check-package-lock 1.12.0 → 1.13.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/settings.local.json +9 -0
- package/.github/workflows/ci.yml +4 -3
- package/.github/workflows/scorecard.yml +5 -1
- package/README.md +42 -46
- package/index.js +49 -68
- package/package.json +11 -10
- package/test/index.js +52 -56
package/.github/workflows/ci.yml
CHANGED
|
@@ -7,15 +7,16 @@ concurrency:
|
|
|
7
7
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
8
8
|
cancel-in-progress: true
|
|
9
9
|
|
|
10
|
-
permissions:
|
|
11
|
-
contents: read
|
|
12
|
-
security-events: write
|
|
10
|
+
permissions: {}
|
|
13
11
|
|
|
14
12
|
jobs:
|
|
15
13
|
build:
|
|
16
14
|
name: Build and Test
|
|
17
15
|
runs-on: ubuntu-latest
|
|
18
16
|
environment: Development
|
|
17
|
+
permissions:
|
|
18
|
+
contents: read
|
|
19
|
+
security-events: write # to report vulnerabilities
|
|
19
20
|
|
|
20
21
|
steps:
|
|
21
22
|
- name: Harden Runner
|
|
@@ -10,8 +10,12 @@ on:
|
|
|
10
10
|
push:
|
|
11
11
|
branches: [ "main" ]
|
|
12
12
|
|
|
13
|
+
concurrency:
|
|
14
|
+
group: ${{ github.workflow }}-${{ github.ref }}
|
|
15
|
+
cancel-in-progress: true
|
|
16
|
+
|
|
13
17
|
# Declare default permissions as read only.
|
|
14
|
-
permissions:
|
|
18
|
+
permissions: {}
|
|
15
19
|
|
|
16
20
|
jobs:
|
|
17
21
|
analysis:
|
package/README.md
CHANGED
|
@@ -1,46 +1,42 @@
|
|
|
1
|
-
# check-package-lock
|
|
2
|
-
Checks the package-lock.json file for http:// links
|
|
3
|
-
|
|
4
|
-
## What does it do?
|
|
5
|
-
check-package-lock can check if the package-lock.json file contain insecure http:// links
|
|
6
|
-
|
|
7
|
-
## Usage
|
|
8
|
-
To check the package-lock.json file in the current folder:
|
|
9
|
-
```
|
|
10
|
-
npm install -g check-package-lock
|
|
11
|
-
check-package-lock
|
|
12
|
-
```
|
|
13
|
-
|
|
14
|
-
To check the package-lock.json file in another folder:
|
|
15
|
-
```
|
|
16
|
-
npm install -g check-package-lock
|
|
17
|
-
check-package-lock --folder 'nodefolder'
|
|
18
|
-
```
|
|
19
|
-
|
|
20
|
-
## Exit codes
|
|
21
|
-
```
|
|
22
|
-
0 = No errors
|
|
23
|
-
1 = Errors were founds in the package-lock.json files
|
|
24
|
-
2 = package-lock.json was not found
|
|
25
|
-
3 = Folder specified does not exists
|
|
26
|
-
4 = Folder specified is not a folder
|
|
27
|
-
```
|
|
28
|
-
|
|
29
|
-
## CI - Continuous Integration
|
|
30
|
-
check-package-lock can be used in CI environments to check your package-lock.json file before merging a pull request
|
|
31
|
-
|
|
32
|
-
## Badges
|
|
33
|
-
|
|
34
|
-
[](https://www.codefactor.io/repository/github/gemal/node-check-package-lock)
|
|
45
|
-
|
|
46
|
-
[](https://deepscan.io/dashboard#view=project&tid=14204&pid=17307&bid=392368)
|
|
1
|
+
# check-package-lock
|
|
2
|
+
Checks the package-lock.json file for http:// links
|
|
3
|
+
|
|
4
|
+
## What does it do?
|
|
5
|
+
check-package-lock can check if the package-lock.json file contain insecure http:// links
|
|
6
|
+
|
|
7
|
+
## Usage
|
|
8
|
+
To check the package-lock.json file in the current folder:
|
|
9
|
+
```
|
|
10
|
+
npm install -g check-package-lock
|
|
11
|
+
check-package-lock
|
|
12
|
+
```
|
|
13
|
+
|
|
14
|
+
To check the package-lock.json file in another folder:
|
|
15
|
+
```
|
|
16
|
+
npm install -g check-package-lock
|
|
17
|
+
check-package-lock --folder 'nodefolder'
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
## Exit codes
|
|
21
|
+
```
|
|
22
|
+
0 = No errors
|
|
23
|
+
1 = Errors were founds in the package-lock.json files
|
|
24
|
+
2 = package-lock.json was not found
|
|
25
|
+
3 = Folder specified does not exists
|
|
26
|
+
4 = Folder specified is not a folder
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
## CI - Continuous Integration
|
|
30
|
+
check-package-lock can be used in CI environments to check your package-lock.json file before merging a pull request
|
|
31
|
+
|
|
32
|
+
## Badges
|
|
33
|
+
|
|
34
|
+
[](https://codecov.io/gh/gemal/node-check-package-lock)
|
|
35
|
+
|
|
36
|
+
[](https://github.styleci.io/repos/183420925)
|
|
37
|
+
|
|
38
|
+
[](https://snyk.io/test/github/gemal/node-check-package-lock)
|
|
39
|
+
|
|
40
|
+
[](https://www.codefactor.io/repository/github/gemal/node-check-package-lock)
|
|
41
|
+
|
|
42
|
+
[](https://deepscan.io/dashboard#view=project&tid=14204&pid=17307&bid=392368)
|
package/index.js
CHANGED
|
@@ -1,68 +1,49 @@
|
|
|
1
|
-
#!/usr/bin/env node
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
import
|
|
6
|
-
import
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
const
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
console.log(
|
|
40
|
-
|
|
41
|
-
}
|
|
42
|
-
}
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
.
|
|
49
|
-
|
|
50
|
-
const options = program.opts();
|
|
51
|
-
if (options.folder) {
|
|
52
|
-
if (fs.existsSync(options.folder)) {
|
|
53
|
-
const stats = fs.statSync(options.folder);
|
|
54
|
-
if (stats.isDirectory()) {
|
|
55
|
-
const err = checkFolder();
|
|
56
|
-
process.exitCode = err;
|
|
57
|
-
} else {
|
|
58
|
-
console.log('Oops! Folder is not a real folder: ' + options.folder);
|
|
59
|
-
process.exitCode = 4;
|
|
60
|
-
}
|
|
61
|
-
} else {
|
|
62
|
-
console.log('Oops! Folder does not exist: ' + options.folder);
|
|
63
|
-
process.exitCode = 3;
|
|
64
|
-
}
|
|
65
|
-
} else {
|
|
66
|
-
const err = checkFolder();
|
|
67
|
-
process.exitCode = err;
|
|
68
|
-
}
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
|
|
3
|
+
import fs from 'node:fs';
|
|
4
|
+
import path from 'node:path';
|
|
5
|
+
import { program } from 'commander';
|
|
6
|
+
import { fileURLToPath } from 'node:url';
|
|
7
|
+
|
|
8
|
+
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
9
|
+
|
|
10
|
+
function checkFolder(folder) {
|
|
11
|
+
const packPath = folder ? path.join(folder, 'package-lock.json') : 'package-lock.json';
|
|
12
|
+
if (!fs.existsSync(packPath)) {
|
|
13
|
+
console.log(`${packPath} does not exist`);
|
|
14
|
+
return 2;
|
|
15
|
+
}
|
|
16
|
+
const filecontent = fs.readFileSync(packPath, { encoding: 'utf-8' });
|
|
17
|
+
if (/"http:\/\/registry\.npmjs\.org[/"']/.test(filecontent)) {
|
|
18
|
+
console.log(`${packPath} is NOT OK. It contains references to http://registry.npmjs.org`);
|
|
19
|
+
console.log('In order to fix this do:');
|
|
20
|
+
console.log('- Delete the package-lock.json file');
|
|
21
|
+
console.log('- Delete the node_modules folder');
|
|
22
|
+
console.log('- Run <npm cache clean --force>');
|
|
23
|
+
console.log('- Run <npm install>');
|
|
24
|
+
return 1;
|
|
25
|
+
}
|
|
26
|
+
console.log(`${packPath} is OK`);
|
|
27
|
+
return 0;
|
|
28
|
+
}
|
|
29
|
+
|
|
30
|
+
program
|
|
31
|
+
.version(JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'))).version)
|
|
32
|
+
.description('Checks the package-lock.json file for http:// links')
|
|
33
|
+
.option('-f, --folder <folder>', 'Folder with package-lock.json file')
|
|
34
|
+
.parse(process.argv);
|
|
35
|
+
|
|
36
|
+
const options = program.opts();
|
|
37
|
+
if (options.folder) {
|
|
38
|
+
if (!fs.existsSync(options.folder)) {
|
|
39
|
+
console.log(`Oops! Folder does not exist: ${options.folder}`);
|
|
40
|
+
process.exitCode = 3;
|
|
41
|
+
} else if (!fs.statSync(options.folder).isDirectory()) {
|
|
42
|
+
console.log(`Oops! Folder is not a real folder: ${options.folder}`);
|
|
43
|
+
process.exitCode = 4;
|
|
44
|
+
} else {
|
|
45
|
+
process.exitCode = checkFolder(options.folder);
|
|
46
|
+
}
|
|
47
|
+
} else {
|
|
48
|
+
process.exitCode = checkFolder();
|
|
49
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "check-package-lock",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.13.0",
|
|
4
4
|
"description": "Checks the package-lock.json file for insecure http:// links",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"repository": {
|
|
@@ -8,7 +8,8 @@
|
|
|
8
8
|
"url": "https://github.com/gemal/node-check-package-lock.git"
|
|
9
9
|
},
|
|
10
10
|
"scripts": {
|
|
11
|
-
"test": "mocha"
|
|
11
|
+
"test": "mocha",
|
|
12
|
+
"eslint": "eslint *.js test/*.js"
|
|
12
13
|
},
|
|
13
14
|
"type": "module",
|
|
14
15
|
"author": "Henrik Gemal <henrik@gemal.dk> (https://gemal.dk/)",
|
|
@@ -31,16 +32,16 @@
|
|
|
31
32
|
],
|
|
32
33
|
"homepage": "https://github.com/gemal/node-check-package-lock",
|
|
33
34
|
"dependencies": {
|
|
34
|
-
"commander": "^
|
|
35
|
+
"commander": "^15.0.0"
|
|
35
36
|
},
|
|
36
37
|
"devDependencies": {
|
|
37
|
-
"@eslint/js": "^
|
|
38
|
-
"chai": "^
|
|
38
|
+
"@eslint/js": "^10.0.1",
|
|
39
|
+
"chai": "^6.2.2",
|
|
39
40
|
"child_process": "^1.0.2",
|
|
40
|
-
"eslint": "^
|
|
41
|
-
"expect": "^
|
|
42
|
-
"globals": "^
|
|
43
|
-
"mocha": "^
|
|
44
|
-
"nyc": "^
|
|
41
|
+
"eslint": "^10.5.0",
|
|
42
|
+
"expect": "^30.4.1",
|
|
43
|
+
"globals": "^17.6.0",
|
|
44
|
+
"mocha": "^11.7.6",
|
|
45
|
+
"nyc": "^18.0.0"
|
|
45
46
|
}
|
|
46
47
|
}
|
package/test/index.js
CHANGED
|
@@ -1,56 +1,52 @@
|
|
|
1
|
-
import { expect } from 'chai';
|
|
2
|
-
import path from 'path';
|
|
3
|
-
import { exec } from
|
|
4
|
-
import { fileURLToPath } from 'url';
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
}
|
|
24
|
-
|
|
25
|
-
it('should exit
|
|
26
|
-
runTest(['--folder', 'test/
|
|
27
|
-
});
|
|
28
|
-
|
|
29
|
-
it('should exit 0 having no problems', function(done) {
|
|
30
|
-
runTest(['--folder', 'test/test2'], 0, /package-lock.json is OK/, done);
|
|
31
|
-
});
|
|
32
|
-
|
|
33
|
-
it('should exit 0 having no problems
|
|
34
|
-
runTest([
|
|
35
|
-
});
|
|
36
|
-
|
|
37
|
-
it('should exit
|
|
38
|
-
runTest([],
|
|
39
|
-
});
|
|
40
|
-
|
|
41
|
-
it('should exit
|
|
42
|
-
runTest(['--folder', 'test
|
|
43
|
-
});
|
|
44
|
-
|
|
45
|
-
it('should exit
|
|
46
|
-
runTest(['--folder', '
|
|
47
|
-
});
|
|
48
|
-
|
|
49
|
-
it('should exit
|
|
50
|
-
runTest(['--folder', '
|
|
51
|
-
});
|
|
52
|
-
|
|
53
|
-
it('should exit 4 if folder is not a folder', function(done) {
|
|
54
|
-
runTest(['--folder', 'test/index.js'], 4, /Oops! Folder is not a real folder: test\/index.js\n/, done);
|
|
55
|
-
});
|
|
56
|
-
});
|
|
1
|
+
import { expect } from 'chai';
|
|
2
|
+
import path from 'node:path';
|
|
3
|
+
import { exec } from 'node:child_process';
|
|
4
|
+
import { fileURLToPath } from 'node:url';
|
|
5
|
+
|
|
6
|
+
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
7
|
+
|
|
8
|
+
describe('index.js', function() {
|
|
9
|
+
this.timeout(8000);
|
|
10
|
+
|
|
11
|
+
function runTest(args, expectedExitCode, expectedOutput, done) {
|
|
12
|
+
const command = `node ${path.join(__dirname, '../index.js')} ${args.join(' ')}`;
|
|
13
|
+
exec(command, { cwd: path.join(__dirname, '../') }, (error, stdout) => {
|
|
14
|
+
const exitCode = error ? error.code : 0;
|
|
15
|
+
expect(exitCode).to.equal(expectedExitCode);
|
|
16
|
+
expect(stdout).to.match(expectedOutput);
|
|
17
|
+
done();
|
|
18
|
+
});
|
|
19
|
+
}
|
|
20
|
+
|
|
21
|
+
it('should exit 1 having problems in test1', function(done) {
|
|
22
|
+
runTest(['--folder', 'test/test1'], 1, /package-lock.json is NOT OK/, done);
|
|
23
|
+
});
|
|
24
|
+
|
|
25
|
+
it('should exit 0 having no problems', function(done) {
|
|
26
|
+
runTest(['--folder', 'test/test2'], 0, /package-lock.json is OK/, done);
|
|
27
|
+
});
|
|
28
|
+
|
|
29
|
+
it('should exit 0 having no problems with slash', function(done) {
|
|
30
|
+
runTest(['--folder', 'test/test2/'], 0, /package-lock.json is OK/, done);
|
|
31
|
+
});
|
|
32
|
+
|
|
33
|
+
it('should exit 0 having no problems without folder', function(done) {
|
|
34
|
+
runTest([], 0, /package-lock.json is OK/, done);
|
|
35
|
+
});
|
|
36
|
+
|
|
37
|
+
it('should exit 1 having problems in test3', function(done) {
|
|
38
|
+
runTest(['--folder', 'test/test3'], 1, /package-lock.json is NOT OK/, done);
|
|
39
|
+
});
|
|
40
|
+
|
|
41
|
+
it('should exit 2 having problems with no file', function(done) {
|
|
42
|
+
runTest(['--folder', 'test'], 2, /package-lock.json does not exist/, done);
|
|
43
|
+
});
|
|
44
|
+
|
|
45
|
+
it('should exit 3 if folder does not exist', function(done) {
|
|
46
|
+
runTest(['--folder', '404'], 3, /Oops! Folder does not exist: 404/, done);
|
|
47
|
+
});
|
|
48
|
+
|
|
49
|
+
it('should exit 4 if folder is not a folder', function(done) {
|
|
50
|
+
runTest(['--folder', 'test/index.js'], 4, /Oops! Folder is not a real folder: test\/index.js/, done);
|
|
51
|
+
});
|
|
52
|
+
});
|