@socketsecurity/lib 4.0.1 → 4.2.0

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.1.0](https://github.com/SocketDev/socket-lib/releases/tag/v4.1.0) - 2025-11-17
+
+### Added
+
+- **constants/node**: New version helper functions for cleaner version detection
+  - `getNodeMinorVersion()`: Extract minor version number
+  - `getNodePatchVersion()`: Extract patch version number
+
+### Fixed
+
+- **constants/node**: Improve Node.js flag management in `getNodeHardenFlags()`
+  - Properly guard `--experimental-permission` for Node 20-23 only
+  - Properly guard `--permission` for Node 24+ only
+  - Properly guard `--force-node-api-uncaught-exceptions-policy` for Node 22+ (was incorrectly applied to all versions)
+  - Automatically include permission grants from `getNodePermissionFlags()` for Node 24+
+  - Remove `--experimental-policy` flag (no policy file provided)
+
 ## [4.0.1](https://github.com/SocketDev/socket-lib/releases/tag/v4.0.1) - 2025-11-17
 
 ### Changed

package/dist/constants/node.d.ts

@@ -1,6 +1,8 @@
 // Version detection.
 export declare function getNodeVersion(): string;
 export declare function getNodeMajorVersion(): number;
+export declare function getNodeMinorVersion(): number;
+export declare function getNodePatchVersion(): number;
 // Maintained Node.js versions.
 export declare function getMaintainedNodeVersions(): readonly string[] & {
     current: string;
@@ -18,8 +20,8 @@ export declare function supportsNodeRun(): boolean;
 export declare function supportsNodeDisableSigusr1Flag(): boolean;
 export declare function getNodeDisableSigusr1Flags(): string[];
 export declare function supportsProcessSend(): boolean;
-export declare function getNodeHardenFlags(): string[];
 export declare function getNodePermissionFlags(): string[];
+export declare function getNodeHardenFlags(): string[];
 export declare function getNodeNoWarningsFlags(): string[];
 // Execution path.
 export declare function getExecPath(): string;

package/dist/constants/node.js

@@ -26,7 +26,9 @@ __export(node_exports, {
   getNodeDisableSigusr1Flags: () => getNodeDisableSigusr1Flags,
   getNodeHardenFlags: () => getNodeHardenFlags,
   getNodeMajorVersion: () => getNodeMajorVersion,
+  getNodeMinorVersion: () => getNodeMinorVersion,
   getNodeNoWarningsFlags: () => getNodeNoWarningsFlags,
+  getNodePatchVersion: () => getNodePatchVersion,
   getNodePermissionFlags: () => getNodePermissionFlags,
   getNodeVersion: () => getNodeVersion,
   supportsNodeCompileCacheApi: () => supportsNodeCompileCacheApi,
@@ -45,7 +47,13 @@ function getNodeVersion() {
   return NODE_VERSION;
 }
 function getNodeMajorVersion() {
-  return Number.parseInt(NODE_VERSION.slice(1).split(".")[0] || "0", 10);
+  return Number.parseInt(NODE_VERSION.slice(1).split(".")[0] ?? "0", 10);
+}
+function getNodeMinorVersion() {
+  return Number.parseInt(NODE_VERSION.split(".")[1] ?? "0", 10);
+}
+function getNodePatchVersion() {
+  return Number.parseInt(NODE_VERSION.split(".")[2] ?? "0", 10);
 }
 function getMaintainedNodeVersions() {
   return import_maintained_node_versions.maintainedNodeVersions;
@@ -68,24 +76,22 @@ function supportsNodePermissionFlag() {
 }
 function supportsNodeRequireModule() {
   const major = getNodeMajorVersion();
-  return major >= 23 || major === 22 && Number.parseInt(NODE_VERSION.split(".")[1] || "0", 10) >= 12;
+  return major >= 23 || major === 22 && getNodeMinorVersion() >= 12;
 }
 function supportsNodeRun() {
   const major = getNodeMajorVersion();
-  return major >= 23 || major === 22 && Number.parseInt(NODE_VERSION.split(".")[1] || "0", 10) >= 11;
+  return major >= 23 || major === 22 && getNodeMinorVersion() >= 11;
 }
 function supportsNodeDisableSigusr1Flag() {
   const major = getNodeMajorVersion();
+  const minor = getNodeMinorVersion();
   if (major >= 24) {
-    const minor = Number.parseInt(NODE_VERSION.split(".")[1] || "0", 10);
     return minor >= 8;
   }
   if (major === 23) {
-    const minor = Number.parseInt(NODE_VERSION.split(".")[1] || "0", 10);
     return minor >= 7;
   }
   if (major === 22) {
-    const minor = Number.parseInt(NODE_VERSION.split(".")[1] || "0", 10);
     return minor >= 14;
   }
   return false;
@@ -101,24 +107,6 @@ function supportsProcessSend() {
   return typeof process.send === "function";
 }
 let _nodeHardenFlags;
-function getNodeHardenFlags() {
-  if (_nodeHardenFlags === void 0) {
-    const major = getNodeMajorVersion();
-    const flags = [
-      "--disable-proto=delete",
-      // Node.js 24+ uses --permission instead of --experimental-permission.
-      // The permission model graduated from experimental to production-ready.
-      major >= 24 ? "--permission" : "--experimental-permission",
-      // Force uncaught exceptions policy for N-API addons (Node.js 22+).
-      "--force-node-api-uncaught-exceptions-policy"
-    ];
-    if (major < 24) {
-      flags.push("--experimental-policy");
-    }
-    _nodeHardenFlags = flags;
-  }
-  return _nodeHardenFlags;
-}
 let _nodePermissionFlags;
 function getNodePermissionFlags() {
   if (_nodePermissionFlags === void 0) {
@@ -138,6 +126,23 @@ function getNodePermissionFlags() {
   }
   return _nodePermissionFlags;
 }
+function getNodeHardenFlags() {
+  if (_nodeHardenFlags === void 0) {
+    const major = getNodeMajorVersion();
+    const flags = ["--disable-proto=delete"];
+    if (major >= 24) {
+      flags.push("--permission");
+      flags.push(...getNodePermissionFlags());
+    } else if (major >= 20) {
+      flags.push("--experimental-permission");
+    }
+    if (major >= 22) {
+      flags.push("--force-node-api-uncaught-exceptions-policy");
+    }
+    _nodeHardenFlags = flags;
+  }
+  return _nodeHardenFlags;
+}
 let _nodeNoWarningsFlags;
 function getNodeNoWarningsFlags() {
   if (_nodeNoWarningsFlags === void 0) {
@@ -159,7 +164,9 @@ const ESNEXT = "esnext";
   getNodeDisableSigusr1Flags,
   getNodeHardenFlags,
   getNodeMajorVersion,
+  getNodeMinorVersion,
   getNodeNoWarningsFlags,
+  getNodePatchVersion,
   getNodePermissionFlags,
   getNodeVersion,
   supportsNodeCompileCacheApi,

package/dist/constants/process.d.ts

@@ -1,7 +1,2 @@
-/**
- * Process control: abort signals and UI utilities.
- */
-import type { Spinner } from '../spinner';
 export declare function getAbortController(): AbortController;
 export declare function getAbortSignal(): AbortSignal;
-export declare function getSpinner(): Spinner | null;

package/dist/constants/process.js

@@ -20,11 +20,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var process_exports = {};
 __export(process_exports, {
   getAbortController: () => getAbortController,
-  getAbortSignal: () => getAbortSignal,
-  getSpinner: () => getSpinner
+  getAbortSignal: () => getAbortSignal
 });
 module.exports = __toCommonJS(process_exports);
-var import_spinner = require("../spinner");
 let _abortController;
 function getAbortController() {
   if (_abortController === void 0) {
@@ -35,16 +33,8 @@ function getAbortController() {
 function getAbortSignal() {
   return getAbortController().signal;
 }
-let _spinner;
-function getSpinner() {
-  if (_spinner === void 0) {
-    _spinner = (0, import_spinner.Spinner)() ?? null;
-  }
-  return _spinner ?? null;
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   getAbortController,
-  getAbortSignal,
-  getSpinner
+  getAbortSignal
 });

package/dist/debug.js

@@ -43,16 +43,16 @@ __export(debug_exports, {
   isDebugNs: () => isDebugNs
 });
 module.exports = __toCommonJS(debug_exports);
-var import_process = require("./constants/process");
 var import_debug = require("./env/debug");
 var import_socket = require("./env/socket");
 var import_is_unicode_supported = __toESM(require("./external/@socketregistry/is-unicode-supported"));
 var import_debug2 = __toESM(require("./external/debug"));
 var import_logger = require("./logger");
 var import_objects = require("./objects");
+var import_spinner = require("./spinner");
 var import_strings = require("./strings");
-const logger = (0, import_logger.getDefaultLogger)();
 const ReflectApply = Reflect.apply;
+const logger = (0, import_logger.getDefaultLogger)();
 const debugByNamespace = /* @__PURE__ */ new Map();
 // @__NO_SIDE_EFFECTS__
 function getDebugJsInstance(namespace) {
@@ -176,7 +176,7 @@ function debugDirNs(namespacesOrOpts, obj, inspectOpts) {
       };
     }
   }
-  const spinnerInstance = options.spinner || (0, import_process.getSpinner)();
+  const spinnerInstance = options.spinner || (0, import_spinner.getDefaultSpinner)();
   const wasSpinning = spinnerInstance?.isSpinning;
   spinnerInstance?.stop();
   logger.info(`[DEBUG] ${callerName} ${pointingTriangle} object inspection:`);
@@ -205,7 +205,7 @@ function debugNs(namespacesOrOpts, ...args) {
     ),
     ...args.slice(1)
   ] : args;
-  const spinnerInstance = options.spinner || (0, import_process.getSpinner)();
+  const spinnerInstance = options.spinner || (0, import_spinner.getDefaultSpinner)();
   const wasSpinning = spinnerInstance?.isSpinning;
   spinnerInstance?.stop();
   ReflectApply(logger.info, logger, logArgs);
@@ -232,7 +232,7 @@ function debugLogNs(namespacesOrOpts, ...args) {
     ),
     ...args.slice(1)
   ] : [`[DEBUG] ${callerName} ${pointingTriangle}`, ...args];
-  const spinnerInstance = options.spinner || (0, import_process.getSpinner)();
+  const spinnerInstance = options.spinner || (0, import_spinner.getDefaultSpinner)();
   const wasSpinning = spinnerInstance?.isSpinning;
   spinnerInstance?.stop();
   ReflectApply(logger.info, logger, logArgs);
@@ -253,7 +253,7 @@ function debugCacheNs(namespacesOrOpts, operation, key, meta) {
   }
   const prefix = `[CACHE] ${callerName} ${pointingTriangle} ${operation}: ${key}`;
   const logArgs = meta !== void 0 ? [prefix, meta] : [prefix];
-  const spinnerInstance = options.spinner || (0, import_process.getSpinner)();
+  const spinnerInstance = options.spinner || (0, import_spinner.getDefaultSpinner)();
   const wasSpinning = spinnerInstance?.isSpinning;
   spinnerInstance?.stop();
   ReflectApply(logger.info, logger, logArgs);

package/dist/spawn.d.ts

@@ -1,3 +1,4 @@
+import type { EventEmitter } from 'node:events';
 // Define BufferEncoding type for TypeScript compatibility.
 type BufferEncoding = globalThis.BufferEncoding;
 /**
@@ -31,7 +32,7 @@ export type PromiseSpawnOptions = {
  * This is a Promise that resolves with process exit information and output,
  * with additional properties for accessing the running process and stdin stream.
  *
- * @property {ChildProcessType} process - The running child process instance
+ * @property {ChildProcess} process - The running child process instance
  * @property {WritableStreamType | null} stdin - Writable stream for process stdin, or `null` if not piped
  *
  * @example
@@ -48,7 +49,7 @@ export type PromiseSpawnResult = Promise<{
     stdout: string | Buffer;
     stderr: string | Buffer;
 }> & {
-    process: ChildProcessType;
+    process: ChildProcess;
     stdin: WritableStreamType | null;
 };
 /**
@@ -218,7 +219,7 @@ interface NodeSpawnOptions {
 }
 // Duplicated from Node.js child_process.ChildProcess
 // This represents a spawned child process
-interface ChildProcessType {
+interface ChildProcess extends EventEmitter {
     stdin: NodeJS.WritableStream | null;
     stdout: NodeJS.ReadableStream | null;
     stderr: NodeJS.ReadableStream | null;

package/dist/spawn.js

@@ -42,9 +42,10 @@ var import_arrays = require("./arrays");
 var import_bin = require("./bin");
 var import_normalize = require("./paths/normalize");
 var import_objects = require("./objects");
+var import_spinner = require("./spinner");
 var import_strings = require("./strings");
 const abortSignal = (0, import_process.getAbortSignal)();
-const spinner = (0, import_process.getSpinner)();
+const spinner = (0, import_spinner.getDefaultSpinner)();
 const windowsScriptExtRegExp = /\.(?:cmd|bat|ps1)$/i;
 let _child_process;
 // @__NO_SIDE_EFFECTS__

package/dist/stdio/prompts.js

@@ -48,12 +48,13 @@ var import_input = __toESM(require("../external/@inquirer/input"));
 var import_password = __toESM(require("../external/@inquirer/password"));
 var searchModule = __toESM(require("../external/@inquirer/search"));
 var selectModuleImport = __toESM(require("../external/@inquirer/select"));
+var import_yoctocolors_cjs = __toESM(require("../external/yoctocolors-cjs"));
+var import_spinner = require("../spinner");
 var import_context = require("../themes/context");
 var import_themes = require("../themes/themes");
 var import_utils = require("../themes/utils");
-var import_yoctocolors_cjs = __toESM(require("../external/yoctocolors-cjs"));
 const abortSignal = (0, import_process.getAbortSignal)();
-const spinner = (0, import_process.getSpinner)();
+const spinner = (0, import_spinner.getDefaultSpinner)();
 const searchRaw = searchModule.default;
 const selectModule = selectModuleImport;
 const selectRaw = selectModule.default;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "4.0.1",
+  "version": "4.2.0",
   "packageManager": "pnpm@10.22.0",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
@@ -690,7 +690,7 @@
     "@socketregistry/is-unicode-supported": "1.0.5",
     "@socketregistry/packageurl-js": "1.3.5",
     "@socketregistry/yocto-spinner": "1.0.25",
-    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@4.0.0",
+    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@4.1.0",
     "@types/node": "24.9.2",
     "@typescript/native-preview": "7.0.0-dev.20250920.1",
     "@vitest/coverage-v8": "4.0.3",