@zairakai/js-dev-tools 3.12.0 → 3.12.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zairakai/js-dev-tools",
-  "version": "3.12.0",
+  "version": "3.12.2",
   "description": "The unified and centralized development toolkit for JavaScript/TypeScript projects - ESLint, Prettier, Stylelint, Knip, Vitest, Git Hooks, and GitLab CI pipeline templates",
   "keywords": [
     "dev-tools",

package/scripts/update-dependencies.mjs

@@ -45,6 +45,7 @@ const POLICY_URL = 'https://gitlab.com/zairakai/dependency-policy/-/raw/main'
 const POLICY_FILES = { npm: 'node.json', composer: 'php.json' }
 const POLICY_BRANCH_PREFIX = 'chore/unblock'
 const GROUP_SCOPE = '@zairakai/'
+const TRUSTED_SCOPES = [GROUP_SCOPE, '@stanislas-poisson/']
 
 const DEFAULTS = {
   reject: [],
@@ -251,6 +252,19 @@ export function isLifted(entry, ranges) {
   })
 }
 
+/**
+ * The packages of a lock file that the refresh may update: the ones of the group are left out, because they are trusted
+ * and not made to wait, and the cooling date would refuse a version that was just published.
+ */
+export function refreshableNames(lock, scopes = TRUSTED_SCOPES) {
+  const names = Object.keys(lock?.packages ?? {})
+    .filter((path) => '' !== path)
+    .map((path) => path.slice(path.lastIndexOf('node_modules/') + 'node_modules/'.length))
+    .filter((name) => !scopes.some((scope) => name.startsWith(scope)))
+
+  return [...new Set(names)].sort()
+}
+
 /** The age, as a date, from which a version is taken: now minus the cooling period ("3d", "12h"). */
 export function cooldownDate(cooldown, now = new Date()) {
   const match = /^(\d+)\s*([dhm])$/.exec(cooldown)
@@ -594,12 +608,19 @@ async function update(config) {
     // The lock file is refreshed inside the ranges, so that a fix of a package that this project only inherits arrives
     // (overrides of a dependency do not apply here). The new versions wait for the cooling period, except for a fix.
     const before = cooldownDate(config.cooldown)
-    run('npm', [
-      'update',
-      '--no-audit',
-      '--no-fund',
-      ...(urgent || null === before ? [] : [`--before=${before.toISOString()}`]),
-    ])
+    const names = refreshableNames(JSON.parse(readFileSync('package-lock.json', 'utf8')))
+
+    // The refresh is a bonus: when npm cannot respect the cooling date (a range that starts at a version younger than
+    // the period, after an urgent update), it waits for the next run and the update goes on.
+    try {
+      if (urgent || null === before) {
+        run('npm', ['update', '--no-audit', '--no-fund'])
+      } else if (0 < names.length) {
+        run('npm', ['update', '--no-audit', '--no-fund', `--before=${before.toISOString()}`, ...names])
+      }
+    } catch (error) {
+      log(`The lock file is not refreshed this time: ${secret(error.message).split('\n')[0]}`)
+    }
 
     if (urgent) {
       try {