npq 3.27.3 → 3.27.4

package/README.md

@@ -50,6 +50,12 @@ npq install express
 
 When npq completes its signal checks it hands over the actual package install job to the package manager (npm by default, or as specified via the `NPQ_PKG_MGR` environment variable).
 
+Registry-manifest checks use npm's selection rules for versions, ranges, and tags.
+If an enabled registry-manifest check cannot resolve the requested version, the
+audit fails. The Snyk/OSV vulnerability check handles selectors separately. These
+checks do not pin the subsequent install: lockfiles, package-manager-specific
+resolution, and registry changes after the audit can affect what is installed.
+
 **DISCLAIMER**: there's no guaranteed absolute safety; a malicious or vulnerable package could still exist that has no security vulnerabilities publicly disclosed and passes npq's checks.
 
 ## Demo

package/lib/cli.js

@@ -64,8 +64,7 @@ class CliParser {
     // Parse and normalize packages
     return packages.map((pkg) => {
       const parsedPackage = json ? parseJsonRegistryPackageSpec(pkg) : npa(pkg)
-      const versionModifier = parsedPackage.fetchSpec === '*' ? 'latest' : parsedPackage.fetchSpec
-      return `${parsedPackage.name}@${versionModifier}`
+      return `${parsedPackage.name}@${parsedPackage.fetchSpec}`
     })
   }
 

package/lib/helpers/packageRepoUtils.js

@@ -2,6 +2,7 @@
 
 const semver = require('semver')
 const RegistryClient = require('./registryClient')
+const resolveManifest = require('./resolveManifest')
 
 class PackageRepoUtils {
   constructor({ registryClient = RegistryClient.public() } = {}) {
@@ -48,40 +49,13 @@ class PackageRepoUtils {
   }
 
   async getSemVer(packageName, packageVersion) {
-    if (semver.valid(packageVersion)) {
-      return packageVersion
-    } else {
-      // this is probably an alias such as `latest` that we need to match
-      // via dist-tags:
-      const packageInfo = await this.getPackageInfo(packageName)
-
-      if (packageInfo['dist-tags'] === undefined) {
-        throw new Error(`Could not find dist-tags for package ${packageName}`)
-      }
-
-      if (packageInfo['dist-tags'][packageVersion] !== undefined) {
-        const semverVersion = packageInfo['dist-tags'][packageVersion]
-        return semverVersion
-      }
-
-      // If not found in dist-tags, try to find the highest version that satisfies
-      // the semver range from the versions object
-      if (packageInfo.versions) {
-        const availableVersions = Object.keys(packageInfo.versions).filter((v) => semver.valid(v))
-
-        try {
-          const satisfyingVersion = semver.maxSatisfying(availableVersions, packageVersion)
-
-          if (satisfyingVersion) {
-            return satisfyingVersion
-          }
-        } catch {
-          // semver.maxSatisfying throws if the range is invalid, continue to error below
-        }
-      }
-
-      throw new Error(`Could not find dist-tag ${packageVersion} for package ${packageName}`)
-    }
+    const packageInfo = await this.getPackageInfo(packageName)
+    return resolveManifest(
+      packageName,
+      packageVersion,
+      packageInfo,
+      this.registryClient.registryConfig?.requestOptions
+    ).version
   }
 
   /**

package/lib/helpers/registryClient.js

@@ -5,6 +5,7 @@ const npmFetch = require('npm-registry-fetch')
 const NotEvaluated = require('./notEvaluated')
 const RegistryConfig = require('./registryConfig')
 const { RegistryError } = require('./registryErrors')
+const resolveManifest = require('./resolveManifest')
 
 const PUBLIC_REGISTRY = 'https://registry.npmjs.org/'
 const OPTIONAL_STATUS = new Set([404, 405, 501])
@@ -96,15 +97,15 @@ class RegistryClient {
   async getManifest(packageSpec, packument = null) {
     const spec = npa(packageSpec)
     const data = packument || (await this.getPackageInfo(spec.name))
-    let version = spec.fetchSpec
-    if (!version || version === '*' || version === 'latest') {
-      version = data['dist-tags'] && data['dist-tags'].latest
-    }
-    if (!data.versions || !data.versions[version]) {
-      throw new Error(`Version ${version} not found for package ${spec.name}`)
-    }
+    const manifest = resolveManifest(
+      spec.name,
+      spec.fetchSpec,
+      data,
+      this.registryConfig.requestOptions
+    )
+    const version = manifest.version
     return {
-      ...data.versions[version],
+      ...manifest,
       ...(data.time && data.time[version] ? { _time: data.time[version] } : {})
     }
   }

package/lib/helpers/resolveManifest.js

@@ -0,0 +1,41 @@
+'use strict'
+
+const npa = require('npm-package-arg')
+const pickManifest = require('npm-pick-manifest')
+const { RegistryError } = require('./registryErrors')
+
+// Selection must follow npm's spec classification and manifest preferences. In
+// particular, a semver-shaped dist-tag must never override a version or range.
+function resolveManifest(packageName, versionSpec, packument, options = {}) {
+  try {
+    if (typeof versionSpec !== 'string' || versionSpec.trim() === '') {
+      throw new Error('Missing version specification')
+    }
+    const spec = npa.resolve(packageName, versionSpec)
+    if (!['version', 'range', 'tag'].includes(spec.type)) {
+      throw new Error('Only registry versions, ranges, and tags can be audited')
+    }
+    if (!packument || !packument.versions) {
+      throw new Error('Missing package versions')
+    }
+
+    // npm-pick-manifest normalizes bin fields in place. Keep the cached
+    // packument unchanged so every marshall sees the original metadata.
+    const manifest = pickManifest(
+      structuredClone({ ...packument, name: packageName }),
+      spec.fetchSpec,
+      options
+    )
+    if (!manifest.version || !packument.versions[manifest.version]) {
+      throw new Error('Selected manifest has no matching package version')
+    }
+    return manifest
+  } catch (cause) {
+    throw new RegistryError(`Unable to resolve version ${versionSpec} for package ${packageName}`, {
+      code: 'EREGISTRYRESOLVE',
+      cause
+    })
+  }
+}
+
+module.exports = resolveManifest

package/lib/marshalls/author.marshall.js

@@ -138,8 +138,6 @@ class Marshall extends BaseMarshall {
       pkg.packageVersion
     )
 
-    // @TODO fix to work for both explicit versions (1.0.0) and also
-    // for dist-tags (latest)
     const npmUser = pakument.versions[packageVersion]._npmUser
     if (!npmUser || !npmUser.email) {
       throw new Error('Could not determine publishing user for this package version')

package/lib/marshalls/baseMarshall.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const semver = require('semver')
+const resolveManifest = require('../helpers/resolveManifest')
 const util = require('node:util')
 const NotEvaluated = require('../helpers/notEvaluated')
 const { RegistryError } = require('../helpers/registryErrors')
@@ -107,30 +107,14 @@ class BaseMarshall {
    * @param {string} packageName - The package name
    * @param {string} versionSpec - The version specification (could be dist-tag or semver)
    * @param {Object} packageData - Optional package data to avoid re-fetching
-   * @returns {Promise<string|null>} - The resolved semver version or null if not found
+   * @returns {Promise<string>} - The resolved semver version; rejects on resolution failure
    */
 
   async resolvePackageVersion(packageName, versionSpec, packageData) {
-    if (typeof versionSpec !== 'string' || versionSpec.trim() === '') return null
     const data = packageData || (await this.packageRepoUtils.getPackageInfo(packageName))
-
-    if (!data) return null
-
-    // Handle dist-tags first
-    if (data['dist-tags'] && data['dist-tags'][versionSpec]) {
-      return data['dist-tags'][versionSpec]
-    }
-
-    // Handle semver ranges and exact versions using all available versions
-    if (data.versions) {
-      const availableVersions = Object.keys(data.versions)
-      const resolved = semver.maxSatisfying(availableVersions, versionSpec)
-      if (resolved) return resolved
-    }
-
-    // Fallback for simple parsing if range resolution fails
-    const parsed = this.packageRepoUtils.parsePackageVersion(versionSpec)
-    return parsed ? parsed.version : null
+    const client = this.registryClient || this.packageRepoUtils.registryClient
+    return resolveManifest(packageName, versionSpec, data, client?.registryConfig?.requestOptions)
+      .version
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.27.3",
+  "version": "3.27.4",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",
@@ -47,6 +47,7 @@
     "@npmcli/config": "^10.10.0",
     "cross-spawn": "^7.0.6",
     "npm-package-arg": "^13.0.2",
+    "npm-pick-manifest": "^11.0.3",
     "npm-registry-fetch": "^19.1.1",
     "semver": "^7.7.4",
     "sigstore": "^4.1.0",