eslint-plugin-node-dependencies 1.1.2 → 1.3.0

package/README.md

@@ -158,6 +158,7 @@ The rules with the following star :star: are included in the `plugin:node-depend
 | [node-dependencies/absolute-version](https://ota-meshi.github.io/eslint-plugin-node-dependencies/rules/absolute-version.html) | require or disallow absolute version of dependency. |  |
 | [node-dependencies/no-deprecated](https://ota-meshi.github.io/eslint-plugin-node-dependencies/rules/no-deprecated.html) | disallow having dependencies on deprecate packages. |  |
 | [node-dependencies/no-restricted-deps](https://ota-meshi.github.io/eslint-plugin-node-dependencies/rules/no-restricted-deps.html) | Disallows dependence on the specified package. |  |
+| [node-dependencies/require-provenance-deps](https://ota-meshi.github.io/eslint-plugin-node-dependencies/rules/require-provenance-deps.html) | Require provenance information for dependencies |  |
 
 ### Stylistic Issues
 

package/dist/configs/flat/recommended.d.ts

@@ -1,4 +1,4 @@
-import type { ESLint, Linter } from "eslint";
+import type { ESLint } from "eslint";
 import * as jsonParser from "jsonc-eslint-parser";
 export declare const recommendedConfig: ({
     plugins: {
@@ -12,6 +12,6 @@ export declare const recommendedConfig: ({
     languageOptions: {
         parser: typeof jsonParser;
     };
-    rules: Linter.RulesRecord;
+    rules: import("@eslint/core").RulesConfig;
     plugins?: undefined;
 })[];

package/dist/configs/recommended.d.ts

@@ -3,7 +3,7 @@ declare const _default: {
     overrides: {
         files: string[];
         parser: string;
-        rules: import("eslint").Linter.RulesRecord;
+        rules: import("@eslint/core").RulesConfig;
     }[];
 };
 export = _default;

package/dist/index.d.ts

@@ -8,7 +8,7 @@ declare const _default: {
             overrides: {
                 files: string[];
                 parser: string;
-                rules: import("eslint").Linter.RulesRecord;
+                rules: import("@eslint/core").RulesConfig;
             }[];
         };
         "flat/recommended": ({
@@ -23,7 +23,7 @@ declare const _default: {
             languageOptions: {
                 parser: typeof import("jsonc-eslint-parser");
             };
-            rules: import("eslint").Linter.RulesRecord;
+            rules: import("@eslint/core").RulesConfig;
             plugins?: undefined;
         })[];
     };

package/dist/rules/absolute-version.js

@@ -5,6 +5,7 @@ const utils_1 = require("../utils");
 const ast_utils_1 = require("../utils/ast-utils");
 const regexp_1 = require("../utils/regexp");
 const semver_1 = require("../utils/semver");
+const eslint_compat_utils_1 = require("eslint-compat-utils");
 const PREFERS = ["always", "never", "ignore"];
 const SCHEMA_FOR_DEPS_PROPERTIES = {
     dependencies: { enum: PREFERS },
@@ -100,7 +101,7 @@ exports.default = (0, utils_1.createRule)("absolute-version", {
         type: "suggestion",
     },
     create(context) {
-        const sourceCode = context.getSourceCode();
+        const sourceCode = (0, eslint_compat_utils_1.getSourceCode)(context);
         if (!sourceCode.parserServices.isJSON) {
             return {};
         }

package/dist/rules/compat-engines.js

@@ -9,6 +9,7 @@ const semver_1 = __importDefault(require("semver"));
 const ast_utils_1 = require("../utils/ast-utils");
 const semver_2 = require("../utils/semver");
 const meta_1 = require("../utils/meta");
+const eslint_compat_utils_1 = require("eslint-compat-utils");
 class EnginesContext {
     constructor(engineNames, validDependencies = new Set()) {
         this.unprocessedEngines = new Set();
@@ -141,7 +142,7 @@ exports.default = (0, utils_1.createRule)("compat-engines", {
     },
     create(context) {
         var _a, _b, _c;
-        const sourceCode = context.getSourceCode();
+        const sourceCode = (0, eslint_compat_utils_1.getSourceCode)(context);
         if (!sourceCode.parserServices.isJSON) {
             return {};
         }

package/dist/rules/no-deprecated.js

@@ -4,6 +4,7 @@ const jsonc_eslint_parser_1 = require("jsonc-eslint-parser");
 const utils_1 = require("../utils");
 const ast_utils_1 = require("../utils/ast-utils");
 const meta_1 = require("../utils/meta");
+const eslint_compat_utils_1 = require("eslint-compat-utils");
 exports.default = (0, utils_1.createRule)("no-deprecated", {
     meta: {
         docs: {
@@ -30,7 +31,7 @@ exports.default = (0, utils_1.createRule)("no-deprecated", {
     },
     create(context) {
         var _a;
-        const sourceCode = context.getSourceCode();
+        const sourceCode = (0, eslint_compat_utils_1.getSourceCode)(context);
         if (!sourceCode.parserServices.isJSON) {
             return {};
         }

package/dist/rules/no-dupe-deps.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const utils_1 = require("../utils");
 const ast_utils_1 = require("../utils/ast-utils");
+const eslint_compat_utils_1 = require("eslint-compat-utils");
 const DEPS = [
     "dependencies",
     "peerDependencies",
@@ -33,7 +34,7 @@ exports.default = (0, utils_1.createRule)("no-dupe-deps", {
         type: "problem",
     },
     create(context) {
-        const sourceCode = context.getSourceCode();
+        const sourceCode = (0, eslint_compat_utils_1.getSourceCode)(context);
         if (!sourceCode.parserServices.isJSON) {
             return {};
         }

package/dist/rules/no-restricted-deps.js

@@ -7,6 +7,7 @@ const semver_2 = require("../utils/semver");
 const ast_utils_1 = require("../utils/ast-utils");
 const jsonc_eslint_parser_1 = require("jsonc-eslint-parser");
 const meta_1 = require("../utils/meta");
+const eslint_compat_utils_1 = require("eslint-compat-utils");
 const DEPS = [
     "dependencies",
     "peerDependencies",
@@ -173,7 +174,7 @@ exports.default = (0, utils_1.createRule)("no-restricted-deps", {
         type: "suggestion",
     },
     create(context) {
-        const sourceCode = context.getSourceCode();
+        const sourceCode = (0, eslint_compat_utils_1.getSourceCode)(context);
         if (!sourceCode.parserServices.isJSON) {
             return {};
         }

package/dist/rules/prefer-caret-range-version.js

@@ -4,6 +4,7 @@ const semver_1 = require("semver");
 const utils_1 = require("../utils");
 const semver_2 = require("../utils/semver");
 const semver_range_1 = require("../utils/semver-range");
+const eslint_compat_utils_1 = require("eslint-compat-utils");
 exports.default = (0, utils_1.createRule)("prefer-caret-range-version", {
     meta: {
         docs: {
@@ -17,7 +18,7 @@ exports.default = (0, utils_1.createRule)("prefer-caret-range-version", {
         type: "suggestion",
     },
     create(context) {
-        const sourceCode = context.getSourceCode();
+        const sourceCode = (0, eslint_compat_utils_1.getSourceCode)(context);
         if (!sourceCode.parserServices.isJSON) {
             return {};
         }

package/dist/rules/prefer-tilde-range-version.js

@@ -4,6 +4,7 @@ const semver_1 = require("semver");
 const utils_1 = require("../utils");
 const semver_2 = require("../utils/semver");
 const semver_range_1 = require("../utils/semver-range");
+const eslint_compat_utils_1 = require("eslint-compat-utils");
 exports.default = (0, utils_1.createRule)("prefer-tilde-range-version", {
     meta: {
         docs: {
@@ -17,7 +18,7 @@ exports.default = (0, utils_1.createRule)("prefer-tilde-range-version", {
         type: "suggestion",
     },
     create(context) {
-        const sourceCode = context.getSourceCode();
+        const sourceCode = (0, eslint_compat_utils_1.getSourceCode)(context);
         if (!sourceCode.parserServices.isJSON) {
             return {};
         }

package/dist/rules/require-provenance-deps.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("../types").RuleModule;
+export default _default;

package/dist/rules/require-provenance-deps.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("../utils");
+const jsonc_eslint_parser_1 = require("jsonc-eslint-parser");
+const ast_utils_1 = require("../utils/ast-utils");
+const meta_1 = require("../utils/meta");
+const eslint_compat_utils_1 = require("eslint-compat-utils");
+exports.default = (0, utils_1.createRule)("require-provenance-deps", {
+    meta: {
+        docs: {
+            description: "Require provenance information for dependencies",
+            category: "Best Practices",
+            recommended: false,
+        },
+        schema: [
+            {
+                type: "object",
+                properties: {
+                    devDependencies: { type: "boolean" },
+                    allows: {
+                        type: "array",
+                        items: { type: "string" },
+                        uniqueItems: true,
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+        messages: {
+            missingProvenance: 'Dependency "{{name}}" has versions without provenance information: {{versions}}.',
+        },
+        type: "suggestion",
+    },
+    create(context) {
+        var _a;
+        const sourceCode = (0, eslint_compat_utils_1.getSourceCode)(context);
+        if (!sourceCode.parserServices.isJSON) {
+            return {};
+        }
+        const devDependencies = Boolean((_a = context.options[0]) === null || _a === void 0 ? void 0 : _a.devDependencies);
+        function extractNoProvenanceRanges(meta) {
+            var _a, _b;
+            const noProvenanceRanges = [];
+            let prev = null;
+            for (let index = 0; index < meta.length; index++) {
+                const m = meta[index];
+                if ((_b = (_a = m.dist) === null || _a === void 0 ? void 0 : _a.attestations) === null || _b === void 0 ? void 0 : _b.provenance) {
+                    prev = null;
+                    continue;
+                }
+                if (prev == null) {
+                    prev = [m.version, m.version];
+                    noProvenanceRanges.push(prev);
+                }
+                else {
+                    prev[1] = m.version;
+                }
+            }
+            return noProvenanceRanges;
+        }
+        return (0, utils_1.defineJsonVisitor)({
+            [devDependencies
+                ? "dependencies, peerDependencies, devDependencies"
+                : "dependencies, peerDependencies"](node) {
+                var _a, _b;
+                const name = (0, ast_utils_1.getKeyFromJSONProperty)(node);
+                const ver = (0, jsonc_eslint_parser_1.getStaticJSONValue)(node.value);
+                if (typeof name !== "string" || typeof ver !== "string" || !ver) {
+                    return;
+                }
+                if ((_b = (_a = context.options[0]) === null || _a === void 0 ? void 0 : _a.allows) === null || _b === void 0 ? void 0 : _b.includes(name)) {
+                    return;
+                }
+                const meta = (0, meta_1.getMetaFromNpm)(name, ver).get();
+                if (!meta || !meta.length) {
+                    return;
+                }
+                const noProvenanceRanges = extractNoProvenanceRanges(meta);
+                if (noProvenanceRanges.length === 0) {
+                    return;
+                }
+                context.report({
+                    loc: node.loc,
+                    messageId: "missingProvenance",
+                    data: {
+                        name,
+                        versions: formatList(noProvenanceRanges.map(([from, to]) => from === to ? `${from}` : `${from} - ${to}`)),
+                    },
+                });
+            },
+        });
+        function formatList(items) {
+            return items.length <= 2
+                ? items.join(" and ")
+                : `${items.slice(0, -1).join(", ")}, and ${items[items.length - 1]}`;
+        }
+    },
+});

package/dist/rules/valid-semver.js

@@ -4,6 +4,7 @@ const jsonc_eslint_parser_1 = require("jsonc-eslint-parser");
 const utils_1 = require("../utils");
 const ast_utils_1 = require("../utils/ast-utils");
 const semver_1 = require("../utils/semver");
+const eslint_compat_utils_1 = require("eslint-compat-utils");
 exports.default = (0, utils_1.createRule)("valid-semver", {
     meta: {
         docs: {
@@ -16,7 +17,7 @@ exports.default = (0, utils_1.createRule)("valid-semver", {
         type: "problem",
     },
     create(context) {
-        const sourceCode = context.getSourceCode();
+        const sourceCode = (0, eslint_compat_utils_1.getSourceCode)(context);
         if (!sourceCode.parserServices.isJSON) {
             return {};
         }

package/dist/utils/meta.d.ts

@@ -12,6 +12,11 @@ export type NpmPackageMeta = PackageMeta & {
     "dist-tags": {
         [key: string]: string | void;
     } | undefined;
+    dist?: {
+        attestations?: {
+            provenance?: Record<string, unknown>;
+        };
+    };
 };
 export declare function getMetaFromNodeModules(name: string, ver: string, options: {
     context: Rule.RuleContext;

package/dist/utils/meta.js

@@ -47,14 +47,16 @@ const semver_1 = require("./semver");
 const semver_2 = require("semver");
 const npm_package_arg_1 = __importDefault(require("npm-package-arg"));
 const package_json_1 = require("./package-json");
+const eslint_compat_utils_1 = require("eslint-compat-utils");
 const TTL = 1000 * 60 * 60;
+const CACHE_VERSION = 2;
 const CACHED_META_ROOT = path_1.default.join(__dirname, `../../.cached_meta`);
 function getMetaFromNodeModules(name, ver, options) {
     try {
-        const ownerJsonPath = options.ownerPackageJsonPath || options.context.getFilename();
+        const ownerJsonPath = options.ownerPackageJsonPath || (0, eslint_compat_utils_1.getFilename)(options.context);
         const relativeTo = path_1.default.join(ownerJsonPath && path_1.default.isAbsolute(ownerJsonPath)
             ? (0, path_1.dirname)(ownerJsonPath)
-            : getCwd(options.context), "__placeholder__.js");
+            : (0, eslint_compat_utils_1.getCwd)(options.context), "__placeholder__.js");
         const req = module_1.default.createRequire(relativeTo);
         const where = req.resolve(`${name}/package.json`);
         const pkg = req(where);
@@ -176,7 +178,10 @@ function getMetaFromName(name, cachedFilePath) {
             return null;
         }
         const data = require(cachedFilePath);
-        if (data.meta == null) {
+        if (!data || data.meta == null) {
+            return null;
+        }
+        if (data.v !== CACHE_VERSION) {
             return null;
         }
         const alive = Boolean((typeof data.expired === "number" && data.expired >= Date.now()) ||
@@ -202,6 +207,7 @@ function getMetaFromNameWithoutCache(name, cachedFilePath) {
                 optionalDependencies: vm.optionalDependencies,
                 "dist-tags": allMeta["dist-tags"],
                 deprecated: vm.deprecated,
+                dist: vm.dist,
             };
         });
     }
@@ -210,6 +216,7 @@ function getMetaFromNameWithoutCache(name, cachedFilePath) {
     }
     const timestamp = Date.now();
     const content = {
+        v: CACHE_VERSION,
         meta,
         timestamp,
         expired: timestamp + Math.floor(Math.random() * 1000 * 60),
@@ -260,9 +267,3 @@ function makeDirs(dir) {
         fs_1.default.mkdirSync(d);
     }
 }
-function getCwd(context) {
-    if (context.getCwd) {
-        return context.getCwd();
-    }
-    return path_1.default.resolve("");
-}

package/dist/utils/rules.js

@@ -11,6 +11,7 @@ const no_dupe_deps_1 = __importDefault(require("../rules/no-dupe-deps"));
 const no_restricted_deps_1 = __importDefault(require("../rules/no-restricted-deps"));
 const prefer_caret_range_version_1 = __importDefault(require("../rules/prefer-caret-range-version"));
 const prefer_tilde_range_version_1 = __importDefault(require("../rules/prefer-tilde-range-version"));
+const require_provenance_deps_1 = __importDefault(require("../rules/require-provenance-deps"));
 const valid_engines_1 = __importDefault(require("../rules/valid-engines"));
 const valid_semver_1 = __importDefault(require("../rules/valid-semver"));
 exports.rules = [
@@ -21,6 +22,7 @@ exports.rules = [
     no_restricted_deps_1.default,
     prefer_caret_range_version_1.default,
     prefer_tilde_range_version_1.default,
+    require_provenance_deps_1.default,
     valid_engines_1.default,
     valid_semver_1.default,
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-node-dependencies",
-  "version": "1.1.2",
+  "version": "1.3.0",
   "description": "ESLint plugin to check Node.js dependencies.",
   "repository": "git+https://github.com/ota-meshi/eslint-plugin-node-dependencies.git",
   "homepage": "https://github.com/ota-meshi/eslint-plugin-node-dependencies#readme",
@@ -33,6 +33,7 @@
     "eslint": ">=6.0.0"
   },
   "dependencies": {
+    "eslint-compat-utils": "^0.6.5",
     "jsonc-eslint-parser": "^2.0.2",
     "npm-package-arg": "^12.0.2",
     "package-json": "^10.0.1",