js

package
v0.23.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 13, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

Documentation

Overview

Package js implements omnibump support for JavaScript projects.

The package manager (pnpm, yarn, npm, bun) is determined from the lock file on disk or via --manager. The updater writes each override into the field the chosen manager honours:

  • pnpm -> .pnpm.overrides.<selector>
  • yarn -> .resolutions.<selector>
  • npm -> .overrides.<selector>
  • bun -> .overrides.<selector>

Index

Constants

View Source
const (
	PnpmLock      = "pnpm-lock.yaml"
	YarnLock      = "yarn.lock"
	NpmLock       = "package-lock.json"
	BunLock       = "bun.lock"
	BunLockBinary = "bun.lockb"
)

Lock file names recognised for manager detection.

View Source
const PackageJSON = "package.json"

PackageJSON is the canonical manifest filename for JavaScript projects.

Variables

View Source
var (
	// ErrPackageJSONNotFound is returned when package.json is missing from
	// the project root.
	ErrPackageJSONNotFound = errors.New("package.json not found")

	// ErrNoDependencies is returned when no overrides were supplied to apply.
	ErrNoDependencies = errors.New("no dependencies to update")
)
View Source
var (
	// ErrUnknownManager is returned when an explicit manager string does
	// not match any recognised manager.
	ErrUnknownManager = errors.New("unknown package manager")

	// ErrNoManagerDetected is returned when no lock file is present and
	// no explicit manager was supplied.
	ErrNoManagerDetected = errors.New("could not detect package manager")

	// ErrAmbiguousManager is returned when multiple lock files are present
	// and no explicit manager was supplied.
	ErrAmbiguousManager = errors.New("multiple lock files present, package manager is ambiguous")
)
View Source
var (
	// ErrEmptySelector is returned when an override has no selector.
	ErrEmptySelector = errors.New("override selector is empty")

	// ErrEmptyVersion is returned when an override has no version.
	ErrEmptyVersion = errors.New("override version is empty")

	// ErrOverrideMissing is returned by VerifyOverrides when an override
	// was expected at a JSON path but was absent or had the wrong value.
	ErrOverrideMissing = errors.New("override not present at expected path")
)

AllManagers is the canonical list of supported managers.

View Source
var ErrManagerInvalidType = errors.New("manager: expected a string or list of strings")

ErrManagerInvalidType is returned when a Managers value in JSON/YAML is neither a string scalar nor a list of strings.

View Source
var ErrRemoteAnalysisNotImplemented = errors.New("remote analysis not yet implemented")

ErrRemoteAnalysisNotImplemented is returned by AnalyzeRemote until a remote-fetch backend is added.

Functions

func ApplyOverrides

func ApplyOverrides(pkgPath string, managers []Manager, overrides []Override) error

ApplyOverrides reads pkgPath, writes each override under each manager's dotted path, and saves the file. sjson mutates the buffer in place, preserving the surrounding formatting and key order.

func VerifyOverrides

func VerifyOverrides(pkgPath string, managers []Manager, overrides []Override) error

VerifyOverrides reads pkgPath and confirms each override is present under each manager's path with the expected value.

Types

type JS

type JS struct{}

JS implements the Language interface for JavaScript projects.

func (*JS) Detect

func (j *JS) Detect(ctx context.Context, dir string) (bool, error)

Detect checks if a JavaScript project exists in the directory.

func (*JS) GetManifestFiles

func (j *JS) GetManifestFiles() []string

GetManifestFiles returns JavaScript manifest and lock files.

func (*JS) Name

func (j *JS) Name() string

Name returns the language identifier.

func (*JS) SupportsAnalysis

func (j *JS) SupportsAnalysis() bool

SupportsAnalysis returns true since JS has analysis capabilities.

func (*JS) Update

func (j *JS) Update(ctx context.Context, cfg *languages.UpdateConfig) error

Update applies the configured dependency overrides to package.json.

func (*JS) Validate

func (j *JS) Validate(ctx context.Context, cfg *languages.UpdateConfig) error

Validate re-reads package.json after Update and confirms each override is present at the expected JSON path.

type JSAnalyzer

type JSAnalyzer struct{}

JSAnalyzer implements analyzer.Analyzer for JavaScript projects.

func (*JSAnalyzer) Analyze

func (a *JSAnalyzer) Analyze(ctx context.Context, projectPath string) (*analyzer.AnalysisResult, error)

Analyze performs dependency analysis on a JavaScript project.

func (*JSAnalyzer) AnalyzeRemote

func (a *JSAnalyzer) AnalyzeRemote(_ context.Context, _ map[string][]byte) (*analyzer.RemoteAnalysisResult, error)

AnalyzeRemote is not yet implemented for JS.

func (*JSAnalyzer) RecommendStrategy

func (a *JSAnalyzer) RecommendStrategy(ctx context.Context, _ *analyzer.AnalysisResult, deps []analyzer.Dependency) (*analyzer.Strategy, error)

RecommendStrategy suggests update strategy for JS dependencies. JS updates are always direct overrides.

type Manager

type Manager string

Manager identifies a JavaScript package manager whose conventions dictate where overrides live in package.json.

const (
	// ManagerPnpm writes to .pnpm.overrides.
	ManagerPnpm Manager = "pnpm"

	// ManagerYarn writes to .resolutions.
	ManagerYarn Manager = "yarn"

	// ManagerNpm writes to .overrides.
	ManagerNpm Manager = "npm"

	// ManagerBun writes to .overrides (bun honours npm's overrides field).
	ManagerBun Manager = "bun"
)

func DetectManagerFromLocks

func DetectManagerFromLocks(ctx context.Context, dir string) (Manager, error)

DetectManagerFromLocks inspects dir for recognised lock files and returns the implied manager. Returns ErrNoManagerDetected when none are found and ErrAmbiguousManager when more than one is found. Two lock files that imply the same manager (e.g. bun.lock and bun.lockb) are treated as a single signal and are not ambiguous.

func SelectManagers

func SelectManagers(ctx context.Context, dir string, overrides []Manager) ([]Manager, error)

SelectManagers resolves the manager(s) to use for a project rooted at dir. A non-empty override list always wins; each entry must be a known manager. With no override list, exactly one recognised lock file must be present.

func (Manager) IsKnown

func (m Manager) IsKnown() bool

IsKnown reports whether m is a recognised manager identifier.

func (Manager) OverridesPath

func (m Manager) OverridesPath() string

OverridesPath returns the dotted JSON path at which overrides for the given manager live in package.json.

type Managers

type Managers []Manager

Managers holds one or more Manager identifiers. It accepts either a scalar or a sequence in YAML/JSON, which the custom unmarshaller normalises to a slice.

func (*Managers) UnmarshalJSON

func (m *Managers) UnmarshalJSON(data []byte) error

UnmarshalJSON accepts a scalar string or an array of strings.

type Override

type Override struct {
	// Selector is the package.json key used to identify the dependency.
	// May be a bare name ("simple-git"), a scoped name
	// ("@isaacs/brace-expansion") or a name with a version range qualifier
	// ("undici@^6"). It is written into package.json verbatim.
	Selector string

	// Version is the target version string.
	Version string

	// Reason is a free-form note (typically a CVE/GHSA list) recorded in
	// build logs.
	Reason string
}

Override represents a single dependency override to apply.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL