Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(guided remediation): remove --relock-cmd flag #1517

Merged
merged 1 commit into from
Jan 21, 2025
Merged

fix(guided remediation): remove --relock-cmd flag #1517

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions cmd/osv-scanner/fix/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,6 @@ type osvFixOptions struct {
ManifestRW manifest.ReadWriter
Lockfile string
LockfileRW lockfile.ReadWriter
RelockCmd string
NoIntroduce bool
}

Expand Down Expand Up @@ -91,10 +90,6 @@ func Command(stdout, stderr io.Writer, r *reporter.Reporter) *cli.Command {
Name: "maven-registry",
Usage: "URL of the default Maven registry to fetch metadata",
},
&cli.StringFlag{
Name: "relock-cmd",
Usage: "command to run to regenerate lockfile on disk after changing the manifest",
},

&cli.BoolFlag{
Name: "non-interactive",
Expand Down Expand Up @@ -319,7 +314,6 @@ func action(ctx *cli.Context, stdout, stderr io.Writer) (reporter.Reporter, erro
},
Manifest: ctx.String("manifest"),
Lockfile: ctx.String("lockfile"),
RelockCmd: ctx.String("relock-cmd"),
NoIntroduce: ctx.Bool("no-introduce"),
}

Expand Down
6 changes: 2 additions & 4 deletions cmd/osv-scanner/fix/noninteractive.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ func autoRelax(ctx context.Context, r *outputReporter, opts osvFixOptions, maxUp
return err
}

if opts.Lockfile != "" || opts.RelockCmd != "" {
if opts.Lockfile != "" {
// We only recreate the lockfile if we know a lockfile already exists
// or we've been given a command to run.
r.Infof("Shelling out to regenerate lockfile...\n")
Expand All @@ -198,9 +198,7 @@ func autoRelax(ctx context.Context, r *outputReporter, opts osvFixOptions, maxUp
if err == nil {
return nil
}
if opts.RelockCmd != "" {
return err
}

r.Warnf("Install failed. Trying again with `--legacy-peer-deps`...\n")
cmd, err = regenerateLockfileCmd(opts)
if err != nil {
Expand Down
8 changes: 1 addition & 7 deletions cmd/osv-scanner/fix/regen_lockfile.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ import (
"os"
"os/exec"
"path/filepath"
"strings"
)

func regenerateLockfileCmd(opts osvFixOptions) (*exec.Cmd, error) {
Expand All @@ -19,12 +18,7 @@ func regenerateLockfileCmd(opts osvFixOptions) (*exec.Cmd, error) {
}
// TODO: need to also remove node_modules/ in workspace packages

cmd := opts.RelockCmd
if cmd == "" {
cmd = "npm install --package-lock-only"
}
cmdParts := strings.Split(cmd, " ")
c := exec.Command(cmdParts[0], cmdParts[1:]...) //nolint:gosec
c := exec.Command("npm", "install", "--package-lock-only")
c.Dir = dir

return c, nil
Expand Down
4 changes: 2 additions & 2 deletions cmd/osv-scanner/fix/state-relock-result.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -514,7 +514,7 @@ func (st *stateRelockResult) write(m model) tea.Msg {
return writeMsg{err}
}

if m.options.Lockfile == "" && m.options.RelockCmd == "" {
if m.options.Lockfile == "" {
// TODO: there's no user feedback to show this was successful
return writeMsg{nil}
}
Expand All @@ -525,7 +525,7 @@ func (st *stateRelockResult) write(m model) tea.Msg {
}

return tea.ExecProcess(c, func(err error) tea.Msg {
if err != nil && m.options.RelockCmd == "" {
if err != nil {
// try again with "--legacy-peer-deps"
c, err := regenerateLockfileCmd(m.options)
if err != nil {
Expand Down
5 changes: 1 addition & 4 deletions docs/guided-remediation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -683,10 +683,7 @@ The relaxation patches are presented in order of effectiveness, with patches tha
If you wish to apply your current relock & relaxation changes, select the "Write" option to update your manifest file with the new requirements and regenerate your lockfile (if provided).

{: .note }

> The `package-lock.json` file is regenerated by first deleting the existing `package-lock.json` and `node_modules/` directory, then running `npm install --package-lock-only`. This recreates the lockfile but does not install the `node_modules/` dependencies. Run `npm ci` separately to install the dependencies.
>
> The `--relock-cmd` flag can be used to change the executed install command.
The `package-lock.json` file is regenerated by first deleting the existing `package-lock.json` and `node_modules/` directory, then running `npm install --package-lock-only`. This recreates the lockfile but does not install the `node_modules/` dependencies. Run `npm ci` separately to install the dependencies.

### Override dependency versions

Expand Down
Loading