feat: implement npmMinimalAgeGate and npmPreapprovedPackages config options
#6901
+714
−5
fix: rename options to better align with existing npm-related options
- Loading branch information
commit 11f5edd381f9c8eecf6d71a63808c0b9eee616d3
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,13 +1,13 @@ | ||
| const ONE_DAY_IN_MINUTES = 24 * 60; | ||
|
|
||
| describe(`Features`, () => { | ||
| describe(`npmMinimumReleaseAge and npmMinimumReleaseAgeExclude`, () => { | ||
| describe(`add`, () => { | ||
| // TODO failing | ||
| test( | ||
| `add should install the latest version allowed by the minimum release age`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| }, async ({run, source}) => { | ||
| await run(`add`, `release-date`); | ||
| await expect(source(`require('release-date/package.json')`)).resolves.toMatchObject({ | ||
|
|
@@ -20,7 +20,7 @@ describe(`Features`, () => { | |
| test( | ||
| `it should fail when trying to install exact version that is newer than the minimum release age`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| }, async ({run}) => { | ||
| await expect(run(`add`, `[email protected]`)).rejects.toThrowError(`No candidates found`); | ||
| }), | ||
|
|
@@ -29,7 +29,7 @@ describe(`Features`, () => { | |
| test( | ||
| `it should install older package versions when the minimum release age disallows the newest suitable version`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| }, async ({run, source}) => { | ||
| await run(`add`, `release-date@^1.0.0`); | ||
|
|
||
|
|
@@ -43,8 +43,8 @@ describe(`Features`, () => { | |
| test( | ||
| `it should install new version when excluded by exact locator; while transitive dependencies are not excluded`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`[email protected]`], | ||
| // we are checking a transitive dependencies version, which the pnp will throw an error for | ||
| // disabling these checks for the purpose of this test | ||
| pnpFallbackMode: `all`, | ||
|
|
@@ -67,8 +67,8 @@ describe(`Features`, () => { | |
| test( | ||
| `it should install new version when excluded by npm protocol locator`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`release-date@npm:1.1.1`], | ||
| }, async ({run, source}) => { | ||
| await run(`add`, `[email protected]`); | ||
|
|
||
|
|
@@ -82,8 +82,8 @@ describe(`Features`, () => { | |
| test( | ||
| `it should install new version when excluded by descriptor range`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`release-date@^1.0.0`], | ||
| }, async ({run, source}) => { | ||
| await run(`add`, `release-date@^1.0.0`); | ||
|
|
||
|
|
@@ -97,8 +97,8 @@ describe(`Features`, () => { | |
| test( | ||
| `it should install new version when excluded by npm protocol descriptor range`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`release-date@npm:^1.0.0`], | ||
| }, async ({run, source}) => { | ||
| await run(`add`, `release-date@^1.0.0`); | ||
|
|
||
|
|
@@ -112,8 +112,8 @@ describe(`Features`, () => { | |
| test( | ||
| `it should install new version when excluded by package name glob pattern`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`release-*`], | ||
| }, async ({run, source}) => { | ||
| await run(`add`, `release-date@^1.0.0`); | ||
|
|
||
|
|
@@ -127,8 +127,8 @@ describe(`Features`, () => { | |
| test( | ||
| `it should install new version when excluded by package ident`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`release-date`], | ||
| }, async ({run, source}) => { | ||
| await run(`add`, `release-date@^1.0.0`); | ||
|
|
||
|
|
@@ -142,7 +142,7 @@ describe(`Features`, () => { | |
| test( | ||
| `it should not impact semver prioritization of newer versions when multiple versions meet the age requirement`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: 0, | ||
| }, async ({run, source}) => { | ||
| await run(`add`, `release-date@^1.0.0`); | ||
|
|
||
|
|
@@ -156,7 +156,7 @@ describe(`Features`, () => { | |
| test( | ||
| `it should work with scoped packages`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| }, async ({run}) => { | ||
| await expect(run(`add`, `@scoped/[email protected]`)).rejects.toThrowError(`No candidates found`); | ||
| }), | ||
|
|
@@ -165,8 +165,8 @@ describe(`Features`, () => { | |
| test( | ||
| `it should install scoped package when excluded`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`@scoped/release-date`], | ||
| }, async ({run, source}) => { | ||
| await run(`add`, `@scoped/release-date@^1.0.0`); | ||
|
|
||
|
|
@@ -180,8 +180,8 @@ describe(`Features`, () => { | |
| test( | ||
| `it should install scoped package when excluded by scoped glob pattern`, | ||
| makeTemporaryEnv({}, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`@scoped/*`], | ||
| }, async ({run, source}) => { | ||
| await run(`add`, `@scoped/release-date@^1.0.0`); | ||
|
|
||
|
|
@@ -198,7 +198,7 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`release-date`]: `1.1.1`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| }, async ({run}) => { | ||
| await expect(run(`install`)).rejects.toThrowError(`No candidates found`); | ||
| }), | ||
|
|
@@ -209,7 +209,7 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`release-date`]: `^1.0.0`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
|
|
||
|
|
@@ -225,8 +225,8 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`release-date`]: `^1.0.0`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`[email protected]`], | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
|
|
||
|
|
@@ -242,8 +242,8 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`release-date`]: `1.1.1`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`release-date@npm:1.1.1`], | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
|
|
||
|
|
@@ -259,8 +259,8 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`release-date`]: `^1.0.0`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`release-date@^1.0.0`], | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
|
|
||
|
|
@@ -276,8 +276,8 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`release-date`]: `^1.0.0`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`release-date@npm:^1.0.0`], | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
|
|
||
|
|
@@ -293,8 +293,8 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`release-date`]: `^1.0.0`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`release-*`], | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
|
|
||
|
|
@@ -310,8 +310,8 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`release-date`]: `^1.0.0`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`release-date`], | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
|
|
||
|
|
@@ -327,7 +327,7 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`release-date`]: `^1.0.0`}, | ||
| }, { | ||
| npmMinimumReleaseAge: 0, | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
|
|
||
|
|
@@ -343,7 +343,7 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`@scoped/release-date`]: `1.1.1`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| }, async ({run}) => { | ||
| await expect(run(`install`)).rejects.toThrowError(`No candidates found`); | ||
| }), | ||
|
|
@@ -354,8 +354,8 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`@scoped/release-date`]: `^1.0.0`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`@scoped/release-date`], | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
|
|
||
|
|
@@ -371,8 +371,8 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`@scoped/release-date`]: `^1.0.0`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| npmMinimumReleaseAgeExclude: [`@scoped/*`], | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
|
|
||
|
|
@@ -390,7 +390,7 @@ describe(`Features`, () => { | |
| makeTemporaryEnv({ | ||
| dependencies: {[`release-date`]: `^1.0.0`}, | ||
| }, { | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
| await run(`set`, `resolution`, `release-date@npm:^1.0.0`, `npm:1.0.0`); | ||
|
|
@@ -416,7 +416,7 @@ describe(`Features`, () => { | |
| // disabling these checks for the purpose of this test | ||
| pnpFallbackMode: `all`, | ||
| pnpMode: `loose`, | ||
| npmMinimumReleaseAge: ONE_DAY_IN_MINUTES, | ||
| }, async ({run, source}) => { | ||
| await run(`install`); | ||
| await run(`set`, `resolution`, `release-date@npm:^1.0.0`, `npm:1.0.0`); | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -407,23 +407,6 @@ | |
| } | ||
| ] | ||
| }, | ||
| "networkConcurrency": { | ||
| "_package": "@yarnpkg/core", | ||
| "title": "Amount of HTTP requests that are allowed to run at the same time.", | ||
|
|
@@ -496,6 +479,24 @@ | |
| "type": "string", | ||
| "default": "pnp" | ||
| }, | ||
| "npmMinimumReleaseAge": { | ||
| "_package": "@yarnpkg/core", | ||
| "title": "Minimum age of a package version according to the publish date on the npm registry in minutes to be considered for installation.", | ||
| "description": "If a package version is newer than the minimum release age, it will not be considered for installation. This can be used to reduce the likelihood of installing compromised packages.", | ||
| "type": "number", | ||
| "default": 0 | ||
| }, | ||
| "npmMinimumReleaseAgeExclude": { | ||
| "_package": "@yarnpkg/core", | ||
| "title": "Array of exact package descriptors, exact package locators, or package name glob patterns to exclude from the minimum release age check.", | ||
| "description": "If a package descriptor, locator, or name matches specified pattern, it will not be considered for the minimum release age check. That is, the newest matching package version will be selected for installation regardless of the minimum release age configuration.", | ||
| "type": "array", | ||
| "items": { | ||
| "type": "string" | ||
| }, | ||
| "default": [], | ||
| "examples": ["@scoped-package/*", "package", "package*", "package@^1.0.0", "[email protected]", "package@npm:1.0.0", "package@npm:^1.0.0"] | ||
| }, | ||
| "pnpmStoreFolder": { | ||
| "_package": "@yarnpkg/plugin-pnpm", | ||
| "title": "Path where the pnpm store will be stored", | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I could envision multiple types of gates.