Version 4.0.2 of acho was just published.

This version is covered by your current version range and after updating it in your project the build failed.

acho is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Your Greenkeeper Bot 🌴

In typing up the previous bug report (#11), I mistyped the command as $ finepack package (without the ".json" extension because I had multiple package* files in my directory and I was lazily using CLI auto-complete). I got the following error:

$ finepack package # instead of the correct "package.json"

fs.js:439
  return binding.open(pathModule._makeLong(path), stringToFlags(flags), mode);
                 ^
Error: ENOENT, no such file or directory '/Users/pdehaan/dev/tmp/finepack-test2/package'
  at Object.fs.openSync (fs.js:439:18)
  at Object.fs.readFileSync (fs.js:290:15)
  at Object.<anonymous> (/Users/pdehaan/.npm-packages/lib/node_modules/finepack/bin/index.js:31:19)
  at Module._compile (module.js:456:26)
  at Object.Module._extensions..js (module.js:474:10)
  at Module.load (module.js:356:32)
  at Function.Module._load (module.js:312:12)
  at Function.Module.runMain (module.js:497:10)
  at startup (node.js:119:16)
  at node.js:929:3

$ echo $?
8

If I'm reading it correctly, it's coming from here:

/* 29: */ var filepath = path.resolve(cli.input[0]);
/* 30: */ var filename = path.basename(filepath);
/* 31: */ var filedata = fs.readFileSync(filepath, {encoding: 'utf8'});

We may want to verify that the file exists before attempting to open it barfing all over the Terminal.
Either checking if the file exists using fs.existsSync() or maybe wrapping the fs.readFileSync() in a try...catch block.

UPDATE: It looks like just wrapping the fs.readFileSync() in a try...catch block may be the answer (per Node docs):

fs.exists() is an anachronism and exists only for historical reasons. There should almost never be a reason to use it in your own code.
In particular, checking if a file exists before opening it is an anti-pattern that leaves you vulnerable to race conditions: another process may remove the file between the calls to fs.exists() and fs.open(). Just open the file and handle the error when it's not there.
fs.exists() will be deprecated.
...
fs.existsSync() will be deprecated.

— via https://nodejs.org/api/fs.html#fs_fs_exists_path_callback

I tried installing finepack globally and running it on a local directory and got the following error:

Error: Cannot find module 'superb'

Steps to reproduce

$ npm i finepack --global
/Users/pdehaan/.npm-packages/bin/finepack -> /Users/pdehaan/.npm-packages/lib/node_modules/finepack/bin/index.js
[email protected] /Users/pdehaan/.npm-packages/lib/node_modules/finepack
├── [email protected] ([email protected])
├── [email protected] ([email protected], [email protected], [email protected], [email protected], [email protected])
├── [email protected]
├── [email protected] ([email protected], [email protected], [email protected], [email protected])
└── [email protected] ([email protected], [email protected], [email protected], [email protected], [email protected])


$ finepack

module.js:340
    throw err;
          ^
Error: Cannot find module 'superb'
  at Function.Module._resolveFilename (module.js:338:15)
  at Function.Module._load (module.js:280:25)
  at Module.require (module.js:364:17)
  at require (module.js:380:17)
  at Object.<anonymous> (/Users/pdehaan/.npm-packages/lib/node_modules/finepack/lib/Finepack.coffee:7:21)
  at Object.<anonymous> (/Users/pdehaan/.npm-packages/lib/node_modules/finepack/lib/Finepack.coffee:1:1)
  at Module._compile (module.js:456:26)
  at Object.loadFile (/Users/pdehaan/.npm-packages/lib/node_modules/finepack/node_modules/coffee-script/lib/coffee-script/register.js:16:19)
  at Module.load (/Users/pdehaan/.npm-packages/lib/node_modules/finepack/node_modules/coffee-script/lib/coffee-script/register.js:45:36)
  at Function.Module._load (module.js:312:12)
  at Module.require (module.js:364:17)
  at require (module.js:380:17)
  at Object.<anonymous> (/Users/pdehaan/.npm-packages/lib/node_modules/finepack/bin/index.js:6:16)
  at Module._compile (module.js:456:26)
  at Object.Module._extensions..js (module.js:474:10)
  at Module.load (module.js:356:32)
  at Function.Module._load (module.js:312:12)
  at Function.Module.runMain (module.js:497:10)
  at startup (node.js:119:16)
  at node.js:929:3

I didn't see the superb dependency listed in ./package.json, but I did notice a reference in the stack trace to a require() in ./lib/Finepack.coffee:7.

The dependency acho was updated from 4.0.2 to 4.0.3.

🚨 View failing branch.

This version is covered by your current version range and after updating it in your project the build failed.

acho is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Your Greenkeeper Bot 🌴

Need to be present!

Version 4.0.1 of acho was just published.

This version is covered by your current version range and after updating it in your project the build failed.

acho is a direct dependency of this project, and it is very likely causing it to break. If other packages depend on yours, this update is probably also breaking those in turn.

Your Greenkeeper Bot 🌴

I'm using the API example from the README file, and notice that my output has all the chalk color codes sprinkled through the messages. Not sure if there is a flag or setting to disable the colors when I'm using the API instead of having to pass the --no-color flag via the CLI.

$ node index
[ error: [],
  warning: [ '\u001b[33mwarning\u001b[39m: \u001b[90mmissing \'bugs\'\u001b[39m',
    '\u001b[33mwarning\u001b[39m: \u001b[90mmissing \'keywords\'\u001b[39m',
    '\u001b[33mwarning\u001b[39m: \u001b[90mmissing \'homepage\'\u001b[39m',
    '\u001b[33mwarning\u001b[39m: \u001b[90mmissing \'repository\'\u001b[39m' ],
  success: [],
  info: [ '\u001b[90minfo\u001b[39m: \u001b[1mpackage.json\u001b[22m is near to be \u001b[1mfine\u001b[22m. Check the file and run again.' ] ]

Versus:

$ node index --no-color
[ error: [],
  warning: [ 'warning: missing \'bugs\'',
    'warning: missing \'keywords\'',
    'warning: missing \'homepage\'',
    'warning: missing \'repository\'' ],
  success: [],
  info: [ 'info: package.json is near to be fine. Check the file and run again.' ] ]

Steps to reproduce:

$ finepack package.json



warning: missing 'bugs'
warning: missing 'keywords'
warning: missing 'homepage'
warning: missing 'repository'


info: package.json is near to be fine. Check the file and run again.

$ finepack package.json -l



warning: missing 'bugs'
warning: missing 'keywords'
warning: missing 'homepage'
warning: missing 'repository'


info: package.json is near to be fine. Check the file and run again.

references:

• https://github.com/zaach/jsonlint

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Finepack depends on jsonlint, which depends on nomnom, which depends on [email protected].

See https://nvd.nist.gov/vuln/detail/CVE-2021-23358 for vulnerability details.

I'm seeing an issue where if I use the finepack module API and try and do console.log(JSON.stringify(messages) then I get an empty array back instead of a formatted object with error, warning, success, and info keys.

Steps to reproduce:

Here's my index.js file:

var fs = require('fs');
var path     = require('path');
var finepack = require('finepack');

var filename = path.basename(filepath);
var filepath = path.resolve('./package.json');
var filedata = fs.readFileSync(filepath).toString();

var options = {
  filename: filename,
  lint: true
};

finepack(filedata, options, function(err, output, messages){
  if (err) {
    console.error('err', err);
  }
  console.log('\nraw:');
  console.log(messages);
  console.log('\nJSON.stringify():');
  console.log(JSON.stringify(messages, null, 2));
});

And I run it via the CLI (and have to specify --no-color otherwise the output gets chalk data in the messages):

$ node index --no-color
err true

raw:
[ error: [],
  warning: [ 'warning: missing \'bugs\'',
    'warning: missing \'keywords\'',
    'warning: missing \'homepage\'',
    'warning: missing \'repository\'' ],
  success: [],
  info: [ 'info: undefined is near to be fine. Check the file and run again.' ] ]

JSON.stringify():
[]

As you can see, when I use JSON.stringify() on the messages, I get back an empty array. As close as I can tell, this is a slight issue in ./lib/Logger.coffee:10 where the constructor method sets @messages to an array (@messages = []), where we probably want that to be an object ({}). Changing that locally in my ./node_modules/ directory seems to have solved the issue for me.

There are a few new license changes in newer versions of npm.

https://docs.npmjs.com/files/package.json#license
http://npm1k.org/

See https://www.npmjs.com/package/spdx

I've seen this in a few of our project's lately, so it'd be nice if the finepack tool could check if the file specified in main and bin paths are valid (something like fs.existsSync() or whatever).

For example, I think by default npm sets the main script to "index.js". In my case, the index file is set to "indexxxx.js" which doesn't exist. It'd be nice if finepack could display a warning or error.

{
  "name": "espree-test",
  "description": "",
  "version": "1.0.0",
  "author": "peter",
  "dependencies": {
    "canonical-json": "0.0.4",
    "espree": "1.11.0"
  },
  "license": "WTFPL",
  "main": "indexxxx.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  }
}

This would let me use finepack to lint random package.json or bower.json files directly from GitHub (via the request or wreck module).

Basically I want to scrape https://raw.githubusercontent.com/Kikobeats/finepack/master/package.json and then pass the JSON object to finepack so I can take advantage of the linters. I could use something like package-json-validator instead, but this package also supports bower and is pretty awesome.

Version 2.0.1 of acho-skin-cli just got published.

This version is covered by your current version range and after updating it in your project the build failed.

acho-skin-cli is a direct dependency of this project this is very likely breaking your project right now. If other packages depend on you it’s very likely also breaking them.
I recommend you give this issue a very high priority. I’m sure you can resolve this 💪

Your Greenkeeper Bot 🌴

Related:

• https://github.com/npm/read-package-json
• https://github.com/npm/normalize-package-data

🚨 You need to enable Continuous Integration on all branches of this repository. 🚨

To enable Greenkeeper, you need to make sure that a commit status is reported on all branches. This is required by Greenkeeper because we are using your CI build statuses to figure out when to notify you about breaking changes.

Since we did not receive a CI status on the greenkeeper/initial branch, we assume that you still need to configure it.

If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with greenkeeper/.

We recommend using Travis CI, but Greenkeeper will work with every other CI service as well.

Once you have installed CI on this repository, you’ll need to re-trigger Greenkeeper’s initial Pull Request. To do this, please delete the greenkeeper/initial branch in this repository, and then remove and re-add this repository to the Greenkeeper integration’s white list on Github. You'll find this list on your repo or organiszation’s settings page, under Installed GitHub Apps.

Not sure if this is a regression, or expected or...

Steps to reproduce

1. Go to a clean folder
2. npm init
3. Fill in all the fields.
4. finepack package.json

Actual results:

Before finepack:

{
  "name": "finepack-test2",
  "version": "1.0.0",
  "description": "this is a desc",
  "main": "index.js",
  "dependencies": {},
  "devDependencies": {},
  "scripts": {
    "test": "eslint ."
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/git/repo"
  },
  "keywords": [
    "keywords"
  ],
  "author": "Peter deHaan <[email protected]> (http://nodeexamples.com/)",
  "license": "WTFPL",
  "bugs": {
    "url": "https://github.com/git/repo/issues"
  },
  "homepage": "https://github.com/git/repo"
}

After finepack:

{
  "name": "finepack-test2",
  "description": "this is a desc",
  "homepage": "https://github.com/git/repo",
  "version": "1.0.0",
  "main": "index.js",
  "author": "Peter deHaan <[email protected]> (http://nodeexamples.com/)",
  "repository": {
    "type": "git",
    "url": "https://github.com/git/repo"
  },
  "bugs": {
    "url": "https://github.com/git/repo/issues"
  },
  "keywords": [
    "keywords"
  ],
  "dependencies": {},
  "devDependencies": {},
  "scripts": {
    "test": "eslint ."
  },
  "license": "WTFPL"
}

Expected results:

Sorted properties (per the documentation: "Sorts the rest of the keys alphabetically and recursively."):

{
  "name": "finepack-test2",
  "description": "this is a desc",
  "version": "1.0.0",
  "author": "Peter deHaan <[email protected]> (http://nodeexamples.com/)",
  "bugs": {
    "url": "https://github.com/git/repo/issues"
  },
  "dependencies": {},
  "devDependencies": {},
  "homepage": "https://github.com/git/repo",
  "keywords": [
    "keywords"
  ],
  "license": "WTFPL",
  "main": "index.js",
  "repository": {
    "type": "git",
    "url": "https://github.com/git/repo"
  },
  "scripts": {
    "test": "eslint ."
  }
}