snyk-nodejs-lockfile-parser 2.7.1 → 2.8.1

package/dist/utils.js

@@ -4,6 +4,8 @@ exports.getLockfileVersionFromFile = exports.NodeLockfileVersion = void 0;
 exports.getPnpmLockfileVersion = getPnpmLockfileVersion;
 exports.getYarnLockfileVersion = getYarnLockfileVersion;
 exports.getNpmLockfileVersion = getNpmLockfileVersion;
+exports.parseJsonFile = parseJsonFile;
+exports.describeLikelyJsonCause = describeLikelyJsonCause;
 const fs_1 = require("fs");
 const js_yaml_1 = require("js-yaml");
 const errors_1 = require("./errors");
@@ -64,24 +66,65 @@ function getYarnLockfileVersion(lockFileContents) {
     }
 }
 function getNpmLockfileVersion(lockFileContents) {
+    // Parse first; surfacing the real JSON error happens inside parseJsonFile.
+    const lockfileJson = parseJsonFile(lockFileContents, 'package-lock.json');
+    // The version check runs *outside* the parse try/catch so that an
+    // unsupported (but otherwise valid JSON) lockfile is not mis-reported as a
+    // JSON syntax error.
+    const lockfileVersion = lockfileJson.lockfileVersion || null;
+    switch (lockfileVersion) {
+        case null:
+        case 1:
+            return NodeLockfileVersion.NpmLockV1;
+        case 2:
+            return NodeLockfileVersion.NpmLockV2;
+        case 3:
+            return NodeLockfileVersion.NpmLockV3;
+        default:
+            throw new errors_1.InvalidUserInputError(`Unsupported npm lockfile version "${lockfileVersion}" in package-lock.json. ` +
+                'Please provide a package-lock.json with lockfileVersion 1, 2 or 3');
+    }
+}
+/**
+ * Parse JSON from a manifest or lockfile. On failure throws an
+ * InvalidUserInputError that preserves the underlying parser message
+ * (including the position of the syntax error) and appends a best-effort hint
+ * about the likely cause.
+ *
+ * `fileLabel` is the file kind shown in the error, e.g. 'package.json' or
+ * 'package-lock.json'.
+ */
+function parseJsonFile(content, fileLabel) {
     try {
-        const lockfileJson = JSON.parse(lockFileContents);
-        const lockfileVersion = lockfileJson.lockfileVersion || null;
-        switch (lockfileVersion) {
-            case null:
-            case 1:
-                return NodeLockfileVersion.NpmLockV1;
-            case 2:
-                return NodeLockfileVersion.NpmLockV2;
-            case 3:
-                return NodeLockfileVersion.NpmLockV3;
-            default:
-                throw new errors_1.InvalidUserInputError(`Unsupported npm lockfile version in package-lock.json. ` +
-                    'Please provide a package-lock.json with lockfileVersion 1, 2 or 3');
-        }
+        return JSON.parse(content);
     }
     catch (e) {
-        throw new errors_1.InvalidUserInputError(`Problem parsing package-lock.json - make sure the package-lock.json is a valid JSON file`);
+        throw new errors_1.InvalidUserInputError(`${fileLabel} parsing failed with error ${e.message}` +
+            describeLikelyJsonCause(content));
+    }
+}
+/**
+ * Best-effort, allocation-light hint describing the most likely reason a JSON
+ * parse failed. Inspects only the leading characters of the content, never
+ * throws, and returns '' when nothing recognisable is found - so it is always
+ * safe to append to a parse-error message.
+ */
+function describeLikelyJsonCause(content) {
+    if (!content) {
+        return ' The file is empty.';
+    }
+    // A byte-order mark (UTF-8/UTF-16/UTF-32) decoded into the string.
+    if (content.charCodeAt(0) === 0xfeff) {
+        return ' The file begins with a byte-order mark (BOM); re-save it as UTF-8 without a BOM.';
+    }
+    // NUL bytes strongly suggest the file is UTF-16/UTF-32 encoded.
+    if (content.includes('\x00')) {
+        return ' The file contains NUL bytes; it may be UTF-16/UTF-32 encoded. Re-save it as UTF-8.';
+    }
+    // Unresolved git merge-conflict markers.
+    if (/^(<{7}|={7}|>{7})( |$)/m.test(content)) {
+        return ' The file appears to contain unresolved git merge-conflict markers.';
     }
+    return '';
 }
 //# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../lib/utils.ts"],"names":[],"mappings":";;;AAkCA,wDAsBC;AAED,wDAQC;AAED,sDA6BC;AAjGD,2BAAkC;AAClC,qCAAgD;AAChD,qCAAiD;AACjD,mFAAyE;AAEzE,IAAY,mBASX;AATD,WAAY,mBAAmB;IAC7B,gDAAyB,CAAA;IACzB,gDAAyB,CAAA;IACzB,gDAAyB,CAAA;IACzB,kDAA2B,CAAA;IAC3B,kDAA2B,CAAA;IAC3B,kDAA2B,CAAA;IAC3B,kDAA2B,CAAA;IAC3B,kDAA2B,CAAA;AAC7B,CAAC,EATW,mBAAmB,mCAAnB,mBAAmB,QAS9B;AAEM,MAAM,0BAA0B,GAAG,CACxC,UAAkB,EACG,EAAE;IACvB,MAAM,gBAAgB,GAAG,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,OAAO,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjD,OAAO,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,8BAAqB,CAC7B,oBAAoB,UAAU,IAAI;YAChC,sEAAsE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAhBW,QAAA,0BAA0B,8BAgBrC;AAEF,SAAgB,sBAAsB,CACpC,gBAAwB;IAKxB,MAAM,WAAW,GAAG,IAAA,cAAI,EAAC,gBAAgB,EAAE;QACzC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,yBAAe;KACxB,CAAC,CAAC;IACH,MAAM,EAAE,eAAe,EAAE,GAAG,WAAW,CAAC;IACxC,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACxC,CAAC;SAAM,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACxC,CAAC;SAAM,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,kDAAoB,CAAC,mCAAmC,CAChE,uCAAuC,eAAe,mBAAmB,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CACpC,gBAAwB;IAExB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5C,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CACnC,gBAAwB;IAKxB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAClD,MAAM,eAAe,GAAkB,YAAY,CAAC,eAAe,IAAI,IAAI,CAAC;QAE5E,QAAQ,eAAe,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC;YACV,KAAK,CAAC;gBACJ,OAAO,mBAAmB,CAAC,SAAS,CAAC;YACvC,KAAK,CAAC;gBACJ,OAAO,mBAAmB,CAAC,SAAS,CAAC;YACvC,KAAK,CAAC;gBACJ,OAAO,mBAAmB,CAAC,SAAS,CAAC;YACvC;gBACE,MAAM,IAAI,8BAAqB,CAC7B,yDAAyD;oBACvD,mEAAmE,CACtE,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,8BAAqB,CAC7B,0FAA0F,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../lib/utils.ts"],"names":[],"mappings":";;;AAkCA,wDAsBC;AAED,wDAQC;AAED,sDA2BC;AAWD,sCASC;AAQD,0DAiBC;AA5ID,2BAAkC;AAClC,qCAAgD;AAChD,qCAAiD;AACjD,mFAAyE;AAEzE,IAAY,mBASX;AATD,WAAY,mBAAmB;IAC7B,gDAAyB,CAAA;IACzB,gDAAyB,CAAA;IACzB,gDAAyB,CAAA;IACzB,kDAA2B,CAAA;IAC3B,kDAA2B,CAAA;IAC3B,kDAA2B,CAAA;IAC3B,kDAA2B,CAAA;IAC3B,kDAA2B,CAAA;AAC7B,CAAC,EATW,mBAAmB,mCAAnB,mBAAmB,QAS9B;AAEM,MAAM,0BAA0B,GAAG,CACxC,UAAkB,EACG,EAAE;IACvB,MAAM,gBAAgB,GAAG,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,OAAO,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjD,OAAO,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,8BAAqB,CAC7B,oBAAoB,UAAU,IAAI;YAChC,sEAAsE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAhBW,QAAA,0BAA0B,8BAgBrC;AAEF,SAAgB,sBAAsB,CACpC,gBAAwB;IAKxB,MAAM,WAAW,GAAG,IAAA,cAAI,EAAC,gBAAgB,EAAE;QACzC,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,yBAAe;KACxB,CAAC,CAAC;IACH,MAAM,EAAE,eAAe,EAAE,GAAG,WAAW,CAAC;IACxC,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACxC,CAAC;SAAM,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACxC,CAAC;SAAM,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,kDAAoB,CAAC,mCAAmC,CAChE,uCAAuC,eAAe,mBAAmB,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CACpC,gBAAwB;IAExB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5C,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,OAAO,mBAAmB,CAAC,UAAU,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CACnC,gBAAwB;IAKxB,2EAA2E;IAC3E,MAAM,YAAY,GAAG,aAAa,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;IAE1E,kEAAkE;IAClE,2EAA2E;IAC3E,qBAAqB;IACrB,MAAM,eAAe,GAAkB,YAAY,CAAC,eAAe,IAAI,IAAI,CAAC;IAC5E,QAAQ,eAAe,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC;QACV,KAAK,CAAC;YACJ,OAAO,mBAAmB,CAAC,SAAS,CAAC;QACvC,KAAK,CAAC;YACJ,OAAO,mBAAmB,CAAC,SAAS,CAAC;QACvC,KAAK,CAAC;YACJ,OAAO,mBAAmB,CAAC,SAAS,CAAC;QACvC;YACE,MAAM,IAAI,8BAAqB,CAC7B,qCAAqC,eAAe,0BAA0B;gBAC5E,mEAAmE,CACtE,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,aAAa,CAAU,OAAe,EAAE,SAAiB;IACvE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,8BAAqB,CAC7B,GAAG,SAAS,8BAA+B,CAAW,CAAC,OAAO,EAAE;YAC9D,uBAAuB,CAAC,OAAO,CAAC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAAe;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,mEAAmE;IACnE,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO,mFAAmF,CAAC;IAC7F,CAAC;IACD,gEAAgE;IAChE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,qFAAqF,CAAC;IAC/F,CAAC;IACD,yCAAyC;IACzC,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO,qEAAqE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/package.json

@@ -22,8 +22,13 @@
   },
   "author": "snyk.io",
   "license": "Apache-2.0",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
   "engines": {
-    "node": ">=18"
+    "node": "^20.19.0 || ^22.13.0 || >=24.0.0",
+    "npm": ">=10"
   },
   "files": [
     "bin",
@@ -53,13 +58,13 @@
   "devDependencies": {
     "@types/jest": "^28.1.3",
     "@types/lodash": "^4.17.20",
-    "@types/node": "^18.19.127",
+    "@types/node": "^24",
     "@types/semver": "^7.3.6",
     "@types/uuid": "^8.3.0",
-    "@typescript-eslint/eslint-plugin": "^4.33.0",
-    "@typescript-eslint/parser": "^4.33.0",
-    "eslint": "7.32.0",
-    "eslint-config-prettier": "^8.3.0",
+    "@typescript-eslint/eslint-plugin": "^8.60.0",
+    "@typescript-eslint/parser": "^8.60.0",
+    "eslint": "^8.57.1",
+    "eslint-config-prettier": "^9.1.0",
     "jest": "^28.1.3",
     "prettier": "^2.7.1",
     "tap": "^15.0.4",
@@ -71,5 +76,5 @@
     "tar": "7.5.11"
   },
   "packageManager": "yarn@2.4.1",
-  "version": "2.7.1"
+  "version": "2.8.1"
 }