update-browserslist-db 1.3.2 → 1.3.4

package/index.js

@@ -1,6 +1,6 @@
-let { execSync } = require('child_process')
+let { execFileSync, execSync } = require('child_process')
 let escalade = require('escalade/sync')
-let { existsSync, readFileSync, writeFileSync } = require('fs')
+let { existsSync, readFileSync, unlinkSync, writeFileSync } = require('fs')
 let { dirname, join } = require('path')
 let pico = require('picocolors')
 
@@ -17,7 +17,6 @@ function BrowserslistUpdateError(message) {
 
 BrowserslistUpdateError.prototype = Error.prototype
 
-// Check if HADOOP_HOME is set to determine if this is running in a Hadoop environment
 const YARN_CMD = process.env.HADOOP_HOME ? 'yarnpkg' : 'yarn'
 
 /* c8 ignore next 3 */
@@ -70,6 +69,14 @@ function getLatestInfo(lock) {
   try {
     if (lock.mode === 'yarn') {
       if (lock.version === 1) {
+        let yarnMajorVersion = getYarnMajor()
+        if (yarnMajorVersion !== 1) {
+          throw new BrowserslistUpdateError(
+            'This project has a Yarn v1 (classic) lockfile, but the installed ' +
+              `Yarn is Berry v${yarnMajorVersion}. Install and activate Yarn classic ` +
+              'to update caniuse-lite.'
+          )
+        }
         return JSON.parse(
           execSync(YARN_CMD + ' info caniuse-lite --json').toString()
         ).data
@@ -96,7 +103,20 @@ function getLatestInfo(lock) {
 
     return JSON.parse(execSync('npm show caniuse-lite --json').toString())
   } catch (e) {
-    if (e.code === 'ENOENT' || e.status === 127) {
+    // ENOENT / status 127 are the POSIX "command not found" signals. cmd.exe
+    // instead reports `'<binary>' is not recognized as an internal or external
+    // command`. Anchor that phrase to the binary we actually launched so an
+    // unrelated "is not recognized" line in a real failure's output (e.g. a
+    // nested tool) is not mistaken for a missing package manager.
+    let binary = lock.mode === 'yarn' ? YARN_CMD : lock.mode
+    let missingOnWindows = new RegExp(
+      "'" + binary + "' is not recognized as an internal or external command"
+    )
+    if (
+      e.code === 'ENOENT' ||
+      e.status === 127 ||
+      missingOnWindows.test(commandErrorText(e))
+    ) {
       throw new BrowserslistUpdateError(
         'Cannot find ' +
           lock.mode +
@@ -109,6 +129,11 @@ function getLatestInfo(lock) {
   }
 }
 
+function getYarnMajor() {
+  let version = execSync(YARN_CMD + ' --version').toString().trim()
+  return Number(version.split('.')[0])
+}
+
 function getBrowsers() {
   let browserslist = require('browserslist')
   return browserslist().reduce((result, entry) => {
@@ -171,7 +196,13 @@ function deletePackage(node, metadata) {
 let yarnVersionRe = /version "(.*?)"/
 
 function updateYarnLockfile(lock, latest) {
-  let blocks = lock.content.split(/(\n{2,})/).map(block => {
+  // Split entries on blank lines using LF. A CRLF lockfile has `\r\n\r\n`
+  // between entries, which `\n{2,}` cannot match, so the whole file would
+  // collapse into one block and no version be detected. CRLF can occur on any
+  // OS (git autocrlf, editor settings), so normalize regardless of platform;
+  // updateLockfile restores the original EOL on the returned content.
+  let normalized = lock.content.replace(/\r\n/g, '\n')
+  let blocks = normalized.split(/(\n{2,})/).map(block => {
     return block.split('\n')
   })
   let versions = {}
@@ -224,7 +255,7 @@ function updatePackageManually(print, lock, latest) {
   let caniuseVersions = Object.keys(lockfileData.versions).sort()
   if (caniuseVersions.length === 1 && caniuseVersions[0] === latest.version) {
     print(
-      'Installed version:  ' +
+      'Installed version:       ' +
         pico.bold(pico.green(caniuseVersions[0])) +
         '\n' +
         pico.bold(pico.green('caniuse-lite is up to date')) +
@@ -238,7 +269,7 @@ function updatePackageManually(print, lock, latest) {
   }
   print(
     'Installed version' +
-      (caniuseVersions.length === 1 ? ':  ' : 's: ') +
+      (caniuseVersions.length === 1 ? ':       ' : 's:      ') +
       pico.bold(pico.red(caniuseVersions.join(', '))) +
       '\n' +
       'Removing old caniuse-lite from lock file\n'
@@ -328,6 +359,241 @@ function updateBun(print, lock, latest) {
   updateWith(print, 'bun install', 'Removing the temporary override')
 }
 
+function commandErrorText(error) {
+  return [error.message, error.stdout, error.stderr]
+    .filter(Boolean)
+    .map(i => i.toString())
+    .join('\n')
+}
+
+function quotePnpmArg(arg) {
+  // cmd.exe expands %VAR% and !VAR! even inside double quotes. It also ignores
+  // the backslash in `\"`, so JSON values end up outside its quotes, where
+  // ^ & | < > ( ) run commands or redirect output. Refuse rather than run
+  // a mangled command.
+  if (/[%!^&|<>()]/.test(arg)) {
+    throw new BrowserslistUpdateError(
+      'Cannot safely pass any of %!^&|<>() to pnpm on Windows: ' + arg
+    )
+  }
+  if (!/[\s"]/.test(arg)) return arg
+  // Escape embedded quotes (doubling any backslash run that precedes them) and
+  // double a trailing backslash run so it cannot escape the closing quote.
+  return '"' + arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1') + '"'
+}
+
+function runPnpm(args, options = {}) {
+  // Node on Windows cannot launch pnpm's `.cmd` shim without a shell
+  if (process.platform === 'win32') {
+    return execFileSync('pnpm', args.map(quotePnpmArg), {
+      ...options,
+      shell: true
+    })
+  }
+
+  return execFileSync('pnpm', args, options)
+}
+
+function getPnpmConfig(name) {
+  let output = runPnpm([
+    'config',
+    'get',
+    name,
+    '--json'
+  ]).toString()
+  return output.trim() === 'undefined' ? undefined : JSON.parse(output)
+}
+
+function getPnpmPackageTimes(name) {
+  let times
+  try {
+    times = JSON.parse(
+      runPnpm(['info', name, 'time', '--json']).toString()
+    )
+  } catch (error) /* c8 ignore start */ {
+    throw new BrowserslistUpdateError(
+      'Cannot read publication dates of ' +
+        name +
+        ' from pnpm. Refusing to bypass pnpm minimumReleaseAge.\n' +
+        commandErrorText(error)
+    )
+  } /* c8 ignore end */
+  if (!times || typeof times !== 'object' || Array.isArray(times)) {
+    /* c8 ignore next 6 */
+    throw new BrowserslistUpdateError(
+      'pnpm returned no publication dates for ' +
+        name +
+        '. Refusing to bypass pnpm minimumReleaseAge.'
+    )
+  }
+  return times
+}
+
+function getMatureVersion(name, minimumReleaseAge) {
+  let cutoff = Date.now() - minimumReleaseAge * 60 * 1000
+  let times = getPnpmPackageTimes(name)
+
+  let mature, matureTime
+  for (let version of Object.keys(times)) {
+    let time = Date.parse(times[version])
+    if (!/^\d+\.\d+\.\d+$/.test(version) || !(time <= cutoff)) continue
+    if (matureTime === undefined || time > matureTime) {
+      mature = version
+      matureTime = time
+    }
+  }
+
+  if (!mature) {
+    throw new BrowserslistUpdateError(
+      'Cannot find a ' +
+        name +
+        ' version old enough for pnpm minimumReleaseAge (' +
+        minimumReleaseAge +
+        ' minutes). Wait for a release to pass the age gate and try again.'
+    )
+  }
+
+  return mature
+}
+
+function restoreFile(file, original) {
+  if (original === undefined) {
+    if (existsSync(file)) unlinkSync(file)
+  } else {
+    writeFileSync(file, original)
+  }
+}
+
+function updatePnpmStrict(print, lock, packages) {
+  let minimumReleaseAge = getPnpmConfig('minimumReleaseAge')
+  if (
+    typeof minimumReleaseAge !== 'number' ||
+    !Number.isFinite(minimumReleaseAge) ||
+    minimumReleaseAge <= 0
+  ) {
+    throw new BrowserslistUpdateError(
+      'Cannot read a valid pnpm minimumReleaseAge. Refusing to disable pnpm security checks.'
+    )
+  }
+
+  let versions = {}
+  for (let name of packages) {
+    versions[name] = getMatureVersion(name, minimumReleaseAge)
+  }
+
+  let originalOverrides = getPnpmConfig('overrides')
+  if (
+    originalOverrides === undefined ||
+    originalOverrides === null ||
+    Array.isArray(originalOverrides) ||
+    typeof originalOverrides !== 'object'
+  ) {
+    originalOverrides = {}
+  }
+  let temporaryOverrides = { ...originalOverrides, ...versions }
+  let packageDir = dirname(lock.file)
+  let workspaceFile = join(packageDir, 'pnpm-workspace.yaml')
+  let originalWorkspace = existsSync(workspaceFile)
+    ? readFileSync(workspaceFile)
+    : undefined
+  let originalLockfile = readFileSync(lock.file)
+  let packageFile = join(packageDir, 'package.json')
+  let originalPackage = existsSync(packageFile)
+    ? readFileSync(packageFile)
+    : undefined
+  let command = 'pnpm config set overrides'
+
+  print(
+    'Strict pnpm minimumReleaseAge detected\n' +
+      'Latest policy-compliant: ' +
+      pico.bold(pico.green(versions['caniuse-lite'])) +
+      '\n' +
+      Object.keys(versions)
+        .filter(name => name !== 'caniuse-lite')
+        .map(name => '  ' + name + ': ' + versions[name] + '\n')
+        .join('')
+  )
+
+  try {
+    runPnpm(
+      [
+        'config',
+        'set',
+        'overrides',
+        JSON.stringify(temporaryOverrides),
+        '--json',
+        '--location',
+        'project'
+      ],
+      { cwd: packageDir }
+    )
+
+    command = 'pnpm install --lockfile-only'
+    print(
+      'Updating caniuse-lite version\n' +
+        pico.yellow('$ ' + command) +
+        ' (with temporary policy-compliant overrides)\n'
+    )
+    runPnpm(['install', '--lockfile-only'], { cwd: packageDir })
+
+    restoreFile(workspaceFile, originalWorkspace)
+    // The lockfile no longer matches the restored overrides, and pnpm
+    // freezes the lockfile by default in CI
+    command = 'pnpm install --no-frozen-lockfile'
+    print(
+      'Removing temporary pnpm overrides\n' + pico.yellow('$ ' + command) + '\n'
+    )
+    runPnpm(['install', '--no-frozen-lockfile'], {
+      cwd: packageDir
+    })
+  } catch (error) /* c8 ignore start */ {
+    restoreFile(workspaceFile, originalWorkspace)
+    restoreFile(packageFile, originalPackage)
+    writeFileSync(lock.file, originalLockfile)
+    print(pico.red(commandErrorText(error)))
+    print(
+      pico.red('\n\nProblem with `' + command + '` call. Run it manually.\n')
+    )
+    process.exit(1)
+  } /* c8 ignore end */
+}
+
+function updatePnpm(print, lock) {
+  let lockContent = readFileSync(lock.file).toString()
+  let packages = lockContent.includes('baseline-browser-mapping')
+    ? ['caniuse-lite', 'baseline-browser-mapping']
+    : ['caniuse-lite']
+  let command = 'pnpm up --depth=9999 --no-save ' + packages.join(' ')
+
+  print('Updating caniuse-lite version\n' + pico.yellow('$ ' + command) + '\n')
+  try {
+    runPnpm(['up', '--depth=9999', '--no-save', ...packages], {
+      stdio: 'pipe'
+    })
+  } catch (error) /* c8 ignore start */ {
+    let text = commandErrorText(error)
+    // pnpm versions before 12.4.2 can fail `up --no-save` under strict
+    // minimumReleaseAge. The error differs by version: 10 uses
+    // NO_MATURE_MATCHING_VERSION, 11 uses MINIMUM_RELEASE_AGE_VIOLATION, and
+    // 12.0–12.4.1 uses STRICT_MIN_RELEASE_AGE_REQUIRES_SAVE. In each case,
+    // resolve and pin the newest mature versions ourselves. pnpm 12.4.2+ does
+    // this natively and succeeds before reaching this catch.
+    if (
+      text.includes('ERR_PNPM_STRICT_MIN_RELEASE_AGE_REQUIRES_SAVE') ||
+      text.includes('ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION') ||
+      text.includes('ERR_PNPM_NO_MATURE_MATCHING_VERSION')
+    ) {
+      updatePnpmStrict(print, lock, packages)
+    } else {
+      print(pico.red(text))
+      print(
+        pico.red('\n\nProblem with `' + command + '` call. Run it manually.\n')
+      )
+      process.exit(1)
+    }
+  } /* c8 ignore end */
+}
+
 function updateWith(print, cmd, message = 'Updating caniuse-lite version') {
   print(message + '\n' + pico.yellow('$ ' + cmd) + '\n')
   try {
@@ -361,16 +627,14 @@ module.exports = function updateDB(print = defaultPrint) {
     listError = e
   }
 
-  print('Latest version:     ' + pico.bold(pico.green(latest.version)) + '\n')
+  print(
+    'Registry latest:         ' + pico.bold(pico.green(latest.version)) + '\n'
+  )
 
   if (lock.mode === 'yarn' && lock.version !== 1) {
     updateWith(print, YARN_CMD + ' up -R caniuse-lite baseline-browser-mapping')
   } else if (lock.mode === 'pnpm') {
-    let lockContent = readFileSync(lock.file).toString()
-    let packages = lockContent.includes('baseline-browser-mapping')
-      ? 'caniuse-lite baseline-browser-mapping'
-      : 'caniuse-lite'
-    updateWith(print, 'pnpm up --depth=9999 --no-save ' + packages)
+    updatePnpm(print, lock)
   } else if (lock.mode === 'bun') {
     updateBun(print, lock, latest)
   } else if (lock.mode === 'deno') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "update-browserslist-db",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "CLI tool to update caniuse-lite to refresh target browsers from Browserslist config",
   "keywords": [
     "browsers",