Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security fix for semver vulnerability #7043

Merged
merged 9 commits into from Jul 5, 2023
Merged

Security fix for semver vulnerability #7043

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
dcfd122
Migrate cli to ESM and update meow dependency
romainmenke Jul 4, 2023
61497eb
Create twenty-camels-promise.md
jeddy3 Jul 4, 2023
79b9b96
Merge branch 'main' into migrate-cli-to-esmodules-and-update-meow-dep…
romainmenke Jul 4, 2023
2bee9c7
Merge branch 'main' into migrate-cli-to-esmodules-and-update-meow-dep…
jeddy3 Jul 4, 2023
ad850ea
meow version ^10.1.0
romainmenke Jul 5, 2023
656caa2
Apply suggestions from code review
romainmenke Jul 5, 2023
7dadf91
undo
romainmenke Jul 5, 2023
0292af8
Update package.json
romainmenke Jul 5, 2023
685c37f
lock file
romainmenke Jul 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/twenty-camels-promise.md
View file
Open in desktop
@@ -0,0 +1,5 @@
---
"stylelint": patch
---

Security: fix for `semver` vulnerability
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[note] Our maintainer guide now doesn't mention the Security: prefix. This doesn't block this PR, but I'm a bit curious. 😅

stylelint/docs/maintainer-guide/pull-requests.md

Lines 22 to 23 in a42f955

2. If applicable, add a [changeset](https://github.com/changesets/changesets) using the GitHub interface:
- prefix the entry with either: "Removed", "Changed", "Deprecated", "Added", or "Fixed"

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's an oversight. It should list all the ones from https://keepachangelog.com/en/1.0.0/. I'll open a PR.

5 changes: 0 additions & 5 deletions bin/stylelint.js
View file
Open in desktop

This file was deleted.

5 changes: 5 additions & 0 deletions bin/stylelint.mjs
View file
Open in desktop
@@ -0,0 +1,5 @@
#!/usr/bin/env node

import cli from '../lib/cli.mjs';

cli(process.argv.slice(2));
4 changes: 1 addition & 3 deletions lib/__tests__/cli.test.mjs
View file
Open in desktop
Expand Up @@ -10,16 +10,14 @@ import stripAnsi from 'strip-ansi';
import readJSONFile from '../testUtils/readJSONFile.mjs';
import replaceBackslashes from '../testUtils/replaceBackslashes.mjs';

import cli from '../cli.js';
import cli, { buildCLI } from '../cli.mjs';

const pkg = readJSONFile(new URL('../../package.json', import.meta.url));

const fixturesPath = (...elems) =>
replaceBackslashes(path.join(fileURLToPath(new URL('./fixtures', import.meta.url)), ...elems));

describe('buildCLI', () => {
const { buildCLI } = cli;

it('flags - default', () => {
expect(buildCLI([]).flags).toEqual({
allowEmptyInput: false,
Expand Down
47 changes: 26 additions & 21 deletions lib/cli.js → lib/cli.mjs
View file
Open in desktop
@@ -1,23 +1,30 @@
'use strict';

romainmenke marked this conversation as resolved.
Show resolved Hide resolved
const { EOL } = require('os');
const meow = require('meow');
const path = require('path');
const { red, dim } = require('picocolors');
const resolveFrom = require('resolve-from');

const { isPlainObject } = require('./utils/validateTypes');
const checkInvalidCLIOptions = require('./utils/checkInvalidCLIOptions');
const printConfig = require('./printConfig');
const standalone = require('./standalone');
const writeOutputFile = require('./writeOutputFile');
const resolveCustomFormatter = require('./resolveCustomFormatter');
const {
import picocolors from 'picocolors';
const { dim, red } = picocolors;

import { EOL } from 'os';
import meow from 'meow';
import path from 'path';
import resolveFrom from 'resolve-from';

import checkInvalidCLIOptions from './utils/checkInvalidCLIOptions.js';
import { isPlainObject } from './utils/validateTypes.js';
import printConfig from './printConfig.js';
import resolveCustomFormatter from './resolveCustomFormatter.js';
import standalone from './standalone.js';
import writeOutputFile from './writeOutputFile.js';

import {
DEFAULT_CACHE_LOCATION,
DEFAULT_IGNORE_FILENAME,
DEFAULT_FORMATTER,
DEFAULT_IGNORE_FILENAME,
EXIT_CODE_ERROR,
} = require('./constants');
} from './constants.js';

import { createRequire } from 'module';
// @ts-expect-error
const require = createRequire(import.meta.url);

/**
* @typedef {{
Expand Down Expand Up @@ -376,7 +383,7 @@ const meowOptions = {
* @param {string[]} argv
* @returns {Promise<any>}
*/
module.exports = async function main(argv) {
export default async function main(argv) {
const cli = buildCLI(argv);

const invalidOptionsMessage = checkInvalidCLIOptions(meowOptions.flags, cli.flags);
Expand Down Expand Up @@ -574,7 +581,7 @@ module.exports = async function main(argv) {
}
})
.catch(handleError);
};
}

/**
* @param {{ stack: any, code: any }} err
Expand Down Expand Up @@ -628,9 +635,7 @@ async function getStdin() {
* @param {string[]} argv
* @returns {CLIOptions}
*/
function buildCLI(argv) {
export function buildCLI(argv) {
// @ts-expect-error -- TS2322: Type 'Result<AnyFlags>' is not assignable to type 'CLIOptions'.
return meow({ ...meowOptions, argv });
return meow({ ...meowOptions, argv, importMeta: import.meta });
}

module.exports.buildCLI = buildCLI;