bundler-trivy 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3079187f7de00f3634dd3f042607d9c4b2f505d96239eec97c5633478b4c3e80
-  data.tar.gz: 1ca3ac43876af2b7eff2b5a0bd10ae0f2af13ee1eaf754d90bfd7f93a4b6e131
+  metadata.gz: b15121173aebfa308affe634e3d6cb0277f93f79837e981bcd260421026b969b
+  data.tar.gz: 5c6bddbbe3f88ec138326b8f24c1c4401eb6829c363d7f51bfabd0d17b0af9f4
 SHA512:
-  metadata.gz: 3f8298ad2fe95f9b1b72c824b93f59bcea9ffc398f3e681c1591cfdde8475850a71632e599eabcb155dcd7cc3903c52afa31395da5889284c76ffa627f911902
-  data.tar.gz: c374956836874f08ed84bab869e2b625155cd0b413f77e9907c05b7631e69729b5162a82fdff3dc7c2daedb5f4d6c80aab53531e906da56652a790e7ae3f205c
+  metadata.gz: 0070302073a86081f13386e0815842ed3b076ad1d77804bbfa64058a0b013cdc05cde42acf86add7f8461ab65406074946b0e74e6570632564b4cd1655782e24
+  data.tar.gz: 4cd3b619ba077a13868ceb77c152b5d60159762db88eeec20cd7dbebd5b2a5f9b255d016f55ed66e03322bfc8edc70e8ff64447c728ac514f0c510ca98d70ad4

data/README.md

@@ -39,21 +39,21 @@ sudo apt-get install trivy
 
 **From source** (currently):
 ```bash
-gem build bundler-trivy-plugin.gemspec
-bundle plugin install bundler-trivy-plugin --source .
+gem build bunder-trivy.gemspec
+bundle plugin install bunder-trivy --source .
 ```
 
 **Coming soon - from RubyGems**:
 ```bash
-gem install bundler-trivy-plugin
-bundle plugin install bundler-trivy-plugin
+gem install bunder-trivy
+bundle plugin install bunder-trivy
 ```
 
 ### 3. Verify Installation
 
 ```bash
 bundle plugin list
-# Should show: bundler-trivy-plugin
+# Should show: bunder-trivy
 
 trivy --version
 # Should show: Version: 0.x.x or later
@@ -264,8 +264,8 @@ jobs:
 
       - name: Install Plugin
         run: |
-          gem build bundler-trivy-plugin.gemspec
-          bundle plugin install bundler-trivy-plugin --source .
+          gem build bunder-trivy.gemspec
+          bundle plugin install bunder-trivy --source .
 
       - name: Install Dependencies with Security Scan
         run: bundle install
@@ -282,8 +282,8 @@ security_scan:
     - wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | apt-key add -
     - echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | tee -a /etc/apt/sources.list.d/trivy.list
     - apt-get update && apt-get install -y trivy
-    - gem build bundler-trivy-plugin.gemspec
-    - bundle plugin install bundler-trivy-plugin --source .
+    - gem build bunder-trivy.gemspec
+    - bundle plugin install bunder-trivy --source .
   script:
     - bundle install
   allow_failure: false
@@ -309,13 +309,13 @@ BUNDLER_TRIVY_FAIL_ON_HIGH=true bundle install
 **Check plugin is installed**:
 ```bash
 bundle plugin list
-# Should show bundler-trivy-plugin
+# Should show bunder-trivy
 ```
 
 **Reinstall if needed**:
 ```bash
-bundle plugin uninstall bundler-trivy-plugin
-bundle plugin install bundler-trivy-plugin --source .
+bundle plugin uninstall bunder-trivy
+bundle plugin install bunder-trivy --source .
 ```
 
 ### Trivy not found
@@ -378,8 +378,8 @@ chmod +x $(which trivy)
 ### Setup
 
 ```bash
-git clone https://github.com/durableprogramming/bundler-trivy-plugin.git
-cd bundler-trivy-plugin
+git clone https://github.com/durableprogramming/bunder-trivy.git
+cd bunder-trivy
 bundle install
 ```
 
@@ -410,12 +410,12 @@ bundle exec rubocop -a
 
 ```bash
 # Build gem
-gem build bundler-trivy-plugin.gemspec
+gem build bunder-trivy.gemspec
 
 # Install in test project
 cd /path/to/test/project
-bundle plugin uninstall bundler-trivy-plugin || true
-bundle plugin install bundler-trivy-plugin --source /path/to/plugin
+bundle plugin uninstall bunder-trivy || true
+bundle plugin install bunder-trivy --source /path/to/plugin
 
 # Test
 bundle install
@@ -465,8 +465,8 @@ MIT License - see [LICENSE](LICENSE) for details.
 
 ## Support
 
-- **Documentation**: [GitHub README](https://github.com/durableprogramming/bundler-trivy-plugin)
-- **Issues**: [GitHub Issues](https://github.com/durableprogramming/bundler-trivy-plugin/issues)
+- **Documentation**: [GitHub README](https://github.com/durableprogramming/bunder-trivy)
+- **Issues**: [GitHub Issues](https://github.com/durableprogramming/bunder-trivy/issues)
 - **Email**: commercial@durableprogramming.com
 
 ## Credits

data/lib/bundler/trivy/reporter.rb

@@ -123,9 +123,12 @@ module Bundler
         puts bold("Recommended Actions:")
         puts
 
-        fixable.group_by(&:package_name).each do |pkg, vulns|
-          vulns.map(&:fixed_version).compact.max_by { |v| Gem::Version.new(v.split(",").first) }
-          puts "  Update #{pkg}: bundle update #{pkg}"
+        fixable.group_by(&:package_name).each do |_pkg, vulns|
+          # Get all fixed versions from all vulnerabilities for this package
+          all_versions = vulns.flat_map(&:fixed_versions).compact.uniq
+          # Find the minimum version that fixes all vulns (safest upgrade path)
+          _recommended_version = all_versions.min_by { |v| Gem::Version.new(v) } if all_versions.any?
+          puts "  Update #{_pkg}: bundle update #{_pkg}"
         end
 
         puts

data/lib/bundler/trivy/version.rb

@@ -3,6 +3,6 @@
 module Bundler
   module Trivy
     # Version constant for bundler-trivy-plugin
-    VERSION = "0.1.2"
+    VERSION = "0.1.4"
   end
 end

data/lib/bundler/trivy/vulnerability.rb

@@ -88,7 +88,8 @@ module Bundler
 
       # Returns an array of all available fixed versions.
       #
-      # Parses the fixed_version string and splits on commas.
+      # Parses the fixed_version string and splits on commas, extracting
+      # version numbers from requirement constraints (e.g., "~> 7.1.5" -> "7.1.5").
       #
       # @return [Array<String>] Array of fixed version strings, empty if no fix available
       #
@@ -97,7 +98,18 @@ module Bundler
       def fixed_versions
         return [] unless fixable?
 
-        fixed_version.split(",").map(&:strip)
+        fixed_version.split(",").map(&:strip).filter_map do |constraint|
+          begin
+            # Parse as a requirement (e.g., "~> 7.1.5" or ">= 7.1.5.2")
+            Gem::Requirement.new(constraint)
+            # Extract the version number from the requirement
+            # For "~> 7.1.5" -> "7.1.5", ">= 7.1.5.2" -> "7.1.5.2"
+            constraint.match(/[\d.]+/)&.to_s
+          rescue ArgumentError
+            # If it's not a valid requirement, try to extract version directly
+            constraint.match(/[\d.]+/)&.to_s
+          end
+        end.compact
       end
 
       # Returns the most applicable fixed version for the installed version.
@@ -117,9 +129,23 @@ module Bundler
         begin
           installed = Gem::Version.new(installed_version)
 
-          fixed_versions.find do |v|
+          # Find versions in same major.minor series
+          same_series = fixed_versions.select do |v|
             fixed = Gem::Version.new(v)
             fixed.segments[0..1] == installed.segments[0..1]
+          rescue ArgumentError
+            false
+          end
+
+          # Return the minimum version in the same series, or the overall minimum
+          target_versions = same_series.empty? ? fixed_versions : same_series
+          target_versions.min_by do |v|
+            begin
+              Gem::Version.new(v)
+            rescue ArgumentError
+              # If version parsing fails, use a very high version to sort it last
+              Gem::Version.new("999.999.999")
+            end
           end
         rescue ArgumentError
           # If version parsing fails, return the first fixed version

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler-trivy
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.4
 platform: ruby
 authors:
 - Durable Programming LLC