Skip to content

Commit 0e6a975

Browse files
thehenrytsaithehenrytsai
authored
Replaced madge with dependency-cruiser to fix dependency vulnerabilities (#782)
1 parent 4cd136b commit 0e6a975

File tree

5 files changed

+854
-1438
lines changed

5 files changed

+854
-1438
lines changed

‎.dependency-cruiser.cjs‎

Lines changed: 389 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,389 @@
1+
/** @type {import('dependency-cruiser').IConfiguration} */
2+
module.exports = {
3+
forbidden: [
4+
{
5+
name: 'no-circular',
6+
severity: 'error',
7+
comment:
8+
'This dependency is part of a circular relationship. You might want to revise ' +
9+
'your solution (i.e. use dependency inversion, make sure the modules have a single responsibility) ',
10+
from: {},
11+
to: {
12+
circular: true
13+
}
14+
},
15+
{
16+
name: 'no-orphans',
17+
comment:
18+
"This is an orphan module - it's likely not used (anymore?). Either use it or " +
19+
"remove it. If it's logical this module is an orphan (i.e. it's a config file), " +
20+
"add an exception for it in your dependency-cruiser configuration. By default " +
21+
"this rule does not scrutinize dot-files (e.g. .eslintrc.js), TypeScript declaration " +
22+
"files (.d.ts), tsconfig.json and some of the babel and webpack configs.",
23+
severity: 'warn',
24+
from: {
25+
orphan: true,
26+
pathNot: [
27+
'(^|/)[.][^/]+[.](?:js|cjs|mjs|ts|cts|mts|json)$', // dot files
28+
'[.]d[.]ts$', // TypeScript declaration files
29+
'(^|/)tsconfig[.]json$', // TypeScript config
30+
'(^|/)(?:babel|webpack)[.]config[.](?:js|cjs|mjs|ts|cts|mts|json)$' // other configs
31+
]
32+
},
33+
to: {},
34+
},
35+
{
36+
name: 'no-deprecated-core',
37+
comment:
38+
'A module depends on a node core module that has been deprecated. Find an alternative - these are ' +
39+
"bound to exist - node doesn't deprecate lightly.",
40+
severity: 'warn',
41+
from: {},
42+
to: {
43+
dependencyTypes: [
44+
'core'
45+
],
46+
path: [
47+
'^v8/tools/codemap$',
48+
'^v8/tools/consarray$',
49+
'^v8/tools/csvparser$',
50+
'^v8/tools/logreader$',
51+
'^v8/tools/profile_view$',
52+
'^v8/tools/profile$',
53+
'^v8/tools/SourceMap$',
54+
'^v8/tools/splaytree$',
55+
'^v8/tools/tickprocessor-driver$',
56+
'^v8/tools/tickprocessor$',
57+
'^node-inspect/lib/_inspect$',
58+
'^node-inspect/lib/internal/inspect_client$',
59+
'^node-inspect/lib/internal/inspect_repl$',
60+
'^async_hooks$',
61+
'^punycode$',
62+
'^domain$',
63+
'^constants$',
64+
'^sys$',
65+
'^_linklist$',
66+
'^_stream_wrap$'
67+
],
68+
}
69+
},
70+
{
71+
name: 'not-to-deprecated',
72+
comment:
73+
'This module uses a (version of an) npm module that has been deprecated. Either upgrade to a later ' +
74+
'version of that module, or find an alternative. Deprecated modules are a security risk.',
75+
severity: 'warn',
76+
from: {},
77+
to: {
78+
dependencyTypes: [
79+
'deprecated'
80+
]
81+
}
82+
},
83+
{
84+
name: 'no-non-package-json',
85+
severity: 'error',
86+
comment:
87+
"This module depends on an npm package that isn't in the 'dependencies' section of your package.json. " +
88+
"That's problematic as the package either (1) won't be available on live (2 - worse) will be " +
89+
"available on live with an non-guaranteed version. Fix it by adding the package to the dependencies " +
90+
"in your package.json.",
91+
from: {},
92+
to: {
93+
dependencyTypes: [
94+
'npm-no-pkg',
95+
'npm-unknown'
96+
]
97+
}
98+
},
99+
{
100+
name: 'not-to-unresolvable',
101+
comment:
102+
"This module depends on a module that cannot be found ('resolved to disk'). If it's an npm " +
103+
'module: add it to your package.json. In all other cases you likely already know what to do.',
104+
severity: 'error',
105+
from: {},
106+
to: {
107+
couldNotResolve: true
108+
}
109+
},
110+
{
111+
name: 'no-duplicate-dep-types',
112+
comment:
113+
"Likely this module depends on an external ('npm') package that occurs more than once " +
114+
"in your package.json i.e. bot as a devDependencies and in dependencies. This will cause " +
115+
"maintenance problems later on.",
116+
severity: 'warn',
117+
from: {},
118+
to: {
119+
moreThanOneDependencyType: true,
120+
// as it's pretty common to have a type import be a type only import
121+
// _and_ (e.g.) a devDependency - don't consider type-only dependency
122+
// types for this rule
123+
dependencyTypesNot: ["type-only"]
124+
}
125+
},
126+
127+
/* rules you might want to tweak for your specific situation: */
128+
{
129+
name: 'not-to-test',
130+
comment:
131+
"This module depends on code within a folder that should only contain tests. As tests don't " +
132+
"implement functionality this is odd. Either you're writing a test outside the test folder " +
133+
"or there's something in the test folder that isn't a test.",
134+
severity: 'warn',
135+
from: {
136+
pathNot: '^(tests)'
137+
},
138+
to: {
139+
path: '^(tests)'
140+
}
141+
},
142+
{
143+
name: 'not-to-spec',
144+
comment:
145+
'This module depends on a spec (test) file. The sole responsibility of a spec file is to test code. ' +
146+
"If there's something in a spec that's of use to other modules, it doesn't have that single " +
147+
'responsibility anymore. Factor it out into (e.g.) a separate utility/ helper or a mock.',
148+
severity: 'error',
149+
from: {},
150+
to: {
151+
path: '[.](?:spec|test)[.](?:js|mjs|cjs|jsx|ts|mts|cts|tsx)$'
152+
}
153+
},
154+
{
155+
name: 'not-to-dev-dep',
156+
severity: 'error',
157+
comment:
158+
"This module depends on an npm package from the 'devDependencies' section of your " +
159+
'package.json. It looks like something that ships to production, though. To prevent problems ' +
160+
"with npm packages that aren't there on production declare it (only!) in the 'dependencies'" +
161+
'section of your package.json. If this module is development only - add it to the ' +
162+
'from.pathNot re of the not-to-dev-dep rule in the dependency-cruiser configuration',
163+
from: {
164+
path: '^(src)',
165+
pathNot: '[.](?:spec|test)[.](?:js|mjs|cjs|jsx|ts|mts|cts|tsx)$'
166+
},
167+
to: {
168+
dependencyTypes: [
169+
'npm-dev',
170+
],
171+
// type only dependencies are not a problem as they don't end up in the
172+
// production code or are ignored by the runtime.
173+
dependencyTypesNot: [
174+
'type-only'
175+
],
176+
pathNot: [
177+
'node_modules/@types/'
178+
]
179+
}
180+
},
181+
{
182+
name: 'optional-deps-used',
183+
severity: 'info',
184+
comment:
185+
"This module depends on an npm package that is declared as an optional dependency " +
186+
"in your package.json. As this makes sense in limited situations only, it's flagged here. " +
187+
"If you're using an optional dependency here by design - add an exception to your" +
188+
"dependency-cruiser configuration.",
189+
from: {},
190+
to: {
191+
dependencyTypes: [
192+
'npm-optional'
193+
]
194+
}
195+
},
196+
{
197+
name: 'peer-deps-used',
198+
comment:
199+
"This module depends on an npm package that is declared as a peer dependency " +
200+
"in your package.json. This makes sense if your package is e.g. a plugin, but in " +
201+
"other cases - maybe not so much. If the use of a peer dependency is intentional " +
202+
"add an exception to your dependency-cruiser configuration.",
203+
severity: 'warn',
204+
from: {},
205+
to: {
206+
dependencyTypes: [
207+
'npm-peer'
208+
]
209+
}
210+
}
211+
],
212+
options: {
213+
214+
/* Which modules not to follow further when encountered */
215+
doNotFollow: {
216+
/* path: an array of regular expressions in strings to match against */
217+
path: ['node_modules']
218+
},
219+
220+
/* Which modules to exclude */
221+
// exclude : {
222+
// /* path: an array of regular expressions in strings to match against */
223+
// path: '',
224+
// },
225+
226+
/* Which modules to exclusively include (array of regular expressions in strings)
227+
dependency-cruiser will skip everything not matching this pattern
228+
*/
229+
// includeOnly : [''],
230+
231+
/* List of module systems to cruise.
232+
When left out dependency-cruiser will fall back to the list of _all_
233+
module systems it knows of. It's the default because it's the safe option
234+
It might come at a performance penalty, though.
235+
moduleSystems: ['amd', 'cjs', 'es6', 'tsd']
236+
237+
As in practice only commonjs ('cjs') and ecmascript modules ('es6')
238+
are widely used, you can limit the moduleSystems to those.
239+
*/
240+
241+
// moduleSystems: ['cjs', 'es6'],
242+
243+
/* prefix for links in html and svg output (e.g. 'https://github.com/you/yourrepo/blob/main/'
244+
to open it on your online repo or `vscode://file/${process.cwd()}/` to
245+
open it in visual studio code),
246+
*/
247+
// prefix: `vscode://file/${process.cwd()}/`,
248+
249+
/* false (the default): ignore dependencies that only exist before typescript-to-javascript compilation
250+
true: also detect dependencies that only exist before typescript-to-javascript compilation
251+
"specify": for each dependency identify whether it only exists before compilation or also after
252+
*/
253+
tsPreCompilationDeps: true,
254+
255+
/* list of extensions to scan that aren't javascript or compile-to-javascript.
256+
Empty by default. Only put extensions in here that you want to take into
257+
account that are _not_ parsable.
258+
*/
259+
// extraExtensionsToScan: [".json", ".jpg", ".png", ".svg", ".webp"],
260+
261+
/* if true combines the package.jsons found from the module up to the base
262+
folder the cruise is initiated from. Useful for how (some) mono-repos
263+
manage dependencies & dependency definitions.
264+
*/
265+
// combinedDependencies: false,
266+
267+
/* if true leave symlinks untouched, otherwise use the realpath */
268+
// preserveSymlinks: false,
269+
270+
/* TypeScript project file ('tsconfig.json') to use for
271+
(1) compilation and
272+
(2) resolution (e.g. with the paths property)
273+
274+
The (optional) fileName attribute specifies which file to take (relative to
275+
dependency-cruiser's current working directory). When not provided
276+
defaults to './tsconfig.json'.
277+
*/
278+
tsConfig: {
279+
fileName: 'tsconfig.json'
280+
},
281+
282+
/* Webpack configuration to use to get resolve options from.
283+
284+
The (optional) fileName attribute specifies which file to take (relative
285+
to dependency-cruiser's current working directory. When not provided defaults
286+
to './webpack.conf.js'.
287+
288+
The (optional) `env` and `arguments` attributes contain the parameters
289+
to be passed if your webpack config is a function and takes them (see
290+
webpack documentation for details)
291+
*/
292+
// webpackConfig: {
293+
// fileName: 'webpack.config.js',
294+
// env: {},
295+
// arguments: {}
296+
// },
297+
298+
/* Babel config ('.babelrc', '.babelrc.json', '.babelrc.json5', ...) to use
299+
for compilation
300+
*/
301+
// babelConfig: {
302+
// fileName: '.babelrc',
303+
// },
304+
305+
/* List of strings you have in use in addition to cjs/ es6 requires
306+
& imports to declare module dependencies. Use this e.g. if you've
307+
re-declared require, use a require-wrapper or use window.require as
308+
a hack.
309+
*/
310+
// exoticRequireStrings: [],
311+
312+
/* options to pass on to enhanced-resolve, the package dependency-cruiser
313+
uses to resolve module references to disk. The values below should be
314+
suitable for most situations
315+
316+
If you use webpack: you can also set these in webpack.conf.js. The set
317+
there will override the ones specified here.
318+
*/
319+
enhancedResolveOptions: {
320+
/* What to consider as an 'exports' field in package.jsons */
321+
exportsFields: ["exports"],
322+
/* List of conditions to check for in the exports field.
323+
Only works when the 'exportsFields' array is non-empty.
324+
*/
325+
conditionNames: ["import", "require", "node", "default", "types"],
326+
/*
327+
The extensions, by default are the same as the ones dependency-cruiser
328+
can access (run `npx depcruise --info` to see which ones that are in
329+
_your_ environment). If that list is larger than you need you can pass
330+
the extensions you actually use (e.g. [".js", ".jsx"]). This can speed
331+
up module resolution, which is the most expensive step.
332+
*/
333+
// extensions: [".js", ".jsx", ".ts", ".tsx", ".d.ts"],
334+
/* What to consider a 'main' field in package.json */
335+
mainFields: ["module", "main", "types", "typings"],
336+
/*
337+
A list of alias fields in package.jsons
338+
See [this specification](https://github.com/defunctzombie/package-browser-field-spec) and
339+
the webpack [resolve.alias](https://webpack.js.org/configuration/resolve/#resolvealiasfields)
340+
documentation
341+
342+
Defaults to an empty array (= don't use alias fields).
343+
*/
344+
// aliasFields: ["browser"],
345+
},
346+
reporterOptions: {
347+
dot: {
348+
/* pattern of modules that can be consolidated in the detailed
349+
graphical dependency graph. The default pattern in this configuration
350+
collapses everything in node_modules to one folder deep so you see
351+
the external modules, but their innards.
352+
*/
353+
collapsePattern: 'node_modules/(?:@[^/]+/[^/]+|[^/]+)',
354+
355+
/* Options to tweak the appearance of your graph.See
356+
https://github.com/sverweij/dependency-cruiser/blob/main/doc/options-reference.md#reporteroptions
357+
for details and some examples. If you don't specify a theme
358+
dependency-cruiser falls back to a built-in one.
359+
*/
360+
// theme: {
361+
// graph: {
362+
// /* splines: "ortho" gives straight lines, but is slow on big graphs
363+
// splines: "true" gives bezier curves (fast, not as nice as ortho)
364+
// */
365+
// splines: "true"
366+
// },
367+
// }
368+
},
369+
archi: {
370+
/* pattern of modules that can be consolidated in the high level
371+
graphical dependency graph. If you use the high level graphical
372+
dependency graph reporter (`archi`) you probably want to tweak
373+
this collapsePattern to your situation.
374+
*/
375+
collapsePattern: '^(?:packages|src|lib(s?)|app(s?)|bin|test(s?)|spec(s?))/[^/]+|node_modules/(?:@[^/]+/[^/]+|[^/]+)',
376+
377+
/* Options to tweak the appearance of your graph. If you don't specify a
378+
theme for 'archi' dependency-cruiser will use the one specified in the
379+
dot section above and otherwise use the default one.
380+
*/
381+
// theme: { },
382+
},
383+
"text": {
384+
"highlightFocused": true
385+
},
386+
}
387+
}
388+
};
389+
// generated: [email protected] on 2024-07-16T21:45:56.970Z

0 commit comments

Comments
 (0)