socket-security[bot]
commented
5 months ago New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
| Package | New capabilities | Transitives | Size | Publisher |
|---|---|---|---|---|
| npm/zx@8.1.8 | environment, filesystem, network, shell, unsafe | 0 |
849 kB | google-wombot |
🚮 Removed packages: npm/zx@8.0.1
This PR contains the following updates:
8.0.1->8.1.8Release Notes
google/zx (zx)
### [`v8.1.8`](https://redirect.github.com/google/zx/releases/tag/8.1.8) [Compare Source](https://redirect.github.com/google/zx/compare/8.1.7...8.1.8) - Apply the proper `TeplateStringArray` detection [#904](https://redirect.github.com/google/zx/issues/904), [#905](https://redirect.github.com/google/zx/pull/905) - `PromiseProcess` got lazy getters to optimize mem usage [#903](https://redirect.github.com/google/zx/pull/903) ### [`v8.1.7`](https://redirect.github.com/google/zx/releases/tag/8.1.7) [Compare Source](https://redirect.github.com/google/zx/compare/8.1.6...8.1.7) Step by step on the road to improvements #### Fixes Finally, we've fixed the issue with piped process rejection [#640](https://redirect.github.com/google/zx/issues/640) [#899](https://redirect.github.com/google/zx/pull/899): ```js const p1 = $`exit 1`.pipe($`echo hello`) try { await p1 } catch (e) { assert.equal(e.exitCode, 1) } const p2 = await $({ nothrow: true })`echo hello && exit 1`.pipe($`cat`) assert.equal(p2.exitCode, 0) assert.equal(p2.stdout.trim(), 'hello') ``` #### Enhancements Added `cmd` display to `ProcessPromise` [#891](https://redirect.github.com/google/zx/pull/891): ```js const foo = 'bar' const p = $`echo ${foo}` p.cmd // 'echo bar' ``` and `duration` field to `ProcessOutput` [#892](https://redirect.github.com/google/zx/pull/892): ```js const p = $`sleep 1`.nothrow() const o = await p o.duration // ~1000 (in ms) ``` Enabled [zurk-like](https://redirect.github.com/webpod/zurk/blob/main/src/test/ts/x.test.ts#L143) pipe string literals [#900](https://redirect.github.com/google/zx/pull/900): ```js const p = await $`echo foo`.pipe`cat` p.stdout.trim() // 'foo' ``` ### [`v8.1.6`](https://redirect.github.com/google/zx/releases/tag/8.1.6) [Compare Source](https://redirect.github.com/google/zx/compare/8.1.5...8.1.6) ##### Improvements & Fixes - The `$.preferLocal` option now also accepts a directory [#886](https://redirect.github.com/google/zx/pull/886), [#887](https://redirect.github.com/google/zx/pull/887). ```ts $.preferLocal = true // injects node_modules/.bin to the $PATH $.preferLocal = '/foo/bar' // attaches /foo/bar to the $PATH $.preferLocal = ['/bar', '/baz'] // now the $PATH includes both /bar and /baz ``` Why not just `$.env['PATH'] = 'extra:' + '$.env['PATH']`? Well, the API internally does the same, but also [handles the win paths peculiarities](https://redirect.github.com/google/zx/blob/main/src/util.ts#L54). - Provided `$.killSignal` option for the symmetry with the `$.timeoutSignal`. You can override the default termination flow [#885](https://redirect.github.com/google/zx/pull/885): ```ts $.killSignal = 'SIGKILL' const p = $({nothrow: true})`sleep 10000` setTimeout(p.kill, 100) (await p).signal // SIGKILL ``` - `$` opt presets became chainable [#883](https://redirect.github.com/google/zx/pull/883): ```ts const $$ = $({ nothrow: true }) assert.equal((await $$`exit 1`).exitCode, 1) const $$$ = $$({ sync: true }) // Both {nothrow: true, sync: true} are applied assert.equal($$$`exit 2`.exitCode, 2) ``` - Enhanced the internal `Duration` parser [#884](https://redirect.github.com/google/zx/pull/884): ```ts const p = $({timeout: '1mss'})`sleep 999` // raises an error now ``` - Abortion signal listeners are now removed after the process completes [#881](https://redirect.github.com/google/zx/issues/881), [#889](https://redirect.github.com/google/zx/pull/889), [zurk#12](https://redirect.github.com/webpod/zurk/pull/12), [zurk#13](https://redirect.github.com/webpod/zurk/pull/13). - Extended integration tests matrix, added nodejs-nightly builds and TS dev snapshots [#888](https://redirect.github.com/google/zx/pull/888) ### [`v8.1.5`](https://redirect.github.com/google/zx/releases/tag/8.1.5) [Compare Source](https://redirect.github.com/google/zx/compare/8.1.4...8.1.5) We've rolled out a new release! #### Fixes - Added the minimist typings to the dts bundle. [#872](https://redirect.github.com/google/zx/pull/872) brings the fix. - Re-enabled the YAML extra API. [#870](https://redirect.github.com/google/zx/issues/870) [#879](https://redirect.github.com/google/zx/pull/879) #### Chores - Clarified `cd()`, `within()` and `syncProcessCwd()` interactions. [#878](https://redirect.github.com/google/zx/pull/878) - Included mention of the `cwd` option in the documentation. [#868](https://redirect.github.com/google/zx/pull/868) - Test enhancements. [#877](https://redirect.github.com/google/zx/pull/877) [#880](https://redirect.github.com/google/zx/pull/880) ### [`v8.1.4`](https://redirect.github.com/google/zx/releases/tag/8.1.4) [Compare Source](https://redirect.github.com/google/zx/compare/8.1.3...8.1.4) We continue optimizing bundles and CI/CD pipelines. - Update [@webpod/ps](https://redirect.github.com/webpod/ps) to v0.0.0-beta.7 to sync internal [zurk](https://redirect.github.com/webpod/zurk) version. [#855](https://redirect.github.com/google/zx/pull/855) - Split vendor chunk to reduce the `zx/core` entry size. [#856](https://redirect.github.com/google/zx/pull/856) - Add bundle size check. [#857](https://redirect.github.com/google/zx/pull/857) - Refactor the testing flow, remove duplicated tasks. [#861](https://redirect.github.com/google/zx/pull/861) - Add missing types for the global `defaults`. [#864](https://redirect.github.com/google/zx/pull/864) - Omit redundant YAML API extras. [#866](https://redirect.github.com/google/zx/pull/866) Which gives us: **897 kB → 829 kB** (-7.58%) ### [`v8.1.3`](https://redirect.github.com/google/zx/releases/tag/8.1.3) [Compare Source](https://redirect.github.com/google/zx/compare/8.1.2...8.1.3) Nothing special today. We just keep improving the implementation. #### Features - ESM support is now available for Node.js v12 (previously was cjs only):[#824](https://redirect.github.com/google/zx/pull/824), [#827](https://redirect.github.com/google/zx/pull/827), [#828](https://redirect.github.com/google/zx/pull/828) ```ts import {$} from 'zx' ``` - `zx/cli` exports its inners to allow more advanced usage. Imagine, your own CLI tool that uses `zx` as a base:
[#828](https://redirect.github.com/google/zx/pull/838) ```ts #!/usr/bin/env node import './index.mjs' import {main} from 'zx/cli' main() ``` - Provide intermediate store configuration for fine-grained control of memory usage.
[#650](https://redirect.github.com/google/zx/pull/650), [#849](https://redirect.github.com/google/zx/pull/849) ```ts const getFixedSizeArray = (size) => { const arr = [] return new Proxy(arr, { get: (target, prop) => prop === 'push' && arr.length >= size ? () => {} : target[prop], }) } const store = { stdout: getFixedSizeArray(1), stderr: getFixedSizeArray(1), stdall: getFixedSizeArray(0), } const p = await $({ store })`echo foo` p.stdout.trim() // 'foo' p.toString() // '' ``` - Introduced sync methods for `ps`:
[#840](https://redirect.github.com/google/zx/pull/840) ```ts import { ps } from 'zx' const list1 = await ps() const list2 = await tree() // new methods const list3 = ps.sync() const list4 = tree.sync() ``` #### Chore - `$.log` accepts `kind: 'custom'` [#834](https://redirect.github.com/google/zx/pull/834) - Describe [`$.verbose` and `$.quiet` modes internals](https://google.github.io/zx/faq#verbose-and-quiet) [#835](https://redirect.github.com/google/zx/pull/835) - Mention `quotePowerShell` in docs [#851](https://redirect.github.com/google/zx/pull/851) - Finally fixed the annoying flaky problem of the process end detection in Bun [#839](https://redirect.github.com/google/zx/pull/839), [coderef](https://redirect.github.com/webpod/zurk/pull/10/files#diff-d32293984327495f7762a47d34fd13d89e57732be64a76d01b1d5edd6c2d316cR185) - Suppress `async_hooks.createHook` warning on bun [#848](https://redirect.github.com/google/zx/pull/848) - Remove node-abort-controller in favor of built-in node-fetch polyfill [#842](https://redirect.github.com/google/zx/pull/842) - Add missing global types [#853](https://redirect.github.com/google/zx/pull/853) ### [`v8.1.2`](https://redirect.github.com/google/zx/releases/tag/8.1.2) [Compare Source](https://redirect.github.com/google/zx/compare/8.1.1...8.1.2) Every new zx version is better than previous one. What have we here? #### Features - Added `ProcessPromise.verbose()` to enhance debugging experience.
[#820](https://redirect.github.com/google/zx/pull/820), [#710](https://redirect.github.com/google/zx/pull/710) ```js const p = $`echo foo` p.quiet() // enable silent mode p.quiet(false) // then disable p.verbose() // enable verbose/debug mode p.verbose(false) // and turn it off await p ``` - Aligned `ProcessPromise.isSmth()` API:
[#823](https://redirect.github.com/google/zx/pull/823) ```js const p = $`echo foo` p.isHalted() p.isVerbose() p.isQuiet() p.isNothrow() ``` #### Bug Fixes - fix: apply EOL ensurer to the last chunk only [#825](https://redirect.github.com/google/zx/pull/825) - fix(cli): return exit code 1 on incorrect inputs [#826](https://redirect.github.com/google/zx/pull/826) - fix: set cjs bundle as legacy `main` entrypoint [#827](https://redirect.github.com/google/zx/pull/827) #### Chore - Published with [npm provenance](https://docs.npmjs.com/generating-provenance-statements/) [#818](https://redirect.github.com/google/zx/pull/818) - Minor polyfills optimizations [#821](https://redirect.github.com/google/zx/pull/821) ### [`v8.1.1`](https://redirect.github.com/google/zx/releases/tag/8.1.1) [Compare Source](https://redirect.github.com/google/zx/compare/8.1.0...8.1.1) This release brings a pinch of sugar and minor fixes. ##### Features - Introduced `$.preferLocal` option to prefer `node_modules/.bin` located binaries over globally system installed ones.
[#798](https://redirect.github.com/google/zx/issues/798) ```js $.preferLocal = true await $`c8 npm test` await $({ preferLocal: true })`eslint .` ``` - Added some formatter shortcuts for `ProcessPromise`:
[#764](https://redirect.github.com/google/zx/issues/764), [#811](https://redirect.github.com/google/zx/issues/811), [#815](https://redirect.github.com/google/zx/issues/815) ```js const p = $`echo 'foo\nbar'` await p.text() // foo\n\bar\n await p.text('hex') // 666f6f0a0861720a await p.buffer() // Buffer.from('foo\n\bar\n') await p.lines() // ['foo', 'bar'] await $`echo '{"foo": "bar"}'`.json() // {foo: 'bar'} ``` - `ProcessPromise` now exposes its `signal` reference.
[#816](https://redirect.github.com/google/zx/issues/816) ```js const p = $`sleep 999` const {signal} = p const res = fetch('https://example.com', {signal}) setTimeout(() => p.abort('reason'), 1000) ``` ##### Fixes - CLI flag `--quiet` is mapped to `$.quiet` option. [#813](https://redirect.github.com/google/zx/pull/813) - Module conditional exports are properly sorted now. [#812](https://redirect.github.com/google/zx/pull/812) - A newline character is appended to the output of `ProcessPromise` if it's missing. [#810](https://redirect.github.com/google/zx/pull/810) ### [`v8.1.0`](https://redirect.github.com/google/zx/releases/tag/8.1.0) [Compare Source](https://redirect.github.com/google/zx/compare/8.0.2...8.1.0) This new release is a big deal. It brings significant improvements in reliability and compatibility. - Switched to [hybrid-scheme](https://2ality.com/2019/10/hybrid-npm-packages.html) package: both ESM and CJS entry points are provided. - Extended Node.js supported versions range: from [12.17.0 to the latest 22.x.x](https://redirect.github.com/google/zx/blob/main/.github/workflows/test.yml#L101). - [Added](https://redirect.github.com/google/zx/blob/main/.github/workflows/test.yml#L84) compatibility with Deno 1.x. - zx libdefs are now compatible with [TS 4.0+](https://redirect.github.com/google/zx/pull/801). #### New features Added `usePwsh()` helper to switch to PowerShell v7+ [#790](https://redirect.github.com/google/zx/pull/790) ```js import {usePwsh, useBash} from 'zx' usePwsh() $.shell // 'pwsh' useBash() $.shell // 'bash' ``` `timeout` is now configurable `$` opts [#796](https://redirect.github.com/google/zx/pull/796) ```js import {$} from 'zx' await $({ timeout: 100 })`sleep 999` $.timeout = 1000 // Sets default timeout for all commands $.timeoutSignal = 'SIGKILL' // Sets signal to send on timeout await $`sleep 999` ``` Added `--cwd` option for CLI [#804](https://redirect.github.com/google/zx/pull/804) ```bash zx --cwd=/some/path script.js ``` Introduced `tmpdir` and `tmpfile` helpers [#803](https://redirect.github.com/google/zx/pull/803) ```js import {tmpdir, tmpfile} from 'zx' t1 = tmpdir() // /os/based/tmp/zx-1ra1iofojgg/ t2 = tmpdir('foo') // /os/based/tmp/zx-1ra1iofojgg/foo/ f1 = tmpfile() // /os/based/tmp/zx-1ra1iofojgg f2 = tmpfile('f.txt') // /os/based/tmp/zx-1ra1iofojgg/foo.txt f3 = tmpfile('f.txt', 'string or buffer') ``` - Support CRLF for markdown script [#788](https://redirect.github.com/google/zx/pull/788) - Added help digest for [man](https://docs.npmjs.com/cli/v10/configuring-npm/package-json#man) [#806](https://redirect.github.com/google/zx/pull/806) - Added compatibility with Deno 1.x. → zx seems to be working with Deno 1.x. ### [`v8.0.2`](https://redirect.github.com/google/zx/releases/tag/8.0.2) [Compare Source](https://redirect.github.com/google/zx/compare/8.0.1...8.0.2) **In this release:** - Added configurable `detached` option ([#782](https://redirect.github.com/google/zx/issues/782)) - Fixed pkg typings entries for tsd tests ([#780](https://redirect.github.com/google/zx/issues/780))
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.