@socketsecurity/cli 0.14.30 → 0.14.32
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/module-sync/cli.js +128 -105
- package/dist/module-sync/constants.d.ts +2 -1
- package/dist/module-sync/constants.js +18 -10
- package/dist/module-sync/link.js +15 -3
- package/dist/module-sync/npm-cli.js +21 -9
- package/dist/module-sync/npm-injection.js +395 -176
- package/dist/module-sync/npx-cli.js +19 -7
- package/dist/module-sync/path-resolve.js +17 -5
- package/dist/module-sync/sdk.d.ts +1 -2
- package/dist/module-sync/sdk.js +42 -32
- package/dist/module-sync/vendor.js +82 -0
- package/dist/require/cli.js +93 -69
- package/dist/require/constants.d.ts +2 -1
- package/dist/require/constants.js +19 -6
- package/dist/require/link.js +15 -3
- package/dist/require/npm-cli.js +19 -7
- package/dist/require/npm-injection.js +156 -173
- package/dist/require/npx-cli.js +17 -5
- package/dist/require/path-resolve.js +17 -5
- package/dist/require/sdk.d.ts +1 -2
- package/dist/require/sdk.js +36 -26
- package/dist/require/vendor.js +23 -11
- package/package.json +5 -3
- package/translations.json +1 -1
|
@@ -1,27 +1,38 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
var
|
|
16
|
-
var
|
|
17
|
-
var require$$
|
|
18
|
-
var require$$
|
|
19
|
-
var require$$
|
|
20
|
-
var require$$
|
|
21
|
-
var require$$
|
|
22
|
-
var
|
|
23
|
-
var
|
|
24
|
-
var
|
|
3
|
+
function _interop(e) {
|
|
4
|
+
let d
|
|
5
|
+
if (e) {
|
|
6
|
+
let c = 0
|
|
7
|
+
for (const k in e) {
|
|
8
|
+
d = c++ === 0 && k === 'default' ? e[k] : void 0
|
|
9
|
+
if (!d) break
|
|
10
|
+
}
|
|
11
|
+
}
|
|
12
|
+
return d ?? e
|
|
13
|
+
}
|
|
14
|
+
|
|
15
|
+
var vendor = _interop(require('./vendor.js'));
|
|
16
|
+
var constants = _interop(require('./constants.js'));
|
|
17
|
+
var require$$1$3 = _interop(require('node:events'));
|
|
18
|
+
var require$$0 = _interop(require('node:fs'));
|
|
19
|
+
var require$$3$3 = _interop(require('node:https'));
|
|
20
|
+
var require$$1 = _interop(require('node:path'));
|
|
21
|
+
var require$$3 = _interop(require('node:readline'));
|
|
22
|
+
var require$$6$2 = _interop(require('node:timers/promises'));
|
|
23
|
+
var require$$1$2 = _interop(require('@inquirer/confirm'));
|
|
24
|
+
var require$$3$2 = _interop(require('@socketregistry/yocto-spinner'));
|
|
25
|
+
var require$$3$1 = _interop(require('is-interactive'));
|
|
26
|
+
var require$$5$1 = _interop(require('npm-package-arg'));
|
|
27
|
+
var require$$4 = _interop(require('semver'));
|
|
28
|
+
var require$$6$1 = _interop(require('@socketsecurity/config'));
|
|
29
|
+
var require$$7 = _interop(require('@socketsecurity/registry/lib/objects'));
|
|
30
|
+
var require$$1$1 = _interop(require('node:net'));
|
|
31
|
+
var require$$2 = _interop(require('node:os'));
|
|
32
|
+
var require$$5 = _interop(require('node:stream'));
|
|
33
|
+
var sdk = _interop(require('./sdk.js'));
|
|
34
|
+
var pathResolve = _interop(require('./path-resolve.js'));
|
|
35
|
+
var link = _interop(require('./link.js'));
|
|
25
36
|
|
|
26
37
|
var npmInjection$2 = {};
|
|
27
38
|
|
|
@@ -31,6 +42,246 @@ var arborist = {};
|
|
|
31
42
|
|
|
32
43
|
var ttyServer$1 = {};
|
|
33
44
|
|
|
45
|
+
var name = "@socketsecurity/cli";
|
|
46
|
+
var version = "0.14.32";
|
|
47
|
+
var description = "CLI tool for Socket.dev";
|
|
48
|
+
var homepage = "http://github.com/SocketDev/socket-cli";
|
|
49
|
+
var license = "MIT";
|
|
50
|
+
var repository = {
|
|
51
|
+
type: "git",
|
|
52
|
+
url: "git+https://github.com/SocketDev/socket-cli.git"
|
|
53
|
+
};
|
|
54
|
+
var author = {
|
|
55
|
+
name: "Socket Inc",
|
|
56
|
+
email: "eng@socket.dev",
|
|
57
|
+
url: "https://socket.dev"
|
|
58
|
+
};
|
|
59
|
+
var bin = {
|
|
60
|
+
cli: "./bin/cli.js",
|
|
61
|
+
socket: "./bin/cli.js",
|
|
62
|
+
"socket-npm": "./bin/npm-cli.js",
|
|
63
|
+
"socket-npx": "./bin/npx-cli.js"
|
|
64
|
+
};
|
|
65
|
+
var exports$1 = {
|
|
66
|
+
"./bin/cli.js": {
|
|
67
|
+
"module-sync": {
|
|
68
|
+
types: "./dist/module-sync/cli.d.ts",
|
|
69
|
+
"default": "./dist/module-sync/cli.js"
|
|
70
|
+
},
|
|
71
|
+
require: {
|
|
72
|
+
types: "./dist/require/cli.d.ts",
|
|
73
|
+
"default": "./dist/require/cli.js"
|
|
74
|
+
}
|
|
75
|
+
},
|
|
76
|
+
"./bin/npm-cli.js": {
|
|
77
|
+
"module-sync": {
|
|
78
|
+
types: "./dist/module-sync/npm-cli.d.ts",
|
|
79
|
+
"default": "./dist/module-sync/npm-cli.js"
|
|
80
|
+
},
|
|
81
|
+
require: {
|
|
82
|
+
types: "./dist/require/npm-cli.d.ts",
|
|
83
|
+
"default": "./dist/require/npm-cli.js"
|
|
84
|
+
}
|
|
85
|
+
},
|
|
86
|
+
"./bin/npx-cli.js": {
|
|
87
|
+
"module-sync": {
|
|
88
|
+
types: "./dist/module-sync/npx-cli.d.ts",
|
|
89
|
+
"default": "./dist/module-sync/npx-cli.js"
|
|
90
|
+
},
|
|
91
|
+
require: {
|
|
92
|
+
types: "./dist/require/npx-cli.d.ts",
|
|
93
|
+
"default": "./dist/require/npx-cli.js"
|
|
94
|
+
}
|
|
95
|
+
},
|
|
96
|
+
"./package.json": "./package.json",
|
|
97
|
+
"./translations.json": "./translations.json"
|
|
98
|
+
};
|
|
99
|
+
var scripts = {
|
|
100
|
+
build: "run-s build:*",
|
|
101
|
+
"build:dist": "rollup -c .config/rollup.dist.config.mjs",
|
|
102
|
+
"build:test": "rollup -c .config/rollup.test.config.mjs",
|
|
103
|
+
check: "run-p -c --aggregate-output check:*",
|
|
104
|
+
"check:lint": "eslint --report-unused-disable-directives .",
|
|
105
|
+
"check:tsc": "tsc",
|
|
106
|
+
"check:type-coverage": "type-coverage --detail --strict --at-least 95 --ignore-files 'test/*'",
|
|
107
|
+
"knip:dependencies": "knip --dependencies",
|
|
108
|
+
"knip:exports": "knip --include exports,duplicates",
|
|
109
|
+
lint: "oxlint -c=./.oxlintrc.json --ignore-path=./.prettierignore --tsconfig=./tsconfig.json .",
|
|
110
|
+
"lint:fix": "npm run lint -- --fix && npm run lint:fix:fast",
|
|
111
|
+
"lint:fix:fast": "prettier --cache --log-level warn --write .",
|
|
112
|
+
prepare: "husky && custompatch",
|
|
113
|
+
test: "run-s check build:* test:*",
|
|
114
|
+
"test:c8": "c8 --reporter=none node --test 'test/socket-npm.test.cjs'",
|
|
115
|
+
"test-ci": "run-s build:* test:*",
|
|
116
|
+
"test:unit": "tap-run",
|
|
117
|
+
"test:coverage": "cp -r .tap/coverage/*.json coverage/tmp && c8 --reporter=lcov --reporter=text --include 'dist/{module-sync,require}/*.js' --exclude 'dist/require/vendor.js' report"
|
|
118
|
+
};
|
|
119
|
+
var dependencies = {
|
|
120
|
+
"@apideck/better-ajv-errors": "^0.3.6",
|
|
121
|
+
"@cyclonedx/cdxgen": "^11.0.5",
|
|
122
|
+
"@inquirer/confirm": "^5.0.2",
|
|
123
|
+
"@inquirer/password": "^4.0.3",
|
|
124
|
+
"@inquirer/select": "^4.0.3",
|
|
125
|
+
"@npmcli/promise-spawn": "^8.0.2",
|
|
126
|
+
"@socketregistry/hyrious__bun.lockb": "1.0.5",
|
|
127
|
+
"@socketregistry/yocto-spinner": "^1.0.1",
|
|
128
|
+
"@socketsecurity/config": "^2.1.3",
|
|
129
|
+
"@socketsecurity/registry": "^1.0.35",
|
|
130
|
+
"@socketsecurity/sdk": "^1.3.0",
|
|
131
|
+
blessed: "^0.1.81",
|
|
132
|
+
"blessed-contrib": "^4.11.0",
|
|
133
|
+
browserslist: "4.24.2",
|
|
134
|
+
"chalk-table": "^1.0.2",
|
|
135
|
+
"has-flag": "^4.0.0",
|
|
136
|
+
hpagent: "^1.2.0",
|
|
137
|
+
ignore: "^6.0.2",
|
|
138
|
+
micromatch: "^4.0.8",
|
|
139
|
+
"npm-package-arg": "^12.0.0",
|
|
140
|
+
"pony-cause": "^2.1.11",
|
|
141
|
+
semver: "^7.6.3",
|
|
142
|
+
synp: "^1.9.14",
|
|
143
|
+
tinyglobby: "^0.2.10",
|
|
144
|
+
which: "^5.0.0",
|
|
145
|
+
yaml: "^2.6.1",
|
|
146
|
+
"yargs-parser": "^21.1.1",
|
|
147
|
+
"yoctocolors-cjs": "^2.1.2"
|
|
148
|
+
};
|
|
149
|
+
var devDependencies = {
|
|
150
|
+
"@babel/core": "^7.26.0",
|
|
151
|
+
"@babel/plugin-proposal-export-default-from": "^7.25.9",
|
|
152
|
+
"@babel/plugin-syntax-dynamic-import": "^7.8.3",
|
|
153
|
+
"@babel/plugin-transform-export-namespace-from": "^7.25.9",
|
|
154
|
+
"@babel/plugin-transform-modules-commonjs": "^7.26.3",
|
|
155
|
+
"@babel/plugin-transform-runtime": "^7.25.9",
|
|
156
|
+
"@babel/preset-env": "^7.26.0",
|
|
157
|
+
"@babel/preset-typescript": "^7.26.0",
|
|
158
|
+
"@babel/runtime": "^7.26.0",
|
|
159
|
+
"@eslint/compat": "^1.2.4",
|
|
160
|
+
"@eslint/js": "^9.16.0",
|
|
161
|
+
"@rollup/plugin-commonjs": "^28.0.1",
|
|
162
|
+
"@rollup/plugin-json": "^6.1.0",
|
|
163
|
+
"@rollup/plugin-node-resolve": "^15.3.0",
|
|
164
|
+
"@rollup/plugin-replace": "^6.0.1",
|
|
165
|
+
"@rollup/pluginutils": "^5.1.3",
|
|
166
|
+
"@tapjs/run": "^4.0.1",
|
|
167
|
+
"@types/blessed": "^0.1.25",
|
|
168
|
+
"@types/micromatch": "^4.0.9",
|
|
169
|
+
"@types/mocha": "^10.0.10",
|
|
170
|
+
"@types/mock-fs": "^4.13.4",
|
|
171
|
+
"@types/node": "^22.10.1",
|
|
172
|
+
"@types/npmcli__arborist": "^5.6.11",
|
|
173
|
+
"@types/npmcli__promise-spawn": "^6.0.3",
|
|
174
|
+
"@types/proc-log": "^3.0.4",
|
|
175
|
+
"@types/semver": "^7.5.8",
|
|
176
|
+
"@types/update-notifier": "^6.0.8",
|
|
177
|
+
"@types/which": "^3.0.4",
|
|
178
|
+
"@types/yargs-parser": "^21.0.3",
|
|
179
|
+
"@typescript-eslint/eslint-plugin": "^8.17.0",
|
|
180
|
+
"@typescript-eslint/parser": "^8.17.0",
|
|
181
|
+
c8: "^10.1.2",
|
|
182
|
+
custompatch: "^1.0.28",
|
|
183
|
+
eslint: "^9.16.0",
|
|
184
|
+
"eslint-import-resolver-oxc": "^0.6.0",
|
|
185
|
+
"eslint-plugin-depend": "^0.12.0",
|
|
186
|
+
"eslint-plugin-import-x": "^4.5.0",
|
|
187
|
+
"eslint-plugin-n": "^17.14.0",
|
|
188
|
+
"eslint-plugin-sort-destructure-keys": "^2.0.0",
|
|
189
|
+
"eslint-plugin-unicorn": "^56.0.1",
|
|
190
|
+
husky: "^9.1.7",
|
|
191
|
+
"is-interactive": "^2.0.0",
|
|
192
|
+
"is-unicode-supported": "^2.1.0",
|
|
193
|
+
knip: "^5.39.2",
|
|
194
|
+
"magic-string": "^0.30.14",
|
|
195
|
+
meow: "^13.2.0",
|
|
196
|
+
"mock-fs": "^5.4.1",
|
|
197
|
+
nock: "^13.5.6",
|
|
198
|
+
"npm-run-all2": "^7.0.1",
|
|
199
|
+
open: "^10.1.0",
|
|
200
|
+
oxlint: "0.14.1",
|
|
201
|
+
prettier: "3.4.2",
|
|
202
|
+
"read-package-up": "^11.0.0",
|
|
203
|
+
rollup: "4.28.1",
|
|
204
|
+
"rollup-plugin-ts": "^3.4.5",
|
|
205
|
+
"terminal-link": "^3.0.0",
|
|
206
|
+
"tiny-updater": "^3.5.2",
|
|
207
|
+
"type-coverage": "^2.29.7",
|
|
208
|
+
typescript: "5.4.5",
|
|
209
|
+
"typescript-eslint": "^8.17.0",
|
|
210
|
+
"unplugin-purge-polyfills": "^0.0.7"
|
|
211
|
+
};
|
|
212
|
+
var overrides = {
|
|
213
|
+
"aggregate-error": "npm:@socketregistry/aggregate-error@^1",
|
|
214
|
+
"es-define-property": "npm:@socketregistry/es-define-property@^1",
|
|
215
|
+
"function-bind": "npm:@socketregistry/function-bind@^1",
|
|
216
|
+
globalthis: "npm:@socketregistry/globalthis@^1",
|
|
217
|
+
gopd: "npm:@socketregistry/gopd@^1",
|
|
218
|
+
"has-property-descriptors": "npm:@socketregistry/has-property-descriptors@^1",
|
|
219
|
+
"has-proto": "npm:@socketregistry/has-proto@^1",
|
|
220
|
+
"has-symbols": "npm:@socketregistry/has-symbols@^1",
|
|
221
|
+
hasown: "npm:@socketregistry/hasown@^1",
|
|
222
|
+
"indent-string": "npm:@socketregistry/indent-string@^1",
|
|
223
|
+
"is-core-module": "npm:@socketregistry/is-core-module@^1",
|
|
224
|
+
isarray: "npm:@socketregistry/isarray@^1",
|
|
225
|
+
"npm-package-arg": "$npm-package-arg",
|
|
226
|
+
"packageurl-js": "npm:@socketregistry/packageurl-js@^1",
|
|
227
|
+
"path-parse": "npm:@socketregistry/path-parse@^1",
|
|
228
|
+
"safe-buffer": "npm:@socketregistry/safe-buffer@^1",
|
|
229
|
+
"safer-buffer": "npm:@socketregistry/safer-buffer@^1",
|
|
230
|
+
semver: "$semver",
|
|
231
|
+
"set-function-length": "npm:@socketregistry/set-function-length@^1",
|
|
232
|
+
"side-channel": "npm:@socketregistry/side-channel@^1",
|
|
233
|
+
yaml: "$yaml"
|
|
234
|
+
};
|
|
235
|
+
var resolutions = {
|
|
236
|
+
"aggregate-error": "npm:@socketregistry/aggregate-error@^1",
|
|
237
|
+
"es-define-property": "npm:@socketregistry/es-define-property@^1",
|
|
238
|
+
"function-bind": "npm:@socketregistry/function-bind@^1",
|
|
239
|
+
globalthis: "npm:@socketregistry/globalthis@^1",
|
|
240
|
+
gopd: "npm:@socketregistry/gopd@^1",
|
|
241
|
+
"has-property-descriptors": "npm:@socketregistry/has-property-descriptors@^1",
|
|
242
|
+
"has-proto": "npm:@socketregistry/has-proto@^1",
|
|
243
|
+
"has-symbols": "npm:@socketregistry/has-symbols@^1",
|
|
244
|
+
hasown: "npm:@socketregistry/hasown@^1",
|
|
245
|
+
"indent-string": "npm:@socketregistry/indent-string@^1",
|
|
246
|
+
"is-core-module": "npm:@socketregistry/is-core-module@^1",
|
|
247
|
+
isarray: "npm:@socketregistry/isarray@^1",
|
|
248
|
+
"npm-package-arg": "^12.0.0",
|
|
249
|
+
"packageurl-js": "npm:@socketregistry/packageurl-js@^1",
|
|
250
|
+
"path-parse": "npm:@socketregistry/path-parse@^1",
|
|
251
|
+
"safe-buffer": "npm:@socketregistry/safe-buffer@^1",
|
|
252
|
+
"safer-buffer": "npm:@socketregistry/safer-buffer@^1",
|
|
253
|
+
semver: "^7.6.3",
|
|
254
|
+
"set-function-length": "npm:@socketregistry/set-function-length@^1",
|
|
255
|
+
"side-channel": "npm:@socketregistry/side-channel@^1",
|
|
256
|
+
yaml: "^2.6.0"
|
|
257
|
+
};
|
|
258
|
+
var engines = {
|
|
259
|
+
node: "^18.20.4 || ^20.9.0 || >=22.0.0"
|
|
260
|
+
};
|
|
261
|
+
var files = [
|
|
262
|
+
"bin/**",
|
|
263
|
+
"dist/**",
|
|
264
|
+
"translations.json"
|
|
265
|
+
];
|
|
266
|
+
var require$$6 = {
|
|
267
|
+
name: name,
|
|
268
|
+
version: version,
|
|
269
|
+
description: description,
|
|
270
|
+
homepage: homepage,
|
|
271
|
+
license: license,
|
|
272
|
+
repository: repository,
|
|
273
|
+
author: author,
|
|
274
|
+
bin: bin,
|
|
275
|
+
exports: exports$1,
|
|
276
|
+
scripts: scripts,
|
|
277
|
+
dependencies: dependencies,
|
|
278
|
+
devDependencies: devDependencies,
|
|
279
|
+
overrides: overrides,
|
|
280
|
+
resolutions: resolutions,
|
|
281
|
+
engines: engines,
|
|
282
|
+
files: files
|
|
283
|
+
};
|
|
284
|
+
|
|
34
285
|
Object.defineProperty(ttyServer$1, "__esModule", {
|
|
35
286
|
value: true
|
|
36
287
|
});
|
|
@@ -40,7 +291,7 @@ var _nodeNet = require$$1$1;
|
|
|
40
291
|
var _nodeOs = require$$2;
|
|
41
292
|
var _nodePath$1 = require$$1;
|
|
42
293
|
var _nodeReadline$1 = require$$3;
|
|
43
|
-
var _nodeStream
|
|
294
|
+
var _nodeStream = require$$5;
|
|
44
295
|
var _package = require$$6;
|
|
45
296
|
var _misc$1 = sdk.misc;
|
|
46
297
|
const NEWLINE_CHAR_CODE = 10; /*'\n'*/
|
|
@@ -78,10 +329,10 @@ function createNonStandardTTYServer() {
|
|
|
78
329
|
if (remote_ipc_version !== _package.version) {
|
|
79
330
|
throw new Error('Mismatched STDIO tunnel IPC version, ensure you only have 1 version of socket CLI being called.');
|
|
80
331
|
}
|
|
81
|
-
const input = hasInput ? new _nodeStream
|
|
332
|
+
const input = hasInput ? new _nodeStream.PassThrough() : null;
|
|
82
333
|
input?.pause();
|
|
83
334
|
if (input) conn.pipe(input);
|
|
84
|
-
const output = hasOutput ? new _nodeStream
|
|
335
|
+
const output = hasOutput ? new _nodeStream.PassThrough() : null;
|
|
85
336
|
if (output) {
|
|
86
337
|
output.pipe(conn)
|
|
87
338
|
// Make ora happy
|
|
@@ -235,7 +486,7 @@ var issueRules = {};
|
|
|
235
486
|
Object.defineProperty(issueRules, "__esModule", {
|
|
236
487
|
value: true
|
|
237
488
|
});
|
|
238
|
-
issueRules.
|
|
489
|
+
issueRules.createAlertUXLookup = createAlertUXLookup;
|
|
239
490
|
//#region UX Constants
|
|
240
491
|
|
|
241
492
|
const IGNORE_UX = {
|
|
@@ -302,7 +553,7 @@ function resolveIssueRuleUX(entriesOrderedIssueRules, defaultValue) {
|
|
|
302
553
|
function issueRuleValueDoesNotDefer(issueRule) {
|
|
303
554
|
if (issueRule === undefined) {
|
|
304
555
|
return false;
|
|
305
|
-
} else if (typeof issueRule === 'object'
|
|
556
|
+
} else if (issueRule !== null && typeof issueRule === 'object') {
|
|
306
557
|
const {
|
|
307
558
|
action
|
|
308
559
|
} = issueRule;
|
|
@@ -334,11 +585,13 @@ function uxForDefinedNonDeferValue(issueRuleValue) {
|
|
|
334
585
|
|
|
335
586
|
//#region exports
|
|
336
587
|
|
|
337
|
-
function
|
|
588
|
+
function createAlertUXLookup(settings) {
|
|
338
589
|
const cachedUX = new Map();
|
|
339
590
|
return context => {
|
|
340
|
-
const
|
|
341
|
-
|
|
591
|
+
const {
|
|
592
|
+
type
|
|
593
|
+
} = context.alert;
|
|
594
|
+
let ux = cachedUX.get(type);
|
|
342
595
|
if (ux) {
|
|
343
596
|
return ux;
|
|
344
597
|
}
|
|
@@ -351,7 +604,7 @@ function createIssueUXLookup(settings) {
|
|
|
351
604
|
if (!resolvedTarget) {
|
|
352
605
|
break;
|
|
353
606
|
}
|
|
354
|
-
const issueRuleValue = resolvedTarget.issueRules?.[
|
|
607
|
+
const issueRuleValue = resolvedTarget.issueRules?.[type];
|
|
355
608
|
if (typeof issueRuleValue !== 'undefined') {
|
|
356
609
|
orderedIssueRules.push(issueRuleValue);
|
|
357
610
|
}
|
|
@@ -359,7 +612,7 @@ function createIssueUXLookup(settings) {
|
|
|
359
612
|
}
|
|
360
613
|
entriesOrderedIssueRules.push(orderedIssueRules);
|
|
361
614
|
}
|
|
362
|
-
const defaultValue = settings.defaults.issueRules[
|
|
615
|
+
const defaultValue = settings.defaults.issueRules[type];
|
|
363
616
|
let resolvedDefaultValue = {
|
|
364
617
|
action: 'error'
|
|
365
618
|
};
|
|
@@ -373,27 +626,27 @@ function createIssueUXLookup(settings) {
|
|
|
373
626
|
};
|
|
374
627
|
}
|
|
375
628
|
ux = resolveIssueRuleUX(entriesOrderedIssueRules, resolvedDefaultValue);
|
|
376
|
-
cachedUX.set(
|
|
629
|
+
cachedUX.set(type, ux);
|
|
377
630
|
return ux;
|
|
378
631
|
};
|
|
379
632
|
}
|
|
380
633
|
|
|
381
|
-
var _interopRequireDefault =
|
|
634
|
+
var _interopRequireDefault = vendor.interopRequireDefault.default;
|
|
382
635
|
Object.defineProperty(arborist, "__esModule", {
|
|
383
636
|
value: true
|
|
384
637
|
});
|
|
385
638
|
arborist.SafeArborist = void 0;
|
|
386
639
|
arborist.installSafeArborist = installSafeArborist;
|
|
387
|
-
var _nodeEvents = require$$1$
|
|
640
|
+
var _nodeEvents = require$$1$3;
|
|
388
641
|
var _nodeFs = require$$0;
|
|
389
642
|
var _nodeHttps = require$$3$3;
|
|
390
643
|
var _nodePath = require$$1;
|
|
391
644
|
var _nodeReadline = require$$3;
|
|
392
|
-
var
|
|
393
|
-
var
|
|
645
|
+
var _promises = require$$6$2;
|
|
646
|
+
var _confirm = require$$1$2;
|
|
647
|
+
var _yoctoSpinner = require$$3$2;
|
|
394
648
|
var _isInteractive = _interopRequireDefault(require$$3$1);
|
|
395
649
|
var _npmPackageArg = require$$5$1;
|
|
396
|
-
var _yoctoSpinner = require$$3$2;
|
|
397
650
|
var _semver = require$$4;
|
|
398
651
|
var _config = require$$6$1;
|
|
399
652
|
var _objects = require$$7;
|
|
@@ -466,7 +719,7 @@ const OverrideSet = require(arboristOverrideSetClassPatch);
|
|
|
466
719
|
const kCtorArgs = Symbol('ctorArgs');
|
|
467
720
|
const kRiskyReify = Symbol('riskyReify');
|
|
468
721
|
const formatter = new _colorOrMarkdown.ColorOrMarkdown(false);
|
|
469
|
-
const pubToken = (0, _sdk.getDefaultKey)() ??
|
|
722
|
+
const pubToken = (0, _sdk.getDefaultKey)() ?? _constants$1.SOCKET_PUBLIC_API_KEY;
|
|
470
723
|
const ttyServer = (0, _ttyServer.createTTYServer)((0, _isInteractive.default)({
|
|
471
724
|
stream: process.stdin
|
|
472
725
|
}), log);
|
|
@@ -481,31 +734,20 @@ async function uxLookup(settings) {
|
|
|
481
734
|
return _uxLookup(settings);
|
|
482
735
|
}
|
|
483
736
|
async function* batchScan(pkgIds) {
|
|
484
|
-
const
|
|
485
|
-
packages: pkgIds.map(id => {
|
|
486
|
-
const {
|
|
487
|
-
name,
|
|
488
|
-
version
|
|
489
|
-
} = pkgidParts(id);
|
|
490
|
-
return {
|
|
491
|
-
eco: 'npm',
|
|
492
|
-
pkg: name,
|
|
493
|
-
ver: version,
|
|
494
|
-
top: true
|
|
495
|
-
};
|
|
496
|
-
})
|
|
497
|
-
};
|
|
498
|
-
// TODO: Migrate to SDK.
|
|
499
|
-
const pkgDataReq = _nodeHttps.request(`${_constants$1.API_V0_URL}/scan/batch`, {
|
|
737
|
+
const req = _nodeHttps.request(`${_constants$1.API_V0_URL}/purl?alerts=true`, {
|
|
500
738
|
method: 'POST',
|
|
501
739
|
headers: {
|
|
502
740
|
Authorization: `Basic ${Buffer.from(`${pubToken}:`).toString('base64url')}`
|
|
503
741
|
},
|
|
504
742
|
signal: abortSignal
|
|
505
|
-
}).end(JSON.stringify(
|
|
743
|
+
}).end(JSON.stringify({
|
|
744
|
+
components: pkgIds.map(id => ({
|
|
745
|
+
purl: `pkg:npm/${id}`
|
|
746
|
+
}))
|
|
747
|
+
}));
|
|
506
748
|
const {
|
|
507
749
|
0: res
|
|
508
|
-
} = await _nodeEvents.once(
|
|
750
|
+
} = await _nodeEvents.once(req, 'response');
|
|
509
751
|
const ok = res.statusCode >= 200 && res.statusCode <= 299;
|
|
510
752
|
if (!ok) {
|
|
511
753
|
throw new Error(`Socket API Error: ${res.statusCode}`);
|
|
@@ -571,118 +813,118 @@ function findSpecificOverrideSet(first, second) {
|
|
|
571
813
|
log.silly('Conflicting override sets', first, second);
|
|
572
814
|
return undefined;
|
|
573
815
|
}
|
|
816
|
+
function isAlertFixable(alert) {
|
|
817
|
+
const {
|
|
818
|
+
type
|
|
819
|
+
} = alert;
|
|
820
|
+
if (type === 'cve' || type === 'mediumCVE' || type === 'mildCVE' || type === 'criticalCVE') {
|
|
821
|
+
return !!alert.props?.['firstPatchedVersionIdentifier'];
|
|
822
|
+
}
|
|
823
|
+
return type === 'socketUpgradeAvailable';
|
|
824
|
+
}
|
|
574
825
|
function maybeReadfileSync(filepath) {
|
|
575
826
|
try {
|
|
576
827
|
return (0, _nodeFs.readFileSync)(filepath, 'utf8');
|
|
577
828
|
} catch {}
|
|
578
829
|
return undefined;
|
|
579
830
|
}
|
|
580
|
-
async function
|
|
831
|
+
async function getPackagesAlerts(safeArb, _registry, pkgs, output) {
|
|
581
832
|
const spinner = _yoctoSpinner({
|
|
582
833
|
stream: output
|
|
583
834
|
});
|
|
584
|
-
let result = false;
|
|
585
835
|
let {
|
|
586
836
|
length: remaining
|
|
587
837
|
} = pkgs;
|
|
838
|
+
const packageAlerts = [];
|
|
588
839
|
if (!remaining) {
|
|
589
840
|
spinner.success('No changes detected');
|
|
590
|
-
return
|
|
841
|
+
return packageAlerts;
|
|
591
842
|
}
|
|
592
843
|
const getText = () => `Looking up data for ${remaining} packages`;
|
|
593
844
|
spinner.start(getText());
|
|
594
845
|
try {
|
|
595
|
-
for await (const
|
|
846
|
+
for await (const artifact of batchScan(pkgs.map(p => p.pkgid))) {
|
|
847
|
+
if (!artifact.name || !artifact.version || !artifact.alerts?.length) {
|
|
848
|
+
continue;
|
|
849
|
+
}
|
|
596
850
|
const {
|
|
597
|
-
|
|
598
|
-
|
|
599
|
-
|
|
600
|
-
const id = `${name}@${version}`;
|
|
851
|
+
version
|
|
852
|
+
} = artifact;
|
|
853
|
+
const name = `${artifact.namespace ? `${artifact.namespace}/` : ''}${artifact.name}`;
|
|
854
|
+
const id = `${name}@${artifact.version}`;
|
|
855
|
+
let blocked = false;
|
|
601
856
|
let displayWarning = false;
|
|
602
|
-
let
|
|
603
|
-
|
|
604
|
-
|
|
605
|
-
|
|
606
|
-
|
|
607
|
-
|
|
608
|
-
|
|
857
|
+
let alerts = [];
|
|
858
|
+
for (const alert of artifact.alerts) {
|
|
859
|
+
// eslint-disable-next-line no-await-in-loop
|
|
860
|
+
const ux = await uxLookup({
|
|
861
|
+
package: {
|
|
862
|
+
name,
|
|
863
|
+
version
|
|
864
|
+
},
|
|
865
|
+
alert: {
|
|
866
|
+
type: alert.type
|
|
867
|
+
}
|
|
609
868
|
});
|
|
610
|
-
|
|
611
|
-
|
|
612
|
-
|
|
613
|
-
|
|
614
|
-
|
|
615
|
-
|
|
616
|
-
|
|
617
|
-
|
|
618
|
-
|
|
619
|
-
|
|
620
|
-
|
|
621
|
-
|
|
622
|
-
|
|
623
|
-
|
|
624
|
-
}
|
|
869
|
+
if (ux.block) {
|
|
870
|
+
blocked = true;
|
|
871
|
+
}
|
|
872
|
+
if (ux.display) {
|
|
873
|
+
displayWarning = true;
|
|
874
|
+
}
|
|
875
|
+
if (ux.block || ux.display) {
|
|
876
|
+
alerts.push({
|
|
877
|
+
name,
|
|
878
|
+
version,
|
|
879
|
+
type: alert.type,
|
|
880
|
+
block: ux.block,
|
|
881
|
+
raw: alert,
|
|
882
|
+
fixable: isAlertFixable(alert)
|
|
625
883
|
});
|
|
626
|
-
if
|
|
627
|
-
|
|
628
|
-
|
|
629
|
-
|
|
630
|
-
|
|
631
|
-
|
|
632
|
-
|
|
633
|
-
|
|
634
|
-
|
|
635
|
-
|
|
636
|
-
|
|
637
|
-
|
|
638
|
-
|
|
639
|
-
//
|
|
640
|
-
//
|
|
641
|
-
|
|
642
|
-
if (pkg?.existing) {
|
|
643
|
-
const oldPkgData =
|
|
644
|
-
// eslint-disable-next-line no-await-in-loop
|
|
645
|
-
(await batchScan([pkg.existing]).next()).value;
|
|
646
|
-
if (oldPkgData.type === 'success') {
|
|
647
|
-
failures = failures.filter(issue => oldPkgData.value.issues.find(oldIssue => oldIssue.type === issue.type) === undefined);
|
|
648
|
-
}
|
|
649
|
-
}
|
|
884
|
+
// Before we ask about problematic issues, check to see if they
|
|
885
|
+
// already existed in the old version if they did, be quiet.
|
|
886
|
+
const pkg = pkgs.find(p => p.pkgid === id && p.existing?.startsWith(`${name}@`));
|
|
887
|
+
if (pkg?.existing) {
|
|
888
|
+
// const oldArtifact: SocketArtifact =
|
|
889
|
+
// // eslint-disable-next-line no-await-in-loop
|
|
890
|
+
// (await batchScan([pkg.existing]).next()).value
|
|
891
|
+
// console.log('oldArtifact', oldArtifact)
|
|
892
|
+
// if (oldArtifact.type === 'success') {
|
|
893
|
+
// issues = issues.filter(
|
|
894
|
+
// ({ type }) =>
|
|
895
|
+
// oldPkgData.value.issues.find(
|
|
896
|
+
// oldIssue => oldIssue.type === type
|
|
897
|
+
// ) === undefined
|
|
898
|
+
// )
|
|
899
|
+
// }
|
|
650
900
|
}
|
|
651
901
|
}
|
|
652
|
-
|
|
653
|
-
|
|
654
|
-
|
|
655
|
-
|
|
656
|
-
|
|
657
|
-
|
|
658
|
-
|
|
659
|
-
|
|
660
|
-
|
|
661
|
-
}
|
|
902
|
+
}
|
|
903
|
+
if (!blocked) {
|
|
904
|
+
const pkg = pkgs.find(p => p.pkgid === id);
|
|
905
|
+
if (pkg) {
|
|
906
|
+
await tarball.stream(id, stream => {
|
|
907
|
+
stream.resume();
|
|
908
|
+
return stream.promise();
|
|
909
|
+
}, {
|
|
910
|
+
...safeArb[kCtorArgs][0]
|
|
911
|
+
});
|
|
662
912
|
}
|
|
663
913
|
}
|
|
664
914
|
if (displayWarning) {
|
|
665
915
|
spinner.stop(`(socket) ${formatter.hyperlink(id, `https://socket.dev/npm/package/${name}/overview/${version}`)} contains risks:`);
|
|
666
|
-
|
|
667
|
-
if (name === 'socket' || name.startsWith('@socketregistry/') || name.startsWith('@socketsecurity/')) {
|
|
668
|
-
failures = failures.filter(({
|
|
669
|
-
type
|
|
670
|
-
}) => type !== 'unpopularPackage' && type !== 'unstableOwnership');
|
|
671
|
-
}
|
|
672
|
-
failures.sort((a, b) => a.type < b.type ? -1 : 1);
|
|
916
|
+
alerts.sort((a, b) => a.type < b.type ? -1 : 1);
|
|
673
917
|
const lines = new Set();
|
|
674
|
-
for (const
|
|
675
|
-
const {
|
|
676
|
-
type
|
|
677
|
-
} = failure;
|
|
918
|
+
for (const alert of alerts) {
|
|
678
919
|
// Based data from { pageProps: { alertTypes } } of:
|
|
679
920
|
// https://socket.dev/_next/data/94666139314b6437ee4491a0864e72b264547585/en-US.json
|
|
680
|
-
const info = translations.
|
|
681
|
-
const title = info?.title ?? type;
|
|
682
|
-
const
|
|
921
|
+
const info = translations.alerts[alert.type];
|
|
922
|
+
const title = info?.title ?? alert.type;
|
|
923
|
+
const attributes = [...(alert.fixable ? ['fixable'] : []), ...(alert.block ? [] : ['non-blocking'])];
|
|
924
|
+
const maybeAttributes = attributes.length ? ` (${attributes.join('; ')})` : '';
|
|
683
925
|
const maybeDesc = info?.description ? ` - ${info.description}` : '';
|
|
684
926
|
// TODO: emoji seems to mis-align terminals sometimes
|
|
685
|
-
lines.add(` ${title}${
|
|
927
|
+
lines.add(` ${title}${maybeAttributes}${maybeDesc}\n`);
|
|
686
928
|
}
|
|
687
929
|
for (const line of lines) {
|
|
688
930
|
output?.write(line);
|
|
@@ -691,20 +933,14 @@ async function packagesHaveRiskyIssues(safeArb, _registry, pkgs, output) {
|
|
|
691
933
|
}
|
|
692
934
|
remaining -= 1;
|
|
693
935
|
spinner.text = remaining > 0 ? getText() : '';
|
|
936
|
+
packageAlerts.push(...alerts);
|
|
694
937
|
}
|
|
695
|
-
|
|
938
|
+
} catch (e) {
|
|
939
|
+
console.log('error', e);
|
|
696
940
|
} finally {
|
|
697
941
|
spinner.stop();
|
|
698
942
|
}
|
|
699
|
-
|
|
700
|
-
function pkgidParts(pkgid) {
|
|
701
|
-
const delimiter = pkgid.lastIndexOf('@');
|
|
702
|
-
const name = pkgid.slice(0, delimiter);
|
|
703
|
-
const version = pkgid.slice(delimiter + 1);
|
|
704
|
-
return {
|
|
705
|
-
name,
|
|
706
|
-
version
|
|
707
|
-
};
|
|
943
|
+
return packageAlerts;
|
|
708
944
|
}
|
|
709
945
|
function toRepoUrl(resolved) {
|
|
710
946
|
return resolved.replace(/#[\s\S]*$/, '').replace(/\?[\s\S]*$/, '').replace(/\/[^/]*\/-\/[\s\S]*$/, '');
|
|
@@ -1437,36 +1673,19 @@ class SafeArborist extends Arborist {
|
|
|
1437
1673
|
if (!proceed) {
|
|
1438
1674
|
proceed = await ttyServer.captureTTY(async (input, output) => {
|
|
1439
1675
|
if (input && output) {
|
|
1440
|
-
const
|
|
1441
|
-
if (!
|
|
1676
|
+
const alerts = await getPackagesAlerts(this, this['registry'], diff, output);
|
|
1677
|
+
if (!alerts.length) {
|
|
1442
1678
|
return true;
|
|
1443
1679
|
}
|
|
1444
|
-
|
|
1445
|
-
|
|
1446
|
-
|
|
1447
|
-
|
|
1448
|
-
|
|
1680
|
+
return await _confirm({
|
|
1681
|
+
message: 'Accept risks of installing these packages?',
|
|
1682
|
+
default: false
|
|
1683
|
+
}, {
|
|
1684
|
+
input,
|
|
1685
|
+
output,
|
|
1686
|
+
signal: abortSignal
|
|
1449
1687
|
});
|
|
1450
|
-
|
|
1451
|
-
try {
|
|
1452
|
-
while (true) {
|
|
1453
|
-
// eslint-disable-next-line no-await-in-loop
|
|
1454
|
-
const answer = await new Promise(resolve => {
|
|
1455
|
-
rli.question('Accept risks of installing these packages (y/N)?\n', {
|
|
1456
|
-
signal: abortSignal
|
|
1457
|
-
}, resolve);
|
|
1458
|
-
});
|
|
1459
|
-
if (/^\s*y(?:es)?\s*$/i.test(answer)) {
|
|
1460
|
-
return true;
|
|
1461
|
-
}
|
|
1462
|
-
if (/^(?:\s*no?\s*|)$/i.test(answer)) {
|
|
1463
|
-
return false;
|
|
1464
|
-
}
|
|
1465
|
-
}
|
|
1466
|
-
} finally {
|
|
1467
|
-
rli.close();
|
|
1468
|
-
}
|
|
1469
|
-
} else if (await packagesHaveRiskyIssues(this, this['registry'], diff, output)) {
|
|
1688
|
+
} else if ((await getPackagesAlerts(this, this['registry'], diff, output)).length > 0) {
|
|
1470
1689
|
throw new Error('Socket npm Unable to prompt to accept risk, need TTY to do so');
|
|
1471
1690
|
}
|
|
1472
1691
|
return true;
|
|
@@ -1567,7 +1786,7 @@ void (async () => {
|
|
|
1567
1786
|
}
|
|
1568
1787
|
});
|
|
1569
1788
|
}
|
|
1570
|
-
_uxLookup = (0, _issueRules.
|
|
1789
|
+
_uxLookup = (0, _issueRules.createAlertUXLookup)(settings);
|
|
1571
1790
|
})();
|
|
1572
1791
|
|
|
1573
1792
|
var _constants = constants.constants;
|
|
@@ -1579,7 +1798,7 @@ var _link = link.link;
|
|
|
1579
1798
|
|
|
1580
1799
|
(function (exports) {
|
|
1581
1800
|
|
|
1582
|
-
var _interopRequireWildcard =
|
|
1801
|
+
var _interopRequireWildcard = vendor.interopRequireWildcard.default;
|
|
1583
1802
|
Object.defineProperty(exports, "__esModule", {
|
|
1584
1803
|
value: true
|
|
1585
1804
|
});
|
|
@@ -1604,6 +1823,6 @@ var _link = link.link;
|
|
|
1604
1823
|
});
|
|
1605
1824
|
} (npmInjection$2));
|
|
1606
1825
|
|
|
1607
|
-
var npmInjection = /*@__PURE__*/
|
|
1826
|
+
var npmInjection = /*@__PURE__*/vendor.getDefaultExportFromCjs(npmInjection$2);
|
|
1608
1827
|
|
|
1609
1828
|
module.exports = npmInjection;
|