Skip to content

Commit 83fb125

Browse files
fritzylukekarrys
authored andcommitted
fix: audit package mismatch in special case
1 parent 4a1ebeb commit 83fb125

File tree

2 files changed

+8
-3
lines changed

2 files changed

+8
-3
lines changed

workspaces/arborist/lib/arborist/build-ideal-tree.js

+5-3
Original file line numberDiff line numberDiff line change
@@ -619,14 +619,16 @@ module.exports = cls => class IdealTreeBuilder extends cls {
619619
continue
620620
}
621621

622-
const { isSemVerMajor, version } = fixAvailable
622+
// name may be different if parent fixes the dep
623+
// see Vuln fixAvailable setter
624+
const { isSemVerMajor, version, name: fixName } = fixAvailable
623625
const breakingMessage = isSemVerMajor
624626
? 'a SemVer major change'
625627
: 'outside your stated dependency range'
626-
log.warn('audit', `Updating ${name} to ${version}, ` +
628+
log.warn('audit', `Updating ${fixName} to ${version}, ` +
627629
`which is ${breakingMessage}.`)
628630

629-
await this[_add](node, { add: [`${name}@${version}`] })
631+
await this[_add](node, { add: [`${fixName}@${version}`] })
630632
nodesTouched.add(node)
631633
}
632634
}

workspaces/arborist/lib/vuln.js

+3
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,9 @@ class Vuln {
6565
// - {name, version, isSemVerMajor} fix requires -f, is semver major
6666
// - {name, version} fix requires -f, not semver major
6767
// - true: fix does not require -f
68+
// TODO: duped entries may require different fixes but the current
69+
// structure does not support this, so the case were a top level fix
70+
// corrects a duped entry may mean you have to run fix more than once
6871
for (const v of this.via) {
6972
// don't blow up on loops
7073
if (v.fixAvailable === f) {

0 commit comments

Comments
 (0)