arui-scripts 23.3.0 → 23.4.0

package/.turbo/turbo-test.log

@@ -1,10 +1,11 @@
 ts-jest[versions] (WARN) Version 6.0.2 of typescript installed has not been tested with ts-jest. If you're experiencing issues, consider using a supported version (>=4.3.0 <6.0.0-0). Please do not report issues in ts-jest if you are using unsupported versions.
 ts-jest[versions] (WARN) Version 6.0.2 of typescript installed has not been tested with ts-jest. If you're experiencing issues, consider using a supported version (>=4.3.0 <6.0.0-0). Please do not report issues in ts-jest if you are using unsupported versions.
 ts-jest[versions] (WARN) Version 6.0.2 of typescript installed has not been tested with ts-jest. If you're experiencing issues, consider using a supported version (>=4.3.0 <6.0.0-0). Please do not report issues in ts-jest if you are using unsupported versions.
-PASS src/bin/__tests__/create-cli.tests.ts (32.447 s)
-PASS src/configs/app-configs/__tests__/update-with-presets.tests.ts
+PASS src/bin/__tests__/create-cli.tests.ts (35.077 s)
+PASS src/templates/__tests__/dockerfile-templates.tests.ts
+PASS src/plugins/postcss-global-variables/utils/__tests__/add-global-variable.tests.ts (35.512 s)
 PASS src/configs/util/__tests__/create-watch-ignore-regex.tests.ts
-PASS src/plugins/postcss-global-variables/utils/__tests__/add-global-variable.tests.ts (32.626 s)
+PASS src/configs/app-configs/__tests__/update-with-presets.tests.ts
 PASS src/configs/util/__tests__/apply-overrides.tests.ts
 PASS src/configs/app-configs/__tests__/update-with-env.tests.ts
 PASS src/configs/app-configs/__tests__/update-with-package.tests.ts
@@ -13,12 +14,12 @@ PASS src/configs/util/__tests__/get-polyfills.tests.ts
 PASS src/plugins/postcss-global-variables/utils/__tests__/parse-variables.tests.ts
 PASS src/plugins/postcss-global-variables/utils/__tests__/get-media-query-name.tests.ts
 PASS src/configs/app-configs/__tests__/validate-settings-keys.tests.ts
-PASS src/configs/__tests__/webpack-client-modules.tests.ts (9.936 s)
-PASS src/configs/util/__tests__/find-plugin.tests.ts (43.865 s)
+PASS src/configs/__tests__/webpack-client-modules.tests.ts (11.464 s)
+PASS src/configs/util/__tests__/find-plugin.tests.ts (47.931 s)
 A worker process has failed to exit gracefully and has been force exited. This is likely caused by tests leaking due to improper teardown. Try running with --detectOpenHandles to find leaks. Active timers can also cause this, ensure that .unref() was called on them.
 
-Test Suites: 14 passed, 14 total
-Tests:       37 passed, 37 total
+Test Suites: 15 passed, 15 total
+Tests:       42 passed, 42 total
 Snapshots:   0 total
-Time:        45.272 s
+Time:        49.677 s
 Ran all test suites.

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # arui-scripts
 
+## 23.4.0
+
+### Minor Changes
+
+-   [#569](https://github.com/core-ds/arui-scripts/pull/569) [`ea2dfc8`](https://github.com/core-ds/arui-scripts/commit/ea2dfc84ee753f85c94900b015d26b776f3ecc30) Thanks [@heymdall-legal](https://github.com/heymdall-legal)! - Добавлена настройка `deleteNpm` для команд `docker-build` и `docker-build:compiled`. При её
+    включении из docker-образа удаляются npm и связанные с ним библиотеки, что уменьшает
+    поверхность атаки и исключает неиспользуемые пакеты из результатов security-сканирования.
+
+## 23.3.1
+
+### Patch Changes
+
+-   [#563](https://github.com/core-ds/arui-scripts/pull/563) [`6d9bf3b`](https://github.com/core-ds/arui-scripts/commit/6d9bf3b9077025827179b8fe094fb905e2687e40) Thanks [@heymdall-legal](https://github.com/heymdall-legal)! - Исправлен запуск команды bundle-analyze с параметрами по умолчанию
+
 ## 23.3.0
 
 ### Minor Changes

package/build/commands/bundle-analyze/index.js

@@ -14,6 +14,7 @@ const core_1 = require("@rspack/core");
 const webpack_bundle_analyzer_1 = require("webpack-bundle-analyzer");
 const app_configs_1 = require("../../configs/app-configs");
 const rspack_client_prod_1 = require("../../configs/rspack.client.prod");
+const load_browserslist_1 = require("../util/load-browserslist");
 const make_tmp_dir_1 = require("../util/make-tmp-dir");
 // В rspack по умолчанию больше не включаются эти поля, но для webpack-bundle-analyzer они нужны
 // https://rspack.rs/guide/migration/rspack_1.x#changed-default-parameters-of-statstojson
@@ -27,6 +28,7 @@ const bundleAnalyzerStatsOptions = {
     modules: true,
 };
 (() => __awaiter(void 0, void 0, void 0, function* () {
+    (0, load_browserslist_1.loadBrowserslist)();
     console.log('Starting bundle analysis...');
     const clientWebpackConfigs = Array.isArray(rspack_client_prod_1.webpackClientConfig)
         ? rspack_client_prod_1.webpackClientConfig

package/build/configs/app-configs/get-defaults.js

@@ -45,6 +45,7 @@ function getDefaultAppConfig() {
         nginx: null,
         runFromNonRootUser: true,
         removeDevDependenciesDuringDockerBuild: true,
+        deleteNpm: false,
         // archive compilation configs
         archiveName: 'build.tar',
         dictionaryCompression: {

package/build/configs/app-configs/types.d.ts

@@ -35,6 +35,7 @@ export type AppConfigs = {
     } | null;
     runFromNonRootUser: boolean;
     removeDevDependenciesDuringDockerBuild: boolean;
+    deleteNpm: boolean;
     archiveName: string;
     dictionaryCompression: {
         dictionaryPath: string[];

package/build/templates/dockerfile-compiled.template.js

@@ -38,6 +38,11 @@ RUN ${installProductionCommand}  && \\
 
 ADD --chown=nginx:nginx . /src
 
+# При необходимости удаляем npm и связанные библиотеки из образа
+${app_configs_1.configs.deleteNpm
+    ? 'RUN rm -rf /usr/local/bin/npm /usr/local/bin/npx /usr/local/lib/node_modules/npm'
+    : ''}
+
 # Создаем директории для nginx и выставляем правильные права
 RUN mkdir -p /var/lib/nginx && \
     chown -R nginx:nginx /var/lib/nginx && \

package/build/templates/dockerfile.template.js

@@ -37,6 +37,9 @@ ${nginxNonRootPart}
 ${app_configs_1.configs.runFromNonRootUser
     ? `ADD --chown=nginx:nginx ${appPathToAdd} ${appTargetPath}`
     : `ADD ${appPathToAdd} ${appTargetPath}`}
+${app_configs_1.configs.deleteNpm
+    ? 'RUN rm -rf /usr/local/bin/npm /usr/local/bin/npx /usr/local/lib/node_modules/npm'
+    : ''}
 ${app_configs_1.configs.clientOnly ? 'COPY env-config.jso[n] /src/' : ''}
 ${app_configs_1.configs.clientOnly ? 'CMD ["nginx"]' : ''}
 `;

package/docs/settings.md

@@ -198,6 +198,13 @@ const settings = {
 Отключает удаление devDependencies из node_modules при сборке докер образа. Используется когда вам не нужно удалять devDependencies,
 т.к. в своём Dockerfile вы не переносите node_modules в докер-контейнер. По умолчанию `true`.
 
+#### deleteNpm
+Удаляет npm и связанные с ним библиотеки (`/usr/local/bin/npm`, `/usr/local/bin/npx`,
+`/usr/local/lib/node_modules/npm`) из итогового docker-образа, собираемого командами
+[docker-build](./commands.md#docker-build) и [docker-build:compiled](./commands.md#docker-buildcompiled).
+Полезно для уменьшения поверхности атаки и исключения неиспользуемых пакетов, которые могут
+ложно срабатывать в security-сканерах. По умолчанию `false`.
+
 #### archiveName
 Имя архива, который будет создан при использовании команды [archive-build](./commands.md#archive-build). По умолчанию `'build.tar'`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arui-scripts",
-  "version": "23.3.0",
+  "version": "23.4.0",
   "main": "./build/index.js",
   "typings": "./build/index.d.ts",
   "exports": {