Giter VIP home page Giter VIP logo

deps-ok's Introduction

deps-ok

Fast checking of top level NPM and Bower dependencies based on version numbers.

NPM info

Build status dependencies devdependencies manpm semantic-release renovate-app badge

See grunt-deps-ok for integrating this task into grunt pipeline.

Install

Install as a global tool

npm install -g deps-ok

Install as a project's dependency

npm install --save-dev deps-ok

Use as a global tool

Checks modules until the first module without valid install. Prints first found error and exits with code 1 if one of the top level dependencies is missing or out of date.

// from the package's root folder execute
deps-ok

deps-ok --verbose
// prints declared and installed version numbers

deps-ok --filename path/to/package.json
// checks give package.json (not in this folder)

Checks both dependencies listed in your package.json and bower.json

If deps-ok finds a problem, then run npm install or bower install

Use as 3rd party module

You can use deps-ok from another module

npm install deps-ok --save
var depsOk = require('deps-ok');
var ok = depsOk(process.cwd(), false /* verbose */);

Use with gulp

If you prefer using gulp, you can quickly just add a task

gulp.task('deps-ok', function () {
  var gutil = require('gulp-util');
  var depsOk = require('deps-ok');
  var ok = depsOk(process.cwd(), false /* verbose */);
  if (!ok) {
    gulp.emit('error', new gutil.PluginError('deps-ok', 'Found outdated installs'));
  }
});
gulp.task('default', ['deps-ok', ...]);

Options

  • --allow-duplicate <name> allows same dependency to be declared in dev and peer dependencies (or other combinations). Useful if you are developing a plugin that requires the main tool (peer) but also uses the main tool for testing (dev).
$ deps-ok --allow-duplicate angular
$ deps-ok --allow-duplicate angular --allow-duplicate jquery
  • --verbose prints verbose console messages, but using DEBUG=deps-ok is a better method

  • --skip-version-check is used to load and check versions but skip actual physical file checks. Useful in end to end testing.

Notes

This check will reject packages without "version" property in the package.json file.

Debug

See debug messages by running module with DEBUG=deps-ok environment variable

Small print

Author: Gleb Bahmutov © 2013

License: MIT - do anything with the code, but don't blame me if it does not work.

Support: if you find any problems with this module, email / tweet / open issue on Github

deps-ok's People

Contributors

bahmutov avatar galniv avatar renovate-bot avatar renovate[bot] avatar tilmanschweitzer avatar vdh avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar

deps-ok's Issues

check version in .bower.json file

The version in a bower.json file is ignored and the version "truth" is the git tag. Therefore some bower modules argue not to use and refer to the spec (https://github.com/bower/bower.json-spec#version).

Bower 1.4 puts a .bower.json file in an installed component which contains the version number. I haven't checked since which version bower does that, but it's probably the more reliable information.

Related discussion for the module bootstrap-css-only fyockm/bootstrap-css-only#7 (comment)

Release version with fixed audit issues

When installing this package I get and audit report with 3 high vulnerabilities:

$ npm audit

  High            Prototype Pollution
  Package         lodash
  Patched in      >=4.17.11
  Dependency of   deps-ok
  Path            deps-ok > lodash
  More info       https://npmjs.com/advisories/782

  High            Prototype Pollution
  Package         lodash
  Patched in      >=4.17.12
  Dependency of   deps-ok
  Path            deps-ok > lodash
  More info       https://npmjs.com/advisories/1065

  Low             Prototype Pollution
  Package         lodash
  Patched in      >=4.17.19
  Dependency of   deps-ok
  Path            deps-ok > lodash
  More info       https://npmjs.com/advisories/1523

  High            Command Injection
  Package         lodash
  Patched in      >=4.17.21
  Dependency of   deps-ok
  Path            deps-ok > lodash
  More info       https://npmjs.com/advisories/1673

  Low             Prototype Pollution
  Package         minimist
  Patched in      >=0.2.1 <1.0.0 || >=1.2.3
  Dependency of   deps-ok
  Path            deps-ok > minimist
  More info       https://npmjs.com/advisories/1179

found 5 vulnerabilities (2 low, 3 high) in 13 scanned packages

These vulnerabilities are meaningless in a dev dependency like this, but still I'd like to get rid of them because it makes it harder to spot other important ones.

Any chance of releasing an updated version?

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Warning

These dependencies are deprecated:

Datasource Name Replacement PR?
npm q Unavailable

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Detected dependencies

npm
package.json
  • check-more-types 2.24.0
  • debug 3.2.7
  • lazy-ass 1.6.0
  • lodash 4.17.20
  • minimist 1.2.5
  • q 2.0.3
  • quote 0.4.0
  • semver 5.7.1
  • execa-wrap 1.4.0
  • git-issues 1.3.1
  • grunt 0.4.5
  • grunt-nice-package 0.10.4
  • jest 22.4.4
  • jshint-summary 0.4.0
  • pre-git 3.17.1
  • semantic-release 15.14.0
  • simple-commit-message 4.1.1
  • standard 11.0.1
  • node >= 0.8.0
travis
.travis.yml
  • node 8

  • Check this box to trigger a request for Renovate to run again on this repository

Handle complex cases

Just show the error message and continue, for example if dependency is specified like "bars": "github:jstrace/bars"

Look for non-standard bower install locations

Bower lets you configure its install directory in a .bowerrc file. It looks like deps-ok only checks the default location.

// .bowerrc
{
   "directory": "vendor/bower",
   "json": "bower.json"
}

Output:

ERROR: cannot find folder /home/will/projects/toad/bower_components/backbone

npm worked like a champ though :) looking forward to adding this into our build

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Error type: Preset name not found within published preset config (monorepo:babel6). Note: this is a nested preset so please contact the preset author if you are unable to fix it yourself.

Warn and skip git: dependencies

Skip with warning dependencies that have git: versions, like git://github.com/bahmutov/grunt-regex-check.git#33b25690780261f8fa4fa7fc43cff5775bd4cd7c

Git dependencies skipped

Related to #17 and #2.

Sometimes you need to make a fork from git, like

"JSV": "git+https://github.com/onetwotrip/JSV.git#06ee6c64b8ef06f41d5dc973ec36395c08f8153e",

and you get message like

skipping invalid version git+https://github.com/onetwotrip/JSV.git#06ee6c64b8ef06f41d5dc973ec36395c08f8153e

Even thorough git hash dependency is valid and can be checked.

It would be great to implement it.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.