@socketsecurity/cli 0.14.7 → 0.14.8

package/dist/cli.js

@@ -1263,6 +1263,7 @@ async function addOverrides({
   if (overridesData) {
     overridesDataObjects.push(overridesData);
   }
+  const aliasMap = new Map();
   for (const {
     1: data
   } of availableOverrides) {
@@ -1274,20 +1275,36 @@ async function addOverrides({
     for (const {
       1: depObj
     } of depEntries) {
-      const pkgSpec = depObj[origPkgName];
+      let pkgSpec = depObj[origPkgName];
       if (pkgSpec) {
-        if (!pkgSpec.startsWith(`npm:${regPkgName}@`)) {
+        // Add package aliases for direct dependencies to avoid npm EOVERRIDE errors.
+        // https://docs.npmjs.com/cli/v8/using-npm/package-spec#aliases
+        const overrideSpecPrefix = `npm:${regPkgName}@`;
+        if (!pkgSpec.startsWith(overrideSpecPrefix)) {
+          aliasMap.set(regPkgName, pkgSpec);
+        } else {
           packageNames.add(regPkgName);
-          depObj[origPkgName] = `npm:${regPkgName}@^${version}`;
+          pkgSpec = `${overrideSpecPrefix}^${version}`;
+          depObj[origPkgName] = pkgSpec;
         }
+        aliasMap.set(origPkgName, pkgSpec);
       }
     }
     for (const {
+      type,
       overrides
     } of overridesDataObjects) {
       if (overrides && !(0, _objects.hasOwn)(overrides, origPkgName) && lockIncludes(lockSrc, origPkgName)) {
         packageNames.add(regPkgName);
-        overrides[origPkgName] = `npm:${regPkgName}@^${_semver.major(version)}`;
+        overrides[origPkgName] =
+        // With npm you may not set an override for a package that you directly
+        // depend on unless both the dependency and the override itself share
+        // the exact same spec. To make this limitation easier to deal with,
+        // overrides may also be defined as a reference to a spec for a direct
+        // dependency by prefixing the name of the package you wish the version
+        // to match with a $.
+        // https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides
+        type === 'npm' && aliasMap.has(origPkgName) && `$${origPkgName}` || `npm:${regPkgName}@^${_semver.major(version)}`;
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/cli",
-  "version": "0.14.7",
+  "version": "0.14.8",
   "description": "CLI tool for Socket.dev",
   "homepage": "http://github.com/SocketDev/socket-cli-js",
   "license": "MIT",