npq 3.10.1 → 3.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.10.1",
+  "version": "3.11.0",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -9,15 +9,15 @@
   "scripts": {
     "lint": "eslint . --ignore-path .gitignore && npm run lint:lockfile",
     "lint:lockfile": "lockfile-lint --path package-lock.json --type npm --validate-https --allowed-hosts npm npm",
-    "test": "NODE_OPTIONS=\"--experimental-vm-modules\" jest",
+    "test": "cross-env NODE_OPTIONS=\"--experimental-vm-modules\" jest",
     "build": "node scripts/build.js",
-    "test:watch": "NODE_OPTIONS=\"--experimental-vm-modules\" jest --watch",
+    "test:watch": "cross-env NODE_OPTIONS=\"--experimental-vm-modules\" jest --watch",
     "coverage:view": "opn coverage/lcov-report/index.html",
     "commit": "git-cz",
-    "format": "prettier --config .prettierrc.js --write '**/*.js'",
+    "format": "prettier --config .prettierrc.js --write \"**/*.js\"",
     "docs": "npm run docs:code && npm run docs:api",
-    "docs:api": "doxdox *.js --layout bootstrap --output docs/index.html",
-    "docs:code": "docco *.js --output docs/code",
+    "docs:api": "doxdox \"*.js\" --layout bootstrap --output docs/index.html",
+    "docs:code": "docco \"*.js\" --output docs/code",
     "semantic-release": "npx semantic-release",
     "#postinstall": "node scripts/postinstall.js",
     "#preuninstall": "node scripts/preuninstall.js",
@@ -26,6 +26,12 @@
   "engines": {
     "node": ">=20.13.0"
   },
+  "files": [
+    "bin/",
+    "data/",
+    "lib/",
+    "scripts/"
+  ],
   "author": {
     "name": "Liran Tal",
     "email": "liran.tal@gmail.com"
@@ -41,29 +47,30 @@
   },
   "dependencies": {
     "fastest-levenshtein": "^1.0.16",
-    "npm-package-arg": "^11.0.1",
-    "pacote": "^17.0.4",
+    "npm-package-arg": "^11.0.3",
+    "pacote": "^17.0.7",
     "semver": "^7.7.2"
   },
   "devDependencies": {
-    "@babel/core": "^7.23.0",
-    "@babel/plugin-transform-runtime": "^7.22.15",
-    "@babel/preset-env": "^7.22.20",
-    "@babel/runtime": "^7.23.1",
-    "@babel/types": "^7.23.0",
-    "@commitlint/cli": "^17.7.2",
-    "@commitlint/config-angular": "^17.7.0",
-    "commitizen": "^4.3.0",
+    "@babel/core": "^7.28.0",
+    "@babel/plugin-transform-runtime": "^7.28.0",
+    "@babel/preset-env": "^7.28.0",
+    "@babel/runtime": "^7.28.2",
+    "@babel/types": "^7.28.2",
+    "@commitlint/cli": "^17.8.1",
+    "@commitlint/config-angular": "^17.8.1",
+    "commitizen": "^4.3.1",
+    "cross-env": "^10.0.0",
     "cz-conventional-changelog": "^3.3.0",
-    "eslint": "^8.50.0",
-    "eslint-plugin-import": "^2.28.1",
+    "eslint": "^8.57.1",
+    "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-security": "^1.7.1",
     "husky": "^8.0.3",
     "jest": "^29.7.0",
     "lint-staged": "^14.0.1",
-    "lockfile-lint": "^4.12.1",
-    "prettier": "^3.0.3"
+    "lockfile-lint": "^4.14.1",
+    "prettier": "^3.6.2"
   },
   "jest": {
     "testEnvironment": "node",

package/.editorconfig

@@ -1,49 +0,0 @@
-# EditorConfig is awesome: http://EditorConfig.org
-# Howto with your editor: http://editorconfig.org/#download
-
-# top-most EditorConfig file
-root = true
-
-# Unix-style newlines with a newline ending every file
-[**]
-end_of_line = lf
-insert_final_newline = true
-charset = utf-8
-
-# Standard at: https://github.com/felixge/node-style-guide
-[**.{js,json}]
-trim_trailing_whitespace = true
-indent_style = space
-indent_size = 2
-quote_type = single
-
-# LT: the following are enforced by standardjs so I commented
-#curly_bracket_next_line = false
-#spaces_around_operators = true
-#space_after_control_statements = true
-#space_after_anonymous_functions = true
-#spaces_in_brackets = false
-
-# No Standard.  Please document a standard if different from .js
-[**.{yml,css}]
-trim_trailing_whitespace = true
-indent_style = space
-
-[**.html]
-trim_trailing_whitespace = true
-indent_style = space
-indent_size = 2
-
-# No standard.  Please document a standard if different from .js
-[**.md]
-indent_style = tab
-
-# Standard at:
-[Makefile]
-indent_style = tab
-
-# The indentation in package.json will always need to be 2 spaces
-# https://github.com/npm/npm/issues/4718
-[{package, bower}.json]
-indent_style = space
-indent_size = 2

package/.github/ISSUE_TEMPLATE.md

@@ -1,32 +0,0 @@
-<!--- Provide a general summary of the issue in the Title above -->
-
-## Expected Behavior
-<!--- If you're describing a bug, tell us what should happen -->
-<!--- If you're suggesting a change/improvement, tell us how it should work -->
-
-## Current Behavior
-<!--- If describing a bug, tell us what happens instead of the expected behavior -->
-<!--- If suggesting a change/improvement, explain the difference from current behavior -->
-
-## Possible Solution
-<!--- Not obligatory, but suggest a fix/reason for the bug, -->
-<!--- or ideas how to implement the addition or change -->
-
-## Steps to Reproduce (for bugs)
-<!--- Provide a link to a live example, or an unambiguous set of steps to -->
-<!--- reproduce this bug. Include code to reproduce, if relevant -->
-1.
-2.
-3.
-4.
-
-## Context
-<!--- How has this issue affected you? What are you trying to accomplish? -->
-<!--- Providing context helps us come up with a solution that is most useful in the real world -->
-
-## Your Environment
-<!--- Include as many relevant details about the environment you experienced the bug in -->
-* Version used:
-* Environment name and version (e.g. Chrome 39, Node.js 5.4):
-* Operating System and version (desktop or mobile):
-* Link to your project:

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -1,35 +0,0 @@
-<!--- Provide a general summary of your changes in the Title above -->
-
-## Description
-<!--- Describe your changes in detail -->
-
-## Types of changes
-<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to change)
-
-## Related Issue
-<!--- This project only accepts pull requests related to open issues -->
-<!--- If suggesting a new feature or change, please discuss it in an issue first -->
-<!--- If fixing a bug, there should be an issue describing it with steps to reproduce -->
-<!--- Please link to the issue here: -->
-
-## Motivation and Context
-<!--- Why is this change required? What problem does it solve? -->
-
-## How Has This Been Tested?
-<!--- Please describe in detail how you tested your changes. -->
-<!--- Include details of your testing environment, and the tests you ran to -->
-<!--- see how your change affects other areas of the code, etc. -->
-<!--- Unit tests are expected for all changes. -->
-
-## Screenshots (if appropriate):
-
-## Checklist:
-<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
-<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
-- [ ] I have updated the documentation (if required).
-- [ ] I have read the **CONTRIBUTING** document.
-- [ ] I have added tests to cover my changes.
-- [ ] All new and existing tests passed.

package/.github/workflows/automerge.yml

@@ -1,39 +0,0 @@
-name: automerge
-on:
-  pull_request:
-    types:
-      - labeled
-      - unlabeled
-      - synchronize
-      - opened
-      - edited
-      - ready_for_review
-      - reopened
-      - unlocked
-  pull_request_review:
-    types:
-      - submitted
-  check_suite:
-    types:
-      - completed
-  status: {}
-jobs:
-  automerge:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - id: automerge
-        name: automerge
-        uses: "pascalgn/automerge-action@v0.16.4"
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          # we only merge PRs with labels of "dependencies" 
-          MERGE_LABELS: "automerge"
-          MERGE_REMOVE_LABELS: "automerge"
-          MERGE_METHOD: "squash"
-          MERGE_COMMIT_MESSAGE: "automatic"
-          MERGE_FORKS: "false"
-          MERGE_REQUIRED_APPROVALS: "0"
-          UPDATE_METHOD: "rebase"

package/.github/workflows/main.yml

@@ -1,58 +0,0 @@
-name: CI
-
-on: [push, pull_request]
-
-jobs:
-  build:
-    strategy:
-      matrix:
-        platform: [ubuntu-latest]
-        node: ['20', '22', '24']
-    name: Node ${{ matrix.node }} (${{ matrix.platform }})
-    runs-on: ${{ matrix.platform }}
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: ${{ matrix.node }}
-      - name: install dependencies
-        run: npm ci --ignore-engines --ignore-scripts
-      - name: lint code
-        run: npm run lint
-        env:
-          CI: true
-      - name: run tests
-        run: npm run test
-        env:
-          CI: true
-      - name: coverage
-        uses: codecov/codecov-action@v1
-        with:
-          fail_ci_if_error: true
-          verbose: false
-        env:
-          CODECOV_TOKEN: ${{secrets.CODECOV_TOKEN}}
-          CI: true
-
-  release:
-    name: do semantic release
-    runs-on: 'ubuntu-latest'
-    permissions:
-      contents: write # to be able to publish a GitHub release
-      issues: write # to be able to comment on released issues
-      pull-requests: write # to be able to comment on released pull requests
-      id-token: write # to enable use of OIDC for npm provenance
-    needs: build
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v2
-        with:
-          node-version: '24'
-      - name: install dependencies
-        run: npm ci --ignore-engines --ignore-scripts
-      - name: release
-        run: npx semantic-release
-        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-          NPM_TOKEN: ${{secrets.NPM_TOKEN}}

package/.husky/commit-msg

@@ -1,4 +0,0 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-npx commitlint --edit $1

package/.husky/post-merge

@@ -1,4 +0,0 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-npm install

package/.husky/pre-commit

@@ -1,4 +0,0 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-npx lint-staged

package/.husky/pre-push

@@ -1,4 +0,0 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-npm run lint && npm run test

package/.prettierrc.js

@@ -1,9 +0,0 @@
-module.exports = {
-  printWidth: 100,
-  tabWidth: 2,
-  singleQuote: true,
-  semi: false,
-  trailingComma: 'none',
-  useTabs: false,
-  bracketSpacing: true
-}

package/CHANGELOG.md

@@ -1,27 +0,0 @@
-# Changelog
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
-and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
-
-<!--
-## [x.y.z] - YYYY-MM-DD
-### [Type of Change]
-- [description of change]
-
-### Types of changes
-- **Added** for new features.
-- **Changed** for changes in existing functionality.
-- **Deprecated** for soon-to-be removed features.
-- **Removed** for now removed features.
-- **Fixed** for any bug fixes.
-- **Security** in case of vulnerabilities.
-
-[x.y.z]: https://github.com/lirantal/npq/compare/1.0.0...x.y.z
--->
-
-## [Unreleased]
-- Initial Release
-
-<!-- Update the Unreleased comparison range with each release -->
-[Unreleased]: https://github.com/lirantal/npq/compare/x.y.z...master

package/CODE_OF_CONDUCT.md

@@ -1,73 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-In the interest of fostering an open and welcoming environment, we as
-contributors and maintainers pledge to making participation in our project and
-our community a harassment-free experience for everyone, regardless of age, body
-size, disability, ethnicity, gender identity and expression, level of experience,
-education, socio-economic status, nationality, personal appearance, race,
-religion, or sexual identity and orientation.
-
-## Our Standards
-
-Examples of behavior that contributes to creating a positive environment
-include:
-
-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
-
-Examples of unacceptable behavior by participants include:
-
-* The use of sexualized language or imagery and unwelcome sexual attention or
-  advances
-* Trolling, insulting/derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or electronic
-  address, without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Our Responsibilities
-
-Project maintainers are responsible for clarifying the standards of acceptable
-behavior and are expected to take appropriate and fair corrective action in
-response to any instances of unacceptable behavior.
-
-Project maintainers have the right and responsibility to remove, edit, or
-reject comments, commits, code, wiki edits, issues, and other contributions
-that are not aligned to this Code of Conduct, or to ban temporarily or
-permanently any contributor for other behaviors that they deem inappropriate,
-threatening, offensive, or harmful.
-
-## Scope
-
-This Code of Conduct applies both within project spaces and in public spaces
-when an individual is representing the project or its community. Examples of
-representing a project or community include using an official project e-mail
-address, posting via an official social media account, or acting as an appointed
-representative at an online or offline event. Representation of a project may be
-further defined and clarified by project maintainers.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project maintainers team via their e-mail addresses. All
-complaints will be reviewed and investigated and will result in a response that
-is deemed necessary and appropriate to the circumstances. The project team is
-obligated to maintain confidentiality with regard to the reporter of an incident.
-Further details of specific enforcement policies may be posted separately.
-
-Project maintainers who do not follow or enforce the Code of Conduct in good
-faith may face temporary or permanent repercussions as determined by other
-members of the project's leadership.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
-
-[homepage]: https://www.contributor-covenant.org

package/CONTRIBUTING.md

@@ -1,55 +0,0 @@
-# Contribution Guidelines
-
-Please review below for developer guidelines on general project contribution guidelines as well as writing your own marshalls plugin.
-
-## Contributing Marshalls
-
-### A Marshall's Interface
-
-A Marshall always extends the BaseMarshall class and needs to implement the following interface:
-* `title(): string`
-* `isEnabled(ctx: object): boolean`
-* `run(ctx: object, task: object): Promise<>`
-
-for reference about the `ctx` and `task` objects passed to tasks refer to [listr](https://github.com/SamVerschueren/listr) package documentation.
-
-### run()
-
-The `run()` method must be able to support multiple packages provided in `ctx.pkgs` to run its check upon.
-
-If you implement multiple packages checks with a `Promise.all()` strategy you should be aware that it will fail-fast on exceptions. This default behavior is not desirable because while errors exist in one packge, you would still want to continue running your checks on the other packages as well.
-
-To mitigate that, your specific check method should now throw an exception if it fails, but instead catch it and call
-```js
-this.setMessage({
-          pkg: pkg,
-          message: err.message
-        })
-```
-to record an error that happened in a specific package.
-
-### General Marshalls Guidelines
-
-* Never overwrite `ctx.pkgs` property
-
-
-## Tests
-
-Make sure you the code you're adding has decent test coverage.
-
-Running project tests and coverage:
-
-```bash
-npm run test
-```
-
-## Commit Guidelines
-
-The project uses the commitizen tool for standardizing changelog style commit
-messages so you should follow it as so:
-
-```bash
-git add .           # add files to staging
-yarn run commit      # use the wizard for the commit message
-```
-

package/SECURITY.md

@@ -1,23 +0,0 @@
-# Security Policy
-
-## Responsible disclosure security policy
-
-A responsible disclosure policy helps protect users of the project from publicly disclosed security vulnerabilities without a fix by employing a process where vulnerabilities are first triaged in a private manner, and only publicly disclosed after a reasonable time period that allows patching the vulnerability and provides an upgrade path for users.
-
-When contacting us directly via email, we will do our best efforts to respond in a reasonable time to resolve the issue. When contacting a security program their disclosure policy will provide details on time-frame, processes and paid bounties.
-
-We kindly ask you to refrain from malicious acts that put our users, the project, or any of the project’s team members at risk.
-
-## Reporting a security issue
-
-We consider the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities present.
-
-If you discover a security vulnerability, please use one of the following means of communications to report it to us:
-
-- Report the security issue to the Node.js Security WG through the [HackerOne program](https://hackerone.com/nodejs-ecosystem) for ecosystem modules on npm, or to [Snyk Security Team](https://snyk.io/vulnerability-disclosure). They will help triage the security issue and work with all involved parties to remediate and release a fix.
-
-Note that time-frame and processes are subject to each program’s own policy.
-
-- Report the security issue to the project maintainers directly.
-
-Your efforts to responsibly disclose your findings are sincerely appreciated and will be taken into account to acknowledge your contributions.

package/__tests__/__fixtures__/test.marshall.js

@@ -1,58 +0,0 @@
-'use strict'
-
-const BaseMarshall = require('../../lib/marshalls/baseMarshall')
-
-const MARSHALL_NAME = 'test.marshall'
-
-class TestMarshall extends BaseMarshall {
-  constructor(options) {
-    super(options)
-    this.name = MARSHALL_NAME
-  }
-
-  title() {
-    return 'A test marshall'
-  }
-
-  run(ctx, task) {
-    const tasks = ctx.pkgs.reduce((prevPkg, currPkg) => {
-      return prevPkg.concat(this.mockCheck(currPkg, ctx, task))
-    }, [])
-
-    return Promise.all(tasks)
-  }
-
-  mockCheck(pkg, ctx) {
-    return this.validateSomething(pkg)
-      .then(() => {
-        const data = 'mock data check'
-        ctx.marshalls[this.name].data[pkg.packageName] = data
-
-        return data
-      })
-      .catch((err) => {
-        this.setMessage({
-          pkg: pkg.packageName,
-          message: err.message
-        })
-      })
-  }
-
-  validateSomething(pkg) {
-    if (pkg.packageName === 'express' || pkg.packageName === 'semver') {
-      return Promise.resolve()
-    } else {
-      return Promise.reject(new Error('simulating mock error'))
-    }
-  }
-
-  validate(pkg) {
-    if (pkg.packageName === 'express' || pkg.packageName === 'semver') {
-      return Promise.resolve('validation-result')
-    } else {
-      return Promise.reject(new Error('simulating mock error'))
-    }
-  }
-}
-
-module.exports = TestMarshall