chore!: security patches and ci improvement

.github/dependabot.yml

@@ -0,0 +1,15 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "npm" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: chore
+      prefix-development: chore
+      include: scope

.github/workflows/node.js.yml

@@ -0,0 +1,34 @@
+# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node
+# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
+
+name: Node.js CI
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  build:
+
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node-version: [18.x, 20.x]
+        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ matrix.node-version }}
+        cache: 'npm'
+    - run: npm install -g npm
+      # Use latest npm versions
+    - run: npm ci
+    - run: npm run build --if-present
+    - run: npm test

.github/workflows/npm-publish.yml

@@ -0,0 +1,35 @@
+# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
+# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
+
+name: Node.js Package
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: lts/*
+      - run: npm install -g npm
+      - run: npm ci
+      - run: npm test
+
+  publish-npm:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: lts/*
+          registry-url: https://registry.npmjs.org/
+      - run: npm install -g npm
+      - run: npm ci
+      - run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.npm_token}}

.gitignore

@@ -6,3 +6,4 @@ test/build/
 self-coverage/
 *.swp
 needs-transpile.js
+tap-snapshots/test/

.npmrc

@@ -1 +1 @@
-package-lock=false
+update-notifier=false

.taprc

@@ -4,7 +4,6 @@
 	"jobs": 1,
 	"timeout": 360,
 	"bail": false,
-	"esm": false,
 	"node-arg": [
 		"--require",
 		"./self-coverage-helper.js"

README.md

@@ -1,13 +1,9 @@
 # nyc
 
-[![Build Status](https://img.shields.io/travis/istanbuljs/nyc/master.svg)](https://travis-ci.org/istanbuljs/nyc)
-[![Windows Build Status](https://img.shields.io/appveyor/ci/istanbuljs/nyc/master.svg?label=Windows%20build)](https://ci.appveyor.com/project/istanbuljs/nyc/branch/master)
-[![Coverage Status](https://img.shields.io/coveralls/github/istanbuljs/nyc/master.svg)](https://coveralls.io/r/istanbuljs/nyc?branch=master)
-[![NPM version](https://img.shields.io/npm/v/nyc.svg)](https://www.npmjs.com/package/nyc)
-[![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow.svg)](https://conventionalcommits.org)
-[![community slack](https://devtoolscommunity.herokuapp.com/badge.svg)](https://devtoolscommunity.herokuapp.com)
-
-_Having problems? want to contribute? join our [community slack](https://devtoolscommunity.herokuapp.com)_.
+
+### This fork is maintained on best-effort basis. Please seek alternatives and migrate away ASAP. 
+
+![Node.js CI / build](https://github.com/cschanaj/nyc/actions/workflows/node.js.yml/badge.svg)
 
 Istanbul's state of the art command line interface, with support for:
 

bin/nyc.js

@@ -32,7 +32,7 @@ async function main () {
   if (!argv.instrument) argv.instrumenter = './lib/instrumenters/noop'
   else argv.instrumenter = './lib/instrumenters/istanbul'
 
-  var nyc = (new NYC(argv))
+  const nyc = (new NYC(argv))
   if (argv.clean) {
     await nyc.reset()
   } else {

build-self-coverage.js

@@ -4,7 +4,7 @@ const path = require('path')
 const fs = require('fs')
 const istanbul = require('istanbul-lib-instrument')
 const makeDir = require('make-dir')
-const glob = require('glob')
+const { glob } = require('glob')
 
 const instrumenter = istanbul.createInstrumenter({
   coverageVariable: '___NYC_SELF_COVERAGE___',
@@ -22,23 +22,20 @@ function instrumentFile (name) {
   fs.writeFileSync(outputPath, instrumentedSource)
 }
 
-function instrumentGlob (pattern) {
-  const result = glob.sync(pattern, {
-    cwd: __dirname,
-    nodir: true
-  })
+async function instrumentGlob (pattern) {
+  const result = await glob(pattern, { windowsPathsNoEscape: true })
 
   result.forEach(file => {
     instrumentFile(file)
   })
 }
 
-function instrumentAll () {
+async function instrumentAll () {
   /* package.json is just being copied so the instrumented copy of lib/hash.js can find it. */
   const globPatterns = ['package.json', 'index.js', 'bin/*.js', 'lib/**/*.js']
 
-  globPatterns.forEach(pattern => {
-    instrumentGlob(pattern)
+  await globPatterns.forEach(async pattern => {
+    await instrumentGlob(pattern)
   })
 }
 

index.js

@@ -6,20 +6,19 @@ const cachingTransform = require('caching-transform')
 const findCacheDir = require('find-cache-dir')
 const fs = require('./lib/fs-promises')
 const os = require('os')
-const { debuglog, promisify } = require('util')
-const glob = promisify(require('glob'))
+const { debuglog } = require('util')
+const { glob } = require('glob')
 const Hash = require('./lib/hash')
 const libCoverage = require('istanbul-lib-coverage')
 const libHook = require('istanbul-lib-hook')
 const { ProcessInfo, ProcessDB } = require('istanbul-lib-processinfo')
 const mkdirp = require('make-dir')
 const Module = require('module')
-const onExit = require('signal-exit')
+const { onExit } = require('signal-exit')
 const path = require('path')
-const rimraf = promisify(require('rimraf'))
+const { rimraf } = require('rimraf')
 const SourceMaps = require('./lib/source-maps')
 const TestExclude = require('test-exclude')
-const pMap = require('p-map')
 const getPackageType = require('get-package-type')
 
 const debugLog = debuglog('nyc')
@@ -32,7 +31,7 @@ const selfCoverageHelper = global[nycSelfCoverageHelper] || {
 }
 
 function coverageFinder () {
-  var coverage = global.__coverage__
+  let coverage = global.__coverage__
   if (typeof __coverage__ === 'object') coverage = __coverage__
   if (!coverage) coverage = global.__coverage__ = {}
   return coverage
@@ -105,7 +104,7 @@ class NYC {
       // when running --all we should not load source-file from
       // cache, we want to instead return the fake source.
       disableCache: this._disableCachingTransform(),
-      ext: ext
+      ext
     }
     if (this._eagerInstantiation) {
       opts.transform = this._transformFactory(this.cacheDirectory)
@@ -153,8 +152,8 @@ class NYC {
   }
 
   _readTranspiledSource (filePath) {
-    var source = null
-    var ext = path.extname(filePath)
+    let source = null
+    let ext = path.extname(filePath)
     if (typeof Module._extensions[ext] === 'undefined') {
       ext = '.js'
     }
@@ -182,7 +181,7 @@ class NYC {
     this._loadAdditionalModules()
 
     this.fakeRequire = true
-    const files = await this.exclude.glob(this.cwd)
+    const files = await this.exclude.glob(this.cwd, { windowsPathsNoEscape: true })
     for (const relFile of files) {
       const filename = path.resolve(this.cwd, relFile)
       const ext = path.extname(filename)
@@ -233,17 +232,19 @@ class NYC {
     this._loadAdditionalModules()
 
     const stats = await fs.lstat(input)
+    const { default: pMap } = await import('p-map')
     if (stats.isDirectory()) {
       inputDir = input
 
-      const filesToInstrument = await this.exclude.glob(input)
+      const filesToInstrument = await this.exclude.glob(input, { windowsPathsNoEscape: true })
 
       const concurrency = output ? os.cpus().length : 1
       if (this.config.completeCopy && output) {
         const files = await glob(path.resolve(input, '**'), {
           dot: true,
           nodir: true,
-          ignore: ['**/.git', '**/.git/**', path.join(output, '**')]
+          ignore: ['**/.git', '**/.git/**', path.join(output, '**')],
+          windowsPathsNoEscape: true
         })
         const destDirs = new Set(
           files.map(src => path.dirname(path.join(output, path.relative(input, src))))
@@ -386,7 +387,7 @@ class NYC {
   }
 
   writeCoverageFile () {
-    var coverage = coverageFinder()
+    const coverage = coverageFinder()
 
     // Remove any files that should be excluded but snuck into the coverage
     Object.keys(coverage).forEach(function (absFile) {
@@ -403,8 +404,8 @@ class NYC {
       }, this)
     }
 
-    var id = this.processInfo.uuid
-    var coverageFilename = path.resolve(this.tempDirectory(), id + '.json')
+    const id = this.processInfo.uuid
+    const coverageFilename = path.resolve(this.tempDirectory(), id + '.json')
 
     fs.writeFileSync(
       coverageFilename,
@@ -420,6 +421,7 @@ class NYC {
   async getCoverageMapFromAllCoverageFiles (baseDirectory) {
     const map = libCoverage.createCoverageMap({})
     const files = await this.coverageFiles(baseDirectory)
+    const { default: pMap } = await import('p-map')
 
     await pMap(
       files,
@@ -493,7 +495,7 @@ class NYC {
 
   _checkCoverage (summary, thresholds, file) {
     Object.keys(thresholds).forEach(function (key) {
-      var coverage = summary[key].pct
+      const coverage = summary[key].pct
       if (coverage < thresholds[key]) {
         process.exitCode = 1
         if (file) {
@@ -522,6 +524,7 @@ class NYC {
   // TODO: Remove from nyc v16
   async coverageData (baseDirectory) {
     const files = await this.coverageFiles(baseDirectory)
+    const { default: pMap } = await import('p-map')
     return pMap(
       files,
       f => this.coverageFileLoad(f, baseDirectory),

lib/commands/helpers.js

@@ -43,7 +43,7 @@ module.exports = {
         option.alias = setup.nycAlias
       }
 
-      const optionName = decamelize(name, '-')
+      const optionName = decamelize(name, { separator: '-' })
       yargs.option(optionName, option)
       if (!setup.nycCommands.includes(command)) {
         yargs.hide(optionName)

lib/commands/instrument.js

@@ -2,9 +2,8 @@
 
 const NYC = require('../../index.js')
 const path = require('path')
-const { promisify } = require('util')
 const resolveFrom = require('resolve-from')
-const rimraf = promisify(require('rimraf'))
+const { rimraf } = require('rimraf')
 const { cliWrapper, setupOptions } = require('./helpers.js')
 
 exports.command = 'instrument <input> [output]'

lib/commands/report.js

@@ -17,7 +17,7 @@ exports.builder = function (yargs) {
 
 exports.handler = cliWrapper(async argv => {
   process.env.NYC_CWD = process.cwd()
-  var nyc = new NYC(argv)
+  const nyc = new NYC(argv)
   await nyc.report().catch(suppressEPIPE)
   if (argv.checkCoverage) {
     await nyc.checkCoverage({

lib/instrumenters/istanbul.js

@@ -18,15 +18,15 @@ function InstrumenterIstanbul (options) {
 
   return {
     instrumentSync (code, filename, { sourceMap, registerMap }) {
-      var instrumented = instrumenter.instrumentSync(code, filename, sourceMap)
+      let instrumented = instrumenter.instrumentSync(code, filename, sourceMap)
       if (instrumented !== code) {
         registerMap()
       }
 
       // the instrumenter can optionally produce source maps,
       // this is useful for features like remapping stack-traces.
       if (options.produceSourceMap) {
-        var lastSourceMap = instrumenter.lastSourceMap()
+        const lastSourceMap = instrumenter.lastSourceMap()
         /* istanbul ignore else */
         if (lastSourceMap) {
           instrumented += '\n' + convertSourceMap.fromObject(lastSourceMap).toComment()