.captureException(e)
   }
 })()
-//# debugId=7be17873-378c-4746-b5ba-617639c5ac8a
+//# debugId=74a80f74-c3fe-4491-ac5e-46b5e6dfdec
 //# sourceMappingURL=cli.js.map