eslint-plugin-node-dependencies 1.1.1 → 1.2.0

package/README.md

@@ -158,6 +158,7 @@ The rules with the following star :star: are included in the `plugin:node-depend
 | [node-dependencies/absolute-version](https://ota-meshi.github.io/eslint-plugin-node-dependencies/rules/absolute-version.html) | require or disallow absolute version of dependency. |  |
 | [node-dependencies/no-deprecated](https://ota-meshi.github.io/eslint-plugin-node-dependencies/rules/no-deprecated.html) | disallow having dependencies on deprecate packages. |  |
 | [node-dependencies/no-restricted-deps](https://ota-meshi.github.io/eslint-plugin-node-dependencies/rules/no-restricted-deps.html) | Disallows dependence on the specified package. |  |
+| [node-dependencies/require-provenance-deps](https://ota-meshi.github.io/eslint-plugin-node-dependencies/rules/require-provenance-deps.html) | Require provenance information for dependencies |  |
 
 ### Stylistic Issues
 

package/dist/configs/flat/recommended.d.ts

@@ -1,4 +1,4 @@
-import type { ESLint, Linter } from "eslint";
+import type { ESLint } from "eslint";
 import * as jsonParser from "jsonc-eslint-parser";
 export declare const recommendedConfig: ({
     plugins: {
@@ -12,6 +12,6 @@ export declare const recommendedConfig: ({
     languageOptions: {
         parser: typeof jsonParser;
     };
-    rules: Linter.RulesRecord;
+    rules: import("@eslint/core").RulesConfig;
     plugins?: undefined;
 })[];

package/dist/configs/recommended.d.ts

@@ -3,7 +3,7 @@ declare const _default: {
     overrides: {
         files: string[];
         parser: string;
-        rules: import("eslint").Linter.RulesRecord;
+        rules: import("@eslint/core").RulesConfig;
     }[];
 };
 export = _default;

package/dist/index.d.ts

@@ -8,7 +8,7 @@ declare const _default: {
             overrides: {
                 files: string[];
                 parser: string;
-                rules: import("eslint").Linter.RulesRecord;
+                rules: import("@eslint/core").RulesConfig;
             }[];
         };
         "flat/recommended": ({
@@ -23,7 +23,7 @@ declare const _default: {
             languageOptions: {
                 parser: typeof import("jsonc-eslint-parser");
             };
-            rules: import("eslint").Linter.RulesRecord;
+            rules: import("@eslint/core").RulesConfig;
             plugins?: undefined;
         })[];
     };

package/dist/rules/require-provenance-deps.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("../types").RuleModule;
+export default _default;

package/dist/rules/require-provenance-deps.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("../utils");
+const jsonc_eslint_parser_1 = require("jsonc-eslint-parser");
+const ast_utils_1 = require("../utils/ast-utils");
+const meta_1 = require("../utils/meta");
+exports.default = (0, utils_1.createRule)("require-provenance-deps", {
+    meta: {
+        docs: {
+            description: "Require provenance information for dependencies",
+            category: "Best Practices",
+            recommended: false,
+        },
+        schema: [
+            {
+                type: "object",
+                properties: {
+                    devDependencies: { type: "boolean" },
+                    allows: {
+                        type: "array",
+                        items: { type: "string" },
+                        uniqueItems: true,
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+        messages: {
+            missingProvenance: 'Dependency "{{name}}" has versions without provenance information: {{versions}}.',
+        },
+        type: "suggestion",
+    },
+    create(context) {
+        var _a;
+        const sourceCode = context.getSourceCode();
+        if (!sourceCode.parserServices.isJSON) {
+            return {};
+        }
+        const devDependencies = Boolean((_a = context.options[0]) === null || _a === void 0 ? void 0 : _a.devDependencies);
+        function extractNoProvenanceRanges(meta) {
+            var _a, _b;
+            const noProvenanceRanges = [];
+            let prev = null;
+            for (let index = 0; index < meta.length; index++) {
+                const m = meta[index];
+                if ((_b = (_a = m.dist) === null || _a === void 0 ? void 0 : _a.attestations) === null || _b === void 0 ? void 0 : _b.provenance) {
+                    prev = null;
+                    continue;
+                }
+                if (prev == null) {
+                    prev = [m.version, m.version];
+                    noProvenanceRanges.push(prev);
+                }
+                else {
+                    prev[1] = m.version;
+                }
+            }
+            return noProvenanceRanges;
+        }
+        return (0, utils_1.defineJsonVisitor)({
+            [devDependencies
+                ? "dependencies, peerDependencies, devDependencies"
+                : "dependencies, peerDependencies"](node) {
+                var _a, _b;
+                const name = (0, ast_utils_1.getKeyFromJSONProperty)(node);
+                const ver = (0, jsonc_eslint_parser_1.getStaticJSONValue)(node.value);
+                if (typeof name !== "string" || typeof ver !== "string" || !ver) {
+                    return;
+                }
+                if ((_b = (_a = context.options[0]) === null || _a === void 0 ? void 0 : _a.allows) === null || _b === void 0 ? void 0 : _b.includes(name)) {
+                    return;
+                }
+                const meta = (0, meta_1.getMetaFromNpm)(name, ver).get();
+                if (!meta || !meta.length) {
+                    return;
+                }
+                const noProvenanceRanges = extractNoProvenanceRanges(meta);
+                if (noProvenanceRanges.length === 0) {
+                    return;
+                }
+                context.report({
+                    loc: node.loc,
+                    messageId: "missingProvenance",
+                    data: {
+                        name,
+                        versions: formatList(noProvenanceRanges.map(([from, to]) => from === to ? `${from}` : `${from} - ${to}`)),
+                    },
+                });
+            },
+        });
+        function formatList(items) {
+            return items.length <= 2
+                ? items.join(" and ")
+                : `${items.slice(0, -1).join(", ")}, and ${items[items.length - 1]}`;
+        }
+    },
+});

package/dist/utils/meta.d.ts

@@ -12,6 +12,11 @@ export type NpmPackageMeta = PackageMeta & {
     "dist-tags": {
         [key: string]: string | void;
     } | undefined;
+    dist?: {
+        attestations?: {
+            provenance?: Record<string, unknown>;
+        };
+    };
 };
 export declare function getMetaFromNodeModules(name: string, ver: string, options: {
     context: Rule.RuleContext;

package/dist/utils/meta.js

@@ -48,6 +48,7 @@ const semver_2 = require("semver");
 const npm_package_arg_1 = __importDefault(require("npm-package-arg"));
 const package_json_1 = require("./package-json");
 const TTL = 1000 * 60 * 60;
+const CACHE_VERSION = 2;
 const CACHED_META_ROOT = path_1.default.join(__dirname, `../../.cached_meta`);
 function getMetaFromNodeModules(name, ver, options) {
     try {
@@ -176,7 +177,10 @@ function getMetaFromName(name, cachedFilePath) {
             return null;
         }
         const data = require(cachedFilePath);
-        if (data.meta == null) {
+        if (!data || data.meta == null) {
+            return null;
+        }
+        if (data.v !== CACHE_VERSION) {
             return null;
         }
         const alive = Boolean((typeof data.expired === "number" && data.expired >= Date.now()) ||
@@ -202,6 +206,7 @@ function getMetaFromNameWithoutCache(name, cachedFilePath) {
                 optionalDependencies: vm.optionalDependencies,
                 "dist-tags": allMeta["dist-tags"],
                 deprecated: vm.deprecated,
+                dist: vm.dist,
             };
         });
     }
@@ -210,6 +215,7 @@ function getMetaFromNameWithoutCache(name, cachedFilePath) {
     }
     const timestamp = Date.now();
     const content = {
+        v: CACHE_VERSION,
         meta,
         timestamp,
         expired: timestamp + Math.floor(Math.random() * 1000 * 60),

package/dist/utils/rules.js

@@ -11,6 +11,7 @@ const no_dupe_deps_1 = __importDefault(require("../rules/no-dupe-deps"));
 const no_restricted_deps_1 = __importDefault(require("../rules/no-restricted-deps"));
 const prefer_caret_range_version_1 = __importDefault(require("../rules/prefer-caret-range-version"));
 const prefer_tilde_range_version_1 = __importDefault(require("../rules/prefer-tilde-range-version"));
+const require_provenance_deps_1 = __importDefault(require("../rules/require-provenance-deps"));
 const valid_engines_1 = __importDefault(require("../rules/valid-engines"));
 const valid_semver_1 = __importDefault(require("../rules/valid-semver"));
 exports.rules = [
@@ -21,6 +22,7 @@ exports.rules = [
     no_restricted_deps_1.default,
     prefer_caret_range_version_1.default,
     prefer_tilde_range_version_1.default,
+    require_provenance_deps_1.default,
     valid_engines_1.default,
     valid_semver_1.default,
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-node-dependencies",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "ESLint plugin to check Node.js dependencies.",
   "repository": "git+https://github.com/ota-meshi/eslint-plugin-node-dependencies.git",
   "homepage": "https://github.com/ota-meshi/eslint-plugin-node-dependencies#readme",
@@ -29,9 +29,6 @@
     "dependencies",
     "json"
   ],
-  "scripts": {
-    "preinstall": "npx only-allow npm"
-  },
   "peerDependencies": {
     "eslint": ">=6.0.0"
   },