socket 0.14.40-alpha.0 → 0.14.40-alpha.2

package/dist/module-sync/cli.js

@@ -1745,8 +1745,9 @@ const optimize = {
         if (isNpm) {
           console.log(`💡 Re-run ${COMMAND_TITLE} whenever ${lockName} changes.\n   This can be skipped once npm ships ${NPM_OVERRIDE_PR_URL}.`);
         }
-      } catch {
+      } catch (e) {
         spinner.error(`${COMMAND_TITLE}: ${agent} install failed to update ${lockName}`);
+        console.error(e);
       }
     }
   }

package/dist/module-sync/npm-injection.js

@@ -426,17 +426,19 @@ async function getPackagesAlerts(safeArb, pkgs, output) {
             raw: alert,
             fixable: isAlertFixable(alert)
           });
-          // Before we ask about problematic issues, check to see if they
-          // already existed in the old version if they did, be quiet.
-          const existing = pkgs.find(p => p.existing?.startsWith(`${name}@`))?.existing;
-          if (existing) {
-            const oldArtifact =
-            // eslint-disable-next-line no-await-in-loop
-            (await batchScan([existing]).next()).value;
-            if (oldArtifact?.alerts?.length) {
-              alerts = alerts.filter(({
-                type
-              }) => !oldArtifact.alerts?.find(a => a.type === type));
+          if (!ENV[SOCKET_CLI_FIX_PACKAGE_LOCK_FILE]) {
+            // Before we ask about problematic issues, check to see if they
+            // already existed in the old version if they did, be quiet.
+            const existing = pkgs.find(p => p.existing?.startsWith(`${name}@`))?.existing;
+            if (existing) {
+              const oldArtifact =
+              // eslint-disable-next-line no-await-in-loop
+              (await batchScan([existing]).next()).value;
+              if (oldArtifact?.alerts?.length) {
+                alerts = alerts.filter(({
+                  type
+                }) => !oldArtifact.alerts?.find(a => a.type === type));
+              }
             }
           }
         }
@@ -482,10 +484,14 @@ async function getPackagesAlerts(safeArb, pkgs, output) {
   return packageAlerts;
 }
 function toRepoUrl(resolved) {
-  return resolved.replace(/#[\s\S]*$/, '').replace(/\?[\s\S]*$/, '').replace(/\/[^/]*\/-\/[\s\S]*$/, '');
+  try {
+    return URL.parse(resolved)?.origin ?? '';
+  } catch {}
+  return '';
 }
-function walk(diff_, needInfoOn = []) {
-  const queue = [diff_];
+function walk(diff_) {
+  const needInfoOn = [];
+  const queue = [...diff_.children];
   let pos = 0;
   let {
     length: queueLength
@@ -495,9 +501,6 @@ function walk(diff_, needInfoOn = []) {
       throw new Error('Detected infinite loop while walking Arborist diff');
     }
     const diff = queue[pos++];
-    if (!diff) {
-      continue;
-    }
     const {
       action
     } = diff;
@@ -526,10 +529,23 @@ function walk(diff_, needInfoOn = []) {
         });
       }
     }
-    if (diff.children) {
-      for (const child of diff.children) {
-        queue[queueLength++] = child;
-      }
+    for (const child of diff.children) {
+      queue[queueLength++] = child;
+    }
+  }
+  if (ENV[SOCKET_CLI_FIX_PACKAGE_LOCK_FILE]) {
+    const {
+      unchanged
+    } = diff_;
+    for (let i = 0, {
+        length
+      } = unchanged; i < length; i += 1) {
+      const pkgNode = unchanged[i];
+      needInfoOn.push({
+        existing: pkgNode.pkgid,
+        pkgid: pkgNode.pkgid,
+        repository_url: toRepoUrl(pkgNode.resolved)
+      });
     }
   }
   return needInfoOn;
@@ -1220,16 +1236,16 @@ class SafeArborist extends Arborist {
     options.dryRun = old.dryRun;
     options['save'] = old.save;
     options['saveBundle'] = old.saveBundle;
-    // Nothing to check, hmmm already installed or all private?
-    const diff = walk(this['diff']);
-    if (diff.findIndex(c => c.repository_url === NPM_REGISTRY_URL) === -1) {
+    const needInfoOn = walk(this['diff']);
+    if (needInfoOn.findIndex(c => c.repository_url === NPM_REGISTRY_URL) === -1) {
+      // Nothing to check, hmmm already installed or all private?
       return await this[kRiskyReify](...args);
     }
     const input = process.stdin;
     const output = process.stderr;
     let alerts;
     const proceed = ENV[SOCKET_CLI_UPDATE_OVERRIDES_IN_PACKAGE_LOCK_FILE] || (await (async () => {
-      alerts = await getPackagesAlerts(this, diff, output);
+      alerts = await getPackagesAlerts(this, needInfoOn, output);
       if (!alerts.length || ENV[SOCKET_CLI_FIX_PACKAGE_LOCK_FILE]) {
         return true;
       }

package/dist/require/cli.js

@@ -1741,8 +1741,9 @@ const optimize = {
         if (isNpm) {
           console.log(`💡 Re-run ${COMMAND_TITLE} whenever ${lockName} changes.\n   This can be skipped once npm ships ${NPM_OVERRIDE_PR_URL}.`);
         }
-      } catch {
+      } catch (e) {
         spinner.error(`${COMMAND_TITLE}: ${agent} install failed to update ${lockName}`);
+        console.error(e);
       }
     }
   }

package/dist/require/npm-injection.js

@@ -426,17 +426,19 @@ async function getPackagesAlerts(safeArb, pkgs, output) {
             raw: alert,
             fixable: isAlertFixable(alert)
           });
-          // Before we ask about problematic issues, check to see if they
-          // already existed in the old version if they did, be quiet.
-          const existing = pkgs.find(p => p.existing?.startsWith(`${name}@`))?.existing;
-          if (existing) {
-            const oldArtifact =
-            // eslint-disable-next-line no-await-in-loop
-            (await batchScan([existing]).next()).value;
-            if (oldArtifact?.alerts?.length) {
-              alerts = alerts.filter(({
-                type
-              }) => !oldArtifact.alerts?.find(a => a.type === type));
+          if (!ENV[SOCKET_CLI_FIX_PACKAGE_LOCK_FILE]) {
+            // Before we ask about problematic issues, check to see if they
+            // already existed in the old version if they did, be quiet.
+            const existing = pkgs.find(p => p.existing?.startsWith(`${name}@`))?.existing;
+            if (existing) {
+              const oldArtifact =
+              // eslint-disable-next-line no-await-in-loop
+              (await batchScan([existing]).next()).value;
+              if (oldArtifact?.alerts?.length) {
+                alerts = alerts.filter(({
+                  type
+                }) => !oldArtifact.alerts?.find(a => a.type === type));
+              }
             }
           }
         }
@@ -482,10 +484,14 @@ async function getPackagesAlerts(safeArb, pkgs, output) {
   return packageAlerts;
 }
 function toRepoUrl(resolved) {
-  return resolved.replace(/#[\s\S]*$/, '').replace(/\?[\s\S]*$/, '').replace(/\/[^/]*\/-\/[\s\S]*$/, '');
+  try {
+    return URL.parse(resolved)?.origin ?? '';
+  } catch {}
+  return '';
 }
-function walk(diff_, needInfoOn = []) {
-  const queue = [diff_];
+function walk(diff_) {
+  const needInfoOn = [];
+  const queue = [...diff_.children];
   let pos = 0;
   let {
     length: queueLength
@@ -495,9 +501,6 @@ function walk(diff_, needInfoOn = []) {
       throw new Error('Detected infinite loop while walking Arborist diff');
     }
     const diff = queue[pos++];
-    if (!diff) {
-      continue;
-    }
     const {
       action
     } = diff;
@@ -526,10 +529,23 @@ function walk(diff_, needInfoOn = []) {
         });
       }
     }
-    if (diff.children) {
-      for (const child of diff.children) {
-        queue[queueLength++] = child;
-      }
+    for (const child of diff.children) {
+      queue[queueLength++] = child;
+    }
+  }
+  if (ENV[SOCKET_CLI_FIX_PACKAGE_LOCK_FILE]) {
+    const {
+      unchanged
+    } = diff_;
+    for (let i = 0, {
+        length
+      } = unchanged; i < length; i += 1) {
+      const pkgNode = unchanged[i];
+      needInfoOn.push({
+        existing: pkgNode.pkgid,
+        pkgid: pkgNode.pkgid,
+        repository_url: toRepoUrl(pkgNode.resolved)
+      });
     }
   }
   return needInfoOn;
@@ -1220,16 +1236,16 @@ class SafeArborist extends Arborist {
     options.dryRun = old.dryRun;
     options['save'] = old.save;
     options['saveBundle'] = old.saveBundle;
-    // Nothing to check, hmmm already installed or all private?
-    const diff = walk(this['diff']);
-    if (diff.findIndex(c => c.repository_url === NPM_REGISTRY_URL) === -1) {
+    const needInfoOn = walk(this['diff']);
+    if (needInfoOn.findIndex(c => c.repository_url === NPM_REGISTRY_URL) === -1) {
+      // Nothing to check, hmmm already installed or all private?
       return await this[kRiskyReify](...args);
     }
     const input = process.stdin;
     const output = process.stderr;
     let alerts;
     const proceed = ENV[SOCKET_CLI_UPDATE_OVERRIDES_IN_PACKAGE_LOCK_FILE] || (await (async () => {
-      alerts = await getPackagesAlerts(this, diff, output);
+      alerts = await getPackagesAlerts(this, needInfoOn, output);
       if (!alerts.length || ENV[SOCKET_CLI_FIX_PACKAGE_LOCK_FILE]) {
         return true;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "0.14.40-alpha.0",
+  "version": "0.14.40-alpha.2",
   "description": "CLI tool for Socket.dev",
   "homepage": "http://github.com/SocketDev/socket-cli",
   "license": "MIT",