Skip to content

Commit

Permalink
fix: audit package mismatch in special case
Browse files Browse the repository at this point in the history
  • Loading branch information
fritzy authored and lukekarrys committed Dec 7, 2022
1 parent 4a1ebeb commit 83fb125
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 3 deletions.
8 changes: 5 additions & 3 deletions workspaces/arborist/lib/arborist/build-ideal-tree.js
Original file line number Diff line number Diff line change
Expand Up @@ -619,14 +619,16 @@ module.exports = cls => class IdealTreeBuilder extends cls {
continue
}

const { isSemVerMajor, version } = fixAvailable
// name may be different if parent fixes the dep
// see Vuln fixAvailable setter
const { isSemVerMajor, version, name: fixName } = fixAvailable
const breakingMessage = isSemVerMajor
? 'a SemVer major change'
: 'outside your stated dependency range'
log.warn('audit', `Updating ${name} to ${version}, ` +
log.warn('audit', `Updating ${fixName} to ${version}, ` +
`which is ${breakingMessage}.`)

await this[_add](node, { add: [`${name}@${version}`] })
await this[_add](node, { add: [`${fixName}@${version}`] })
nodesTouched.add(node)
}
}
Expand Down
3 changes: 3 additions & 0 deletions workspaces/arborist/lib/vuln.js
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,9 @@ class Vuln {
// - {name, version, isSemVerMajor} fix requires -f, is semver major
// - {name, version} fix requires -f, not semver major
// - true: fix does not require -f
// TODO: duped entries may require different fixes but the current
// structure does not support this, so the case were a top level fix
// corrects a duped entry may mean you have to run fix more than once
for (const v of this.via) {
// don't blow up on loops
if (v.fixAvailable === f) {
Expand Down

0 comments on commit 83fb125

Please sign in to comment.