ng-checkup 0.12.0 → 1.0.0

package/dist/vulnerabilities.d.ts

@@ -0,0 +1,54 @@
+import type { WorkspaceInfo } from './workspace.js';
+/** One published advisory affecting a package version. */
+export interface KnownVulnerability {
+    /** The OSV id, a GitHub advisory id such as `GHSA-m2h2-264f-f486` for npm. */
+    id: string;
+    /** The CVE ids among its aliases, which is what most readers search for. */
+    cves: string[];
+    summary: string;
+    /** As the advisory database rates it; undefined when unrated. */
+    severity?: 'low' | 'moderate' | 'high' | 'critical';
+    /**
+     * The lowest fixed version above the installed one, when the advisory
+     * names one; an advisory fixed on several release lines (3.4.1 and 4.3.1)
+     * gives the nearest. AngularJS advisories name none.
+     */
+    fixedIn?: string;
+}
+/** The advisories of one dependency at its exact version. */
+export interface PackageVulnerabilities {
+    name: string;
+    version: string;
+    /** Only in `devDependencies`: tooling, not shipped to users. */
+    dev: boolean;
+    vulnerabilities: KnownVulnerability[];
+}
+/** The outcome of `lookUpVulnerabilities`, as `AnalysisContext.vulnerabilities`. */
+export interface VulnerabilityScan {
+    /** Dependencies whose exact version was checked. */
+    checked: number;
+    /** Only those with at least one advisory. */
+    packages: PackageVulnerabilities[];
+}
+/**
+ * Looks up the known vulnerabilities of the direct dependencies at their
+ * exact versions (installed or locked) in the OSV database (osv.dev), which
+ * carries the GitHub advisories for npm. AngularJS loaded from Bower, a CDN
+ * or a checked-in copy is looked up as the npm package `angular` too.
+ *
+ * Direct dependencies only: the full tree is `npm audit`'s job, and the
+ * direct ones are those the codebase chose and can upgrade. What leaves the
+ * machine is package names and versions, nothing else.
+ *
+ * @returns Undefined offline, or when OSV cannot be reached in time: a slow
+ *   network must not fail a run, and the report then says "not checked".
+ */
+export declare function lookUpVulnerabilities(workspace: WorkspaceInfo, options: {
+    offline: boolean;
+    angularJsVersion?: string;
+    fetch?: typeof fetch;
+}): Promise<VulnerabilityScan | undefined>;
+/** Orders two versions numerically (`3.10.0` after `3.9.1`). Good enough for npm release numbers. */
+export declare function compareVersions(left: string, right: string): number;
+/** 4 for critical down to 0 for unrated: how a package sorts. */
+export declare function severityRank(severity: KnownVulnerability['severity']): number;

package/dist/vulnerabilities.js

@@ -0,0 +1,116 @@
+import { join } from 'node:path';
+import { asRecord, readJson } from './workspace.js';
+/** The OSV endpoints; tests pass their own `fetch`. */
+const OSV = 'https://api.osv.dev/v1';
+/** Advisory details fetched at most, so a very old app cannot turn one run into hundreds of requests. */
+const MAX_DETAILS = 150;
+/**
+ * Looks up the known vulnerabilities of the direct dependencies at their
+ * exact versions (installed or locked) in the OSV database (osv.dev), which
+ * carries the GitHub advisories for npm. AngularJS loaded from Bower, a CDN
+ * or a checked-in copy is looked up as the npm package `angular` too.
+ *
+ * Direct dependencies only: the full tree is `npm audit`'s job, and the
+ * direct ones are those the codebase chose and can upgrade. What leaves the
+ * machine is package names and versions, nothing else.
+ *
+ * @returns Undefined offline, or when OSV cannot be reached in time: a slow
+ *   network must not fail a run, and the report then says "not checked".
+ */
+export async function lookUpVulnerabilities(workspace, options) {
+    if (options.offline)
+        return undefined;
+    const get = options.fetch ?? fetch;
+    const packageJson = readJson(join(workspace.root, 'package.json'));
+    const runtime = new Set(Object.keys(asRecord(packageJson?.['dependencies'])));
+    const targets = Object.keys(workspace.dependencies)
+        .map((name) => ({ name, version: workspace.versions[name], dev: !runtime.has(name) }))
+        .filter((entry) => typeof entry.version === 'string' && /^\d+\.\d+\.\d+/.test(entry.version));
+    if (options.angularJsVersion && /^\d+\.\d+\.\d+$/.test(options.angularJsVersion) && !targets.some((entry) => entry.name === 'angular')) {
+        targets.push({ name: 'angular', version: options.angularJsVersion, dev: false });
+    }
+    if (targets.length === 0)
+        return { checked: 0, packages: [] };
+    try {
+        const batch = await get(`${OSV}/querybatch`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ queries: targets.map((entry) => ({ package: { name: entry.name, ecosystem: 'npm' }, version: entry.version })) }),
+            signal: AbortSignal.timeout(8000),
+        });
+        if (!batch.ok)
+            return undefined;
+        const results = asRecord(await batch.json())['results'];
+        if (!Array.isArray(results))
+            return undefined;
+        const idsPerTarget = targets.map((_, index) => {
+            const vulns = asRecord(results[index])['vulns'];
+            return Array.isArray(vulns) ? vulns.map((vuln) => asRecord(vuln)['id']).filter((id) => typeof id === 'string') : [];
+        });
+        const ids = [...new Set(idsPerTarget.flat())].slice(0, MAX_DETAILS);
+        const details = new Map();
+        // A few at a time: OSV is fast, but a hundred parallel requests from one CLI run is rude.
+        for (let start = 0; start < ids.length; start += 8) {
+            const slice = ids.slice(start, start + 8);
+            const fetched = await Promise.all(slice.map(async (id) => {
+                try {
+                    const response = await get(`${OSV}/vulns/${encodeURIComponent(id)}`, { signal: AbortSignal.timeout(8000) });
+                    return response.ok ? [id, asRecord(await response.json())] : undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            }));
+            for (const entry of fetched)
+                if (entry)
+                    details.set(entry[0], entry[1]);
+        }
+        const packages = targets
+            .map((target, index) => ({ ...target, vulnerabilities: idsPerTarget[index].map((id) => toVulnerability(id, target.name, target.version, details.get(id))) }))
+            .filter((entry) => entry.vulnerabilities.length > 0)
+            .sort((left, right) => Number(left.dev) - Number(right.dev) || worst(right.vulnerabilities) - worst(left.vulnerabilities) || left.name.localeCompare(right.name));
+        return { checked: targets.length, packages };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** One advisory in the report's shape; what the details lack stays undefined. */
+function toVulnerability(id, packageName, installed, detail) {
+    const aliases = Array.isArray(detail?.['aliases']) ? detail['aliases'].filter((alias) => typeof alias === 'string') : [];
+    const rating = String(asRecord(detail?.['database_specific'])['severity'] ?? '').toLowerCase();
+    const severity = rating === 'low' || rating === 'moderate' || rating === 'high' || rating === 'critical' ? rating : undefined;
+    const fixes = [];
+    for (const affected of Array.isArray(detail?.['affected']) ? detail['affected'] : []) {
+        if (asRecord(asRecord(affected)['package'])['name'] !== packageName)
+            continue;
+        for (const range of Array.isArray(asRecord(affected)['ranges']) ? asRecord(affected)['ranges'] : []) {
+            for (const event of Array.isArray(asRecord(range)['events']) ? asRecord(range)['events'] : []) {
+                const fixed = asRecord(event)['fixed'];
+                if (typeof fixed === 'string' && compareVersions(fixed, installed) > 0)
+                    fixes.push(fixed);
+            }
+        }
+    }
+    const fixedIn = fixes.sort(compareVersions)[0];
+    return {
+        id,
+        cves: aliases.filter((alias) => alias.startsWith('CVE-')),
+        summary: typeof detail?.['summary'] === 'string' ? detail['summary'] : id,
+        ...(severity ? { severity } : {}),
+        ...(fixedIn ? { fixedIn } : {}),
+    };
+}
+/** Orders two versions numerically (`3.10.0` after `3.9.1`). Good enough for npm release numbers. */
+export function compareVersions(left, right) {
+    return left.localeCompare(right, undefined, { numeric: true });
+}
+/** 4 for critical down to 0 for unrated: how a package sorts. */
+export function severityRank(severity) {
+    return severity === 'critical' ? 4 : severity === 'high' ? 3 : severity === 'moderate' ? 2 : severity === 'low' ? 1 : 0;
+}
+/** The worst rank among some advisories. */
+function worst(vulnerabilities) {
+    return Math.max(0, ...vulnerabilities.map((vulnerability) => severityRank(vulnerability.severity)));
+}
+//# sourceMappingURL=vulnerabilities.js.map

package/dist/vulnerabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerabilities.js","sourceRoot":"","sources":["../src/vulnerabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAoCpD,uDAAuD;AACvD,MAAM,GAAG,GAAG,wBAAwB,CAAC;AAErC,yGAAyG;AACzG,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAwB,EACxB,OAA8E;IAE9E,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACnC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;SAChD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACrF,MAAM,CAAC,CAAC,KAAK,EAA4D,EAAE,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1J,IAAI,OAAO,CAAC,gBAAgB,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACvI,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,GAAG,aAAa,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YACxI,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpI,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmC,CAAC;QAC3D,0FAA0F;QAC1F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACrB,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,GAAG,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC5G,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAW,CAAC,CAAC,CAAC,SAAS,CAAC;gBACpF,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CACH,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,OAAO;gBAAE,IAAI,KAAK;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO;aACrB,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC7J,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;aACnD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACpK,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,EAAU,EAAE,WAAmB,EAAE,SAAiB,EAAE,MAA2C;IACtH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,SAAS,CAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzJ,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/F,MAAM,QAAQ,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9H,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,UAAU,CAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACpG,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,WAAW;YAAE,SAAS;QAC9E,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACnH,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC7G,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;gBACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO;QACL,EAAE;QACF,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;QACzE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,QAAwC;IACnE,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,4CAA4C;AAC5C,SAAS,KAAK,CAAC,eAAqC;IAClD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ng-checkup",
-  "version": "0.12.0",
+  "version": "1.0.0",
   "description": "A one-minute modernization report for any Angular codebase: version gap, deprecated APIs, zoneless readiness, signals adoption, test runner, type safety and circular dependencies.",
   "keywords": [
     "angular",