diff --git a/.changeset/quote-glob-targets.md b/.changeset/quote-glob-targets.md new file mode 100644 index 0000000..dcadb4f --- /dev/null +++ b/.changeset/quote-glob-targets.md @@ -0,0 +1,5 @@ +--- +'@mawesome/dependency-audit': patch +--- + +Document quoting glob targets (e.g. `"./packages/*"`) in scripts so the CLI, not the shell, expands them — keeping the command portable across shells, including Windows. diff --git a/apps/site/package.json b/apps/site/package.json index d1b56bf..12c32ee 100644 --- a/apps/site/package.json +++ b/apps/site/package.json @@ -15,7 +15,7 @@ "dependencies": { "@astrojs/starlight": "^0.39.3", "@mawesome/dependency-audit": "workspace:*", - "astro": "^6.4.3", + "astro": "^6.4.7", "nanotar": "^0.3.0", "pathe": "^2.0.3" }, diff --git a/packages/dependency-audit/README.md b/packages/dependency-audit/README.md index 2adb207..46db2e2 100644 --- a/packages/dependency-audit/README.md +++ b/packages/dependency-audit/README.md @@ -33,8 +33,8 @@ dependency-audit ./my-lib-1.2.3.tgz dependency-audit lodash@4.17.21 dependency-audit @sindresorhus/is@latest -# Several at once (a glob is expanded by the CLI, so it works on Windows too) -dependency-audit --json ./packages/* +# Several at once — quote the glob so the CLI (not the shell) expands it, identically on every OS +dependency-audit --json "./packages/*" ``` Exit codes: `0` clean, `1` findings, `2` error. See the [CLI reference](./docs/cli.md) for every flag (including `--condition`, `--require-types`, and config files). diff --git a/packages/dependency-audit/docs/cli.md b/packages/dependency-audit/docs/cli.md index 1d8f603..b0c5428 100644 --- a/packages/dependency-audit/docs/cli.md +++ b/packages/dependency-audit/docs/cli.md @@ -13,7 +13,7 @@ A **target** is one of: Multiple targets may be passed; each is audited independently and isolated — one target failing to acquire/audit reports as an error for that target and never discards the others. -A path-shaped glob (e.g. `./packages/*`, `../../packages/*`) is expanded by the CLI itself, so it behaves the same on Windows — where `cmd.exe`/PowerShell don't expand globs — as in a POSIX shell. The base may use `.`, `..`, or be absolute. A pattern matching nothing is kept as-is, surfacing as a clear "not found" error, and a published spec or URL is never globbed, so `lodash@*` still resolves against the registry. +A path-shaped glob (e.g. `./packages/*`, `../../packages/*`) is expanded by the CLI itself, so it behaves the same on Windows — where `cmd.exe`/PowerShell don't expand globs — as in a POSIX shell. **Quote the pattern** (`"./packages/*"`) in a script so a POSIX shell doesn't expand it first; then the CLI does the expansion identically on every OS (the result is the same either way, but quoting keeps the command portable). The base may use `.`, `..`, or be absolute. A pattern matching nothing is kept as-is, surfacing as a clear "not found" error, and a published spec or URL is never globbed, so `lodash@*` still resolves against the registry. A local path that **exists but is not an auditable package** — a non-tarball file, or a directory without a `package.json` — is **skipped** (a neutral `↷` notice), not treated as an error. This is what keeps a stray glob match (`packages/*` catching a `README.md`) from turning a findings run (exit 1) into an error run (exit 2). A path that does **not** exist, or a spec that fails to resolve, is still a hard error. @@ -61,16 +61,16 @@ dependency-audit lodash@4.17.21 dependency-audit @sindresorhus/is@latest # A whole monorepo's built packages, machine-readable, for CI -dependency-audit --json ./packages/* +dependency-audit --json "./packages/*" # Audit the browser export condition instead of the default Node profile dependency-audit --condition browser ./packages/my-lib # Treat "types not built / unreachable" as a hard failure -dependency-audit --require-types ./packages/* +dependency-audit --require-types "./packages/*" # Don't let an internal producer's type gap fail every consumer — fix the producer -dependency-audit --collapse-root-cause ./packages/* +dependency-audit --collapse-root-cause "./packages/*" # Suppress a known-intentional optional import dependency-audit --ignore optional-plugin --ignore react/jsx-runtime ./packages/my-lib @@ -99,10 +99,10 @@ The CLI does not know about your repo layout — point it at the **built** packa ```sh pnpm -r exec dependency-audit . # one process per package (simple, fully isolated) -dependency-audit ./packages/* # one process, bounded-concurrency, isolated per target +dependency-audit "./packages/*" # one process, bounded-concurrency, isolated per target ``` -The `./packages/*` form is expanded by the CLI when the shell doesn't (Windows `cmd.exe`), so the same command works everywhere. +Quote the glob (`"./packages/*"`) so the CLI expands it rather than the shell — the same command then works everywhere, including Windows `cmd.exe`/PowerShell, which don't expand globs. Local `@scope/*` dependencies declared as `file:`/`workspace:`/`link:` are resolved by linking the already-built sibling, so you do not need to publish or rebuild siblings first — just build them. diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ac0dacd..a170102 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -222,13 +222,13 @@ importers: dependencies: '@astrojs/starlight': specifier: ^0.39.3 - version: 0.39.3(astro@6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0))(typescript@6.0.3) + version: 0.39.3(astro@6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0))(typescript@6.0.3) '@mawesome/dependency-audit': specifier: workspace:* version: link:../../packages/dependency-audit astro: - specifier: ^6.4.3 - version: 6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0) + specifier: ^6.4.7 + version: 6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0) nanotar: specifier: ^0.3.0 version: 0.3.0 @@ -1977,8 +1977,8 @@ packages: peerDependencies: astro: ^4.0.0-beta || ^5.0.0-beta || ^3.3.0 || ^6.0.0-beta - astro@6.4.3: - resolution: {integrity: sha512-heArIk8zLcxuoj1WgBH2zGdAD8zKSU1mEcBvS6hYMEHRPlbtvB+4Y8ri9Z27hzeryvGaFgrH32zjghEfV2y07g==} + astro@6.4.7: + resolution: {integrity: sha512-5vsXx0H52u23Jpshs9tM81D03Tb3Oh2Vt2Zo0bpqjXN+njkAWjFyGjTfmWJLAcrCQd9Q+iWB1eqfhR1sZJEaUA==} engines: {node: '>=22.12.0', npm: '>=9.6.5', pnpm: '>=7.1.0'} hasBin: true @@ -4465,12 +4465,12 @@ snapshots: transitivePeerDependencies: - supports-color - '@astrojs/mdx@5.0.6(astro@6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0))': + '@astrojs/mdx@5.0.6(astro@6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0))': dependencies: '@astrojs/markdown-remark': 7.1.2 '@mdx-js/mdx': 3.1.1 acorn: 8.16.0 - astro: 6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0) + astro: 6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0) es-module-lexer: 2.1.0 estree-util-visit: 2.0.0 hast-util-to-html: 9.0.5 @@ -4494,17 +4494,17 @@ snapshots: stream-replace-string: 2.0.0 zod: 4.4.3 - '@astrojs/starlight@0.39.3(astro@6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0))(typescript@6.0.3)': + '@astrojs/starlight@0.39.3(astro@6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0))(typescript@6.0.3)': dependencies: '@astrojs/markdown-remark': 7.2.0 - '@astrojs/mdx': 5.0.6(astro@6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0)) + '@astrojs/mdx': 5.0.6(astro@6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0)) '@astrojs/sitemap': 3.7.3 '@pagefind/default-ui': 1.5.2 '@types/hast': 3.0.4 '@types/js-yaml': 4.0.9 '@types/mdast': 4.0.4 - astro: 6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0) - astro-expressive-code: 0.42.0(astro@6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0)) + astro: 6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0) + astro-expressive-code: 0.42.0(astro@6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0)) bcp-47: 2.1.0 hast-util-from-html: 2.0.3 hast-util-select: 6.0.4 @@ -5004,7 +5004,7 @@ snapshots: '@img/sharp-wasm32@0.34.5': dependencies: - '@emnapi/runtime': 1.10.0 + '@emnapi/runtime': 1.11.0 optional: true '@img/sharp-win32-arm64@0.34.5': @@ -5874,12 +5874,12 @@ snapshots: astring@1.9.0: {} - astro-expressive-code@0.42.0(astro@6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0)): + astro-expressive-code@0.42.0(astro@6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0)): dependencies: - astro: 6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0) + astro: 6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0) rehype-expressive-code: 0.42.0 - astro@6.4.3(@types/node@24.12.4)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0): + astro@6.4.7(@types/node@24.13.2)(lightningcss@1.32.0)(rollup@4.61.0)(yaml@2.9.0): dependencies: '@astrojs/compiler': 4.0.0 '@astrojs/internal-helpers': 0.10.0 @@ -5931,8 +5931,8 @@ snapshots: unist-util-visit: 5.1.0 unstorage: 1.17.5 vfile: 6.0.3 - vite: 7.3.5(@types/node@24.12.4)(lightningcss@1.32.0)(yaml@2.9.0) - vitefu: 1.1.3(vite@7.3.5(@types/node@24.12.4)(lightningcss@1.32.0)(yaml@2.9.0)) + vite: 7.3.5(@types/node@24.13.2)(lightningcss@1.32.0)(yaml@2.9.0) + vitefu: 1.1.3(vite@7.3.5(@types/node@24.13.2)(lightningcss@1.32.0)(yaml@2.9.0)) xxhash-wasm: 1.1.0 yargs-parser: 22.0.0 zod: 4.4.3 @@ -8504,7 +8504,7 @@ snapshots: '@types/unist': 3.0.3 vfile-message: 4.0.3 - vite@7.3.5(@types/node@24.12.4)(lightningcss@1.32.0)(yaml@2.9.0): + vite@7.3.5(@types/node@24.13.2)(lightningcss@1.32.0)(yaml@2.9.0): dependencies: esbuild: 0.28.1 fdir: 6.5.0(picomatch@4.0.4) @@ -8513,7 +8513,7 @@ snapshots: rollup: 4.61.0 tinyglobby: 0.2.17 optionalDependencies: - '@types/node': 24.12.4 + '@types/node': 24.13.2 fsevents: 2.3.3 lightningcss: 1.32.0 yaml: 2.9.0 @@ -8531,9 +8531,9 @@ snapshots: fsevents: 2.3.3 yaml: 2.9.0 - vitefu@1.1.3(vite@7.3.5(@types/node@24.12.4)(lightningcss@1.32.0)(yaml@2.9.0)): + vitefu@1.1.3(vite@7.3.5(@types/node@24.13.2)(lightningcss@1.32.0)(yaml@2.9.0)): optionalDependencies: - vite: 7.3.5(@types/node@24.12.4)(lightningcss@1.32.0)(yaml@2.9.0) + vite: 7.3.5(@types/node@24.13.2)(lightningcss@1.32.0)(yaml@2.9.0) vitest@4.1.8(@types/node@24.13.2)(esbuild@0.28.1)(yaml@2.9.0): dependencies: