npq 3.11.4 → 3.11.5

package/lib/marshalls/age.marshall.js

@@ -28,8 +28,9 @@ class Marshall extends BaseMarshall {
 
     const pkgCreatedDate = data.time.created
     const dateDiff = Date.now() - Date.parse(pkgCreatedDate)
+    const thresholdMs = PACKAGE_AGE_THRESHOLD * 24 * 60 * 60 * 1000
 
-    if (dateDiff < PACKAGE_AGE_THRESHOLD) {
+    if (dateDiff < thresholdMs) {
       throw new Error(
         `Detected a newly published package (created < ${PACKAGE_AGE_THRESHOLD} days) act carefully`
       )
@@ -46,8 +47,9 @@ class Marshall extends BaseMarshall {
     }
 
     const versionReleaseDate = data.time[packageVersion]
-    const versionDateDiff = new Date() - new Date(versionReleaseDate)
+    const versionDateDiff = Date.now() - Date.parse(versionReleaseDate)
     const versionDateDiffInDays = Math.round(versionDateDiff / (1000 * 60 * 60 * 24))
+    const unmaintainedThresholdMs = PACKAGE_AGE_UNMAINTAINED_RISK * 24 * 60 * 60 * 1000
 
     let timeAgoText = 'days'
     let timeAgoNumber = versionDateDiffInDays
@@ -57,7 +59,7 @@ class Marshall extends BaseMarshall {
       timeAgoNumber = Math.floor(versionDateDiffInDays / 365)
     }
 
-    if (versionDateDiffInDays >= PACKAGE_AGE_UNMAINTAINED_RISK) {
+    if (versionDateDiff >= unmaintainedThresholdMs) {
       throw new Warning(`Detected an old package (created ${timeAgoNumber} ${timeAgoText} ago)`)
     }
   }

package/lib/marshalls/baseMarshall.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const semver = require('semver')
 const util = require('node:util')
 const Warning = require('../helpers/warning')
 const { marshallCategories } = require('./constants')
@@ -76,20 +77,26 @@ class BaseMarshall {
    * @param {Object} packageData - Optional package data to avoid re-fetching
    * @returns {Promise<string|null>} - The resolved semver version or null if not found
    */
-  async resolvePackageVersion(packageName, versionSpec, packageData = null) {
-    // Get package data if not provided
+
+  async resolvePackageVersion(packageName, versionSpec, packageData) {
+    if (typeof versionSpec !== 'string' || versionSpec.trim() === '') return null
     const data = packageData || (await this.packageRepoUtils.getPackageInfo(packageName))
 
-    if (!data || !data['dist-tags']) {
-      return null
-    }
+    if (!data) return null
 
-    // Check if versionSpec is a dist-tag
-    if (Object.prototype.hasOwnProperty.call(data['dist-tags'], versionSpec)) {
+    // Handle dist-tags first
+    if (data['dist-tags'] && data['dist-tags'][versionSpec]) {
       return data['dist-tags'][versionSpec]
     }
 
-    // If not a dist-tag, try parsing as semver
+    // Handle semver ranges and exact versions using all available versions
+    if (data.versions) {
+      const availableVersions = Object.keys(data.versions)
+      const resolved = semver.maxSatisfying(availableVersions, versionSpec)
+      if (resolved) return resolved
+    }
+
+    // Fallback for simple parsing if range resolution fails
     const parsed = this.packageRepoUtils.parsePackageVersion(versionSpec)
     return parsed ? parsed.version : null
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.11.4",
+  "version": "3.11.5",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",