From 4fdd0175b10d78cc8fafa5d6a38988f8a1411e03 Mon Sep 17 00:00:00 2001 From: Mark Owsiak Date: Tue, 2 Oct 2018 17:11:47 -0400 Subject: [PATCH 1/7] fix: address npm audit security report --- lib/cli.js | 1 + lib/git/commits.js | 2 +- package.json | 7 +- test/steps/publish-to-npm.test.js | 4 + .../conventional-commits-parser/.editorconfig | 12 + .../.gitattributes | 1 + vendor/conventional-commits-parser/.jscsrc | 5 + vendor/conventional-commits-parser/.jshintrc | 15 + vendor/conventional-commits-parser/.npmignore | 2 + .../conventional-commits-parser/.travis.yml | 7 + .../conventional-commits-parser/CHANGELOG.md | 24 + vendor/conventional-commits-parser/README.md | 306 ++ vendor/conventional-commits-parser/cli.js | 135 + vendor/conventional-commits-parser/index.js | 94 + .../conventional-commits-parser/lib/parser.js | 227 + .../conventional-commits-parser/lib/regex.js | 52 + .../package-lock.json | 3644 +++++++++++++++++ .../conventional-commits-parser/package.json | 79 + .../test/cli.spec.js | 113 + .../test/fixtures/bad_commit.txt | 1 + .../test/fixtures/log1.txt | 8 + .../test/fixtures/log2.txt | 7 + .../test/fixtures/log3.txt | 11 + .../test/index.spec.js | 275 ++ .../test/parser.spec.js | 557 +++ .../test/regex.spec.js | 179 + 26 files changed, 5763 insertions(+), 5 deletions(-) create mode 100644 vendor/conventional-commits-parser/.editorconfig create mode 100644 vendor/conventional-commits-parser/.gitattributes create mode 100644 vendor/conventional-commits-parser/.jscsrc create mode 100644 vendor/conventional-commits-parser/.jshintrc create mode 100644 vendor/conventional-commits-parser/.npmignore create mode 100644 vendor/conventional-commits-parser/.travis.yml create mode 100644 vendor/conventional-commits-parser/CHANGELOG.md create mode 100644 vendor/conventional-commits-parser/README.md create mode 100755 vendor/conventional-commits-parser/cli.js create mode 100644 vendor/conventional-commits-parser/index.js create mode 100644 vendor/conventional-commits-parser/lib/parser.js create mode 100644 vendor/conventional-commits-parser/lib/regex.js create mode 100644 vendor/conventional-commits-parser/package-lock.json create mode 100644 vendor/conventional-commits-parser/package.json create mode 100644 vendor/conventional-commits-parser/test/cli.spec.js create mode 100644 vendor/conventional-commits-parser/test/fixtures/bad_commit.txt create mode 100644 vendor/conventional-commits-parser/test/fixtures/log1.txt create mode 100644 vendor/conventional-commits-parser/test/fixtures/log2.txt create mode 100644 vendor/conventional-commits-parser/test/fixtures/log3.txt create mode 100644 vendor/conventional-commits-parser/test/index.spec.js create mode 100644 vendor/conventional-commits-parser/test/parser.spec.js create mode 100644 vendor/conventional-commits-parser/test/regex.spec.js diff --git a/lib/cli.js b/lib/cli.js index d4a1046..454e129 100644 --- a/lib/cli.js +++ b/lib/cli.js @@ -97,6 +97,7 @@ if (argv.version) { } else { const cwd = process.cwd(); const packageJsonFile = path.join(cwd, 'package.json'); + // eslint-disable-next-line import/no-dynamic-require const pkg = require(packageJsonFile); command(cwd, pkg, pkg.nlm ? _.merge({}, pkg.nlm, argv) : argv) .catch(prettyPrintErrorAndExit) diff --git a/lib/git/commits.js b/lib/git/commits.js index 396f305..34027c6 100644 --- a/lib/git/commits.js +++ b/lib/git/commits.js @@ -32,7 +32,7 @@ 'use strict'; -const commitParser = require('conventional-commits-parser'); +const commitParser = require('../../vendor/conventional-commits-parser'); const debug = require('debug')('nlm:git:commits'); const _ = require('lodash'); diff --git a/package.json b/package.json index 72e2939..df8ff45 100644 --- a/package.json +++ b/package.json @@ -28,13 +28,12 @@ }, "dependencies": { "bluebird": "^3.3.3", - "conventional-commits-parser": "~0.1.2", "debug": "^2.2.0", "glob": "^6.0.1", "gofer": "^3.2.0", - "lodash": "^4.6.1", + "lodash": "^4.17.11", "minimist": "^1.2.0", - "rc": "^1.1.5", + "rc": "^1.2.8", "semver": "^5.1.0" }, "devDependencies": { @@ -44,7 +43,7 @@ "eslint-plugin-import": "^2.8.0", "eslint-plugin-node": "^5.1.1", "eslint-plugin-prettier": "^2.2.0", - "mocha": "^3.1.2", + "mocha": "^5.2.0", "prettier": "^1.6.1" }, "author": { diff --git a/test/steps/publish-to-npm.test.js b/test/steps/publish-to-npm.test.js index c672d4b..9f39536 100644 --- a/test/steps/publish-to-npm.test.js +++ b/test/steps/publish-to-npm.test.js @@ -74,6 +74,7 @@ describe('publishToNpm', function() { it('sends basic auth headers', function() { this.timeout(4000); + // eslint-disable-next-line import/no-dynamic-require return publishToNpm(dirname, require(`${dirname}/package.json`), { currentBranch: 'master', distTag: 'latest', @@ -116,6 +117,7 @@ describe('publishToNpm', function() { it('uses a bearer token', function() { this.timeout(4000); + // eslint-disable-next-line import/no-dynamic-require const pkg = require(`${dirname}/package.json`); return publishToNpm(dirname, pkg, getTokenOptions()).then(function() { assert.deepEqual( @@ -138,6 +140,7 @@ describe('publishToNpm', function() { const opts = getTokenOptions({ commit: false }); return publishToNpm( dirname, + // eslint-disable-next-line import/no-dynamic-require require(`${dirname}/package.json`), opts ).then(function() { @@ -155,6 +158,7 @@ describe('publishToNpm', function() { { private: true, }, + // eslint-disable-next-line import/no-dynamic-require require(`${dirname}/package.json`) ); return publishToNpm(dirname, pkg, getTokenOptions()).then(function() { diff --git a/vendor/conventional-commits-parser/.editorconfig b/vendor/conventional-commits-parser/.editorconfig new file mode 100644 index 0000000..4a7ea30 --- /dev/null +++ b/vendor/conventional-commits-parser/.editorconfig @@ -0,0 +1,12 @@ +root = true + +[*] +indent_style = space +indent_size = 2 +end_of_line = lf +charset = utf-8 +trim_trailing_whitespace = true +insert_final_newline = true + +[*.md] +trim_trailing_whitespace = false diff --git a/vendor/conventional-commits-parser/.gitattributes b/vendor/conventional-commits-parser/.gitattributes new file mode 100644 index 0000000..176a458 --- /dev/null +++ b/vendor/conventional-commits-parser/.gitattributes @@ -0,0 +1 @@ +* text=auto diff --git a/vendor/conventional-commits-parser/.jscsrc b/vendor/conventional-commits-parser/.jscsrc new file mode 100644 index 0000000..703fb35 --- /dev/null +++ b/vendor/conventional-commits-parser/.jscsrc @@ -0,0 +1,5 @@ +{ + "preset": "google", + "maximumLineLength": null, + "excludeFiles": ["node_modules/**"] +} diff --git a/vendor/conventional-commits-parser/.jshintrc b/vendor/conventional-commits-parser/.jshintrc new file mode 100644 index 0000000..2f6b3f5 --- /dev/null +++ b/vendor/conventional-commits-parser/.jshintrc @@ -0,0 +1,15 @@ +{ + "boss": true, + "curly": true, + "eqeqeq": true, + "eqnull": true, + "immed": true, + "latedef": true, + "mocha": true, + "newcap": true, + "noarg": true, + "node": true, + "sub": true, + "undef": true, + "unused": true +} diff --git a/vendor/conventional-commits-parser/.npmignore b/vendor/conventional-commits-parser/.npmignore new file mode 100644 index 0000000..91fa8cf --- /dev/null +++ b/vendor/conventional-commits-parser/.npmignore @@ -0,0 +1,2 @@ +/node_modules/ +npm-debug.log diff --git a/vendor/conventional-commits-parser/.travis.yml b/vendor/conventional-commits-parser/.travis.yml new file mode 100644 index 0000000..bd5ce43 --- /dev/null +++ b/vendor/conventional-commits-parser/.travis.yml @@ -0,0 +1,7 @@ +sudo: false +language: node_js +node_js: + - 'iojs' + - '0.12' + - '0.10' +after_script: NODE_ENV=test istanbul cover ./node_modules/mocha/bin/_mocha -- -R spec && cat ./coverage/lcov.info | ./node_modules/coveralls/bin/coveralls.js && rm -rf ./coverage diff --git a/vendor/conventional-commits-parser/CHANGELOG.md b/vendor/conventional-commits-parser/CHANGELOG.md new file mode 100644 index 0000000..70b11d1 --- /dev/null +++ b/vendor/conventional-commits-parser/CHANGELOG.md @@ -0,0 +1,24 @@ + +## [0.1.2](https://github.com/stevemao/conventional-commits-parser/compare/v0.1.1...v0.1.2) (2015-09-18) + + +### Bug Fixes + +* **parser:** do not trim spaces but newlines ([62e7bf5](https://github.com/stevemao/conventional-commits-parser/commit/62e7bf5)) + + + + +## [0.1.1](https://github.com/stevemao/conventional-commits-parser/compare/v0.1.0...v0.1.1) (2015-09-12) + + +### Bug Fixes + +* **newlines:** preserve newlines in a part ([beb3d05](https://github.com/stevemao/conventional-commits-parser/commit/beb3d05)), closes [#15](https://github.com/stevemao/conventional-commits-parser/issues/15) + +### Features + +* **reference:** expose prefix ([9962dda](https://github.com/stevemao/conventional-commits-parser/commit/9962dda)), closes [#17](https://github.com/stevemao/conventional-commits-parser/issues/17) + + + diff --git a/vendor/conventional-commits-parser/README.md b/vendor/conventional-commits-parser/README.md new file mode 100644 index 0000000..abac751 --- /dev/null +++ b/vendor/conventional-commits-parser/README.md @@ -0,0 +1,306 @@ +# [![NPM version][npm-image]][npm-url] [![Build Status][travis-image]][travis-url] [![Dependency Status][daviddm-image]][daviddm-url] [![Coverage Status][coveralls-image]][coveralls-url] + +> Parse raw conventional commits + + +## Conventional Commit Message Format + +A minimum input should contain a raw message. + +Each commit message consists of a a **header** (mandatory), a **body** and a **footer**. + +``` +
+ +