bundler-trivy 0.1.4 → 0.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b15121173aebfa308affe634e3d6cb0277f93f79837e981bcd260421026b969b
-  data.tar.gz: 5c6bddbbe3f88ec138326b8f24c1c4401eb6829c363d7f51bfabd0d17b0af9f4
+  metadata.gz: a7b59afe9e3d14eaedb5644c7c421ac940519940001ac27fc7bdbcba8c9e9f78
+  data.tar.gz: 95b5980cdd1bd8f25e166444e29d0907d05dff6d9dfaf37ac3a4969f6dd5ecd3
 SHA512:
-  metadata.gz: 0070302073a86081f13386e0815842ed3b076ad1d77804bbfa64058a0b013cdc05cde42acf86add7f8461ab65406074946b0e74e6570632564b4cd1655782e24
-  data.tar.gz: 4cd3b619ba077a13868ceb77c152b5d60159762db88eeec20cd7dbebd5b2a5f9b255d016f55ed66e03322bfc8edc70e8ff64447c728ac514f0c510ca98d70ad4
+  metadata.gz: 036bf8d9aedd742df8adec69f21f4c27412d7b705ff056c783248a90aae823827216efebafc854eea4bac01cb3ee80e6e2d577686c5f74da80aacb6b2c75b875
+  data.tar.gz: 35c039953350c276732df80b6934f0d079dd33543b067832c8ebe4e16fd4f63fddf7100a715e56243f7a63f5a97badfd9f56c3f0befb3cf4692fa1b27bfbcfd9

data/README.md

@@ -12,7 +12,7 @@ A Bundler plugin that automatically integrates [Trivy](https://trivy.dev/) secur
 - **CVE Ignore List**: Temporary ignore vulnerabilities with expiration dates
 - **Multiple Output Formats**: Terminal (default), JSON, and compact modes
 - **Detailed Reporting**: Clear vulnerability summaries with fix recommendations
-- **Zero Dependencies**: Lightweight plugin with minimal runtime dependencies
+- **Zero Gem Dependencies**: Lightweight plugin with minimal runtime dependencies - none besides other than trivy.
 
 ## Quick Start
 

data/lib/bundler/trivy/config.rb

@@ -74,7 +74,7 @@ module Bundler
       #   config.fail_on_critical? # => true
       def fail_on_critical?
         env_bool("BUNDLER_TRIVY_FAIL_ON_CRITICAL",
-                 file_value(%w[fail_on critical], ci_environment?))
+          file_value(%w[fail_on critical], ci_environment?))
       end
 
       # Determines if the plugin should exit with error on HIGH severity vulnerabilities.
@@ -86,7 +86,7 @@ module Bundler
       #   config.fail_on_high? # => true
       def fail_on_high?
         env_bool("BUNDLER_TRIVY_FAIL_ON_HIGH",
-                 file_value(%w[fail_on high], false))
+          file_value(%w[fail_on high], false))
       end
 
       # Determines if the plugin should exit with error on ANY vulnerabilities.
@@ -111,7 +111,7 @@ module Bundler
       # @return [Boolean] true if compact output is enabled
       def compact_output?
         env_bool("BUNDLER_TRIVY_COMPACT",
-                 file_value(%w[output compact], ci_environment?))
+          file_value(%w[output compact], ci_environment?))
       end
 
       # Determines if output should be in JSON format.
@@ -160,7 +160,7 @@ module Bundler
       #   config.trivy_timeout # => 300
       def trivy_timeout
         ENV.fetch("BUNDLER_TRIVY_TIMEOUT",
-                  file_value(%w[scanning timeout], 120)).to_i
+          file_value(%w[scanning timeout], 120)).to_i
       end
 
       # Returns the list of ignored CVEs from configuration.
@@ -238,7 +238,8 @@ module Bundler
         ignored_cves.each do |ignore|
           if ignore["expires"]
             begin
-              Date.parse(ignore["expires"])
+              # Handle both string and Date objects
+              ignore["expires"].is_a?(Date) ? ignore["expires"] : Date.parse(ignore["expires"].to_s)
             rescue ArgumentError
               errors << "Invalid expiration date for #{ignore["id"]}: #{ignore["expires"]}"
             end
@@ -284,8 +285,8 @@ module Bundler
         end
 
         config
-      rescue StandardError => e
-        Bundler.ui.warn "Failed to load config: #{e.message}"
+      rescue => e
+        Bundler.ui.warn "Failed to load config (#{config_path}): #{e.message}"
         {}
       end
 
@@ -306,14 +307,16 @@ module Bundler
 
       def deep_merge(hash1, hash2)
         hash1.merge(hash2) do |_, v1, v2|
-          v1.is_a?(Hash) && v2.is_a?(Hash) ? deep_merge(v1, v2) : v2
+          (v1.is_a?(Hash) && v2.is_a?(Hash)) ? deep_merge(v1, v2) : v2
         end
       end
 
       def expired?(ignore_entry)
         return false unless ignore_entry["expires"]
 
-        expiration_date = Date.parse(ignore_entry["expires"])
+        # Handle both string and Date objects
+        expires = ignore_entry["expires"]
+        expiration_date = expires.is_a?(Date) ? expires : Date.parse(expires.to_s)
         Date.today > expiration_date
       rescue ArgumentError
         # Handle invalid date format, treat as not expired to be safe

data/lib/bundler/trivy/plugin.rb

@@ -49,8 +49,12 @@ module Bundler
 
         # Check if Trivy binary is available in PATH
         unless scanner.trivy_available?
-          Bundler.ui.warn "Trivy not found, skipping scan"
-          Bundler.ui.info "Install: https://trivy.dev/docs/getting-started/installation/"
+          begin
+            Bundler.ui.warn "Trivy not found, skipping scan"
+            Bundler.ui.info "Install: https://trivy.dev/docs/getting-started/installation/"
+          rescue
+            # Ignore UI errors
+          end
           return
         end
 
@@ -64,7 +68,7 @@ module Bundler
 
           # Exit with error code if vulnerabilities exceed configured thresholds
           handle_exit_code(results, config)
-        rescue StandardError => e
+        rescue => e
           Bundler.ui.warn "Trivy scan failed: #{e.message}"
           Bundler.ui.debug e.backtrace.join("\n") if ENV["DEBUG"]
         end

data/lib/bundler/trivy/reporter.rb

@@ -123,12 +123,16 @@ module Bundler
         puts bold("Recommended Actions:")
         puts
 
-        fixable.group_by(&:package_name).each do |_pkg, vulns|
+        fixable.group_by(&:package_name).each do |pkg, vulns|
           # Get all fixed versions from all vulnerabilities for this package
           all_versions = vulns.flat_map(&:fixed_versions).compact.uniq
-          # Find the minimum version that fixes all vulns (safest upgrade path)
-          _recommended_version = all_versions.min_by { |v| Gem::Version.new(v) } if all_versions.any?
-          puts "  Update #{_pkg}: bundle update #{_pkg}"
+          # Find the maximum version that fixes all vulns (safest upgrade path)
+          recommended_version = all_versions.max_by { |v| Gem::Version.new(v) } if all_versions.any?
+          if recommended_version
+            puts "  Update #{pkg} to #{recommended_version}: bundle update #{pkg}"
+          else
+            puts "  Update #{pkg}: bundle update #{pkg}"
+          end
         end
 
         puts
@@ -167,7 +171,7 @@ module Bundler
       end
 
       def severity_order(severity)
-        { "CRITICAL" => 0, "HIGH" => 1, "MEDIUM" => 2, "LOW" => 3, "UNKNOWN" => 4 }[severity] || 99
+        {"CRITICAL" => 0, "HIGH" => 1, "MEDIUM" => 2, "LOW" => 3, "UNKNOWN" => 4}[severity] || 99
       end
 
       # Color helpers

data/lib/bundler/trivy/scanner.rb

@@ -121,7 +121,7 @@ module Bundler
 
         # Add severity filtering if configured
         severity_filter = @config.severity_filter
-        args += ["--severity", severity_filter.join(",")] if severity_filter && severity_filter.any?
+        args += ["--severity", severity_filter.join(",")] if severity_filter&.any?
 
         args << @project_root
         args

data/lib/bundler/trivy/version.rb

@@ -3,6 +3,6 @@
 module Bundler
   module Trivy
     # Version constant for bundler-trivy-plugin
-    VERSION = "0.1.4"
+    VERSION = "0.1.5"
   end
 end

data/lib/bundler/trivy/vulnerability.rb

@@ -99,17 +99,15 @@ module Bundler
         return [] unless fixable?
 
         fixed_version.split(",").map(&:strip).filter_map do |constraint|
-          begin
-            # Parse as a requirement (e.g., "~> 7.1.5" or ">= 7.1.5.2")
-            Gem::Requirement.new(constraint)
-            # Extract the version number from the requirement
-            # For "~> 7.1.5" -> "7.1.5", ">= 7.1.5.2" -> "7.1.5.2"
-            constraint.match(/[\d.]+/)&.to_s
-          rescue ArgumentError
-            # If it's not a valid requirement, try to extract version directly
-            constraint.match(/[\d.]+/)&.to_s
-          end
-        end.compact
+          # Parse as a requirement (e.g., "~> 7.1.5" or ">= 7.1.5.2")
+          Gem::Requirement.new(constraint)
+          # Extract the version number from the requirement
+          # For "~> 7.1.5" -> "7.1.5", ">= 7.1.5.2" -> "7.1.5.2"
+          constraint.match(/\d+(?:\.\d+)*/)&.to_s
+        rescue ArgumentError
+          # If it's not a valid requirement, try to extract version directly
+          constraint.match(/\d+(?:\.\d+)*/)&.to_s
+        end.compact.reject(&:empty?)
       end
 
       # Returns the most applicable fixed version for the installed version.
@@ -140,12 +138,10 @@ module Bundler
           # Return the minimum version in the same series, or the overall minimum
           target_versions = same_series.empty? ? fixed_versions : same_series
           target_versions.min_by do |v|
-            begin
-              Gem::Version.new(v)
-            rescue ArgumentError
-              # If version parsing fails, use a very high version to sort it last
-              Gem::Version.new("999.999.999")
-            end
+            Gem::Version.new(v)
+          rescue ArgumentError
+            # If version parsing fails, use a very high version to sort it last
+            Gem::Version.new("999.999.999")
           end
         rescue ArgumentError
           # If version parsing fails, return the first fixed version

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler-trivy
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.1.5
 platform: ruby
 authors:
 - Durable Programming LLC
@@ -65,6 +65,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: standard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.35.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.35.1
 description: Automatically scans Ruby dependencies for vulnerabilities using Trivy
   after bundle install. Provides configurable security policies, CI/CD integration,
   and comprehensive vulnerability reporting.