fix: make sure dev deps are saved propery

snyk · Jul 7, 2016 · ffe1ad9 · ffe1ad9
1 parent b1e4829
commit ffe1ad9
Show file tree

Hide file tree

Showing 7 changed files with 473 additions and 21 deletions.
diff --git a/cli/commands/protect/wizard.js b/cli/commands/protect/wizard.js
@@ -361,7 +361,7 @@ function processAnswers(answers, policy, options) {
 
       var lbl = 'Updating npm-shrinkwrap.json...';
       return spinner(lbl)
-        .then(npm.bind(null, 'shrinkwrap', null, live, cwd))
+        .then(npm.bind(null, 'shrinkwrap', null, live, cwd, null))
         .then(spinner.clear(lbl));
     }
   })

diff --git a/lib/npm.js b/lib/npm.js
@@ -3,7 +3,8 @@ module.exports = npm;
 var debug = require('debug')('snyk');
 var exec = require('child_process').exec;
 
-function npm(method, packages, live, cwd) {
+function npm(method, packages, live, cwd, flags) {
+  flags = flags || [];
   if (!packages) {
     packages = [];
   }
@@ -14,10 +15,12 @@ function npm(method, packages, live, cwd) {
 
   // only if we have packages, then always save, otherwise the command might
   // be something like `npm shrinkwrap'
-  if (packages.length) {
-    method = '--save ' + method;
+  if (packages.length && !flags.length) {
+    flags.push('--save');
   }
 
+  method += ' ' + flags.join(' ');
+
   return new Promise(function (resolve, reject) {
     var cmd = 'npm ' + method + ' ' + packages.join(' ');
     if (!cwd) {

diff --git a/lib/protect/update.js b/lib/protect/update.js
@@ -12,6 +12,7 @@ var spinner = require('../spinner');
 function update(packages, live) {
   var lbl = 'Running `npm update`...';
   var error = false;
+
   return spinner(lbl).then(function () {
     // the uninstall doesn't need versions in the strings
     // but install *does* so we build up arrays of both
@@ -22,13 +23,17 @@ function update(packages, live) {
       var remediation = vuln.upgradePath.filter(Boolean)[0];
       upgradeWithoutVersions.push(remediation.split('@').shift());
 
-      // TODO fix this string
-      if (vuln.parentDep === 'dev') {
-        console.log('>>>>>>>>>>>>>>>>');
+      return {
+        remediation: remediation,
+        type: vuln.parentDepType || 'prod',
+      };
+    }).reduce(function (ups, vuln) {
+      if (!ups[vuln.type]) {
+        ups[vuln.type] = [];
       }
-
-      return remediation;
-    });
+      ups[vuln.type].push(vuln.remediation);
+      return ups;
+    }, {});
 
     debug('to upgrade', upgrade);
 
@@ -38,12 +43,21 @@ function update(packages, live) {
 
     var toUninstall = _.unique(upgradeWithoutVersions);
     var promise = npm('uninstall', toUninstall, live).then(function () {
-      // FIXME this only adds to prod deps
-      // it should respect the dep type here
-      return npm('install', findUpgrades(upgrade), live).catch(function (e) {
+      var prodUpdate = (upgrade.prod ?
+        npm('install', findUpgrades(upgrade.prod), live) :
+        Promise.resolve(true)).catch(function (e) {
         error = e;
         return false;
       });
+      var devUpdate = (upgrade.dev ?
+        npm('install', findUpgrades(upgrade.dev), live, null, ['--save-dev']) :
+        Promise.resolve(true)).catch(function (e) {
+        error = e;
+        return false;
+      });
+      return Promise.all([prodUpdate, devUpdate]).then(function (results) {
+        return results[0] && results[1];
+      });
     });
 
     return promise;

diff --git a/lib/test.js b/lib/test.js
@@ -122,11 +122,11 @@ function test(root, options, callback) {
             vuln.shrinkwrap = plucked.shrinkwrap;
             vuln.bundled = plucked.bundled;
 
-            vuln.depType = plucked.depType;
-
             var parentPkg = moduleToOjbect(vuln.from[1]);
-            var parent = modules.pluck(vuln.from.slice(0, 2), parentPkg.name, parentPkg.version);
-            vuln.parentDep = parent.depType;
+            var parent = modules.pluck(vuln.from.slice(0, 2),
+                                       parentPkg.name,
+                                       parentPkg.version);
+            vuln.parentDepType = parent.depType;
           });
         }
       }