pr-checkmate 1.21.2 → 1.21.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/scripts/npm-audit.js +13 -1
- package/package.json +3 -3
|
@@ -15,9 +15,20 @@ function isSeverityAtLeast(severity, level) {
|
|
|
15
15
|
const lvlIdx = SEVERITY_ORDER.indexOf(level);
|
|
16
16
|
return sevIdx >= 0 && lvlIdx >= 0 && sevIdx >= lvlIdx;
|
|
17
17
|
}
|
|
18
|
+
function getOwnPackageName() {
|
|
19
|
+
try {
|
|
20
|
+
const ownPkg = node_path_1.default.resolve(__dirname, '../../package.json');
|
|
21
|
+
const content = node_fs_1.default.readFileSync(ownPkg, 'utf-8');
|
|
22
|
+
return JSON.parse(content).name ?? null;
|
|
23
|
+
}
|
|
24
|
+
catch {
|
|
25
|
+
return null;
|
|
26
|
+
}
|
|
27
|
+
}
|
|
18
28
|
/**
|
|
19
29
|
* Run npm audit on the current project.
|
|
20
30
|
* Only fails on vulnerabilities in direct dependencies — transitive ones are silently ignored.
|
|
31
|
+
* Vulnerabilities in pr-checkmate itself are also skipped — the client cannot fix those.
|
|
21
32
|
*/
|
|
22
33
|
async function runNpmAudit() {
|
|
23
34
|
utils_1.logger.info('Running npm audit...');
|
|
@@ -29,6 +40,7 @@ async function runNpmAudit() {
|
|
|
29
40
|
}
|
|
30
41
|
const config = (0, config_1.loadProjectConfig)();
|
|
31
42
|
const auditLevel = config.security?.['npm-audit']?.auditLevel ?? 'moderate';
|
|
43
|
+
const ownName = getOwnPackageName();
|
|
32
44
|
let report;
|
|
33
45
|
try {
|
|
34
46
|
const { stdout } = await (0, execa_1.execa)('npm', ['audit', '--json'], {
|
|
@@ -41,7 +53,7 @@ async function runNpmAudit() {
|
|
|
41
53
|
utils_1.logger.error('[runNpmAudit]: ❌ Failed to parse npm audit output');
|
|
42
54
|
throw error;
|
|
43
55
|
}
|
|
44
|
-
const directVulns = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && isSeverityAtLeast(v.severity, auditLevel));
|
|
56
|
+
const directVulns = Object.values(report.vulnerabilities ?? {}).filter(v => v.isDirect && v.name !== ownName && isSeverityAtLeast(v.severity, auditLevel));
|
|
45
57
|
if (directVulns.length === 0) {
|
|
46
58
|
utils_1.logger.info('[runNpmAudit]: ✅ NPM audit finished successfully');
|
|
47
59
|
return;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "pr-checkmate",
|
|
3
|
-
"version": "1.21.
|
|
3
|
+
"version": "1.21.3",
|
|
4
4
|
"description": "Automated PR quality checks: linting, formatting, dependency analysis, and spellcheck",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"github-actions",
|
|
@@ -74,9 +74,9 @@
|
|
|
74
74
|
"eslint-plugin-prettier": "^5.5.4",
|
|
75
75
|
"execa": "^9.6.0",
|
|
76
76
|
"gitleaks-secret-scanner-fixed": "^2.1.3",
|
|
77
|
-
"jscpd": "^3.5.10",
|
|
78
|
-
"markdownlint-cli": "^0.45.0",
|
|
79
77
|
"inquirer": "^13.0.1",
|
|
78
|
+
"jscpd": "^3.5.10",
|
|
79
|
+
"markdownlint-cli": "^0.49.0",
|
|
80
80
|
"prettier": ">=3.0.0",
|
|
81
81
|
"ts-node": "^10.9.1",
|
|
82
82
|
"typescript": "^5.9.3"
|