Documentation
¶
Overview ¶
Package js implements omnibump support for JavaScript projects.
The package manager (pnpm, yarn, npm, bun) is determined from the lock file on disk or via --manager. The updater writes each override into the field the chosen manager honours:
- pnpm -> .pnpm.overrides.<selector>
- yarn -> .resolutions.<selector>
- npm -> .overrides.<selector>
- bun -> .overrides.<selector>
Index ¶
- Constants
- Variables
- func ApplyOverrides(pkgPath string, managers []Manager, overrides []Override) error
- func VerifyOverrides(pkgPath string, managers []Manager, overrides []Override) error
- type JS
- func (j *JS) Detect(ctx context.Context, dir string) (bool, error)
- func (j *JS) GetManifestFiles() []string
- func (j *JS) Name() string
- func (j *JS) SupportsAnalysis() bool
- func (j *JS) Update(ctx context.Context, cfg *languages.UpdateConfig) error
- func (j *JS) Validate(ctx context.Context, cfg *languages.UpdateConfig) error
- type JSAnalyzer
- func (a *JSAnalyzer) Analyze(ctx context.Context, projectPath string) (*analyzer.AnalysisResult, error)
- func (a *JSAnalyzer) AnalyzeRemote(_ context.Context, _ map[string][]byte) (*analyzer.RemoteAnalysisResult, error)
- func (a *JSAnalyzer) RecommendStrategy(ctx context.Context, _ *analyzer.AnalysisResult, deps []analyzer.Dependency) (*analyzer.Strategy, error)
- type Manager
- type Managers
- type Override
Constants ¶
const ( PnpmLock = "pnpm-lock.yaml" YarnLock = "yarn.lock" NpmLock = "package-lock.json" BunLock = "bun.lock" BunLockBinary = "bun.lockb" )
Lock file names recognised for manager detection.
const PackageJSON = "package.json"
PackageJSON is the canonical manifest filename for JavaScript projects.
Variables ¶
var ( // ErrPackageJSONNotFound is returned when package.json is missing from // the project root. ErrPackageJSONNotFound = errors.New("package.json not found") // ErrNoDependencies is returned when no overrides were supplied to apply. ErrNoDependencies = errors.New("no dependencies to update") )
var ( // ErrUnknownManager is returned when an explicit manager string does // not match any recognised manager. ErrUnknownManager = errors.New("unknown package manager") // ErrNoManagerDetected is returned when no lock file is present and // no explicit manager was supplied. ErrNoManagerDetected = errors.New("could not detect package manager") // ErrAmbiguousManager is returned when multiple lock files are present // and no explicit manager was supplied. ErrAmbiguousManager = errors.New("multiple lock files present, package manager is ambiguous") )
var ( // ErrEmptySelector is returned when an override has no selector. ErrEmptySelector = errors.New("override selector is empty") // ErrEmptyVersion is returned when an override has no version. ErrEmptyVersion = errors.New("override version is empty") // ErrOverrideMissing is returned by VerifyOverrides when an override // was expected at a JSON path but was absent or had the wrong value. ErrOverrideMissing = errors.New("override not present at expected path") )
var AllManagers = []Manager{ManagerPnpm, ManagerYarn, ManagerNpm, ManagerBun}
AllManagers is the canonical list of supported managers.
var ErrManagerInvalidType = errors.New("manager: expected a string or list of strings")
ErrManagerInvalidType is returned when a Managers value in JSON/YAML is neither a string scalar nor a list of strings.
var ErrRemoteAnalysisNotImplemented = errors.New("remote analysis not yet implemented")
ErrRemoteAnalysisNotImplemented is returned by AnalyzeRemote until a remote-fetch backend is added.
Functions ¶
func ApplyOverrides ¶
ApplyOverrides reads pkgPath, writes each override under each manager's dotted path, and saves the file. sjson mutates the buffer in place, preserving the surrounding formatting and key order.
Types ¶
type JS ¶
type JS struct{}
JS implements the Language interface for JavaScript projects.
func (*JS) GetManifestFiles ¶
GetManifestFiles returns JavaScript manifest and lock files.
func (*JS) SupportsAnalysis ¶
SupportsAnalysis returns true since JS has analysis capabilities.
type JSAnalyzer ¶
type JSAnalyzer struct{}
JSAnalyzer implements analyzer.Analyzer for JavaScript projects.
func (*JSAnalyzer) Analyze ¶
func (a *JSAnalyzer) Analyze(ctx context.Context, projectPath string) (*analyzer.AnalysisResult, error)
Analyze performs dependency analysis on a JavaScript project.
func (*JSAnalyzer) AnalyzeRemote ¶
func (a *JSAnalyzer) AnalyzeRemote(_ context.Context, _ map[string][]byte) (*analyzer.RemoteAnalysisResult, error)
AnalyzeRemote is not yet implemented for JS.
func (*JSAnalyzer) RecommendStrategy ¶
func (a *JSAnalyzer) RecommendStrategy(ctx context.Context, _ *analyzer.AnalysisResult, deps []analyzer.Dependency) (*analyzer.Strategy, error)
RecommendStrategy suggests update strategy for JS dependencies. JS updates are always direct overrides.
type Manager ¶
type Manager string
Manager identifies a JavaScript package manager whose conventions dictate where overrides live in package.json.
const ( // ManagerPnpm writes to .pnpm.overrides. ManagerPnpm Manager = "pnpm" // ManagerYarn writes to .resolutions. ManagerYarn Manager = "yarn" // ManagerNpm writes to .overrides. ManagerNpm Manager = "npm" // ManagerBun writes to .overrides (bun honours npm's overrides field). ManagerBun Manager = "bun" )
func DetectManagerFromLocks ¶
DetectManagerFromLocks inspects dir for recognised lock files and returns the implied manager. Returns ErrNoManagerDetected when none are found and ErrAmbiguousManager when more than one is found. Two lock files that imply the same manager (e.g. bun.lock and bun.lockb) are treated as a single signal and are not ambiguous.
func SelectManagers ¶
SelectManagers resolves the manager(s) to use for a project rooted at dir. A non-empty override list always wins; each entry must be a known manager. With no override list, exactly one recognised lock file must be present.
func (Manager) OverridesPath ¶
OverridesPath returns the dotted JSON path at which overrides for the given manager live in package.json.
type Managers ¶
type Managers []Manager
Managers holds one or more Manager identifiers. It accepts either a scalar or a sequence in YAML/JSON, which the custom unmarshaller normalises to a slice.
func (*Managers) UnmarshalJSON ¶
UnmarshalJSON accepts a scalar string or an array of strings.
type Override ¶
type Override struct {
// Selector is the package.json key used to identify the dependency.
// May be a bare name ("simple-git"), a scoped name
// ("@isaacs/brace-expansion") or a name with a version range qualifier
// ("undici@^6"). It is written into package.json verbatim.
Selector string
// Version is the target version string.
Version string
// Reason is a free-form note (typically a CVE/GHSA list) recorded in
// build logs.
Reason string
}
Override represents a single dependency override to apply.