Skip to content

Commit b65dbb7

Browse files
author
Maël Nison
committed
Merge branch 'master' into 1.12-stable
2 parents 98418da + f8e42c5 commit b65dbb7

File tree

28 files changed

+497
-28
lines changed

28 files changed

+497
-28
lines changed

‎CHANGELOG.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,44 @@ Please add one entry in this file for each change in Yarn's behavior. Use the sa
44

55
## 1.12.1
66

7+
**Important:** This release contains a cache bump. It will cause the very first install following the upgrade to take slightly more time, especially if you don't use the [Offline Mirror](https://yarnpkg.com/blog/2016/11/24/offline-mirror/) feature. After that everything will be back to normal.
8+
9+
- Fixes an issue with `yarn audit` when using workspaces
10+
11+
[#6625](https://github.com/yarnpkg/yarn/pull/6639) - [**Jeff Valore**](https://twitter.com/codingwithspike)
12+
13+
- Uses `NODE_OPTIONS` to instruct Node to load the PnP hook, instead of raw CLI arguments
14+
15+
**Caveat:** This change might cause issues for PnP users having a space inside their cwd (cf [nodejs/node#24065](https://github.com/nodejs/node/pull/24065))
16+
17+
[#6479](https://github.com/yarnpkg/yarn/pull/6629) - [**Maël Nison**](https://twitter.com/arcanis)
18+
19+
- Fixes Gulp when used with Plug'n'Play
20+
21+
[#6623](https://github.com/yarnpkg/yarn/pull/6623) - [**Maël Nison**](https://twitter.com/arcanis)
22+
23+
- Fixes an issue with `yarn audit` when the root package was missing a name
24+
25+
[#6611](https://github.com/yarnpkg/yarn/pull/6611) - [**Jack Zhao**](https://github.com/bugzpodder)
26+
27+
- Fixes an issue with `yarn audit` when a package was depending on an empty range
28+
29+
[#6611](https://github.com/yarnpkg/yarn/pull/6611) - [**Jack Zhao**](https://github.com/bugzpodder)
30+
31+
- Fixes an issue with how symlinks are setup into the cache on Windows
32+
33+
[#6621](https://github.com/yarnpkg/yarn/pull/6621) - [**Yoad Snapir**](https://github.com/yoadsn)
34+
35+
- Upgrades `inquirer`, fixing `upgrade-interactive` for users using both Node 10 and Windows
36+
37+
[#6635](https://github.com/yarnpkg/yarn/pull/6635) - [**Philipp Feigl**](https://github.com/pfeigl)
38+
39+
- Exposes the path to the PnP file using `require.resolve('pnpapi')`
40+
41+
[#6643](https://github.com/yarnpkg/yarn/pull/6643) - [**Maël Nison**](https://twitter.com/arcanis)
42+
43+
## 1.12.1
44+
745
- Ensures the engine check is ran before showing the UI for `upgrade-interactive`
846

947
[#6536](https://github.com/yarnpkg/yarn/pull/6536) - [**Orta Therox**](https://github.com/orta)

‎__tests__/commands/audit.js‎

Lines changed: 98 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ test('calls reporter auditAdvisory with correct data', () => {
105105
});
106106
});
107107

108-
// *** Test temporarily removed due to inability to correctly puggest actions to the user.
108+
// *** Test temporarily removed due to inability to correctly suggest actions to the user.
109109
// test('calls reporter auditAction with correct data', () => {
110110
// return runAudit([], {}, 'single-vulnerable-dep-installed', (config, reporter) => {
111111
// const apiResponse = getAuditResponse(config);
@@ -123,3 +123,100 @@ test('calls reporter auditSummary with correct data', () => {
123123
expect(reporter.auditSummary).toBeCalledWith(apiResponse.metadata);
124124
});
125125
});
126+
127+
test.concurrent('sends correct dependency map to audit api for private package.', () => {
128+
const expectedApiPost = {
129+
install: [],
130+
remove: [],
131+
metadata: {},
132+
requires: {
133+
'left-pad': '^1.3.0',
134+
},
135+
dependencies: {
136+
'left-pad': {
137+
version: '1.3.0',
138+
integrity: 'sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==',
139+
requires: {},
140+
dependencies: {},
141+
},
142+
},
143+
};
144+
145+
return runAudit([], {}, 'private-package', async config => {
146+
const calledWithPipe = config.requestManager.request.mock.calls[0][0].body;
147+
const calledWith = JSON.parse(await gunzip(calledWithPipe));
148+
expect(calledWith).toEqual(expectedApiPost);
149+
});
150+
});
151+
152+
test('calls reporter auditAdvisory with correct data for private package', () => {
153+
return runAudit([], {}, 'single-vulnerable-dep-installed', (config, reporter) => {
154+
const apiResponse = getAuditResponse(config);
155+
expect(reporter.auditAdvisory).toBeCalledWith(apiResponse.actions[0].resolves[0], apiResponse.advisories['118']);
156+
});
157+
});
158+
159+
test('calls reporter auditSummary with correct data for private package', () => {
160+
return runAudit([], {}, 'single-vulnerable-dep-installed', (config, reporter) => {
161+
const apiResponse = getAuditResponse(config);
162+
expect(reporter.auditSummary).toBeCalledWith(apiResponse.metadata);
163+
});
164+
});
165+
166+
test.concurrent('sends correct dependency map to audit api for workspaces.', () => {
167+
const expectedApiPost = {
168+
dependencies: {
169+
'balanced-match': {
170+
dependencies: {},
171+
integrity: 'sha1-ibTRmasr7kneFk6gK4nORi1xt2c=',
172+
requires: {},
173+
version: '1.0.0',
174+
},
175+
'brace-expansion': {
176+
dependencies: {},
177+
integrity: 'sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==',
178+
requires: {
179+
'balanced-match': '^1.0.0',
180+
'concat-map': '0.0.1',
181+
},
182+
version: '1.1.11',
183+
},
184+
'concat-map': {
185+
dependencies: {},
186+
integrity: 'sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=',
187+
requires: {},
188+
version: '0.0.1',
189+
},
190+
minimatch: {
191+
dependencies: {},
192+
integrity: 'sha1-UjYVelHk8ATBd/s8Un/33Xjw74M=',
193+
requires: {
194+
'brace-expansion': '^1.0.0',
195+
},
196+
version: '3.0.0',
197+
},
198+
prj1: {
199+
dependencies: {},
200+
integrity: '',
201+
requires: {
202+
minimatch: '3.0.0',
203+
},
204+
version: '0.0.0',
205+
},
206+
},
207+
install: [],
208+
metadata: {},
209+
name: 'yarn-test',
210+
remove: [],
211+
requires: {
212+
prj1: '0.0.0',
213+
},
214+
version: '1.0.0',
215+
};
216+
217+
return runAudit([], {}, 'workspace', async config => {
218+
const calledWithPipe = config.requestManager.request.mock.calls[0][0].body;
219+
const calledWith = JSON.parse(await gunzip(calledWithPipe));
220+
expect(calledWith).toEqual(expectedApiPost);
221+
});
222+
});

‎__tests__/commands/install/integration.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ async function mockConstants(base: Config, mocks: Object, cb: (config: Config) =
4848
beforeEach(request.__resetAuthedRequests);
4949
afterEach(request.__resetAuthedRequests);
5050

51+
test('install should not copy the .bin folders from the cache', () =>
52+
runInstall({}, 'install-no-bin', async config => {
53+
expect(await fs.exists(`${config.cwd}/node_modules/is-pnp/.bin`)).toEqual(false);
54+
}));
55+
5156
test('install should not hoist packages above their peer dependencies', () =>
5257
runInstall({}, 'install-should-not-hoist-through-peer-deps', async config => {
5358
expect(await fs.exists(`${config.cwd}/node_modules/a/node_modules/c`)).toEqual(true);

‎__tests__/fixtures/audit/private-package/audit-api-response.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"actions": [
3+
{
4+
"action": "install",
5+
"module": "minimatch",
6+
"target": "3.0.4",
7+
"isMajor": false,
8+
"resolves": [
9+
{
10+
"id": 118,
11+
"path": "minimatch",
12+
"dev": false,
13+
"optional": false,
14+
"bundled": false
15+
}
16+
]
17+
}
18+
],
19+
"advisories": {
20+
"118": {
21+
"findings": [
22+
{
23+
"version": "3.0.0",
24+
"paths": [
25+
"minimatch"
26+
],
27+
"dev": false,
28+
"optional": false,
29+
"bundled": false
30+
}
31+
],
32+
"id": 118,
33+
"created": "2016-05-25T16:37:20.000Z",
34+
"updated": "2018-03-01T21:58:01.072Z",
35+
"deleted": null,
36+
"title": "Regular Expression Denial of Service",
37+
"found_by": {
38+
"name": "Nick Starke"
39+
},
40+
"reported_by": {
41+
"name": "Nick Starke"
42+
},
43+
"module_name": "minimatch",
44+
"cves": [
45+
"CVE-2016-10540"
46+
],
47+
"vulnerable_versions": "<=3.0.1",
48+
"patched_versions": ">=3.0.2",
49+
"overview": "Affected versions of `minimatch` are vulnerable to regular expression denial of service attacks when user input is passed into the `pattern` argument of `minimatch(path, pattern)`.\n\n\n## Proof of Concept\n```\nvar minimatch = require(“minimatch”);\n\n// utility function for generating long strings\nvar genstr = function (len, chr) {\n var result = “”;\n for (i=0; i<=len; i++) {\n result = result + chr;\n }\n return result;\n}\n\nvar exploit = “[!” + genstr(1000000, “\\\\”) + “A”;\n\n// minimatch exploit.\nconsole.log(“starting minimatch”);\nminimatch(“foo”, exploit);\nconsole.log(“finishing minimatch”);\n```",
50+
"recommendation": "Update to version 3.0.2 or later.",
51+
"references": "",
52+
"access": "public",
53+
"severity": "high",
54+
"cwe": "CWE-400",
55+
"metadata": {
56+
"module_type": "Multi.Library",
57+
"exploitability": 4,
58+
"affected_components": "Internal::Code::Function::minimatch({type:'args', key:0, vector:{type:'string'}})"
59+
},
60+
"url": "https://nodesecurity.io/advisories/118"
61+
}
62+
},
63+
"muted": [],
64+
"metadata": {
65+
"vulnerabilities": {
66+
"info": 0,
67+
"low": 0,
68+
"moderate": 0,
69+
"high": 1,
70+
"critical": 0
71+
},
72+
"dependencies": 5,
73+
"devDependencies": 0,
74+
"optionalDependencies": 0,
75+
"totalDependencies": 5
76+
}
77+
}

‎__tests__/fixtures/audit/private-package/package.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"private": true,
3+
"dependencies": {
4+
"left-pad": "^1.3.0"
5+
}
6+
}

‎__tests__/fixtures/audit/private-package/yarn.lock‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
2+
# yarn lockfile v1
3+
4+
5+
left-pad@^1.3.0:
6+
version "1.3.0"
7+
resolved "https://registry.yarnpkg.com/left-pad/-/left-pad-1.3.0.tgz#5b8a3a7765dfe001261dde915589e782f8c94d1e"
8+
integrity sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==

‎__tests__/fixtures/audit/workspace/audit-api-response.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"actions": [],
3+
"advisories": {},
4+
"muted": [],
5+
"metadata": {
6+
"vulnerabilities": {
7+
"info": 0,
8+
"low": 0,
9+
"moderate": 0,
10+
"high": 0,
11+
"critical": 0
12+
},
13+
"dependencies": 0,
14+
"devDependencies": 0,
15+
"optionalDependencies": 0,
16+
"totalDependencies": 0
17+
}
18+
}

‎__tests__/fixtures/audit/workspace/package.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"name": "yarn-test",
3+
"version": "1.0.0",
4+
"main": "index.js",
5+
"license": "MIT",
6+
"private": true,
7+
"workspaces": ["packages/*"]
8+
}

‎__tests__/fixtures/audit/workspace/packages/prj1/package.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"name": "prj1",
3+
"private": true,
4+
"version": "0.0.0",
5+
"dependencies": {
6+
"minimatch": "3.0.0"
7+
}
8+
}

‎__tests__/fixtures/audit/workspace/yarn.lock‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
2+
# yarn lockfile v1
3+
4+
5+
balanced-match@^1.0.0:
6+
version "1.0.0"
7+
resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.0.tgz#89b4d199ab2bee49de164ea02b89ce462d71b767"
8+
integrity sha1-ibTRmasr7kneFk6gK4nORi1xt2c=
9+
10+
brace-expansion@^1.0.0:
11+
version "1.1.11"
12+
resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.11.tgz#3c7fcbf529d87226f3d2f52b966ff5271eb441dd"
13+
integrity sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==
14+
dependencies:
15+
balanced-match "^1.0.0"
16+
concat-map "0.0.1"
17+
18+
concat-map@0.0.1:
19+
version "0.0.1"
20+
resolved "https://registry.yarnpkg.com/concat-map/-/concat-map-0.0.1.tgz#d8a96bd77fd68df7793a73036a3ba0d5405d477b"
21+
integrity sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=
22+
23+
minimatch@3.0.0:
24+
version "3.0.0"
25+
resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-3.0.0.tgz#5236157a51e4f004c177fb3c527ff7dd78f0ef83"
26+
integrity sha1-UjYVelHk8ATBd/s8Un/33Xjw74M=
27+
dependencies:
28+
brace-expansion "^1.0.0"

0 commit comments

Comments
 (0)