Admit defeat with pnpm overrides and use hybrid approach

packages/npm/assert/overrides/call-bind/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Socket Inc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packages/npm/assert/overrides/call-bind/LICENSE.original

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Jordan Harband
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packages/npm/assert/overrides/call-bind/callBound.d.ts

@@ -0,0 +1,5 @@
+declare function callBoundIntrinsic(
+  name: 'RegExp.prototype.test',
+  allowMissing?: boolean
+): (regex: RegExp, str: string) => boolean
+export = callBoundIntrinsic

packages/npm/assert/overrides/call-bind/callBound.js

@@ -1,11 +1,9 @@
 'use strict'
 
-function noop() {}
-
 function regExpProtoTest(regex, str) {
   return regex.test(str)
 }
 
 module.exports = function callBoundIntrinsic(name, _allowMissing) {
-  return name === 'RegExp.prototype.test' ? regExpProtoTest : noop
+  return name === 'RegExp.prototype.test' ? regExpProtoTest : undefined
 }

packages/npm/assert/overrides/call-bind/index.d.ts

@@ -0,0 +1 @@
+/* empty */

packages/npm/assert/overrides/call-bind/index.js

@@ -0,0 +1 @@
+/* empty */

packages/npm/assert/overrides/call-bind/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@socketregistry/assert",
+  "version": "1.0.6-overrides-call-bind",
+  "license": "MIT",
+  "description": "Socket.dev optimized package override for assert/call-bind",
+  "keywords": [
+    "Socket.dev",
+    "package-overrides"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SocketDev/socket-registry-js.git",
+    "directory": "packages/npm/assert/overrides/call-bind"
+  },
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./index.js"
+    },
+    "./callBound": {
+      "types": "./callBound.d.ts",
+      "default": "./callBound.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18.20.4"
+  },
+  "files": [
+    "*.d.ts",
+    "*.js"
+  ],
+  "socket": {
+    "categories": [
+      "cleanup"
+    ]
+  }
+}

packages/npm/assert/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketregistry/assert",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "license": "MIT",
   "description": "Socket.dev optimized package override for assert",
   "keywords": [
@@ -36,7 +36,7 @@
     "which-typed-array": "npm:@socketregistry/which-typed-array@^1"
   },
   "resolutions": {
-    "call-bind": "link:./overrides/call-bind",
+    "call-bind": "npm::@socketregistry/[email protected]overrides-call-bind",
     "inherits": "npm:[email protected]",
     "is-arguments": "npm:@socketregistry/is-arguments@^1",
     "is-generator-function": "npm:@socketregistry/is-generator-function@^1",
@@ -52,7 +52,8 @@
   },
   "files": [
     "*.d.ts",
-    "**/*.js"
+    "**/*.js",
+    "!overrides/**/{*.d.ts,index.js}"
   ],
   "socket": {
     "categories": [

scripts/constants.js

@@ -229,10 +229,13 @@ const isDirEmptySync = function isDirEmptySync(dirname) {
 }
 
 const readDirNamesSync = function readDirNamesSync(dirname, options) {
-  return innerReadDirNames(
-    fs.readdirSync(dirname, { withFileTypes: true }),
-    options
-  )
+  try {
+    return innerReadDirNames(
+      fs.readdirSync(dirname, { withFileTypes: true }),
+      options
+    )
+  } catch {}
+  return []
 }
 
 const defaultWhichOptions = {

scripts/update-npm-package-access.js

@@ -13,6 +13,7 @@ const {
   registryPkgPath
 } = constants
 const { joinAsList } = require('@socketregistry/scripts/utils/arrays')
+const { readDirNames } = require('@socketregistry/scripts/utils/fs')
 const { execNpm } = require('@socketregistry/scripts/utils/npm')
 const { pEach } = require('@socketregistry/scripts/utils/promises')
 
@@ -24,14 +25,21 @@ const { values: cliArgs } = util.parseArgs(parseArgsConfig)
     return
   }
   const failures = []
-  const packages = [
+  const packages = await Promise.all([
     // Lazily access constants.npmPackageNames.
-    ...constants.npmPackageNames.map(regPkgName => ({
-      name: regPkgName,
-      path: path.join(npmPackagesPath, regPkgName)
-    })),
+    ...constants.npmPackageNames.flatMap(async regPkgName => {
+      const pkgPath = path.join(npmPackagesPath, regPkgName)
+      const overridesPath = path.join(pkgPath, 'overrides')
+      return [
+        { name: regPkgName, path: pkgPath },
+        ...(await readDirNames(overridesPath)).map(n => ({
+          name: regPkgName,
+          path: path.join(overridesPath, n)
+        }))
+      ]
+    }),
     { name: '@socketsecurity/registry', path: registryPkgPath }
-  ]
+  ])
   // Chunk package names to process them in parallel 3 at a time.
   await pEach(packages, 3, async ({ name: regPkgName, path: pkgPath }) => {
     try {

scripts/update-npm-package-publish.js

@@ -7,6 +7,7 @@ const constants = require('@socketregistry/scripts/constants')
 const { COLUMN_LIMIT, ENV, npmPackagesPath, parseArgsConfig, registryPkgPath } =
   constants
 const { joinAsList } = require('@socketregistry/scripts/utils/arrays')
+const { readDirNames } = require('@socketregistry/scripts/utils/fs')
 const { execNpm } = require('@socketregistry/scripts/utils/npm')
 const { pEach } = require('@socketregistry/scripts/utils/promises')
 
@@ -18,14 +19,21 @@ const { values: cliArgs } = util.parseArgs(parseArgsConfig)
     return
   }
   const failures = []
-  const packages = [
+  const packages = await Promise.all([
     // Lazily access constants.npmPackageNames.
-    ...constants.npmPackageNames.map(regPkgName => ({
-      name: regPkgName,
-      path: path.join(npmPackagesPath, regPkgName)
-    })),
+    ...constants.npmPackageNames.flatMap(async regPkgName => {
+      const pkgPath = path.join(npmPackagesPath, regPkgName)
+      const overridesPath = path.join(pkgPath, 'overrides')
+      return [
+        { name: regPkgName, path: pkgPath },
+        ...(await readDirNames(overridesPath)).map(n => ({
+          name: regPkgName,
+          path: path.join(overridesPath, n)
+        }))
+      ]
+    }),
     { name: '@socketsecurity/registry', path: registryPkgPath }
-  ]
+  ])
   // Chunk package names to process them in parallel 3 at a time.
   await pEach(packages, 3, async ({ name: regPkgName, path: pkgPath }) => {
     try {

scripts/utils/fs.js

@@ -17,6 +17,13 @@ const defaultRemoveOptions = Object.freeze({
   retryDelay: 200
 })
 
+function isDirSync(filepath) {
+  try {
+    return fs.statSync(filepath).isDirectory()
+  } catch {}
+  return false
+}
+
 function isSymbolicLinkSync(filepath) {
   try {
     return fs.lstatSync(filepath).isSymbolicLink()
@@ -25,10 +32,13 @@ function isSymbolicLinkSync(filepath) {
 }
 
 async function readDirNames(dirname, options) {
-  return innerReadDirNames(
-    await fs.readdir(dirname, { withFileTypes: true }),
-    options
-  )
+  try {
+    return innerReadDirNames(
+      await fs.readdir(dirname, { withFileTypes: true }),
+      options
+    )
+  } catch {}
+  return []
 }
 
 async function remove(filepath, options) {
@@ -60,6 +70,7 @@ function uniqueSync(filepath) {
 
 module.exports = {
   isDirEmptySync,
+  isDirSync,
   isSymbolicLinkSync,
   readDirNames,
   readDirNamesSync,

test/packages.test.ts

@@ -160,6 +160,11 @@ for (const eco of constants.ecosystems) {
         const jsonFiles = files
           .filter(p => path.extname(p) === '.json')
           .sort(localeCompare)
+        const localOverridesFiles = filesFieldMatches.filter(p =>
+          p.startsWith(overridesWithSlash)
+        )
+        const hasOverrides =
+          !!pkgOverrides || !!pkgResolutions || localOverridesFiles.length > 0
 
         it('package name should be valid', () => {
           assert.ok(isValidPackageName(pkgJson.name))
@@ -260,13 +265,6 @@ for (const eco of constants.ecosystems) {
           )
         })
 
-        it('package files should match "files" field', () => {
-          const filesToCompare = files.filter(
-            p => !isDotFile(p) || dotFileMatches.includes(p)
-          )
-          assert.deepEqual(filesFieldMatches, filesToCompare)
-        })
-
         if (
           files.includes('implementation.js') &&
           files.includes('polyfill.js')
@@ -327,12 +325,6 @@ for (const eco of constants.ecosystems) {
           })
         }
 
-        const localOverridesFiles = filesFieldMatches.filter(p =>
-          p.startsWith(overridesWithSlash)
-        )
-        const hasOverrides =
-          !!pkgOverrides || !!pkgResolutions || localOverridesFiles.length > 0
-
         if (hasOverrides) {
           const localOverridesPackages = localOverridesFiles.map(p =>
             p.slice(
@@ -343,15 +335,7 @@ for (const eco of constants.ecosystems) {
 
           it('should have overrides and resolutions fields in package.json', () => {
             assert.ok(isObjectObject(pkgOverrides))
-            const actual = Object.fromEntries(
-              Object.entries(pkgOverrides).map(({ 0: k, 1: v }) => {
-                return [
-                  k,
-                  typeof v === 'string' ? v.replace(/^file:/, 'link:') : v
-                ]
-              })
-            )
-            assert.deepEqual(actual, pkgResolutions)
+            assert.ok(isObjectObject(pkgResolutions))
           })
 
           it('should have overrides directory', () => {
@@ -365,6 +349,13 @@ for (const eco of constants.ecosystems) {
               assert.strictEqual(spec, expected)
             }
           })
+        } else {
+          it('package files should match "files" field', () => {
+            const filesToCompare = files.filter(
+              p => !isDotFile(p) || dotFileMatches.includes(p)
+            )
+            assert.deepEqual(filesFieldMatches, filesToCompare)
+          })
         }
       })
     }