-
Notifications
You must be signed in to change notification settings - Fork 3.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Make sure to validate any lock file (either package-lock.json or npm-shrinkwrap.json) against the current install. This will properly throw an error in case any of the dependencies being installed don't match the dependencies that are currently listed in the lock file. Fixes: #2701 Fixes: #3947
- Loading branch information
Showing
8 changed files
with
304 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,29 @@ | ||
// compares the inventory of package items in the tree | ||
// that is about to be installed (idealTree) with the inventory | ||
// of items stored in the package-lock file (virtualTree) | ||
// | ||
// Returns empty array if no errors found or an array populated | ||
// with an entry for each validation error found. | ||
function validateLockfile (virtualTree, idealTree) { | ||
const errors = [] | ||
|
||
// loops through the inventory of packages resulted by ideal tree, | ||
// for each package compares the versions with the version stored in the | ||
// package-lock and adds an error to the list in case of mismatches | ||
for (const [key, entry] of idealTree.entries()) { | ||
const lock = virtualTree.get(key) | ||
|
||
if (!lock) { | ||
errors.push(`Missing: ${entry.name}@${entry.version} from lock file`) | ||
continue | ||
} | ||
|
||
if (entry.version !== lock.version) { | ||
errors.push(`Invalid: lock file's ${lock.name}@${lock.version} does ` + | ||
`not satisfy ${entry.name}@${entry.version}`) | ||
} | ||
} | ||
return errors | ||
} | ||
|
||
module.exports = validateLockfile |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
/* IMPORTANT | ||
* This snapshot file is auto-generated, but designed for humans. | ||
* It should be checked into source control and tracked carefully. | ||
* Re-generate by setting TAP_SNAPSHOT=1 and running tests. | ||
* Make sure to inspect the output below. Do not ignore changes! | ||
*/ | ||
'use strict' | ||
exports[`test/lib/commands/ci.js TAP should throw error when ideal inventory mismatches virtual > must match snapshot 1`] = ` | ||
\`npm ci\` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with \`npm install\` before continuing. | ||
Invalid: lock file's foo@1.0.0 does not satisfy foo@2.0.0 | ||
` |
35 changes: 35 additions & 0 deletions
35
tap-snapshots/test/lib/utils/validate-lockfile.js.test.cjs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,35 @@ | ||
/* IMPORTANT | ||
* This snapshot file is auto-generated, but designed for humans. | ||
* It should be checked into source control and tracked carefully. | ||
* Re-generate by setting TAP_SNAPSHOT=1 and running tests. | ||
* Make sure to inspect the output below. Do not ignore changes! | ||
*/ | ||
'use strict' | ||
exports[`test/lib/utils/validate-lockfile.js TAP extra inventory items on idealTree > should have missing entries error 1`] = ` | ||
Array [ | ||
"Missing: baz@3.0.0 from lock file", | ||
] | ||
` | ||
|
||
exports[`test/lib/utils/validate-lockfile.js TAP extra inventory items on virtualTree > should have no errors if finding virtualTree extra items 1`] = ` | ||
Array [] | ||
` | ||
|
||
exports[`test/lib/utils/validate-lockfile.js TAP identical inventory for both idealTree and virtualTree > should have no errors on identical inventories 1`] = ` | ||
Array [] | ||
` | ||
|
||
exports[`test/lib/utils/validate-lockfile.js TAP mismatching versions on inventory > should have errors for each mismatching version 1`] = ` | ||
Array [ | ||
"Invalid: lock file's foo@1.0.0 does not satisfy foo@2.0.0", | ||
"Invalid: lock file's bar@2.0.0 does not satisfy bar@3.0.0", | ||
] | ||
` | ||
|
||
exports[`test/lib/utils/validate-lockfile.js TAP missing virtualTree inventory > should have errors for each mismatching version 1`] = ` | ||
Array [ | ||
"Missing: foo@1.0.0 from lock file", | ||
"Missing: bar@2.0.0 from lock file", | ||
"Missing: baz@3.0.0 from lock file", | ||
] | ||
` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,82 @@ | ||
const t = require('tap') | ||
const validateLockfile = require('../../../lib/utils/validate-lockfile.js') | ||
|
||
t.test('identical inventory for both idealTree and virtualTree', async t => { | ||
t.matchSnapshot( | ||
validateLockfile( | ||
new Map([ | ||
['foo', { name: 'foo', version: '1.0.0' }], | ||
['bar', { name: 'bar', version: '2.0.0' }], | ||
]), | ||
new Map([ | ||
['foo', { name: 'foo', version: '1.0.0' }], | ||
['bar', { name: 'bar', version: '2.0.0' }], | ||
]) | ||
), | ||
'should have no errors on identical inventories' | ||
) | ||
}) | ||
|
||
t.test('extra inventory items on idealTree', async t => { | ||
t.matchSnapshot( | ||
validateLockfile( | ||
new Map([ | ||
['foo', { name: 'foo', version: '1.0.0' }], | ||
['bar', { name: 'bar', version: '2.0.0' }], | ||
]), | ||
new Map([ | ||
['foo', { name: 'foo', version: '1.0.0' }], | ||
['bar', { name: 'bar', version: '2.0.0' }], | ||
['baz', { name: 'baz', version: '3.0.0' }], | ||
]) | ||
), | ||
'should have missing entries error' | ||
) | ||
}) | ||
|
||
t.test('extra inventory items on virtualTree', async t => { | ||
t.matchSnapshot( | ||
validateLockfile( | ||
new Map([ | ||
['foo', { name: 'foo', version: '1.0.0' }], | ||
['bar', { name: 'bar', version: '2.0.0' }], | ||
['baz', { name: 'baz', version: '3.0.0' }], | ||
]), | ||
new Map([ | ||
['foo', { name: 'foo', version: '1.0.0' }], | ||
['bar', { name: 'bar', version: '2.0.0' }], | ||
]) | ||
), | ||
'should have no errors if finding virtualTree extra items' | ||
) | ||
}) | ||
|
||
t.test('mismatching versions on inventory', async t => { | ||
t.matchSnapshot( | ||
validateLockfile( | ||
new Map([ | ||
['foo', { name: 'foo', version: '1.0.0' }], | ||
['bar', { name: 'bar', version: '2.0.0' }], | ||
]), | ||
new Map([ | ||
['foo', { name: 'foo', version: '2.0.0' }], | ||
['bar', { name: 'bar', version: '3.0.0' }], | ||
]) | ||
), | ||
'should have errors for each mismatching version' | ||
) | ||
}) | ||
|
||
t.test('missing virtualTree inventory', async t => { | ||
t.matchSnapshot( | ||
validateLockfile( | ||
new Map([]), | ||
new Map([ | ||
['foo', { name: 'foo', version: '1.0.0' }], | ||
['bar', { name: 'bar', version: '2.0.0' }], | ||
['baz', { name: 'baz', version: '3.0.0' }], | ||
]) | ||
), | ||
'should have errors for each mismatching version' | ||
) | ||
}) |