|
| 1 | +#!/usr/bin/env node |
| 2 | + |
| 3 | +const { execSync } = require('child_process'); |
| 4 | +const fs = require('fs'); |
| 5 | +const path = require('path'); |
| 6 | + |
| 7 | +/** |
| 8 | + * Validates that a package name is safe (contains only valid npm package characters) |
| 9 | + */ |
| 10 | +function isValidPackageName(name) { |
| 11 | + // npm package names must be lowercase, can contain hyphens and underscores |
| 12 | + // This regex matches valid npm package names |
| 13 | + return /^(@?[a-z0-9]([a-z0-9-]*[a-z0-9])?\/)?[a-z0-9]([a-z0-9._-]*[a-z0-9])?$/.test(name); |
| 14 | +} |
| 15 | + |
| 16 | +/** |
| 17 | + * Fetches the repository URL for a given package |
| 18 | + */ |
| 19 | +function getRepoUrl(packageName) { |
| 20 | + try { |
| 21 | + // Validate package name to prevent command injection |
| 22 | + if (!isValidPackageName(packageName)) { |
| 23 | + return null; |
| 24 | + } |
| 25 | + |
| 26 | + const result = execSync(`npm view ${packageName} repository.url`, { |
| 27 | + encoding: 'utf-8', |
| 28 | + stdio: ['pipe', 'pipe', 'pipe'], |
| 29 | + }); |
| 30 | + return result.trim(); |
| 31 | + } catch { |
| 32 | + return null; |
| 33 | + } |
| 34 | +} |
| 35 | + |
| 36 | +/** |
| 37 | + * Converts git URLs to HTTPS GitHub URLs and attempts to link to changelog |
| 38 | + */ |
| 39 | +function formatChangelogUrl(repoUrl) { |
| 40 | + if (!repoUrl) return null; |
| 41 | + |
| 42 | + // Convert git:// or git+https:// to https:// |
| 43 | + let url = repoUrl |
| 44 | + .replace('git+https://', 'https://') |
| 45 | + .replace('git://', 'https://') |
| 46 | + .replace('git@github.com:', 'https://github.com/') |
| 47 | + .replace(/\.git$/, ''); |
| 48 | + |
| 49 | + // Try to link to releases page for GitHub repos |
| 50 | + if (url.includes('github.com')) { |
| 51 | + return `${url}/releases`; |
| 52 | + } |
| 53 | + |
| 54 | + return url; |
| 55 | +} |
| 56 | + |
| 57 | +/** |
| 58 | + * Safely reads package.json from the current working directory |
| 59 | + */ |
| 60 | +function readPackageJson() { |
| 61 | + const cwd = process.cwd(); |
| 62 | + const packageJsonPath = path.join(cwd, 'package.json'); |
| 63 | + |
| 64 | + // Validate that the resolved path is within the current working directory |
| 65 | + // to prevent directory traversal attacks |
| 66 | + const resolvedPath = path.resolve(packageJsonPath); |
| 67 | + const resolvedCwd = path.resolve(cwd); |
| 68 | + |
| 69 | + if (!resolvedPath.startsWith(resolvedCwd)) { |
| 70 | + throw new Error('Invalid package.json path'); |
| 71 | + } |
| 72 | + |
| 73 | + return JSON.parse(fs.readFileSync(resolvedPath, 'utf-8')); |
| 74 | +} |
| 75 | + |
| 76 | +/** |
| 77 | + * Main function |
| 78 | + */ |
| 79 | +async function main() { |
| 80 | + try { |
| 81 | + // Read current package.json |
| 82 | + const packageJson = readPackageJson(); |
| 83 | + const currentDeps = { ...packageJson.dependencies, ...packageJson.devDependencies }; |
| 84 | + |
| 85 | + // Run ncu and get JSON output |
| 86 | + const ncuOutput = execSync('ncu --jsonUpgraded', { |
| 87 | + encoding: 'utf-8', |
| 88 | + }); |
| 89 | + |
| 90 | + const upgrades = JSON.parse(ncuOutput); |
| 91 | + |
| 92 | + if (Object.keys(upgrades).length === 0) { |
| 93 | + console.log('✨ All dependencies are up to date!'); |
| 94 | + return; |
| 95 | + } |
| 96 | + |
| 97 | + console.log('\n📦 Outdated Dependencies:\n'); |
| 98 | + |
| 99 | + // Process each package |
| 100 | + for (const [packageName, latestVersion] of Object.entries(upgrades)) { |
| 101 | + const currentVersion = currentDeps[packageName] || 'unknown'; |
| 102 | + |
| 103 | + const repoUrl = getRepoUrl(packageName); |
| 104 | + const changelogUrl = formatChangelogUrl(repoUrl); |
| 105 | + |
| 106 | + // Format output |
| 107 | + const packageInfo = `${packageName.padEnd(30)} ${currentVersion.padEnd(15)} → ${latestVersion.padEnd(15)}`; |
| 108 | + |
| 109 | + if (changelogUrl) { |
| 110 | + console.log(`${packageInfo} ${changelogUrl}`); |
| 111 | + } else { |
| 112 | + console.log(`${packageInfo} (no repo found)`); |
| 113 | + } |
| 114 | + } |
| 115 | + |
| 116 | + console.log('\n'); |
| 117 | + } catch (error) { |
| 118 | + if (error.message.includes('No dependencies')) { |
| 119 | + console.log('✨ All dependencies are up to date!'); |
| 120 | + } else { |
| 121 | + console.error('Error:', error.message); |
| 122 | + process.exit(1); |
| 123 | + } |
| 124 | + } |
| 125 | +} |
| 126 | + |
| 127 | +main(); |
0 commit comments