Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
virtualStoreDir: string,
},
): Promise<{
currentLockfile: Lockfile,
existsCurrentLockfile: boolean,
existsWantedLockfile: boolean,
wantedLockfile: Lockfile,
}> {
// ignore `pnpm-lock.yaml` on CI servers
// a latest pnpm should not break all the builds
const lockfileOpts = {
ignoreIncompatible: opts.force || isCI,
wantedVersion: LOCKFILE_VERSION,
}
const files = await Promise.all([
opts.useLockfile && readWantedLockfile(opts.lockfileDir, lockfileOpts)
|| await existsWantedLockfile(opts.lockfileDir) &&
logger.warn({
message: `A ${WANTED_LOCKFILE} file exists. The current configuration prohibits to read or write a lockfile`,
prefix: opts.lockfileDir,
}),
readCurrentLockfile(opts.virtualStoreDir, lockfileOpts),
])
const sopts = { lockfileVersion: LOCKFILE_VERSION }
const importerIds = opts.importers.map((importer) => importer.id)
const currentLockfile = files[1] || createLockfileObject(importerIds, sopts)
for (const importerId of importerIds) {
if (!currentLockfile.importers[importerId]) {
currentLockfile.importers[importerId] = {
specifiers: {},
}
}
export async function handler (
args: string[],
opts: Pick & {
auditLevel?: 'low' | 'moderate' | 'high' | 'critical',
include: IncludedDependencies
json?: boolean,
lockfileDir?: string,
registries: Registries,
},
command: string,
) {
const lockfile = await readWantedLockfile(opts.lockfileDir || opts.dir, { ignoreIncompatible: true })
if (!lockfile) {
throw new PnpmError('AUDIT_NO_LOCKFILE', `No ${WANTED_LOCKFILE} found: Cannot audit a project without a lockfile`)
}
const auditReport = await audit(lockfile, { include: opts.include, registry: opts.registries.default })
if (opts.json) {
return JSON.stringify(auditReport, null, 2)
}
let output = ''
const auditLevel = AUDIT_LEVEL_NUMBER[opts.auditLevel || 'low']
const advisories = Object.values(auditReport.advisories)
.filter(({ severity }) => AUDIT_LEVEL_NUMBER[severity] >= auditLevel)
.sort((a1, a2) => AUDIT_LEVEL_NUMBER[a2.severity] - AUDIT_LEVEL_NUMBER[a1.severity])
for (const advisory of advisories) {
output += table([
[AUDIT_COLOR[advisory.severity](advisory.severity), chalk.bold(advisory.title)],
export async function lockfileToPnp (lockfileDirectory: string) {
const lockfile = await readWantedLockfile(lockfileDirectory, { ignoreIncompatible: true })
if (!lockfile) throw new Error('Cannot generate a .pnp.js without a lockfile')
const importerNames = {} as { [importerId: string]: string }
await Promise.all(
Object.keys(lockfile.importers)
.map(async (importerId) => {
const importerDirectory = path.join(lockfileDirectory, importerId)
const { manifest } = await readImporterManifest(importerDirectory)
importerNames[importerId] = manifest.name as string
}),
)
const { registries, store } = await getConfigs({ cliArgs: {}, packageManager: { name: 'pnpm', version: '*' } })
const storeDirectory = await resolveStoreDir(lockfileDirectory, store)
const packageRegistry = lockfileToPackageRegistry(lockfile, {
importerNames,
lockfileDirectory,
registries,
export async function outdatedDependenciesOfWorkspacePackages (
pkgs: Array<{dir: string, manifest: ImporterManifest}>,
args: string[],
opts: OutdatedOptions,
) {
const lockfileDir = opts.lockfileDir || opts.dir
const modules = await readModulesManifest(path.join(lockfileDir, 'node_modules'))
const virtualStoreDir = modules?.virtualStoreDir || path.join(lockfileDir, 'node_modules/.pnpm')
const currentLockfile = await readCurrentLockfile(virtualStoreDir, { ignoreIncompatible: false })
const wantedLockfile = await readWantedLockfile(lockfileDir, { ignoreIncompatible: false }) || currentLockfile
if (!wantedLockfile) {
throw new PnpmError('OUTDATED_NO_LOCKFILE', 'No lockfile in this directory. Run `pnpm install` to generate one.')
}
const storeDir = await storePath(opts.dir, opts.store)
const getLatestManifest = createLatestManifestGetter({
...opts,
lockfileDir,
storeDir,
})
return Promise.all(pkgs.map(async ({ dir, manifest }) => {
let match = args.length && matcher(args) || undefined
return {
manifest,
outdatedPackages: await outdated({
currentLockfile,
getLatestManifest,