perf: lazy-load semver and fastSort in sorts and versions modules

sorts.ts: Convert semver and fastSort to lazy require() calls via
getSemver()/getFastSort() getters with hoisted local variables.
Only loaded when compareSemver() or naturalSorter() is first called.

versions.ts: Convert semver to lazy require() via getSemver() getter.
Every function delegates to the getter on first call.

Impact: importing @socketsecurity/lib/objects (for isObject) or
@socketsecurity/lib/http-request (for httpJson) no longer transitively
loads the 2.5 MB npm-pack bundle at module init time via the
sorts -> semver -> npm-pack chain.

Author: jdalton

src/sorts.ts

@@ -3,17 +3,34 @@
  * Provides various comparison utilities for arrays and collections.
  */
 
-import * as fastSort from './external/fast-sort.js'
-import * as semver from './external/semver.js'
+import type * as fastSortType from './external/fast-sort.js'
+import type * as semverType from './external/semver.js'
+
+let _semver: typeof semverType | undefined
+function getSemver() {
+  if (_semver === undefined) {
+    _semver = require('./external/semver.js')
+  }
+  return _semver!
+}
+
+let _fastSort: typeof fastSortType | undefined
+function getFastSort() {
+  if (_fastSort === undefined) {
+    _fastSort = require('./external/fast-sort.js')
+  }
+  return _fastSort!
+}
 
 /**
  * Compare semantic versions.
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function compareSemver(a: string, b: string): number {
   /* c8 ignore next 2 - External semver calls */
-  const validA: string | null = semver.valid(a)
-  const validB: string | null = semver.valid(b)
+  const sv = getSemver()
+  const validA: string | null = sv.valid(a)
+  const validB: string | null = sv.valid(b)
 
   if (!validA && !validB) {
     return 0
@@ -25,7 +42,7 @@ export function compareSemver(a: string, b: string): number {
     return 1
   }
   /* c8 ignore next - External semver call */
-  return semver.compare(a, b) as number
+  return sv.compare(a, b) as number
 }
 
 /**
@@ -90,7 +107,7 @@ export function naturalSorter<T>(
 ): ReturnType<FastSortFunction> {
   if (_naturalSorter === undefined) {
     /* c8 ignore next 3 - External fast-sort call */
-    _naturalSorter = fastSort.createNewSortInstance({
+    _naturalSorter = getFastSort().createNewSortInstance({
       comparer: naturalCompare,
     }) as FastSortFunction
   }

src/versions.ts

@@ -1,13 +1,21 @@
 /** @fileoverview Version comparison and validation utilities for Socket ecosystem. */
 
-import * as semver from './external/semver.js'
+import type * as semverType from './external/semver.js'
+
+let _semver: typeof semverType | undefined
+function getSemver() {
+  if (_semver === undefined) {
+    _semver = require('./external/semver.js')
+  }
+  return _semver!
+}
 
 /**
  * Coerce a version string to valid semver format.
  */
 export function coerceVersion(version: string): string | undefined {
   /* c8 ignore next - External semver call */
-  const coerced = semver.coerce(version)
+  const coerced = getSemver().coerce(version)
   return coerced?.version
 }
 
@@ -21,7 +29,7 @@ export function compareVersions(
 ): -1 | 0 | 1 | undefined {
   try {
     /* c8 ignore next - External semver call */
-    return semver.compare(v1, v2)
+    return getSemver().compare(v1, v2)
   } catch {
     return undefined
   }
@@ -32,15 +40,15 @@ export function compareVersions(
  */
 export function filterVersions(versions: string[], range: string): string[] {
   /* c8 ignore next - External semver call */
-  return versions.filter(v => semver.satisfies(v, range))
+  return versions.filter(v => getSemver().satisfies(v, range))
 }
 
 /**
  * Get the major version number from a version string.
  */
 export function getMajorVersion(version: string): number | undefined {
   /* c8 ignore next - External semver call */
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   return parsed?.major
 }
 
@@ -49,7 +57,7 @@ export function getMajorVersion(version: string): number | undefined {
  */
 export function getMinorVersion(version: string): number | undefined {
   /* c8 ignore next - External semver call */
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   return parsed?.minor
 }
 
@@ -58,7 +66,7 @@ export function getMinorVersion(version: string): number | undefined {
  */
 export function getPatchVersion(version: string): number | undefined {
   /* c8 ignore next - External semver call */
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   return parsed?.patch
 }
 
@@ -78,23 +86,23 @@ export function incrementVersion(
   identifier?: string | undefined,
 ): string | undefined {
   /* c8 ignore next - External semver call */
-  return semver.inc(version, release, identifier) || undefined
+  return getSemver().inc(version, release, identifier) || undefined
 }
 
 /**
  * Check if version1 equals version2.
  */
 export function isEqual(version1: string, version2: string): boolean {
   /* c8 ignore next - External semver call */
-  return semver.eq(version1, version2)
+  return getSemver().eq(version1, version2)
 }
 
 /**
  * Check if version1 is greater than version2.
  */
 export function isGreaterThan(version1: string, version2: string): boolean {
   /* c8 ignore next - External semver call */
-  return semver.gt(version1, version2)
+  return getSemver().gt(version1, version2)
 }
 
 /**
@@ -105,47 +113,47 @@ export function isGreaterThanOrEqual(
   version2: string,
 ): boolean {
   /* c8 ignore next - External semver call */
-  return semver.gte(version1, version2)
+  return getSemver().gte(version1, version2)
 }
 
 /**
  * Check if version1 is less than version2.
  */
 export function isLessThan(version1: string, version2: string): boolean {
   /* c8 ignore next - External semver call */
-  return semver.lt(version1, version2)
+  return getSemver().lt(version1, version2)
 }
 
 /**
  * Check if version1 is less than or equal to version2.
  */
 export function isLessThanOrEqual(version1: string, version2: string): boolean {
   /* c8 ignore next - External semver call */
-  return semver.lte(version1, version2)
+  return getSemver().lte(version1, version2)
 }
 
 /**
  * Validate if a string is a valid semantic version.
  */
 export function isValidVersion(version: string): boolean {
   /* c8 ignore next - External semver call */
-  return semver.valid(version) !== null
+  return getSemver().valid(version) !== null
 }
 
 /**
  * Get the highest version from an array of versions.
  */
 export function maxVersion(versions: string[]): string | undefined {
   /* c8 ignore next - External semver call */
-  return semver.maxSatisfying(versions, '*') || undefined
+  return getSemver().maxSatisfying(versions, '*') || undefined
 }
 
 /**
  * Get the lowest version from an array of versions.
  */
 export function minVersion(versions: string[]): string | undefined {
   /* c8 ignore next - External semver call */
-  return semver.minSatisfying(versions, '*') || undefined
+  return getSemver().minSatisfying(versions, '*') || undefined
 }
 
 /**
@@ -161,7 +169,7 @@ export function parseVersion(version: string):
     }
   | undefined {
   /* c8 ignore next - External semver call */
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   if (!parsed) {
     return undefined
   }
@@ -179,23 +187,23 @@ export function parseVersion(version: string):
  */
 export function satisfiesVersion(version: string, range: string): boolean {
   /* c8 ignore next - External semver call */
-  return semver.satisfies(version, range)
+  return getSemver().satisfies(version, range)
 }
 
 /**
  * Sort versions in ascending order.
  */
 export function sortVersions(versions: string[]): string[] {
   /* c8 ignore next - External semver call */
-  return semver.sort([...versions])
+  return getSemver().sort([...versions])
 }
 
 /**
  * Sort versions in descending order.
  */
 export function sortVersionsDesc(versions: string[]): string[] {
   /* c8 ignore next - External semver call */
-  return semver.rsort([...versions])
+  return getSemver().rsort([...versions])
 }
 
 /**
@@ -216,7 +224,7 @@ export function versionDiff(
   | undefined {
   try {
     /* c8 ignore next - External semver call */
-    return semver.diff(version1, version2) || undefined
+    return getSemver().diff(version1, version2) || undefined
   } catch {
     return undefined
   }