update-browserslist-db 1.3.2 → 1.3.3

package/index.js

@@ -1,6 +1,6 @@
-let { execSync } = require('child_process')
+let { execFileSync, execSync } = require('child_process')
 let escalade = require('escalade/sync')
-let { existsSync, readFileSync, writeFileSync } = require('fs')
+let { existsSync, readFileSync, unlinkSync, writeFileSync } = require('fs')
 let { dirname, join } = require('path')
 let pico = require('picocolors')
 
@@ -224,7 +224,7 @@ function updatePackageManually(print, lock, latest) {
   let caniuseVersions = Object.keys(lockfileData.versions).sort()
   if (caniuseVersions.length === 1 && caniuseVersions[0] === latest.version) {
     print(
-      'Installed version:  ' +
+      'Installed version:       ' +
         pico.bold(pico.green(caniuseVersions[0])) +
         '\n' +
         pico.bold(pico.green('caniuse-lite is up to date')) +
@@ -238,7 +238,7 @@ function updatePackageManually(print, lock, latest) {
   }
   print(
     'Installed version' +
-      (caniuseVersions.length === 1 ? ':  ' : 's: ') +
+      (caniuseVersions.length === 1 ? ':       ' : 's:      ') +
       pico.bold(pico.red(caniuseVersions.join(', '))) +
       '\n' +
       'Removing old caniuse-lite from lock file\n'
@@ -328,6 +328,199 @@ function updateBun(print, lock, latest) {
   updateWith(print, 'bun install', 'Removing the temporary override')
 }
 
+function commandErrorText(error) {
+  return [error.message, error.stdout, error.stderr]
+    .filter(Boolean)
+    .map(i => i.toString())
+    .join('\n')
+}
+
+function getPnpmConfig(name) {
+  let output = execFileSync('pnpm', [
+    'config',
+    'get',
+    name,
+    '--json'
+  ]).toString()
+  return output.trim() === 'undefined' ? undefined : JSON.parse(output)
+}
+
+function getPnpmPackageTimes(name) {
+  let times
+  try {
+    times = JSON.parse(
+      execFileSync('pnpm', ['info', name, 'time', '--json']).toString()
+    )
+  } catch (error) /* c8 ignore start */ {
+    throw new BrowserslistUpdateError(
+      'Cannot read publication dates of ' +
+        name +
+        ' from pnpm. Refusing to bypass pnpm minimumReleaseAge.\n' +
+        commandErrorText(error)
+    )
+  } /* c8 ignore end */
+  if (!times || typeof times !== 'object' || Array.isArray(times)) {
+    /* c8 ignore next 6 */
+    throw new BrowserslistUpdateError(
+      'pnpm returned no publication dates for ' +
+        name +
+        '. Refusing to bypass pnpm minimumReleaseAge.'
+    )
+  }
+  return times
+}
+
+function getMatureVersion(name, minimumReleaseAge) {
+  let cutoff = Date.now() - minimumReleaseAge * 60 * 1000
+  let times = getPnpmPackageTimes(name)
+
+  let mature, matureTime
+  for (let version of Object.keys(times)) {
+    let time = Date.parse(times[version])
+    if (!/^\d+\.\d+\.\d+$/.test(version) || !(time <= cutoff)) continue
+    if (matureTime === undefined || time > matureTime) {
+      mature = version
+      matureTime = time
+    }
+  }
+
+  if (!mature) {
+    throw new BrowserslistUpdateError(
+      'Cannot find a ' +
+        name +
+        ' version old enough for pnpm minimumReleaseAge (' +
+        minimumReleaseAge +
+        ' minutes). Wait for a release to pass the age gate and try again.'
+    )
+  }
+
+  return mature
+}
+
+function restoreFile(file, original) {
+  if (original === undefined) {
+    if (existsSync(file)) unlinkSync(file)
+  } else {
+    writeFileSync(file, original)
+  }
+}
+
+function updatePnpmStrict(print, lock, packages) {
+  let minimumReleaseAge = getPnpmConfig('minimumReleaseAge')
+  if (
+    typeof minimumReleaseAge !== 'number' ||
+    !Number.isFinite(minimumReleaseAge) ||
+    minimumReleaseAge <= 0
+  ) {
+    throw new BrowserslistUpdateError(
+      'Cannot read a valid pnpm minimumReleaseAge. Refusing to disable pnpm security checks.'
+    )
+  }
+
+  let versions = {}
+  for (let name of packages) {
+    versions[name] = getMatureVersion(name, minimumReleaseAge)
+  }
+
+  let originalOverrides = getPnpmConfig('overrides')
+  if (
+    originalOverrides === undefined ||
+    originalOverrides === null ||
+    Array.isArray(originalOverrides) ||
+    typeof originalOverrides !== 'object'
+  ) {
+    originalOverrides = {}
+  }
+  let temporaryOverrides = { ...originalOverrides, ...versions }
+  let packageDir = dirname(lock.file)
+  let workspaceFile = join(packageDir, 'pnpm-workspace.yaml')
+  let originalWorkspace = existsSync(workspaceFile)
+    ? readFileSync(workspaceFile)
+    : undefined
+  let originalLockfile = readFileSync(lock.file)
+  let command = 'pnpm config set overrides'
+
+  print(
+    'Strict pnpm minimumReleaseAge detected\n' +
+      'Latest policy-compliant: ' +
+      pico.bold(pico.green(versions['caniuse-lite'])) +
+      '\n' +
+      Object.keys(versions)
+        .filter(name => name !== 'caniuse-lite')
+        .map(name => '  ' + name + ': ' + versions[name] + '\n')
+        .join('')
+  )
+
+  try {
+    execFileSync(
+      'pnpm',
+      [
+        'config',
+        'set',
+        'overrides',
+        JSON.stringify(temporaryOverrides),
+        '--json',
+        '--location',
+        'project'
+      ],
+      { cwd: packageDir }
+    )
+
+    command = 'pnpm install --lockfile-only'
+    print(
+      'Updating caniuse-lite version\n' +
+        pico.yellow('$ ' + command) +
+        ' (with temporary policy-compliant overrides)\n'
+    )
+    execFileSync('pnpm', ['install', '--lockfile-only'], { cwd: packageDir })
+
+    restoreFile(workspaceFile, originalWorkspace)
+    // The lockfile no longer matches the restored overrides, and pnpm
+    // freezes the lockfile by default in CI
+    command = 'pnpm install --no-frozen-lockfile'
+    print(
+      'Removing temporary pnpm overrides\n' + pico.yellow('$ ' + command) + '\n'
+    )
+    execFileSync('pnpm', ['install', '--no-frozen-lockfile'], {
+      cwd: packageDir
+    })
+  } catch (error) /* c8 ignore start */ {
+    restoreFile(workspaceFile, originalWorkspace)
+    writeFileSync(lock.file, originalLockfile)
+    print(pico.red(commandErrorText(error)))
+    print(
+      pico.red('\n\nProblem with `' + command + '` call. Run it manually.\n')
+    )
+    process.exit(1)
+  } /* c8 ignore end */
+}
+
+function updatePnpm(print, lock) {
+  let lockContent = readFileSync(lock.file).toString()
+  let packages = lockContent.includes('baseline-browser-mapping')
+    ? ['caniuse-lite', 'baseline-browser-mapping']
+    : ['caniuse-lite']
+  let command = 'pnpm up --depth=9999 --no-save ' + packages.join(' ')
+
+  print('Updating caniuse-lite version\n' + pico.yellow('$ ' + command) + '\n')
+  try {
+    execFileSync('pnpm', ['up', '--depth=9999', '--no-save', ...packages], {
+      stdio: 'pipe'
+    })
+  } catch (error) /* c8 ignore start */ {
+    let text = commandErrorText(error)
+    if (text.includes('ERR_PNPM_STRICT_MIN_RELEASE_AGE_REQUIRES_SAVE')) {
+      updatePnpmStrict(print, lock, packages)
+    } else {
+      print(pico.red(text))
+      print(
+        pico.red('\n\nProblem with `' + command + '` call. Run it manually.\n')
+      )
+      process.exit(1)
+    }
+  } /* c8 ignore end */
+}
+
 function updateWith(print, cmd, message = 'Updating caniuse-lite version') {
   print(message + '\n' + pico.yellow('$ ' + cmd) + '\n')
   try {
@@ -361,16 +554,14 @@ module.exports = function updateDB(print = defaultPrint) {
     listError = e
   }
 
-  print('Latest version:     ' + pico.bold(pico.green(latest.version)) + '\n')
+  print(
+    'Registry latest:         ' + pico.bold(pico.green(latest.version)) + '\n'
+  )
 
   if (lock.mode === 'yarn' && lock.version !== 1) {
     updateWith(print, YARN_CMD + ' up -R caniuse-lite baseline-browser-mapping')
   } else if (lock.mode === 'pnpm') {
-    let lockContent = readFileSync(lock.file).toString()
-    let packages = lockContent.includes('baseline-browser-mapping')
-      ? 'caniuse-lite baseline-browser-mapping'
-      : 'caniuse-lite'
-    updateWith(print, 'pnpm up --depth=9999 --no-save ' + packages)
+    updatePnpm(print, lock)
   } else if (lock.mode === 'bun') {
     updateBun(print, lock, latest)
   } else if (lock.mode === 'deno') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "update-browserslist-db",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "CLI tool to update caniuse-lite to refresh target browsers from Browserslist config",
   "keywords": [
     "browsers",