socket 0.14.30 → 0.14.32
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/module-sync/cli.js +128 -105
- package/dist/module-sync/constants.d.ts +2 -1
- package/dist/module-sync/constants.js +18 -10
- package/dist/module-sync/link.js +15 -3
- package/dist/module-sync/npm-cli.js +21 -9
- package/dist/module-sync/npm-injection.js +394 -178
- package/dist/module-sync/npx-cli.js +19 -7
- package/dist/module-sync/path-resolve.js +17 -5
- package/dist/module-sync/sdk.d.ts +1 -2
- package/dist/module-sync/sdk.js +42 -32
- package/dist/module-sync/vendor.js +82 -0
- package/dist/require/cli.js +93 -69
- package/dist/require/constants.d.ts +2 -1
- package/dist/require/constants.js +19 -6
- package/dist/require/link.js +15 -3
- package/dist/require/npm-cli.js +19 -7
- package/dist/require/npm-injection.js +156 -175
- package/dist/require/npx-cli.js +17 -5
- package/dist/require/path-resolve.js +17 -5
- package/dist/require/sdk.d.ts +1 -2
- package/dist/require/sdk.js +36 -26
- package/dist/require/vendor.js +23 -11
- package/package.json +5 -3
- package/translations.json +1 -1
|
@@ -1,28 +1,38 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
var
|
|
16
|
-
var
|
|
17
|
-
var require$$
|
|
18
|
-
var require$$
|
|
19
|
-
var require$$
|
|
20
|
-
var require$$1
|
|
21
|
-
var require$$
|
|
22
|
-
var require$$6 = require('
|
|
23
|
-
var
|
|
24
|
-
var
|
|
25
|
-
var
|
|
3
|
+
function _interop(e) {
|
|
4
|
+
let d
|
|
5
|
+
if (e) {
|
|
6
|
+
let c = 0
|
|
7
|
+
for (const k in e) {
|
|
8
|
+
d = c++ === 0 && k === 'default' ? e[k] : void 0
|
|
9
|
+
if (!d) break
|
|
10
|
+
}
|
|
11
|
+
}
|
|
12
|
+
return d ?? e
|
|
13
|
+
}
|
|
14
|
+
|
|
15
|
+
var vendor = _interop(require('./vendor.js'));
|
|
16
|
+
var constants = _interop(require('./constants.js'));
|
|
17
|
+
var require$$1$3 = _interop(require('node:events'));
|
|
18
|
+
var require$$0 = _interop(require('node:fs'));
|
|
19
|
+
var require$$3$3 = _interop(require('node:https'));
|
|
20
|
+
var require$$1 = _interop(require('node:path'));
|
|
21
|
+
var require$$3 = _interop(require('node:readline'));
|
|
22
|
+
var require$$6$2 = _interop(require('node:timers/promises'));
|
|
23
|
+
var require$$1$2 = _interop(require('@inquirer/confirm'));
|
|
24
|
+
var require$$3$2 = _interop(require('@socketregistry/yocto-spinner'));
|
|
25
|
+
var require$$3$1 = _interop(require('is-interactive'));
|
|
26
|
+
var require$$5$1 = _interop(require('npm-package-arg'));
|
|
27
|
+
var require$$4 = _interop(require('semver'));
|
|
28
|
+
var require$$6$1 = _interop(require('@socketsecurity/config'));
|
|
29
|
+
var require$$7 = _interop(require('@socketsecurity/registry/lib/objects'));
|
|
30
|
+
var require$$1$1 = _interop(require('node:net'));
|
|
31
|
+
var require$$2 = _interop(require('node:os'));
|
|
32
|
+
var require$$5 = _interop(require('node:stream'));
|
|
33
|
+
var sdk = _interop(require('./sdk.js'));
|
|
34
|
+
var pathResolve = _interop(require('./path-resolve.js'));
|
|
35
|
+
var link = _interop(require('./link.js'));
|
|
26
36
|
|
|
27
37
|
var npmInjection$2 = {};
|
|
28
38
|
|
|
@@ -32,6 +42,245 @@ var arborist = {};
|
|
|
32
42
|
|
|
33
43
|
var ttyServer$1 = {};
|
|
34
44
|
|
|
45
|
+
var name = "socket";
|
|
46
|
+
var version = "0.14.32";
|
|
47
|
+
var description = "CLI tool for Socket.dev";
|
|
48
|
+
var homepage = "http://github.com/SocketDev/socket-cli";
|
|
49
|
+
var license = "MIT";
|
|
50
|
+
var repository = {
|
|
51
|
+
type: "git",
|
|
52
|
+
url: "git+https://github.com/SocketDev/socket-cli.git"
|
|
53
|
+
};
|
|
54
|
+
var author = {
|
|
55
|
+
name: "Socket Inc",
|
|
56
|
+
email: "eng@socket.dev",
|
|
57
|
+
url: "https://socket.dev"
|
|
58
|
+
};
|
|
59
|
+
var bin = {
|
|
60
|
+
socket: "./bin/cli.js",
|
|
61
|
+
"socket-npm": "./bin/npm-cli.js",
|
|
62
|
+
"socket-npx": "./bin/npx-cli.js"
|
|
63
|
+
};
|
|
64
|
+
var exports$1 = {
|
|
65
|
+
"./bin/cli.js": {
|
|
66
|
+
"module-sync": {
|
|
67
|
+
types: "./dist/module-sync/cli.d.ts",
|
|
68
|
+
"default": "./dist/module-sync/cli.js"
|
|
69
|
+
},
|
|
70
|
+
require: {
|
|
71
|
+
types: "./dist/require/cli.d.ts",
|
|
72
|
+
"default": "./dist/require/cli.js"
|
|
73
|
+
}
|
|
74
|
+
},
|
|
75
|
+
"./bin/npm-cli.js": {
|
|
76
|
+
"module-sync": {
|
|
77
|
+
types: "./dist/module-sync/npm-cli.d.ts",
|
|
78
|
+
"default": "./dist/module-sync/npm-cli.js"
|
|
79
|
+
},
|
|
80
|
+
require: {
|
|
81
|
+
types: "./dist/require/npm-cli.d.ts",
|
|
82
|
+
"default": "./dist/require/npm-cli.js"
|
|
83
|
+
}
|
|
84
|
+
},
|
|
85
|
+
"./bin/npx-cli.js": {
|
|
86
|
+
"module-sync": {
|
|
87
|
+
types: "./dist/module-sync/npx-cli.d.ts",
|
|
88
|
+
"default": "./dist/module-sync/npx-cli.js"
|
|
89
|
+
},
|
|
90
|
+
require: {
|
|
91
|
+
types: "./dist/require/npx-cli.d.ts",
|
|
92
|
+
"default": "./dist/require/npx-cli.js"
|
|
93
|
+
}
|
|
94
|
+
},
|
|
95
|
+
"./package.json": "./package.json",
|
|
96
|
+
"./translations.json": "./translations.json"
|
|
97
|
+
};
|
|
98
|
+
var scripts = {
|
|
99
|
+
build: "run-s build:*",
|
|
100
|
+
"build:dist": "rollup -c .config/rollup.dist.config.mjs",
|
|
101
|
+
"build:test": "rollup -c .config/rollup.test.config.mjs",
|
|
102
|
+
check: "run-p -c --aggregate-output check:*",
|
|
103
|
+
"check:lint": "eslint --report-unused-disable-directives .",
|
|
104
|
+
"check:tsc": "tsc",
|
|
105
|
+
"check:type-coverage": "type-coverage --detail --strict --at-least 95 --ignore-files 'test/*'",
|
|
106
|
+
"knip:dependencies": "knip --dependencies",
|
|
107
|
+
"knip:exports": "knip --include exports,duplicates",
|
|
108
|
+
lint: "oxlint -c=./.oxlintrc.json --ignore-path=./.prettierignore --tsconfig=./tsconfig.json .",
|
|
109
|
+
"lint:fix": "npm run lint -- --fix && npm run lint:fix:fast",
|
|
110
|
+
"lint:fix:fast": "prettier --cache --log-level warn --write .",
|
|
111
|
+
prepare: "husky && custompatch",
|
|
112
|
+
test: "run-s check build:* test:*",
|
|
113
|
+
"test:c8": "c8 --reporter=none node --test 'test/socket-npm.test.cjs'",
|
|
114
|
+
"test-ci": "run-s build:* test:*",
|
|
115
|
+
"test:unit": "tap-run",
|
|
116
|
+
"test:coverage": "cp -r .tap/coverage/*.json coverage/tmp && c8 --reporter=lcov --reporter=text --include 'dist/{module-sync,require}/*.js' --exclude 'dist/require/vendor.js' report"
|
|
117
|
+
};
|
|
118
|
+
var dependencies = {
|
|
119
|
+
"@apideck/better-ajv-errors": "^0.3.6",
|
|
120
|
+
"@cyclonedx/cdxgen": "^11.0.5",
|
|
121
|
+
"@inquirer/confirm": "^5.0.2",
|
|
122
|
+
"@inquirer/password": "^4.0.3",
|
|
123
|
+
"@inquirer/select": "^4.0.3",
|
|
124
|
+
"@npmcli/promise-spawn": "^8.0.2",
|
|
125
|
+
"@socketregistry/hyrious__bun.lockb": "1.0.5",
|
|
126
|
+
"@socketregistry/yocto-spinner": "^1.0.1",
|
|
127
|
+
"@socketsecurity/config": "^2.1.3",
|
|
128
|
+
"@socketsecurity/registry": "^1.0.35",
|
|
129
|
+
"@socketsecurity/sdk": "^1.3.0",
|
|
130
|
+
blessed: "^0.1.81",
|
|
131
|
+
"blessed-contrib": "^4.11.0",
|
|
132
|
+
browserslist: "4.24.2",
|
|
133
|
+
"chalk-table": "^1.0.2",
|
|
134
|
+
"has-flag": "^4.0.0",
|
|
135
|
+
hpagent: "^1.2.0",
|
|
136
|
+
ignore: "^6.0.2",
|
|
137
|
+
micromatch: "^4.0.8",
|
|
138
|
+
"npm-package-arg": "^12.0.0",
|
|
139
|
+
"pony-cause": "^2.1.11",
|
|
140
|
+
semver: "^7.6.3",
|
|
141
|
+
synp: "^1.9.14",
|
|
142
|
+
tinyglobby: "^0.2.10",
|
|
143
|
+
which: "^5.0.0",
|
|
144
|
+
yaml: "^2.6.1",
|
|
145
|
+
"yargs-parser": "^21.1.1",
|
|
146
|
+
"yoctocolors-cjs": "^2.1.2"
|
|
147
|
+
};
|
|
148
|
+
var devDependencies = {
|
|
149
|
+
"@babel/core": "^7.26.0",
|
|
150
|
+
"@babel/plugin-proposal-export-default-from": "^7.25.9",
|
|
151
|
+
"@babel/plugin-syntax-dynamic-import": "^7.8.3",
|
|
152
|
+
"@babel/plugin-transform-export-namespace-from": "^7.25.9",
|
|
153
|
+
"@babel/plugin-transform-modules-commonjs": "^7.26.3",
|
|
154
|
+
"@babel/plugin-transform-runtime": "^7.25.9",
|
|
155
|
+
"@babel/preset-env": "^7.26.0",
|
|
156
|
+
"@babel/preset-typescript": "^7.26.0",
|
|
157
|
+
"@babel/runtime": "^7.26.0",
|
|
158
|
+
"@eslint/compat": "^1.2.4",
|
|
159
|
+
"@eslint/js": "^9.16.0",
|
|
160
|
+
"@rollup/plugin-commonjs": "^28.0.1",
|
|
161
|
+
"@rollup/plugin-json": "^6.1.0",
|
|
162
|
+
"@rollup/plugin-node-resolve": "^15.3.0",
|
|
163
|
+
"@rollup/plugin-replace": "^6.0.1",
|
|
164
|
+
"@rollup/pluginutils": "^5.1.3",
|
|
165
|
+
"@tapjs/run": "^4.0.1",
|
|
166
|
+
"@types/blessed": "^0.1.25",
|
|
167
|
+
"@types/micromatch": "^4.0.9",
|
|
168
|
+
"@types/mocha": "^10.0.10",
|
|
169
|
+
"@types/mock-fs": "^4.13.4",
|
|
170
|
+
"@types/node": "^22.10.1",
|
|
171
|
+
"@types/npmcli__arborist": "^5.6.11",
|
|
172
|
+
"@types/npmcli__promise-spawn": "^6.0.3",
|
|
173
|
+
"@types/proc-log": "^3.0.4",
|
|
174
|
+
"@types/semver": "^7.5.8",
|
|
175
|
+
"@types/update-notifier": "^6.0.8",
|
|
176
|
+
"@types/which": "^3.0.4",
|
|
177
|
+
"@types/yargs-parser": "^21.0.3",
|
|
178
|
+
"@typescript-eslint/eslint-plugin": "^8.17.0",
|
|
179
|
+
"@typescript-eslint/parser": "^8.17.0",
|
|
180
|
+
c8: "^10.1.2",
|
|
181
|
+
custompatch: "^1.0.28",
|
|
182
|
+
eslint: "^9.16.0",
|
|
183
|
+
"eslint-import-resolver-oxc": "^0.6.0",
|
|
184
|
+
"eslint-plugin-depend": "^0.12.0",
|
|
185
|
+
"eslint-plugin-import-x": "^4.5.0",
|
|
186
|
+
"eslint-plugin-n": "^17.14.0",
|
|
187
|
+
"eslint-plugin-sort-destructure-keys": "^2.0.0",
|
|
188
|
+
"eslint-plugin-unicorn": "^56.0.1",
|
|
189
|
+
husky: "^9.1.7",
|
|
190
|
+
"is-interactive": "^2.0.0",
|
|
191
|
+
"is-unicode-supported": "^2.1.0",
|
|
192
|
+
knip: "^5.39.2",
|
|
193
|
+
"magic-string": "^0.30.14",
|
|
194
|
+
meow: "^13.2.0",
|
|
195
|
+
"mock-fs": "^5.4.1",
|
|
196
|
+
nock: "^13.5.6",
|
|
197
|
+
"npm-run-all2": "^7.0.1",
|
|
198
|
+
open: "^10.1.0",
|
|
199
|
+
oxlint: "0.14.1",
|
|
200
|
+
prettier: "3.4.2",
|
|
201
|
+
"read-package-up": "^11.0.0",
|
|
202
|
+
rollup: "4.28.1",
|
|
203
|
+
"rollup-plugin-ts": "^3.4.5",
|
|
204
|
+
"terminal-link": "^3.0.0",
|
|
205
|
+
"tiny-updater": "^3.5.2",
|
|
206
|
+
"type-coverage": "^2.29.7",
|
|
207
|
+
typescript: "5.4.5",
|
|
208
|
+
"typescript-eslint": "^8.17.0",
|
|
209
|
+
"unplugin-purge-polyfills": "^0.0.7"
|
|
210
|
+
};
|
|
211
|
+
var overrides = {
|
|
212
|
+
"aggregate-error": "npm:@socketregistry/aggregate-error@^1",
|
|
213
|
+
"es-define-property": "npm:@socketregistry/es-define-property@^1",
|
|
214
|
+
"function-bind": "npm:@socketregistry/function-bind@^1",
|
|
215
|
+
globalthis: "npm:@socketregistry/globalthis@^1",
|
|
216
|
+
gopd: "npm:@socketregistry/gopd@^1",
|
|
217
|
+
"has-property-descriptors": "npm:@socketregistry/has-property-descriptors@^1",
|
|
218
|
+
"has-proto": "npm:@socketregistry/has-proto@^1",
|
|
219
|
+
"has-symbols": "npm:@socketregistry/has-symbols@^1",
|
|
220
|
+
hasown: "npm:@socketregistry/hasown@^1",
|
|
221
|
+
"indent-string": "npm:@socketregistry/indent-string@^1",
|
|
222
|
+
"is-core-module": "npm:@socketregistry/is-core-module@^1",
|
|
223
|
+
isarray: "npm:@socketregistry/isarray@^1",
|
|
224
|
+
"npm-package-arg": "$npm-package-arg",
|
|
225
|
+
"packageurl-js": "npm:@socketregistry/packageurl-js@^1",
|
|
226
|
+
"path-parse": "npm:@socketregistry/path-parse@^1",
|
|
227
|
+
"safe-buffer": "npm:@socketregistry/safe-buffer@^1",
|
|
228
|
+
"safer-buffer": "npm:@socketregistry/safer-buffer@^1",
|
|
229
|
+
semver: "$semver",
|
|
230
|
+
"set-function-length": "npm:@socketregistry/set-function-length@^1",
|
|
231
|
+
"side-channel": "npm:@socketregistry/side-channel@^1",
|
|
232
|
+
yaml: "$yaml"
|
|
233
|
+
};
|
|
234
|
+
var resolutions = {
|
|
235
|
+
"aggregate-error": "npm:@socketregistry/aggregate-error@^1",
|
|
236
|
+
"es-define-property": "npm:@socketregistry/es-define-property@^1",
|
|
237
|
+
"function-bind": "npm:@socketregistry/function-bind@^1",
|
|
238
|
+
globalthis: "npm:@socketregistry/globalthis@^1",
|
|
239
|
+
gopd: "npm:@socketregistry/gopd@^1",
|
|
240
|
+
"has-property-descriptors": "npm:@socketregistry/has-property-descriptors@^1",
|
|
241
|
+
"has-proto": "npm:@socketregistry/has-proto@^1",
|
|
242
|
+
"has-symbols": "npm:@socketregistry/has-symbols@^1",
|
|
243
|
+
hasown: "npm:@socketregistry/hasown@^1",
|
|
244
|
+
"indent-string": "npm:@socketregistry/indent-string@^1",
|
|
245
|
+
"is-core-module": "npm:@socketregistry/is-core-module@^1",
|
|
246
|
+
isarray: "npm:@socketregistry/isarray@^1",
|
|
247
|
+
"npm-package-arg": "^12.0.0",
|
|
248
|
+
"packageurl-js": "npm:@socketregistry/packageurl-js@^1",
|
|
249
|
+
"path-parse": "npm:@socketregistry/path-parse@^1",
|
|
250
|
+
"safe-buffer": "npm:@socketregistry/safe-buffer@^1",
|
|
251
|
+
"safer-buffer": "npm:@socketregistry/safer-buffer@^1",
|
|
252
|
+
semver: "^7.6.3",
|
|
253
|
+
"set-function-length": "npm:@socketregistry/set-function-length@^1",
|
|
254
|
+
"side-channel": "npm:@socketregistry/side-channel@^1",
|
|
255
|
+
yaml: "^2.6.0"
|
|
256
|
+
};
|
|
257
|
+
var engines = {
|
|
258
|
+
node: "^18.20.4 || ^20.9.0 || >=22.0.0"
|
|
259
|
+
};
|
|
260
|
+
var files = [
|
|
261
|
+
"bin/**",
|
|
262
|
+
"dist/**",
|
|
263
|
+
"translations.json"
|
|
264
|
+
];
|
|
265
|
+
var require$$6 = {
|
|
266
|
+
name: name,
|
|
267
|
+
version: version,
|
|
268
|
+
description: description,
|
|
269
|
+
homepage: homepage,
|
|
270
|
+
license: license,
|
|
271
|
+
repository: repository,
|
|
272
|
+
author: author,
|
|
273
|
+
bin: bin,
|
|
274
|
+
exports: exports$1,
|
|
275
|
+
scripts: scripts,
|
|
276
|
+
dependencies: dependencies,
|
|
277
|
+
devDependencies: devDependencies,
|
|
278
|
+
overrides: overrides,
|
|
279
|
+
resolutions: resolutions,
|
|
280
|
+
engines: engines,
|
|
281
|
+
files: files
|
|
282
|
+
};
|
|
283
|
+
|
|
35
284
|
Object.defineProperty(ttyServer$1, "__esModule", {
|
|
36
285
|
value: true
|
|
37
286
|
});
|
|
@@ -41,7 +290,7 @@ var _nodeNet = require$$1$1;
|
|
|
41
290
|
var _nodeOs = require$$2;
|
|
42
291
|
var _nodePath$1 = require$$1;
|
|
43
292
|
var _nodeReadline$1 = require$$3;
|
|
44
|
-
var _nodeStream
|
|
293
|
+
var _nodeStream = require$$5;
|
|
45
294
|
var _package = require$$6;
|
|
46
295
|
var _misc$1 = sdk.misc;
|
|
47
296
|
const NEWLINE_CHAR_CODE = 10; /*'\n'*/
|
|
@@ -79,10 +328,10 @@ function createNonStandardTTYServer() {
|
|
|
79
328
|
if (remote_ipc_version !== _package.version) {
|
|
80
329
|
throw new Error('Mismatched STDIO tunnel IPC version, ensure you only have 1 version of socket CLI being called.');
|
|
81
330
|
}
|
|
82
|
-
const input = hasInput ? new _nodeStream
|
|
331
|
+
const input = hasInput ? new _nodeStream.PassThrough() : null;
|
|
83
332
|
input?.pause();
|
|
84
333
|
if (input) conn.pipe(input);
|
|
85
|
-
const output = hasOutput ? new _nodeStream
|
|
334
|
+
const output = hasOutput ? new _nodeStream.PassThrough() : null;
|
|
86
335
|
if (output) {
|
|
87
336
|
output.pipe(conn)
|
|
88
337
|
// Make ora happy
|
|
@@ -236,7 +485,7 @@ var issueRules = {};
|
|
|
236
485
|
Object.defineProperty(issueRules, "__esModule", {
|
|
237
486
|
value: true
|
|
238
487
|
});
|
|
239
|
-
issueRules.
|
|
488
|
+
issueRules.createAlertUXLookup = createAlertUXLookup;
|
|
240
489
|
//#region UX Constants
|
|
241
490
|
|
|
242
491
|
const IGNORE_UX = {
|
|
@@ -303,7 +552,7 @@ function resolveIssueRuleUX(entriesOrderedIssueRules, defaultValue) {
|
|
|
303
552
|
function issueRuleValueDoesNotDefer(issueRule) {
|
|
304
553
|
if (issueRule === undefined) {
|
|
305
554
|
return false;
|
|
306
|
-
} else if (typeof issueRule === 'object'
|
|
555
|
+
} else if (issueRule !== null && typeof issueRule === 'object') {
|
|
307
556
|
const {
|
|
308
557
|
action
|
|
309
558
|
} = issueRule;
|
|
@@ -335,11 +584,13 @@ function uxForDefinedNonDeferValue(issueRuleValue) {
|
|
|
335
584
|
|
|
336
585
|
//#region exports
|
|
337
586
|
|
|
338
|
-
function
|
|
587
|
+
function createAlertUXLookup(settings) {
|
|
339
588
|
const cachedUX = new Map();
|
|
340
589
|
return context => {
|
|
341
|
-
const
|
|
342
|
-
|
|
590
|
+
const {
|
|
591
|
+
type
|
|
592
|
+
} = context.alert;
|
|
593
|
+
let ux = cachedUX.get(type);
|
|
343
594
|
if (ux) {
|
|
344
595
|
return ux;
|
|
345
596
|
}
|
|
@@ -352,7 +603,7 @@ function createIssueUXLookup(settings) {
|
|
|
352
603
|
if (!resolvedTarget) {
|
|
353
604
|
break;
|
|
354
605
|
}
|
|
355
|
-
const issueRuleValue = resolvedTarget.issueRules?.[
|
|
606
|
+
const issueRuleValue = resolvedTarget.issueRules?.[type];
|
|
356
607
|
if (typeof issueRuleValue !== 'undefined') {
|
|
357
608
|
orderedIssueRules.push(issueRuleValue);
|
|
358
609
|
}
|
|
@@ -360,7 +611,7 @@ function createIssueUXLookup(settings) {
|
|
|
360
611
|
}
|
|
361
612
|
entriesOrderedIssueRules.push(orderedIssueRules);
|
|
362
613
|
}
|
|
363
|
-
const defaultValue = settings.defaults.issueRules[
|
|
614
|
+
const defaultValue = settings.defaults.issueRules[type];
|
|
364
615
|
let resolvedDefaultValue = {
|
|
365
616
|
action: 'error'
|
|
366
617
|
};
|
|
@@ -374,31 +625,30 @@ function createIssueUXLookup(settings) {
|
|
|
374
625
|
};
|
|
375
626
|
}
|
|
376
627
|
ux = resolveIssueRuleUX(entriesOrderedIssueRules, resolvedDefaultValue);
|
|
377
|
-
cachedUX.set(
|
|
628
|
+
cachedUX.set(type, ux);
|
|
378
629
|
return ux;
|
|
379
630
|
};
|
|
380
631
|
}
|
|
381
632
|
|
|
382
|
-
var _interopRequireDefault =
|
|
633
|
+
var _interopRequireDefault = vendor.interopRequireDefault.default;
|
|
383
634
|
Object.defineProperty(arborist, "__esModule", {
|
|
384
635
|
value: true
|
|
385
636
|
});
|
|
386
637
|
arborist.SafeArborist = void 0;
|
|
387
638
|
arborist.installSafeArborist = installSafeArborist;
|
|
388
|
-
var _nodeEvents = require$$1$
|
|
639
|
+
var _nodeEvents = require$$1$3;
|
|
389
640
|
var _nodeFs = require$$0;
|
|
390
641
|
var _nodeHttps = require$$3$3;
|
|
391
642
|
var _nodePath = require$$1;
|
|
392
643
|
var _nodeReadline = require$$3;
|
|
393
|
-
var
|
|
394
|
-
var
|
|
644
|
+
var _promises = require$$6$2;
|
|
645
|
+
var _confirm = require$$1$2;
|
|
646
|
+
var _yoctoSpinner = require$$3$2;
|
|
395
647
|
var _isInteractive = _interopRequireDefault(require$$3$1);
|
|
396
648
|
var _npmPackageArg = require$$5$1;
|
|
397
|
-
var _yoctoSpinner = require$$3$2;
|
|
398
649
|
var _semver = require$$4;
|
|
399
650
|
var _config = require$$6$1;
|
|
400
651
|
var _objects = require$$7;
|
|
401
|
-
var _packages = require$$8;
|
|
402
652
|
var _ttyServer = ttyServer$1;
|
|
403
653
|
var _constants$1 = constants.constants;
|
|
404
654
|
var _colorOrMarkdown = sdk.colorOrMarkdown;
|
|
@@ -468,7 +718,7 @@ const OverrideSet = require(arboristOverrideSetClassPatch);
|
|
|
468
718
|
const kCtorArgs = Symbol('ctorArgs');
|
|
469
719
|
const kRiskyReify = Symbol('riskyReify');
|
|
470
720
|
const formatter = new _colorOrMarkdown.ColorOrMarkdown(false);
|
|
471
|
-
const pubToken = (0, _sdk.getDefaultKey)() ??
|
|
721
|
+
const pubToken = (0, _sdk.getDefaultKey)() ?? _constants$1.SOCKET_PUBLIC_API_KEY;
|
|
472
722
|
const ttyServer = (0, _ttyServer.createTTYServer)((0, _isInteractive.default)({
|
|
473
723
|
stream: process.stdin
|
|
474
724
|
}), log);
|
|
@@ -483,31 +733,20 @@ async function uxLookup(settings) {
|
|
|
483
733
|
return _uxLookup(settings);
|
|
484
734
|
}
|
|
485
735
|
async function* batchScan(pkgIds) {
|
|
486
|
-
const
|
|
487
|
-
packages: pkgIds.map(id => {
|
|
488
|
-
const {
|
|
489
|
-
name,
|
|
490
|
-
version
|
|
491
|
-
} = pkgidParts(id);
|
|
492
|
-
return {
|
|
493
|
-
eco: 'npm',
|
|
494
|
-
pkg: name,
|
|
495
|
-
ver: version,
|
|
496
|
-
top: true
|
|
497
|
-
};
|
|
498
|
-
})
|
|
499
|
-
};
|
|
500
|
-
// TODO: Migrate to SDK.
|
|
501
|
-
const pkgDataReq = _nodeHttps.request(`${_constants$1.API_V0_URL}/scan/batch`, {
|
|
736
|
+
const req = _nodeHttps.request(`${_constants$1.API_V0_URL}/purl?alerts=true`, {
|
|
502
737
|
method: 'POST',
|
|
503
738
|
headers: {
|
|
504
739
|
Authorization: `Basic ${Buffer.from(`${pubToken}:`).toString('base64url')}`
|
|
505
740
|
},
|
|
506
741
|
signal: abortSignal
|
|
507
|
-
}).end(JSON.stringify(
|
|
742
|
+
}).end(JSON.stringify({
|
|
743
|
+
components: pkgIds.map(id => ({
|
|
744
|
+
purl: `pkg:npm/${id}`
|
|
745
|
+
}))
|
|
746
|
+
}));
|
|
508
747
|
const {
|
|
509
748
|
0: res
|
|
510
|
-
} = await _nodeEvents.once(
|
|
749
|
+
} = await _nodeEvents.once(req, 'response');
|
|
511
750
|
const ok = res.statusCode >= 200 && res.statusCode <= 299;
|
|
512
751
|
if (!ok) {
|
|
513
752
|
throw new Error(`Socket API Error: ${res.statusCode}`);
|
|
@@ -573,118 +812,118 @@ function findSpecificOverrideSet(first, second) {
|
|
|
573
812
|
log.silly('Conflicting override sets', first, second);
|
|
574
813
|
return undefined;
|
|
575
814
|
}
|
|
815
|
+
function isAlertFixable(alert) {
|
|
816
|
+
const {
|
|
817
|
+
type
|
|
818
|
+
} = alert;
|
|
819
|
+
if (type === 'cve' || type === 'mediumCVE' || type === 'mildCVE' || type === 'criticalCVE') {
|
|
820
|
+
return !!alert.props?.['firstPatchedVersionIdentifier'];
|
|
821
|
+
}
|
|
822
|
+
return type === 'socketUpgradeAvailable';
|
|
823
|
+
}
|
|
576
824
|
function maybeReadfileSync(filepath) {
|
|
577
825
|
try {
|
|
578
826
|
return (0, _nodeFs.readFileSync)(filepath, 'utf8');
|
|
579
827
|
} catch {}
|
|
580
828
|
return undefined;
|
|
581
829
|
}
|
|
582
|
-
async function
|
|
830
|
+
async function getPackagesAlerts(safeArb, _registry, pkgs, output) {
|
|
583
831
|
const spinner = _yoctoSpinner({
|
|
584
832
|
stream: output
|
|
585
833
|
});
|
|
586
|
-
let result = false;
|
|
587
834
|
let {
|
|
588
835
|
length: remaining
|
|
589
836
|
} = pkgs;
|
|
837
|
+
const packageAlerts = [];
|
|
590
838
|
if (!remaining) {
|
|
591
839
|
spinner.success('No changes detected');
|
|
592
|
-
return
|
|
840
|
+
return packageAlerts;
|
|
593
841
|
}
|
|
594
842
|
const getText = () => `Looking up data for ${remaining} packages`;
|
|
595
843
|
spinner.start(getText());
|
|
596
844
|
try {
|
|
597
|
-
for await (const
|
|
845
|
+
for await (const artifact of batchScan(pkgs.map(p => p.pkgid))) {
|
|
846
|
+
if (!artifact.name || !artifact.version || !artifact.alerts?.length) {
|
|
847
|
+
continue;
|
|
848
|
+
}
|
|
598
849
|
const {
|
|
599
|
-
|
|
600
|
-
|
|
601
|
-
|
|
602
|
-
const id = `${name}@${version}`;
|
|
850
|
+
version
|
|
851
|
+
} = artifact;
|
|
852
|
+
const name = `${artifact.namespace ? `${artifact.namespace}/` : ''}${artifact.name}`;
|
|
853
|
+
const id = `${name}@${artifact.version}`;
|
|
854
|
+
let blocked = false;
|
|
603
855
|
let displayWarning = false;
|
|
604
|
-
let
|
|
605
|
-
|
|
606
|
-
|
|
607
|
-
|
|
608
|
-
|
|
609
|
-
|
|
610
|
-
|
|
856
|
+
let alerts = [];
|
|
857
|
+
for (const alert of artifact.alerts) {
|
|
858
|
+
// eslint-disable-next-line no-await-in-loop
|
|
859
|
+
const ux = await uxLookup({
|
|
860
|
+
package: {
|
|
861
|
+
name,
|
|
862
|
+
version
|
|
863
|
+
},
|
|
864
|
+
alert: {
|
|
865
|
+
type: alert.type
|
|
866
|
+
}
|
|
611
867
|
});
|
|
612
|
-
|
|
613
|
-
|
|
614
|
-
|
|
615
|
-
|
|
616
|
-
|
|
617
|
-
|
|
618
|
-
|
|
619
|
-
|
|
620
|
-
|
|
621
|
-
|
|
622
|
-
|
|
623
|
-
|
|
624
|
-
|
|
625
|
-
|
|
626
|
-
}
|
|
868
|
+
if (ux.block) {
|
|
869
|
+
blocked = true;
|
|
870
|
+
}
|
|
871
|
+
if (ux.display) {
|
|
872
|
+
displayWarning = true;
|
|
873
|
+
}
|
|
874
|
+
if (ux.block || ux.display) {
|
|
875
|
+
alerts.push({
|
|
876
|
+
name,
|
|
877
|
+
version,
|
|
878
|
+
type: alert.type,
|
|
879
|
+
block: ux.block,
|
|
880
|
+
raw: alert,
|
|
881
|
+
fixable: isAlertFixable(alert)
|
|
627
882
|
});
|
|
628
|
-
if
|
|
629
|
-
|
|
630
|
-
|
|
631
|
-
|
|
632
|
-
|
|
633
|
-
|
|
634
|
-
|
|
635
|
-
|
|
636
|
-
|
|
637
|
-
|
|
638
|
-
|
|
639
|
-
|
|
640
|
-
|
|
641
|
-
//
|
|
642
|
-
//
|
|
643
|
-
|
|
644
|
-
if (pkg?.existing) {
|
|
645
|
-
const oldPkgData =
|
|
646
|
-
// eslint-disable-next-line no-await-in-loop
|
|
647
|
-
(await batchScan([pkg.existing]).next()).value;
|
|
648
|
-
if (oldPkgData.type === 'success') {
|
|
649
|
-
failures = failures.filter(issue => oldPkgData.value.issues.find(oldIssue => oldIssue.type === issue.type) === undefined);
|
|
650
|
-
}
|
|
651
|
-
}
|
|
883
|
+
// Before we ask about problematic issues, check to see if they
|
|
884
|
+
// already existed in the old version if they did, be quiet.
|
|
885
|
+
const pkg = pkgs.find(p => p.pkgid === id && p.existing?.startsWith(`${name}@`));
|
|
886
|
+
if (pkg?.existing) {
|
|
887
|
+
// const oldArtifact: SocketArtifact =
|
|
888
|
+
// // eslint-disable-next-line no-await-in-loop
|
|
889
|
+
// (await batchScan([pkg.existing]).next()).value
|
|
890
|
+
// console.log('oldArtifact', oldArtifact)
|
|
891
|
+
// if (oldArtifact.type === 'success') {
|
|
892
|
+
// issues = issues.filter(
|
|
893
|
+
// ({ type }) =>
|
|
894
|
+
// oldPkgData.value.issues.find(
|
|
895
|
+
// oldIssue => oldIssue.type === type
|
|
896
|
+
// ) === undefined
|
|
897
|
+
// )
|
|
898
|
+
// }
|
|
652
899
|
}
|
|
653
900
|
}
|
|
654
|
-
|
|
655
|
-
|
|
656
|
-
|
|
657
|
-
|
|
658
|
-
|
|
659
|
-
|
|
660
|
-
|
|
661
|
-
|
|
662
|
-
|
|
663
|
-
}
|
|
901
|
+
}
|
|
902
|
+
if (!blocked) {
|
|
903
|
+
const pkg = pkgs.find(p => p.pkgid === id);
|
|
904
|
+
if (pkg) {
|
|
905
|
+
await tarball.stream(id, stream => {
|
|
906
|
+
stream.resume();
|
|
907
|
+
return stream.promise();
|
|
908
|
+
}, {
|
|
909
|
+
...safeArb[kCtorArgs][0]
|
|
910
|
+
});
|
|
664
911
|
}
|
|
665
912
|
}
|
|
666
913
|
if (displayWarning) {
|
|
667
914
|
spinner.stop(`(socket) ${formatter.hyperlink(id, `https://socket.dev/npm/package/${name}/overview/${version}`)} contains risks:`);
|
|
668
|
-
|
|
669
|
-
if ((0, _packages.isBlessedPackageName)(name)) {
|
|
670
|
-
failures = failures.filter(({
|
|
671
|
-
type
|
|
672
|
-
}) => type !== 'unpopularPackage' && type !== 'unstableOwnership');
|
|
673
|
-
}
|
|
674
|
-
failures.sort((a, b) => a.type < b.type ? -1 : 1);
|
|
915
|
+
alerts.sort((a, b) => a.type < b.type ? -1 : 1);
|
|
675
916
|
const lines = new Set();
|
|
676
|
-
for (const
|
|
677
|
-
const {
|
|
678
|
-
type
|
|
679
|
-
} = failure;
|
|
917
|
+
for (const alert of alerts) {
|
|
680
918
|
// Based data from { pageProps: { alertTypes } } of:
|
|
681
919
|
// https://socket.dev/_next/data/94666139314b6437ee4491a0864e72b264547585/en-US.json
|
|
682
|
-
const info = translations.
|
|
683
|
-
const title = info?.title ?? type;
|
|
684
|
-
const
|
|
920
|
+
const info = translations.alerts[alert.type];
|
|
921
|
+
const title = info?.title ?? alert.type;
|
|
922
|
+
const attributes = [...(alert.fixable ? ['fixable'] : []), ...(alert.block ? [] : ['non-blocking'])];
|
|
923
|
+
const maybeAttributes = attributes.length ? ` (${attributes.join('; ')})` : '';
|
|
685
924
|
const maybeDesc = info?.description ? ` - ${info.description}` : '';
|
|
686
925
|
// TODO: emoji seems to mis-align terminals sometimes
|
|
687
|
-
lines.add(` ${title}${
|
|
926
|
+
lines.add(` ${title}${maybeAttributes}${maybeDesc}\n`);
|
|
688
927
|
}
|
|
689
928
|
for (const line of lines) {
|
|
690
929
|
output?.write(line);
|
|
@@ -693,20 +932,14 @@ async function packagesHaveRiskyIssues(safeArb, _registry, pkgs, output) {
|
|
|
693
932
|
}
|
|
694
933
|
remaining -= 1;
|
|
695
934
|
spinner.text = remaining > 0 ? getText() : '';
|
|
935
|
+
packageAlerts.push(...alerts);
|
|
696
936
|
}
|
|
697
|
-
|
|
937
|
+
} catch (e) {
|
|
938
|
+
console.log('error', e);
|
|
698
939
|
} finally {
|
|
699
940
|
spinner.stop();
|
|
700
941
|
}
|
|
701
|
-
|
|
702
|
-
function pkgidParts(pkgid) {
|
|
703
|
-
const delimiter = pkgid.lastIndexOf('@');
|
|
704
|
-
const name = pkgid.slice(0, delimiter);
|
|
705
|
-
const version = pkgid.slice(delimiter + 1);
|
|
706
|
-
return {
|
|
707
|
-
name,
|
|
708
|
-
version
|
|
709
|
-
};
|
|
942
|
+
return packageAlerts;
|
|
710
943
|
}
|
|
711
944
|
function toRepoUrl(resolved) {
|
|
712
945
|
return resolved.replace(/#[\s\S]*$/, '').replace(/\?[\s\S]*$/, '').replace(/\/[^/]*\/-\/[\s\S]*$/, '');
|
|
@@ -1439,36 +1672,19 @@ class SafeArborist extends Arborist {
|
|
|
1439
1672
|
if (!proceed) {
|
|
1440
1673
|
proceed = await ttyServer.captureTTY(async (input, output) => {
|
|
1441
1674
|
if (input && output) {
|
|
1442
|
-
const
|
|
1443
|
-
if (!
|
|
1675
|
+
const alerts = await getPackagesAlerts(this, this['registry'], diff, output);
|
|
1676
|
+
if (!alerts.length) {
|
|
1444
1677
|
return true;
|
|
1445
1678
|
}
|
|
1446
|
-
|
|
1447
|
-
|
|
1448
|
-
|
|
1449
|
-
|
|
1450
|
-
|
|
1679
|
+
return await _confirm({
|
|
1680
|
+
message: 'Accept risks of installing these packages?',
|
|
1681
|
+
default: false
|
|
1682
|
+
}, {
|
|
1683
|
+
input,
|
|
1684
|
+
output,
|
|
1685
|
+
signal: abortSignal
|
|
1451
1686
|
});
|
|
1452
|
-
|
|
1453
|
-
try {
|
|
1454
|
-
while (true) {
|
|
1455
|
-
// eslint-disable-next-line no-await-in-loop
|
|
1456
|
-
const answer = await new Promise(resolve => {
|
|
1457
|
-
rli.question('Accept risks of installing these packages (y/N)?\n', {
|
|
1458
|
-
signal: abortSignal
|
|
1459
|
-
}, resolve);
|
|
1460
|
-
});
|
|
1461
|
-
if (/^\s*y(?:es)?\s*$/i.test(answer)) {
|
|
1462
|
-
return true;
|
|
1463
|
-
}
|
|
1464
|
-
if (/^(?:\s*no?\s*|)$/i.test(answer)) {
|
|
1465
|
-
return false;
|
|
1466
|
-
}
|
|
1467
|
-
}
|
|
1468
|
-
} finally {
|
|
1469
|
-
rli.close();
|
|
1470
|
-
}
|
|
1471
|
-
} else if (await packagesHaveRiskyIssues(this, this['registry'], diff, output)) {
|
|
1687
|
+
} else if ((await getPackagesAlerts(this, this['registry'], diff, output)).length > 0) {
|
|
1472
1688
|
throw new Error('Socket npm Unable to prompt to accept risk, need TTY to do so');
|
|
1473
1689
|
}
|
|
1474
1690
|
return true;
|
|
@@ -1569,7 +1785,7 @@ void (async () => {
|
|
|
1569
1785
|
}
|
|
1570
1786
|
});
|
|
1571
1787
|
}
|
|
1572
|
-
_uxLookup = (0, _issueRules.
|
|
1788
|
+
_uxLookup = (0, _issueRules.createAlertUXLookup)(settings);
|
|
1573
1789
|
})();
|
|
1574
1790
|
|
|
1575
1791
|
var _constants = constants.constants;
|
|
@@ -1581,7 +1797,7 @@ var _link = link.link;
|
|
|
1581
1797
|
|
|
1582
1798
|
(function (exports) {
|
|
1583
1799
|
|
|
1584
|
-
var _interopRequireWildcard =
|
|
1800
|
+
var _interopRequireWildcard = vendor.interopRequireWildcard.default;
|
|
1585
1801
|
Object.defineProperty(exports, "__esModule", {
|
|
1586
1802
|
value: true
|
|
1587
1803
|
});
|
|
@@ -1606,6 +1822,6 @@ var _link = link.link;
|
|
|
1606
1822
|
});
|
|
1607
1823
|
} (npmInjection$2));
|
|
1608
1824
|
|
|
1609
|
-
var npmInjection = /*@__PURE__*/
|
|
1825
|
+
var npmInjection = /*@__PURE__*/vendor.getDefaultExportFromCjs(npmInjection$2);
|
|
1610
1826
|
|
|
1611
1827
|
module.exports = npmInjection;
|