lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues
Apache License 2.0
782 stars 35 forks source link

feat: add support for yarn berry lockfiles #147

Closed brad-decker closed 1 year ago

brad-decker commented 1 year ago

Description

Adds minimal support for yarn berry lockfiles. This is done by checking if the lockfile is yarn berry by referencing the initial key in the lockfile which will now be the __metadata key. If this occurs the parser normalizes the structure to match what is expected downstream. The changes that are here will result in users of this repo with yarn berry to change the way they configure allowed schemes (the resolved schemes are now things like 'npm:', 'patch:' and 'portal:'. All tests pass for the v1 lock file as well

Example use-case:

lockfile-lint --path yarn.lock --allowed-hosts npm yarn github.com codeload.github.com --empty-hostname true --allowed-schemes "https:" "git+https:" "npm:" "patch:" "workspace:"

Types of changes

Related Issue

fixes #101

Motivation and Context

How Has This Been Tested?

A new lockfile using yarn berry was generated and added to fixtures and a new test was added to load and parse that lockfile

Screenshots (if appropriate):

Checklist:

lirantal commented 1 year ago

This looks good to me. I'm happy if @naugtur wants to take a pass at it too. @brad-decker notice just really the explicit version change that you've updated which we need to revert (I committed to overwrite it so it's now ok).

Overall looks good to me. Let's give it a few days for more eyes before we merge.

codecov-commenter commented 1 year ago

Codecov Report

Base: 97.95% // Head: 97.74% // Decreases project coverage by -0.21% :warning:

Coverage data is based on head (17539b3) compared to base (8f7e4c7). Patch coverage: 93.75% of modified lines in pull request are covered.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #147 +/- ## ========================================== - Coverage 97.95% 97.74% -0.22% ========================================== Files 13 13 Lines 342 354 +12 Branches 73 77 +4 ========================================== + Hits 335 346 +11 - Misses 7 8 +1 ``` | [Impacted Files](https://codecov.io/gh/lirantal/lockfile-lint/pull/147?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal) | Coverage Δ | | |---|---|---| | [packages/lockfile-lint-api/src/ParseLockfile.js](https://codecov.io/gh/lirantal/lockfile-lint/pull/147/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal#diff-cGFja2FnZXMvbG9ja2ZpbGUtbGludC1hcGkvc3JjL1BhcnNlTG9ja2ZpbGUuanM=) | `98.88% <93.75%> (-1.12%)` | :arrow_down: | Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Liran+Tal)

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.

kachkaev commented 1 year ago

Glad to see progress on #101! Happy to help with testing in https://github.com/blockprotocol/blockprotocol/pull/680, if needed 🚀

lirantal commented 1 year ago

👋🏽 @brad-decker @naugtur @kumavis FYI that this has landed and you can apply any relevant updates on the metamask project/repo

brad-decker commented 1 year ago

Sorry for dropping the ball on this @lirantal but thank you for getting it landed. Much appreciated!

lirantal commented 1 year ago

All good buddy. Thank you for opening this to begin with :-)