socket 0.14.17 → 0.14.18

package/dist/cli.js

@@ -1370,6 +1370,7 @@ async function addOverrides({
       package: origPkgName,
       version
     } = data;
+    const major = _semver.major(version);
     for (const {
       1: depObj
     } of depEntries) {
@@ -1403,17 +1404,27 @@ async function addOverrides({
     }) => {
       const overrideExists = (0, _objects.hasOwn)(overrides, origPkgName);
       if (overrideExists || lockIncludes(lockSrc, origPkgName)) {
-        // With npm one may not set an override for a package that one directly
-        // depends on unless both the dependency and the override itself share
-        // the exact same spec. To make this limitation easier to deal with,
-        // overrides may also be defined as a reference to a spec for a direct
-        // dependency by prefixing the name of the package to match the version
-        // of with a $.
-        // https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides
-        const oldSpec = overrides[origPkgName];
+        const oldSpec = overrideExists ? overrides[origPkgName] : undefined;
         const depAlias = depAliasMap.get(origPkgName);
-        const thisVersion = overrideExists && (0, _strings.isNonEmptyString)(oldSpec) ? (await fetchPackageManifest(oldSpec.startsWith('$') ? depAlias?.id ?? oldSpec : oldSpec))?.version ?? version : version;
-        const newSpec = depAlias && type === 'npm' ? `$${origPkgName}` : `npm:${regPkgName}@^${pin ? thisVersion : _semver.major(thisVersion)}`;
+        let newSpec = `npm:${regPkgName}@^${pin ? version : major}`;
+        let thisVersion = version;
+        if (depAlias && type === 'npm') {
+          // With npm one may not set an override for a package that one directly
+          // depends on unless both the dependency and the override itself share
+          // the exact same spec. To make this limitation easier to deal with,
+          // overrides may also be defined as a reference to a spec for a direct
+          // dependency by prefixing the name of the package to match the version
+          // of with a $.
+          // https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides
+          newSpec = `$${origPkgName}`;
+        } else if (overrideExists && pin) {
+          const thisSpec = oldSpec.startsWith('$') ? depAlias?.id ?? newSpec : oldSpec ?? newSpec;
+          thisVersion = _semver.coerce(_npmPackageArg(thisSpec).rawSpec)?.version ?? version;
+          if (_semver.major(thisVersion) !== major) {
+            thisVersion = (await fetchPackageManifest(thisSpec))?.version ?? version;
+          }
+          newSpec = `npm:${regPkgName}@^${pin ? thisVersion : _semver.major(thisVersion)}`;
+        }
         if (newSpec !== oldSpec) {
           if (overrideExists) {
             state.updated.add(regPkgName);
@@ -1551,7 +1562,7 @@ const optimize = optimize$1.optimize = {
         rootPath: pkgPath
       }, state);
     }
-    const pkgJsonChanged = state.updated.size > 0 || state.updated.size > 0;
+    const pkgJsonChanged = state.added.size > 0 || state.updated.size > 0;
     if (state.updated.size > 0) {
       console.log(`Updated ${state.updated.size} Socket.dev optimized overrides ${state.added.size ? '.' : '🚀'}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "0.14.17",
+  "version": "0.14.18",
   "description": "CLI tool for Socket.dev",
   "homepage": "http://github.com/SocketDev/socket-cli",
   "license": "MIT",