lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues

Apache License 2.0

781 stars 35 forks source link

Update README.md to fix cosmiconfig reference #200

Closed joshmeads closed 2 months ago

joshmeads commented 3 months ago

Fix the cosmiconfig docs

Description

As noted in #192 .lockfile-lint.js is invalid. .lockfile-lintrc.js should be a valid Cosmiconfig with the default setup which you appear to be using.

Types of changes

[x] Bug fix (non-breaking change which fixes an issue)
[ ] New feature (non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to change)

Related Issue

192

Motivation and Context

Fixes invalid docs

How Has This Been Tested?

Screenshots (if appropriate):

Checklist:

[x] I have updated the documentation (if required).
[ ] I have read the CONTRIBUTING document.
[ ] I have added tests to cover my changes.
[ ] All new and existing tests passed.
[ ] I added a picture of a cute animal cause it's fun

joshmeads commented 3 months ago

Also based on: https://github.com/lirantal/lockfile-lint/blob/ad53fde2810ccc470dd4c0655920f6db5d509080/packages/lockfile-lint/src/config.js#L10

You're simply using the default cosmiconfig loaded which doesn't appear to support toml.

If you like I can add support but I'll update the readme again to remove it for now.

To add support it should be something like this (untested):

import TOML from 'smol-toml';

cosmiconfig('lockfile-lint', {
  loaders: {
    '.toml': TOML.parse
  }
});

https://github.com/cosmiconfig/cosmiconfig#loaders

Anyway great tool, thanks!

lirantal commented 2 months ago

@joshmeads sorry for the delay, I'll land this.

I think we can also update the README with adding .lockfile-lintrc which you noted is also supported in the original issue, if I understood correctly.

Also if you wanted to follow-up with TOML support I'm happy to land it.

Thanks friend! ❤️