mirror of
https://github.com/nodejs/node.git
synced 2025-05-21 17:44:15 +00:00
1f287b04a2
PR-URL: https://github.com/nodejs/node/pull/36953 Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com>
952 lines
32 KiB
JavaScript
952 lines
32 KiB
JavaScript
// a module that manages a shrinkwrap file (npm-shrinkwrap.json or
|
|
// package-lock.json).
|
|
|
|
// Increment whenever the lockfile version updates
|
|
// v1 - npm <=6
|
|
// v2 - arborist v1, npm v7, backwards compatible with v1, add 'packages'
|
|
// v3 will drop the 'dependencies' field, backwards comp with v2, not v1
|
|
//
|
|
// We cannot bump to v3 until npm v6 is out of common usage, and
|
|
// definitely not before npm v8.
|
|
|
|
const lockfileVersion = 2
|
|
|
|
// for comparing nodes to yarn.lock entries
|
|
const mismatch = (a, b) => a && b && a !== b
|
|
|
|
// this.tree => the root node for the tree (ie, same path as this)
|
|
// - Set the first time we do `this.add(node)` for a path matching this.path
|
|
//
|
|
// this.add(node) =>
|
|
// - decorate the node with the metadata we have, if we have it, and it matches
|
|
// - add to the map of nodes needing to be committed, so that subsequent
|
|
// changes are captured when we commit that location's metadata.
|
|
//
|
|
// this.commit() =>
|
|
// - commit all nodes awaiting update to their metadata entries
|
|
// - re-generate this.data and this.yarnLock based on this.tree
|
|
//
|
|
// Note that between this.add() and this.commit(), `this.data` will be out of
|
|
// date! Always call `commit()` before relying on it.
|
|
//
|
|
// After calling this.commit(), any nodes not present in the tree will have
|
|
// been removed from the shrinkwrap data as well.
|
|
|
|
const YarnLock = require('./yarn-lock.js')
|
|
const {promisify} = require('util')
|
|
const rimraf = promisify(require('rimraf'))
|
|
const fs = require('fs')
|
|
const readFile = promisify(fs.readFile)
|
|
const writeFile = promisify(fs.writeFile)
|
|
const stat = promisify(fs.stat)
|
|
const readdir = promisify(fs.readdir)
|
|
const { resolve, basename } = require('path')
|
|
const specFromLock = require('./spec-from-lock.js')
|
|
const versionFromTgz = require('./version-from-tgz.js')
|
|
const npa = require('npm-package-arg')
|
|
const rpj = require('read-package-json-fast')
|
|
const parseJSON = require('parse-conflict-json')
|
|
|
|
const stringify = require('json-stringify-nice')
|
|
const swKeyOrder = [
|
|
'name',
|
|
'version',
|
|
'lockfileVersion',
|
|
'resolved',
|
|
'integrity',
|
|
'requires',
|
|
'packages',
|
|
'dependencies',
|
|
]
|
|
|
|
// sometimes resolved: is weird or broken, or something npa can't handle
|
|
const specFromResolved = resolved => {
|
|
try {
|
|
return npa(resolved)
|
|
} catch (er) {
|
|
return {}
|
|
}
|
|
}
|
|
|
|
const relpath = require('./relpath.js')
|
|
|
|
const consistentResolve = require('./consistent-resolve.js')
|
|
|
|
const maybeReadFile = file => {
|
|
return readFile(file, 'utf8').then(d => d, er => {
|
|
/* istanbul ignore else - can't test without breaking module itself */
|
|
if (er.code === 'ENOENT')
|
|
return ''
|
|
else
|
|
throw er
|
|
})
|
|
}
|
|
|
|
const maybeStatFile = file => {
|
|
return stat(file).then(st => st.isFile(), er => {
|
|
/* istanbul ignore else - can't test without breaking module itself */
|
|
if (er.code === 'ENOENT')
|
|
return null
|
|
else
|
|
throw er
|
|
})
|
|
}
|
|
|
|
const pkgMetaKeys = [
|
|
// note: name is included if necessary, for alias packages
|
|
'version',
|
|
'dependencies',
|
|
'peerDependencies',
|
|
'peerDependenciesMeta',
|
|
'optionalDependencies',
|
|
'bundleDependencies',
|
|
'acceptDependencies',
|
|
'funding',
|
|
'engines',
|
|
'os',
|
|
'cpu',
|
|
'_integrity',
|
|
'license',
|
|
'_hasShrinkwrap',
|
|
'hasInstallScript',
|
|
'bin',
|
|
'deprecated',
|
|
'workspaces',
|
|
]
|
|
|
|
const nodeMetaKeys = [
|
|
'integrity',
|
|
'inBundle',
|
|
'hasShrinkwrap',
|
|
'hasInstallScript',
|
|
]
|
|
|
|
const metaFieldFromPkg = (pkg, key) => {
|
|
const val = pkg[key]
|
|
// get the license type, not an object
|
|
return (key === 'license' && val && typeof val === 'object' && val.type)
|
|
? val.type
|
|
// skip empty objects and falsey values
|
|
: (val && !(typeof val === 'object' && !Object.keys(val).length)) ? val
|
|
: null
|
|
}
|
|
|
|
// check to make sure that there are no packages newer than the hidden lockfile
|
|
const assertNoNewer = async (path, data, lockTime, dir = path, seen = null) => {
|
|
const base = basename(dir)
|
|
const isNM = dir !== path && base === 'node_modules'
|
|
const isScope = dir !== path && !isNM && base.charAt(0) === '@'
|
|
const isParent = dir === path || isNM || isScope
|
|
|
|
const rel = relpath(path, dir)
|
|
if (dir !== path) {
|
|
const dirTime = (await stat(dir)).mtime
|
|
if (dirTime > lockTime)
|
|
throw 'out of date, updated: ' + rel
|
|
if (!isScope && !isNM && !data.packages[rel])
|
|
throw 'missing from lockfile: ' + rel
|
|
seen.add(rel)
|
|
} else
|
|
seen = new Set([rel])
|
|
|
|
const parent = isParent ? dir : resolve(dir, 'node_modules')
|
|
const children = dir === path
|
|
? Promise.resolve([{name: 'node_modules', isDirectory: () => true }])
|
|
: readdir(parent, { withFileTypes: true })
|
|
|
|
return children.catch(() => [])
|
|
.then(ents => Promise.all(
|
|
ents.filter(ent => ent.isDirectory() && !/^\./.test(ent.name))
|
|
.map(ent => assertNoNewer(path, data, lockTime, resolve(parent, ent.name), seen))
|
|
)).then(() => {
|
|
if (dir !== path)
|
|
return
|
|
|
|
// assert that all the entries in the lockfile were seen
|
|
for (const loc of new Set(Object.keys(data.packages))) {
|
|
if (!seen.has(loc))
|
|
throw 'missing from node_modules: ' + loc
|
|
}
|
|
})
|
|
}
|
|
|
|
const _awaitingUpdate = Symbol('_awaitingUpdate')
|
|
const _updateWaitingNode = Symbol('_updateWaitingNode')
|
|
const _lockFromLoc = Symbol('_lockFromLoc')
|
|
const _pathToLoc = Symbol('_pathToLoc')
|
|
const _loadAll = Symbol('_loadAll')
|
|
const _metaFromLock = Symbol('_metaFromLock')
|
|
const _resolveMetaNode = Symbol('_resolveMetaNode')
|
|
const _fixDependencies = Symbol('_fixDependencies')
|
|
const _buildLegacyLockfile = Symbol('_buildLegacyLockfile')
|
|
const _filenameSet = Symbol('_filenameSet')
|
|
const _maybeRead = Symbol('_maybeRead')
|
|
const _maybeStat = Symbol('_maybeStat')
|
|
class Shrinkwrap {
|
|
static load (options) {
|
|
return new Shrinkwrap(options).load()
|
|
}
|
|
|
|
static get keyOrder () {
|
|
return swKeyOrder
|
|
}
|
|
|
|
static reset (options) {
|
|
// still need to know if it was loaded from the disk, but don't
|
|
// bother reading it if we're gonna just throw it away.
|
|
const s = new Shrinkwrap(options)
|
|
s.reset()
|
|
|
|
return s[_maybeStat]().then(([sw, lock]) => {
|
|
s.filename = resolve(s.path,
|
|
(s.hiddenLockfile ? 'node_modules/.package-lock'
|
|
: s.shrinkwrapOnly || sw ? 'npm-shrinkwrap'
|
|
: 'package-lock') + '.json')
|
|
s.loadedFromDisk = !!(sw || lock)
|
|
s.type = basename(s.filename)
|
|
return s
|
|
})
|
|
}
|
|
|
|
static metaFromNode (node, path) {
|
|
if (node.isLink) {
|
|
return {
|
|
resolved: relpath(path, node.realpath),
|
|
link: true,
|
|
}
|
|
}
|
|
|
|
const meta = {}
|
|
pkgMetaKeys.forEach(key => {
|
|
const val = metaFieldFromPkg(node.package, key)
|
|
if (val)
|
|
meta[key.replace(/^_/, '')] = val
|
|
})
|
|
// we only include name if different from the node path name
|
|
const pname = node.package.name
|
|
if (pname && pname !== node.name)
|
|
meta.name = pname
|
|
|
|
if (node.isTop && node.package.devDependencies)
|
|
meta.devDependencies = node.package.devDependencies
|
|
|
|
nodeMetaKeys.forEach(key => {
|
|
if (node[key])
|
|
meta[key] = node[key]
|
|
})
|
|
|
|
const resolved = consistentResolve(node.resolved, node.path, path, true)
|
|
if (resolved)
|
|
meta.resolved = resolved
|
|
|
|
if (node.extraneous)
|
|
meta.extraneous = true
|
|
else {
|
|
if (node.peer)
|
|
meta.peer = true
|
|
if (node.dev)
|
|
meta.dev = true
|
|
if (node.optional)
|
|
meta.optional = true
|
|
if (node.devOptional && !node.dev && !node.optional)
|
|
meta.devOptional = true
|
|
}
|
|
return meta
|
|
}
|
|
|
|
constructor (options = {}) {
|
|
const {
|
|
path,
|
|
indent = 2,
|
|
newline = '\n',
|
|
shrinkwrapOnly = false,
|
|
hiddenLockfile = false,
|
|
} = options
|
|
this[_awaitingUpdate] = new Map()
|
|
this.tree = null
|
|
this.path = resolve(path || '.')
|
|
this.filename = null
|
|
this.data = null
|
|
this.indent = indent
|
|
this.newline = newline
|
|
this.loadedFromDisk = false
|
|
this.type = null
|
|
this.yarnLock = null
|
|
this.hiddenLockfile = hiddenLockfile
|
|
this.loadingError = null
|
|
// only load npm-shrinkwrap.json in dep trees, not package-lock
|
|
this.shrinkwrapOnly = shrinkwrapOnly
|
|
}
|
|
|
|
// check to see if a spec is present in the yarn.lock file, and if so,
|
|
// if we should use it, and what it should resolve to. This is only
|
|
// done when we did not load a shrinkwrap from disk. Also, decorate
|
|
// the options object if provided with the resolved and integrity that
|
|
// we expect.
|
|
checkYarnLock (spec, options = {}) {
|
|
spec = npa(spec)
|
|
const { yarnLock, loadedFromDisk } = this
|
|
const useYarnLock = yarnLock && !loadedFromDisk
|
|
const fromYarn = useYarnLock && yarnLock.entries.get(spec.raw)
|
|
if (fromYarn && fromYarn.version) {
|
|
// if it's the yarn or npm default registry, use the version as
|
|
// our effective spec. if it's any other kind of thing, use that.
|
|
const yarnRegRe = /^https?:\/\/registry.yarnpkg.com\//
|
|
const npmRegRe = /^https?:\/\/registry.npmjs.org\//
|
|
const {resolved, version, integrity} = fromYarn
|
|
const isYarnReg = spec.registry && yarnRegRe.test(resolved)
|
|
const isnpmReg = spec.registry && !isYarnReg && npmRegRe.test(resolved)
|
|
const isReg = isnpmReg || isYarnReg
|
|
// don't use the simple version if the "registry" url is
|
|
// something else entirely!
|
|
const tgz = isReg && versionFromTgz(spec.name, resolved) || {}
|
|
const yspec = tgz.name === spec.name && tgz.version === version ? version
|
|
: isReg && tgz.name && tgz.version ? `npm:${tgz.name}@${tgz.version}`
|
|
: resolved
|
|
if (yspec) {
|
|
options.resolved = resolved.replace(yarnRegRe, 'https://registry.npmjs.org/')
|
|
options.integrity = integrity
|
|
return npa(`${spec.name}@${yspec}`)
|
|
}
|
|
}
|
|
return spec
|
|
}
|
|
|
|
// throw away the shrinkwrap data so we can start fresh
|
|
// still worth doing a load() first so we know which files to write.
|
|
reset () {
|
|
this.tree = null
|
|
this[_awaitingUpdate] = new Map()
|
|
this.data = {
|
|
lockfileVersion,
|
|
requires: true,
|
|
packages: {},
|
|
dependencies: {},
|
|
}
|
|
}
|
|
|
|
[_filenameSet] () {
|
|
return this.shrinkwrapOnly ? [
|
|
this.path + '/npm-shrinkwrap.json',
|
|
] : this.hiddenLockfile ? [
|
|
null,
|
|
this.path + '/node_modules/.package-lock.json',
|
|
] : [
|
|
this.path + '/npm-shrinkwrap.json',
|
|
this.path + '/package-lock.json',
|
|
this.path + '/yarn.lock',
|
|
]
|
|
}
|
|
|
|
[_maybeRead] () {
|
|
return Promise.all(this[_filenameSet]().map(fn => fn && maybeReadFile(fn)))
|
|
}
|
|
|
|
[_maybeStat] () {
|
|
// throw away yarn, we only care about lock or shrinkwrap when checking
|
|
// this way, since we're not actually loading the full lock metadata
|
|
return Promise.all(this[_filenameSet]().slice(0, 2)
|
|
.map(fn => fn && maybeStatFile(fn)))
|
|
}
|
|
|
|
load () {
|
|
// we don't need to load package-lock.json except for top of tree nodes,
|
|
// only npm-shrinkwrap.json.
|
|
return this[_maybeRead]().then(([sw, lock, yarn]) => {
|
|
const data = sw || lock || ''
|
|
|
|
// use shrinkwrap only for deps, otherwise prefer package-lock
|
|
// and ignore npm-shrinkwrap if both are present.
|
|
// TODO: emit a warning here or something if both are present.
|
|
this.filename = resolve(this.path,
|
|
(this.hiddenLockfile ? 'node_modules/.package-lock'
|
|
: this.shrinkwrapOnly || sw ? 'npm-shrinkwrap'
|
|
: 'package-lock') + '.json')
|
|
|
|
this.type = basename(this.filename)
|
|
this.loadedFromDisk = !!data
|
|
|
|
if (yarn) {
|
|
this.yarnLock = new YarnLock()
|
|
// ignore invalid yarn data. we'll likely clobber it later anyway.
|
|
try {
|
|
this.yarnLock.parse(yarn)
|
|
} catch (_) {}
|
|
}
|
|
|
|
return data ? parseJSON(data) : {}
|
|
}).then(async data => {
|
|
// don't use detect-indent, just pick the first line.
|
|
// if the file starts with {" then we have an indent of '', ie, none
|
|
// which will default to 2 at save time.
|
|
const {
|
|
[Symbol.for('indent')]: indent,
|
|
[Symbol.for('newline')]: newline,
|
|
} = data
|
|
this.indent = indent !== undefined ? indent : this.indent
|
|
this.newline = newline !== undefined ? newline : this.newline
|
|
|
|
if (!this.hiddenLockfile || !data.packages)
|
|
return data
|
|
|
|
// add a few ms just to account for jitter
|
|
const lockTime = +(await stat(this.filename)).mtime + 10
|
|
await assertNoNewer(this.path, data, lockTime)
|
|
|
|
// all good! hidden lockfile is the newest thing in here.
|
|
return data
|
|
}).catch(er => {
|
|
this.loadingError = er
|
|
this.loadedFromDisk = false
|
|
this.ancientLockfile = false
|
|
return {}
|
|
}).then(lock => {
|
|
this.data = {
|
|
...lock,
|
|
lockfileVersion,
|
|
requires: true,
|
|
packages: lock.packages || {},
|
|
...(this.hiddenLockfile ? {} : {dependencies: lock.dependencies || {}}),
|
|
}
|
|
this.originalLockfileVersion = lock.lockfileVersion
|
|
this.ancientLockfile = this.loadedFromDisk &&
|
|
!(lock.lockfileVersion >= 2) && !lock.requires
|
|
|
|
// load old lockfile deps into the packages listing
|
|
if (lock.dependencies && !lock.packages) {
|
|
return rpj(this.path + '/package.json').then(pkg => pkg, er => ({}))
|
|
.then(pkg => {
|
|
this[_loadAll]('', null, this.data)
|
|
this[_fixDependencies](pkg)
|
|
})
|
|
}
|
|
})
|
|
.then(() => this)
|
|
}
|
|
|
|
[_loadAll] (location, name, lock) {
|
|
// migrate a v1 package lock to the new format.
|
|
const meta = this[_metaFromLock](location, name, lock)
|
|
// dependencies nested under a link are actually under the link target
|
|
if (meta.link)
|
|
location = meta.resolved
|
|
if (lock.dependencies) {
|
|
for (const [name, dep] of Object.entries(lock.dependencies)) {
|
|
const loc = location + (location ? '/' : '') + 'node_modules/' + name
|
|
this[_loadAll](loc, name, dep)
|
|
}
|
|
}
|
|
}
|
|
|
|
// v1 lockfiles track the optional/dev flags, but they don't tell us
|
|
// which thing had what kind of dep on what other thing, so we need
|
|
// to correct that now, or every link will be considered prod
|
|
[_fixDependencies] (pkg) {
|
|
// we need the root package.json because legacy shrinkwraps just
|
|
// have requires:true at the root level, which is even less useful
|
|
// than merging all dep types into one object.
|
|
const root = this.data.packages['']
|
|
pkgMetaKeys.forEach(key => {
|
|
const val = metaFieldFromPkg(pkg, key)
|
|
const k = key.replace(/^_/, '')
|
|
if (val)
|
|
root[k] = val
|
|
})
|
|
|
|
for (const [loc, meta] of Object.entries(this.data.packages)) {
|
|
if (!meta.requires || !loc)
|
|
continue
|
|
|
|
// resolve each require to a meta entry
|
|
// if this node isn't optional, but the dep is, then it's an optionalDep
|
|
// likewise for dev deps.
|
|
// This isn't perfect, but it's a pretty good approximation, and at
|
|
// least gets us out of having all 'prod' edges, which throws off the
|
|
// buildIdealTree process
|
|
for (const [name, spec] of Object.entries(meta.requires)) {
|
|
const dep = this[_resolveMetaNode](loc, name)
|
|
// this overwrites the false value set above
|
|
const depType = dep && dep.optional && !meta.optional
|
|
? 'optionalDependencies'
|
|
: /* istanbul ignore next - dev deps are only for the root level */
|
|
dep && dep.dev && !meta.dev ? 'devDependencies'
|
|
// also land here if the dep just isn't in the tree, which maybe
|
|
// should be an error, since it means that the shrinkwrap is
|
|
// invalid, but we can't do much better without any info.
|
|
: 'dependencies'
|
|
meta[depType] = meta[depType] || {}
|
|
meta[depType][name] = spec
|
|
}
|
|
delete meta.requires
|
|
}
|
|
}
|
|
|
|
[_resolveMetaNode] (loc, name) {
|
|
for (let path = loc; true; path = path.replace(/(^|\/)[^/]*$/, '')) {
|
|
const check = `${path}${path ? '/' : ''}node_modules/${name}`
|
|
if (this.data.packages[check])
|
|
return this.data.packages[check]
|
|
|
|
if (!path)
|
|
break
|
|
}
|
|
return null
|
|
}
|
|
|
|
[_lockFromLoc] (lock, path, i = 0) {
|
|
if (!lock)
|
|
return null
|
|
|
|
if (path[i] === '')
|
|
i++
|
|
|
|
if (i >= path.length)
|
|
return lock
|
|
|
|
if (!lock.dependencies)
|
|
return null
|
|
|
|
return this[_lockFromLoc](lock.dependencies[path[i]], path, i + 1)
|
|
}
|
|
|
|
// pass in a path relative to the root path, or an absolute path,
|
|
// get back a /-normalized location based on root path.
|
|
[_pathToLoc] (path) {
|
|
return relpath(this.path, resolve(this.path, path))
|
|
}
|
|
|
|
delete (nodePath) {
|
|
if (!this.data)
|
|
throw new Error('run load() before getting or setting data')
|
|
const location = this[_pathToLoc](nodePath)
|
|
this[_awaitingUpdate].delete(location)
|
|
|
|
delete this.data.packages[location]
|
|
const path = location.split(/(?:^|\/)node_modules\//)
|
|
const name = path.pop()
|
|
const pLock = this[_lockFromLoc](this.data, path)
|
|
if (pLock && pLock.dependencies)
|
|
delete pLock.dependencies[name]
|
|
}
|
|
|
|
get (nodePath) {
|
|
if (!this.data)
|
|
throw new Error('run load() before getting or setting data')
|
|
|
|
const location = this[_pathToLoc](nodePath)
|
|
if (this[_awaitingUpdate].has(location))
|
|
this[_updateWaitingNode](location)
|
|
|
|
// first try to get from the newer spot, which we know has
|
|
// all the things we need.
|
|
if (this.data.packages[location])
|
|
return this.data.packages[location]
|
|
|
|
// otherwise, fall back to the legacy metadata, and hope for the best
|
|
// get the node in the shrinkwrap corresponding to this spot
|
|
const path = location.split(/(?:^|\/)node_modules\//)
|
|
const name = path[path.length - 1]
|
|
const lock = this[_lockFromLoc](this.data, path)
|
|
|
|
return this[_metaFromLock](location, name, lock)
|
|
}
|
|
|
|
[_metaFromLock] (location, name, lock) {
|
|
// This function tries as hard as it can to figure out the metadata
|
|
// from a lockfile which may be outdated or incomplete. Since v1
|
|
// lockfiles used the "version" field to contain a variety of
|
|
// different possible types of data, this gets a little complicated.
|
|
if (!lock)
|
|
return {}
|
|
|
|
// try to figure out a npm-package-arg spec from the lockfile entry
|
|
// This will return null if we could not get anything valid out of it.
|
|
const spec = specFromLock(name, lock, this.path)
|
|
|
|
if (spec.type === 'directory') {
|
|
// the "version" was a file: url to a non-tarball path
|
|
// this is a symlink dep. We don't store much metadata
|
|
// about symlinks, just the target.
|
|
const target = relpath(this.path, spec.fetchSpec)
|
|
this.data.packages[location] = {
|
|
link: true,
|
|
resolved: target,
|
|
}
|
|
// also save the link target, omitting version since we don't know
|
|
// what it is, but we know it isn't a link to itself!
|
|
if (!this.data.packages[target])
|
|
this[_metaFromLock](target, name, { ...lock, version: null })
|
|
return this.data.packages[location]
|
|
}
|
|
|
|
const meta = {}
|
|
// when calling loadAll we'll change these into proper dep objects
|
|
if (lock.requires && typeof lock.requires === 'object')
|
|
meta.requires = lock.requires
|
|
|
|
if (lock.optional)
|
|
meta.optional = true
|
|
if (lock.dev)
|
|
meta.dev = true
|
|
|
|
// the root will typically have a name from the root project's
|
|
// package.json file.
|
|
if (location === '')
|
|
meta.name = lock.name
|
|
|
|
// if we have integrity, save it now.
|
|
if (lock.integrity)
|
|
meta.integrity = lock.integrity
|
|
|
|
if (lock.version && !lock.integrity) {
|
|
// this is usually going to be a git url or symlink, but it could
|
|
// also be a registry dependency that did not have integrity at
|
|
// the time it was saved.
|
|
// Symlinks were already handled above, so that leaves git.
|
|
//
|
|
// For git, always save the full SSH url. we'll actually fetch the
|
|
// tgz most of the time, since it's faster, but it won't work for
|
|
// private repos, and we can't get back to the ssh from the tgz,
|
|
// so we store the ssh instead.
|
|
// For unknown git hosts, just resolve to the raw spec in lock.version
|
|
if (spec.type === 'git') {
|
|
meta.resolved = consistentResolve(spec, this.path, this.path)
|
|
|
|
// return early because there is nothing else we can do with this
|
|
return this.data.packages[location] = meta
|
|
} else if (spec.registry) {
|
|
// registry dep that didn't save integrity. grab the version, and
|
|
// fall through to pick up the resolved and potentially name.
|
|
meta.version = lock.version
|
|
}
|
|
// only other possible case is a tarball without integrity.
|
|
// fall through to do what we can with the filename later.
|
|
}
|
|
|
|
// at this point, we know that the spec is either a registry dep
|
|
// (ie, version, because locking, which means a resolved url),
|
|
// or a remote dep, or file: url. Remote deps and file urls
|
|
// have a fetchSpec equal to the fully resolved thing.
|
|
// Registry deps, we take what's in the lockfile.
|
|
if (lock.resolved || (spec.type && !spec.registry)) {
|
|
if (spec.registry)
|
|
meta.resolved = lock.resolved
|
|
else if (spec.type === 'file')
|
|
meta.resolved = consistentResolve(spec, this.path, this.path, true)
|
|
else if (spec.fetchSpec)
|
|
meta.resolved = spec.fetchSpec
|
|
}
|
|
|
|
// at this point, if still we don't have a version, do our best to
|
|
// infer it from the tarball url/file. This works a surprising
|
|
// amount of the time, even though it's not guaranteed.
|
|
if (!meta.version) {
|
|
if (spec.type === 'file' || spec.type === 'remote') {
|
|
const fromTgz = versionFromTgz(spec.name, spec.fetchSpec) ||
|
|
versionFromTgz(spec.name, meta.resolved)
|
|
if (fromTgz) {
|
|
meta.version = fromTgz.version
|
|
if (fromTgz.name !== name)
|
|
meta.name = fromTgz.name
|
|
}
|
|
} else if (spec.type === 'alias') {
|
|
meta.name = spec.subSpec.name
|
|
meta.version = spec.subSpec.fetchSpec
|
|
} else if (spec.type === 'version')
|
|
meta.version = spec.fetchSpec
|
|
// ok, I did my best! good luck!
|
|
}
|
|
|
|
if (lock.bundled)
|
|
meta.inBundle = true
|
|
|
|
// save it for next time
|
|
return this.data.packages[location] = meta
|
|
}
|
|
|
|
add (node) {
|
|
if (!this.data)
|
|
throw new Error('run load() before getting or setting data')
|
|
|
|
// will be actually updated on read
|
|
const loc = relpath(this.path, node.path)
|
|
if (node.path === this.path)
|
|
this.tree = node
|
|
|
|
// if we have metadata about this node, and it's a match, then
|
|
// try to decorate it.
|
|
if (node.resolved === null || node.integrity === null) {
|
|
const {
|
|
resolved,
|
|
integrity,
|
|
hasShrinkwrap,
|
|
} = this.get(node.path)
|
|
|
|
const pathFixed = !resolved ? null
|
|
: !/^file:/.test(resolved) ? resolved
|
|
// resolve onto the metadata path
|
|
: `file:${resolve(this.path, resolved.substr(5))}`
|
|
|
|
// if we have one, only set the other if it matches
|
|
// otherwise it could be for a completely different thing.
|
|
const resolvedOk = !resolved || !node.resolved ||
|
|
node.resolved === pathFixed
|
|
const integrityOk = !integrity || !node.integrity ||
|
|
node.integrity === integrity
|
|
|
|
if ((resolved || integrity) && resolvedOk && integrityOk) {
|
|
node.resolved = node.resolved || pathFixed || null
|
|
node.integrity = node.integrity || integrity || null
|
|
node.hasShrinkwrap = node.hasShrinkwrap || hasShrinkwrap || false
|
|
} else {
|
|
// try to read off the package or node itself
|
|
const {
|
|
resolved,
|
|
integrity,
|
|
hasShrinkwrap,
|
|
} = Shrinkwrap.metaFromNode(node, this.path)
|
|
node.resolved = node.resolved || resolved || null
|
|
node.integrity = node.integrity || integrity || null
|
|
node.hasShrinkwrap = node.hasShrinkwrap || hasShrinkwrap || false
|
|
}
|
|
}
|
|
this[_awaitingUpdate].set(loc, node)
|
|
}
|
|
|
|
addEdge (edge) {
|
|
if (!this.yarnLock || !edge.valid)
|
|
return
|
|
|
|
const { to: node } = edge
|
|
|
|
// if it's already set up, nothing to do
|
|
if (node.resolved !== null && node.integrity !== null)
|
|
return
|
|
|
|
// if the yarn lock is empty, nothing to do
|
|
if (!this.yarnLock.entries || !this.yarnLock.entries.size)
|
|
return
|
|
|
|
// we relativize the path here because that's how it shows up in the lock
|
|
// XXX how is this different from pathFixed above??
|
|
const pathFixed = !node.resolved ? null
|
|
: !/file:/.test(node.resolved) ? node.resolved
|
|
: consistentResolve(node.resolved, node.path, this.path, true)
|
|
|
|
const entry = this.yarnLock.entries.get(`${node.name}@${edge.spec}`)
|
|
|
|
if (!entry ||
|
|
mismatch(node.version, entry.version) ||
|
|
mismatch(node.integrity, entry.integrity) ||
|
|
mismatch(pathFixed, entry.resolved))
|
|
return
|
|
|
|
node.integrity = node.integrity || entry.integrity || null
|
|
node.resolved = node.resolved ||
|
|
consistentResolve(entry.resolved, this.path, node.path) || null
|
|
|
|
this[_awaitingUpdate].set(relpath(this.path, node.path), node)
|
|
}
|
|
|
|
[_updateWaitingNode] (loc) {
|
|
const node = this[_awaitingUpdate].get(loc)
|
|
this[_awaitingUpdate].delete(loc)
|
|
this.data.packages[loc] = Shrinkwrap.metaFromNode(node, this.path)
|
|
}
|
|
|
|
commit () {
|
|
if (this.tree) {
|
|
if (this.yarnLock)
|
|
this.yarnLock.fromTree(this.tree)
|
|
const root = Shrinkwrap.metaFromNode(this.tree.target || this.tree, this.path)
|
|
this.data.packages = {}
|
|
if (Object.keys(root).length)
|
|
this.data.packages[''] = root
|
|
for (const node of this.tree.root.inventory.values()) {
|
|
// only way this.tree is not root is if the root is a link to it
|
|
if (node === this.tree || node.isRoot || node.location === '')
|
|
continue
|
|
const loc = relpath(this.path, node.path)
|
|
this.data.packages[loc] = Shrinkwrap.metaFromNode(node, this.path)
|
|
}
|
|
} else if (this[_awaitingUpdate].size > 0) {
|
|
for (const loc of this[_awaitingUpdate].keys())
|
|
this[_updateWaitingNode](loc)
|
|
}
|
|
|
|
// hidden lockfiles don't include legacy metadata or a root entry
|
|
if (this.hiddenLockfile) {
|
|
delete this.data.packages['']
|
|
delete this.data.dependencies
|
|
} else if (this.tree)
|
|
this[_buildLegacyLockfile](this.tree, this.data)
|
|
|
|
return this.data
|
|
}
|
|
|
|
[_buildLegacyLockfile] (node, lock, path = []) {
|
|
if (node === this.tree) {
|
|
// the root node
|
|
lock.name = node.package.name || node.name
|
|
if (node.version)
|
|
lock.version = node.version
|
|
}
|
|
|
|
// npm v6 and before tracked 'from', meaning "the request that led
|
|
// to this package being installed". However, that's inherently
|
|
// racey and non-deterministic in a world where deps are deduped
|
|
// ahead of fetch time. In order to maintain backwards compatibility
|
|
// with v6 in the lockfile, we do this trick where we pick a valid
|
|
// dep link out of the edgesIn set. Choose the edge with the fewest
|
|
// number of `node_modules` sections in the requestor path, and then
|
|
// lexically sort afterwards.
|
|
const edge = [...node.edgesIn].filter(e => e.valid).sort((a, b) => {
|
|
const aloc = a.from.location.split('node_modules')
|
|
const bloc = b.from.location.split('node_modules')
|
|
/* istanbul ignore next - sort calling order is indeterminate */
|
|
return aloc.length > bloc.length ? 1
|
|
: bloc.length > aloc.length ? -1
|
|
: aloc[aloc.length - 1].localeCompare(bloc[bloc.length - 1])
|
|
})[0]
|
|
|
|
const res = consistentResolve(node.resolved, this.path, this.path, true)
|
|
const rSpec = specFromResolved(res)
|
|
|
|
// if we don't have anything (ie, it's extraneous) then use the resolved
|
|
// value as if that was where we got it from, since at least it's true.
|
|
// if we don't have either, just an empty object so nothing matches below.
|
|
// This will effectively just save the version and resolved, as if it's
|
|
// a standard version/range dep, which is a reasonable default.
|
|
const spec = !edge ? rSpec
|
|
: npa.resolve(node.name, edge.spec, edge.from.realpath)
|
|
|
|
if (node.target)
|
|
lock.version = `file:${relpath(this.path, node.realpath)}`
|
|
else if (spec && (spec.type === 'file' || spec.type === 'remote'))
|
|
lock.version = spec.saveSpec
|
|
else if (spec && spec.type === 'git' || rSpec.type === 'git') {
|
|
lock.version = node.resolved
|
|
/* istanbul ignore else - don't think there are any cases where a git
|
|
* spec (or indeed, ANY npa spec) doesn't have a .raw member */
|
|
if (spec.raw)
|
|
lock.from = spec.raw
|
|
} else if (!node.isRoot &&
|
|
node.package &&
|
|
node.package.name &&
|
|
node.package.name !== node.name)
|
|
lock.version = `npm:${node.package.name}@${node.version}`
|
|
else if (node.package && node.version)
|
|
lock.version = node.version
|
|
|
|
if (node.inDepBundle)
|
|
lock.bundled = true
|
|
|
|
// when we didn't resolve to git, file, or dir, and didn't request
|
|
// git, file, dir, or remote, then the resolved value is necessary.
|
|
if (node.resolved &&
|
|
!node.target &&
|
|
rSpec.type !== 'git' &&
|
|
rSpec.type !== 'file' &&
|
|
rSpec.type !== 'directory' &&
|
|
spec.type !== 'directory' &&
|
|
spec.type !== 'git' &&
|
|
spec.type !== 'file' &&
|
|
spec.type !== 'remote')
|
|
lock.resolved = node.resolved
|
|
|
|
if (node.integrity)
|
|
lock.integrity = node.integrity
|
|
|
|
if (node.extraneous)
|
|
lock.extraneous = true
|
|
else if (!node.isLink) {
|
|
if (node.peer)
|
|
lock.peer = true
|
|
|
|
if (node.devOptional && !node.dev && !node.optional)
|
|
lock.devOptional = true
|
|
|
|
if (node.dev)
|
|
lock.dev = true
|
|
|
|
if (node.optional)
|
|
lock.optional = true
|
|
}
|
|
|
|
const depender = node.target || node
|
|
if (depender.edgesOut.size > 0) {
|
|
if (node !== this.tree) {
|
|
lock.requires = [...depender.edgesOut.entries()].reduce((set, [k, v]) => {
|
|
// omit peer deps from legacy lockfile requires field, because
|
|
// npm v6 doesn't handle peer deps, and this triggers some bad
|
|
// behavior if the dep can't be found in the dependencies list.
|
|
const { spec, peer } = v
|
|
if (peer)
|
|
return set
|
|
if (spec.startsWith('file:')) {
|
|
// turn absolute file: paths into relative paths from the node
|
|
// this especially shows up with workspace edges when the root
|
|
// node is also a workspace in the set.
|
|
const p = resolve(node.realpath, spec.substr('file:'.length))
|
|
set[k] = `file:${relpath(node.realpath, p)}`
|
|
} else
|
|
set[k] = spec
|
|
return set
|
|
}, {})
|
|
} else
|
|
lock.requires = true
|
|
}
|
|
|
|
// now we walk the children, putting them in the 'dependencies' object
|
|
const {children} = node.target || node
|
|
if (!children.size)
|
|
delete lock.dependencies
|
|
else {
|
|
const kidPath = [...path, node.realpath]
|
|
const dependencies = {}
|
|
// skip any that are already in the descent path, so cyclical link
|
|
// dependencies don't blow up with ELOOP.
|
|
let found = false
|
|
for (const [name, kid] of children.entries()) {
|
|
if (path.includes(kid.realpath))
|
|
continue
|
|
dependencies[name] = this[_buildLegacyLockfile](kid, {}, kidPath)
|
|
found = true
|
|
}
|
|
if (found)
|
|
lock.dependencies = dependencies
|
|
}
|
|
return lock
|
|
}
|
|
|
|
save (options = {}) {
|
|
if (!this.data)
|
|
throw new Error('run load() before saving data')
|
|
|
|
const { format = true } = options
|
|
const defaultIndent = this.indent || 2
|
|
const indent = format === true ? defaultIndent
|
|
: format || 0
|
|
const eol = format ? this.newline || '\n' : ''
|
|
const data = this.commit()
|
|
const json = stringify(data, swKeyOrder, indent).replace(/\n/g, eol)
|
|
return Promise.all([
|
|
writeFile(this.filename, json).catch(er => {
|
|
if (this.hiddenLockfile) {
|
|
// well, we did our best.
|
|
// if we reify, and there's nothing there, then it might be lacking
|
|
// a node_modules folder, but then the lockfile is not important.
|
|
// Remove the file, so that in case there WERE deps, but we just
|
|
// failed to update the file for some reason, it's not out of sync.
|
|
return rimraf(this.filename)
|
|
}
|
|
throw er
|
|
}),
|
|
this.yarnLock && this.yarnLock.entries.size &&
|
|
writeFile(this.path + '/yarn.lock', this.yarnLock.toString()),
|
|
])
|
|
}
|
|
}
|
|
|
|
module.exports = Shrinkwrap
|