qaify-playwright-reporter 0.9.1 → 0.9.2

package/dist/fix.d.ts

@@ -142,6 +142,11 @@ export declare function fixDeps(dir: string, exec?: Exec): Promise<{
     summary: string;
     reason?: string;
 }>;
+/**
+ * Paket di composer.lock yang me-require pkg secara langsung. `--with-all-dependencies` hanya memperbarui dependensi
+ * pkg; tanpa ini dependennya tertinggal di versi lama yang belum tentu cocok dengan pkg baru.
+ */
+export declare function composerDependents(repo: string, pkg: string): Promise<string[]>;
 /** Masih ada advisory untuk paket ini? npm: hanya high / critical (sama dengan temuan audit-static). */
 export declare function stillVulnerable(output: string, manager: 'composer' | 'npm', pkg: string): boolean;
 /**

package/dist/fix.js

@@ -206,8 +206,10 @@ export async function fixDeps(dir, exec = defaultExec) {
     let vulnerable;
     try {
         if (composer) {
-            steps.push(`composer update ${pkg} --with-all-dependencies --no-install`);
-            await exec('composer', ['update', pkg, '--with-all-dependencies', '--no-install', '--no-scripts', '--no-interaction', '--no-progress', `--working-dir=${repo}`]);
+            // paket yang me-require pkg ikut naik: mis. laravel/framework baru butuh laravel/sanctum yang mengenal perubahannya
+            const packages = [pkg, ...(await composerDependents(repo, pkg))];
+            steps.push(`composer update ${packages.join(' ')} --with-all-dependencies --no-install`);
+            await exec('composer', ['update', ...packages, '--with-all-dependencies', '--no-install', '--no-scripts', '--no-interaction', '--no-progress', `--working-dir=${repo}`]);
             vulnerable = stillVulnerable(await report('composer', ['audit', '--locked', '--format=json', '--no-interaction', `--working-dir=${repo}`]), 'composer', pkg);
         }
         else {
@@ -244,6 +246,22 @@ export async function fixDeps(dir, exec = defaultExec) {
         tests_run: `${auditCmd}: ${pkg} bersih. Test aplikasi dijalankan CI repo pada PR ini.`,
     });
 }
+/**
+ * Paket di composer.lock yang me-require pkg secara langsung. `--with-all-dependencies` hanya memperbarui dependensi
+ * pkg; tanpa ini dependennya tertinggal di versi lama yang belum tentu cocok dengan pkg baru.
+ */
+export async function composerDependents(repo, pkg) {
+    let lock;
+    try {
+        lock = JSON.parse(await readFile(join(repo, 'composer.lock'), 'utf8'));
+    }
+    catch {
+        return [];
+    }
+    return [...(lock.packages ?? []), ...(lock['packages-dev'] ?? [])]
+        .filter((p) => p.name !== pkg && p.require && pkg in p.require)
+        .map((p) => p.name);
+}
 /** Masih ada advisory untuk paket ini? npm: hanya high / critical (sama dengan temuan audit-static). */
 export function stillVulnerable(output, manager, pkg) {
     const start = output.search(/[[{]/);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qaify-playwright-reporter",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Reporter Playwright untuk QA Factory (Qaify): kirim hasil test dan artefak ke /api/ingest, tanpa pernah menggagalkan test.",
   "license": "MIT",
   "author": "ahmdkenz",