inup 1.5.5 → 1.6.0

package/dist/features/changelog/services/release-notes-service.js

@@ -38,15 +38,16 @@ const semver = __importStar(require("semver"));
 const github_client_1 = require("../clients/github-client");
 const changelog_parser_1 = require("../parsers/changelog-parser");
 const github_release_html_parser_1 = require("../parsers/github-release-html-parser");
-const constants_1 = require("../../../config/constants");
 const RELEASE_NOTES_FETCH_TIMEOUT_MS = 5000;
 const PREFER_GITHUB_RELEASE_PAGE = true;
 class ReleaseNotesService {
+    metadataService;
+    githubClient;
+    releaseNotesCache = new Map();
+    releaseNotesInFlight = new Map();
     constructor(metadataService, githubClient = new github_client_1.GitHubClient()) {
         this.metadataService = metadataService;
         this.githubClient = githubClient;
-        this.releaseNotesCache = new Map();
-        this.releaseNotesInFlight = new Map();
     }
     clearCache() {
         this.releaseNotesCache.clear();
@@ -87,9 +88,6 @@ class ReleaseNotesService {
                     return notes;
             }
         }
-        const changelogNotes = await this.fetchJsdelivrChangelog(packageName, version, signal);
-        if (changelogNotes)
-            return changelogNotes;
         return null;
     }
     getGitHubSources(repoUrl, version, signal) {
@@ -152,29 +150,6 @@ class ReleaseNotesService {
             return null;
         return (0, changelog_parser_1.extractVersionSection)(fullText, version);
     }
-    async fetchJsdelivrChangelog(packageName, version, signal) {
-        const fullText = await this.fetchPublishedPackageChangelog(packageName, version, signal);
-        if (!fullText)
-            return null;
-        return (0, changelog_parser_1.extractVersionSection)(fullText, version);
-    }
-    async fetchPublishedPackageChangelog(packageName, version, signal) {
-        try {
-            const response = await fetch(`${constants_1.JSDELIVR_CDN_URL}/${encodeURIComponent(packageName)}@${version}/CHANGELOG.md`, {
-                method: 'GET',
-                signal,
-            });
-            if (!response.ok)
-                return null;
-            return await response.text();
-        }
-        catch (error) {
-            if (error instanceof DOMException && error.name === 'AbortError') {
-                throw error;
-            }
-            return null;
-        }
-    }
 }
 exports.ReleaseNotesService = ReleaseNotesService;
 //# sourceMappingURL=release-notes-service.js.map

package/dist/features/debug/services/performance-tracker.js

@@ -2,14 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPerformanceTracker = getPerformanceTracker;
 class PerformanceTracker {
-    constructor() {
-        this.startedAt = null;
-        this.phases = {};
-        this.counts = {};
-        this.batches = [];
-        this.failedPackages = [];
-        this.packageManager = null;
-    }
+    startedAt = null;
+    phases = {};
+    counts = {};
+    batches = [];
+    failedPackages = [];
+    packageManager = null;
     start() {
         this.startedAt = Date.now();
         this.phases = {};

package/dist/features/headless/headless-runner.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HeadlessRunner = void 0;
+const chalk_1 = __importDefault(require("chalk"));
+const package_detector_1 = require("../../core/package-detector");
+const vulnerability_audit_1 = require("./vulnerability-audit");
+const report_1 = require("./report");
+/**
+ * Non-interactive entry point. Resolves the outdated list without rendering the TUI, then either
+ * emits a JSON report (--json) or a plain line-based report. With --check, sets a non-zero exit
+ * code when updates exist so CI can gate on it. Read-only: never writes package.json or installs.
+ *
+ * This is the headless counterpart to the interactive `UpgradeRunner`; it shares only the
+ * `PackageDetector` (the scan/resolve layer), not the UI/upgrade machinery.
+ */
+class HeadlessRunner {
+    detector;
+    constructor(options) {
+        this.detector = new package_detector_1.PackageDetector(options);
+    }
+    async run(options) {
+        try {
+            if (!this.detector.hasPackageJson()) {
+                throw new Error('No package.json found in current directory');
+            }
+            const packages = await this.detector.getOutdatedPackages();
+            const outdated = this.detector.getOutdatedPackagesOnly(packages);
+            // Audit the current versions (one bulk request, best-effort) and cross-reference each
+            // advisory against the upgrade targets, so the report says whether upgrading *fixes* it.
+            const vulnerabilities = await (0, vulnerability_audit_1.auditVulnerabilities)(outdated);
+            if (options.json) {
+                // stdout is reserved for the JSON document only.
+                console.log(JSON.stringify((0, report_1.buildHeadlessReport)(packages, outdated, vulnerabilities), null, 2));
+            }
+            else {
+                console.log((0, report_1.renderPlainReport)(outdated, vulnerabilities));
+            }
+            // Exit 1 only means "updates exist" (like `prettier --check`); 2 is reserved for errors.
+            if (options.check && outdated.length > 0) {
+                process.exitCode = 1;
+            }
+        }
+        catch (error) {
+            console.error(chalk_1.default.red(`Error: ${error instanceof Error ? error.message : String(error)}`));
+            process.exit(2);
+        }
+    }
+}
+exports.HeadlessRunner = HeadlessRunner;
+//# sourceMappingURL=headless-runner.js.map

package/dist/features/headless/index.js

@@ -0,0 +1,27 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderPlainReport = exports.buildHeadlessReport = exports.upgradeClears = exports.auditVulnerabilities = exports.HeadlessRunner = void 0;
+__exportStar(require("./types"), exports);
+var headless_runner_1 = require("./headless-runner");
+Object.defineProperty(exports, "HeadlessRunner", { enumerable: true, get: function () { return headless_runner_1.HeadlessRunner; } });
+var vulnerability_audit_1 = require("./vulnerability-audit");
+Object.defineProperty(exports, "auditVulnerabilities", { enumerable: true, get: function () { return vulnerability_audit_1.auditVulnerabilities; } });
+Object.defineProperty(exports, "upgradeClears", { enumerable: true, get: function () { return vulnerability_audit_1.upgradeClears; } });
+var report_1 = require("./report");
+Object.defineProperty(exports, "buildHeadlessReport", { enumerable: true, get: function () { return report_1.buildHeadlessReport; } });
+Object.defineProperty(exports, "renderPlainReport", { enumerable: true, get: function () { return report_1.renderPlainReport; } });
+//# sourceMappingURL=index.js.map

package/dist/features/headless/report.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHeadlessReport = buildHeadlessReport;
+exports.renderPlainReport = renderPlainReport;
+const types_1 = require("./types");
+/** Build the machine-readable `--json` payload from the scanned + outdated package sets. */
+function buildHeadlessReport(all, outdated, vulnerabilities) {
+    return {
+        schemaVersion: types_1.HEADLESS_SCHEMA_VERSION,
+        summary: {
+            total: all.length,
+            outdated: outdated.length,
+            major: outdated.filter((pkg) => pkg.hasMajorUpdate).length,
+            vulnerable: vulnerabilities.size,
+        },
+        outdated: outdated.map((pkg) => {
+            const entry = {
+                name: pkg.name,
+                current: pkg.currentVersion,
+                range: pkg.rangeVersion,
+                latest: pkg.latestVersion,
+                type: pkg.type,
+                packageJsonPath: pkg.packageJsonPath,
+                hasMajorUpdate: pkg.hasMajorUpdate,
+            };
+            if (pkg.deprecated)
+                entry.deprecated = pkg.deprecated;
+            if (pkg.enginesNode)
+                entry.enginesNode = pkg.enginesNode;
+            const vulnerability = vulnerabilities.get(pkg);
+            if (vulnerability)
+                entry.vulnerability = vulnerability;
+            return entry;
+        }),
+    };
+}
+/** Render the plain, line-based report (one line per package + a recap) as a single string. */
+function renderPlainReport(outdated, vulnerabilities) {
+    if (outdated.length === 0) {
+        return 'All dependencies are up to date — no upgrades needed.';
+    }
+    const lines = outdated.map((pkg) => {
+        const major = pkg.hasMajorUpdate ? ' (major)' : '';
+        const deprecated = pkg.deprecated ? '  [deprecated]' : '';
+        return `${pkg.name}  ${pkg.currentVersion} → ${pkg.latestVersion}  [${pkg.type}]${major}${vulnMarker(vulnerabilities.get(pkg))}${deprecated}`;
+    });
+    const fileCount = new Set(outdated.map((pkg) => pkg.packageJsonPath)).size;
+    const vulnNote = vulnerabilities.size > 0 ? ` — ${vulnerabilities.size} with known vulnerabilities` : '';
+    lines.push('', `${outdated.length} package(s) outdated across ${fileCount} file(s)${vulnNote}.`);
+    return lines.join('\n');
+}
+/** A compact `[vuln: N sev → verdict]` tag for the plain report; '' when there are none. */
+function vulnMarker(vulnerability) {
+    if (!vulnerability)
+        return '';
+    // Prefer the cheaper fix: if the in-range bump already clears it, that's the safer action.
+    const verdict = vulnerability.fixedByRange
+        ? 'fixed by range upgrade'
+        : vulnerability.fixedByLatest
+            ? 'fixed by latest only'
+            : 'not fixed by upgrade';
+    return `  [vuln: ${vulnerability.count} ${vulnerability.highestSeverity} → ${verdict}]`;
+}
+//# sourceMappingURL=report.js.map

package/dist/features/headless/types.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEADLESS_SCHEMA_VERSION = void 0;
+/** Bump when the `--json` shape changes in a way consumers (scripts, agents) must adapt to. */
+exports.HEADLESS_SCHEMA_VERSION = 1;
+//# sourceMappingURL=types.js.map

package/dist/features/headless/vulnerability-audit.js

@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditVulnerabilities = auditVulnerabilities;
+exports.upgradeClears = upgradeClears;
+const semver = __importStar(require("semver"));
+const services_1 = require("../../services");
+const utils_1 = require("../../utils");
+/**
+ * Audit the outdated packages' currently-installed versions (one bulk request, matching the
+ * interactive audit) and, for each advisory, cross-reference its affected range against the
+ * upgrade targets — so callers can state whether upgrading actually *fixes* the issue.
+ *
+ * Best-effort: `fetchVulnerabilities` swallows network errors and returns an empty map, so a
+ * failed audit never blocks the report. Returns only the vulnerable packages, keyed by package.
+ */
+async function auditVulnerabilities(outdated) {
+    const result = new Map();
+    if (outdated.length === 0)
+        return result;
+    // The bulk advisory API is keyed by package name (one version per name), so dedupe by name.
+    const versions = new Map();
+    for (const pkg of outdated) {
+        if (!versions.has(pkg.name))
+            versions.set(pkg.name, pkg.currentVersion);
+    }
+    const advisories = await (0, services_1.fetchVulnerabilities)(versions);
+    if (advisories.size === 0)
+        return result;
+    for (const pkg of outdated) {
+        const found = advisories.get(pkg.name);
+        if (!found || found.vulnerabilities.length === 0 || !found.highestSeverity)
+            continue;
+        result.set(pkg, summarizeVulnerability(pkg, found.vulnerabilities, found.highestSeverity));
+    }
+    return result;
+}
+function summarizeVulnerability(pkg, vulnerabilities, highestSeverity) {
+    const advisories = vulnerabilities.map((vuln) => ({
+        id: vuln.id,
+        title: vuln.title,
+        severity: vuln.severity,
+        url: vuln.url,
+        vulnerableVersions: vuln.vulnerable_versions,
+        fixedByRange: upgradeClears(pkg.rangeVersion, vuln.vulnerable_versions),
+        fixedByLatest: upgradeClears(pkg.latestVersion, vuln.vulnerable_versions),
+    }));
+    return {
+        count: advisories.length,
+        highestSeverity,
+        fixedByRange: advisories.every((advisory) => advisory.fixedByRange),
+        fixedByLatest: advisories.every((advisory) => advisory.fixedByLatest),
+        advisories,
+    };
+}
+/**
+ * True when upgrading to `target` escapes an advisory's affected range. Conservative: if either
+ * the target or the advisory range can't be parsed, we do NOT claim a fix — `semver.satisfies`
+ * treats an invalid range as "matches nothing", which would otherwise read as a false "fixed".
+ */
+function upgradeClears(target, vulnerableVersions) {
+    const comparable = (0, utils_1.toComparableVersion)(target);
+    if (!comparable)
+        return false;
+    if (semver.validRange(vulnerableVersions) === null)
+        return false;
+    try {
+        return !semver.satisfies(comparable, vulnerableVersions, { includePrerelease: true });
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=vulnerability-audit.js.map

package/dist/index.js

@@ -3,8 +3,7 @@
  * Public API for inup
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PnpmUpgradeInteractive = exports.UpgradeRunner = void 0;
+exports.UpgradeRunner = void 0;
 var core_1 = require("./core");
 Object.defineProperty(exports, "UpgradeRunner", { enumerable: true, get: function () { return core_1.UpgradeRunner; } });
-Object.defineProperty(exports, "PnpmUpgradeInteractive", { enumerable: true, get: function () { return core_1.PnpmUpgradeInteractive; } });
 //# sourceMappingURL=index.js.map