package-audit 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55535a9ef08ce99d8cdacbfe15e0ec11e770f4803e4ef212d9ff4565111c89a6
-  data.tar.gz: 3f1efc9489c0ac9139f94bb7ed66d8ccee255e9c61f79440c899c0dcc4cd5885
+  metadata.gz: b01c3c377fec4245b836119f812bbacc6ceac724ed3c64da348f0b97481fd2a1
+  data.tar.gz: ceec2dc5e451fbe9ece1b915e35f790ed2ef60efb18fb3130ccc876e1eb7237c
 SHA512:
-  metadata.gz: 9c7ee67ccfadae05b1ec3a7e53d77ed8d977ae43bd54bbc0b95dee86e33ddceb87592089abc7a1410dba71c00802cc6172c3849d23e789878a9e8e14a1de2d96
-  data.tar.gz: 4ff43ca9c9e7bc410b545cde33b77798bfe71d40ebf92874235a695fb1862b2fa826849ce62f67cab831dfa22b987506248754e0a03b3827612e17b12df3f9be
+  metadata.gz: '0438ecb657dcaf116dc0048b89a9de474785d88e868f68f306521e917045651b525f49c8a6b802fda8401e8ff795f02b79c0be627fd337dc5eff4dcd48eaf128'
+  data.tar.gz: 38f68c6e7251196f2a526d4affcbb1487760615dd6947a3bd11b20f6ed0f791bac762a1327741b7c31e72ffa6a6b44471fdcfa98c0e0135d5d77b1751729ce80

data/lib/package/audit/cli.rb

@@ -1,11 +1,11 @@
-require_relative './const/time'
-require_relative './version'
-require_relative './util/summary_printer'
-require_relative './ruby/bundler_specs'
-require_relative './printer'
-require_relative './ruby/gem_collection'
-require_relative './npm/node_collection'
-require_relative './command_service'
+require_relative 'const/time'
+require_relative 'version'
+require_relative 'util/summary_printer'
+require_relative 'ruby/bundler_specs'
+require_relative 'printer'
+require_relative 'ruby/gem_collection'
+require_relative 'npm/node_collection'
+require_relative 'command_service'
 
 require 'json'
 require 'thor'
@@ -17,44 +17,44 @@ module Package
 
       map '--version' => :version
 
-      desc 'report', 'Show a report of potentially deprecated, outdated or vulnerable packages'
+      desc 'report [DIR]', 'Show a report of potentially deprecated, outdated or vulnerable packages'
       method_option :csv, type: :boolean, default: false, desc: 'Output using comma separated values (CSV)'
       method_option :'exclude-headers', type: :boolean, default: false, desc: 'Hide headers if when using CSV'
 
-      def report
-        within_rescue_block do
-          exit CommandService.new(Dir.pwd, options).all
-        end
+      def report(dir = Dir.pwd)
+        # within_rescue_block do
+        exit CommandService.new(dir, options).all
+        # end
       end
 
-      desc 'deprecated',
+      desc 'deprecated [DIR]',
            "Show packages with no updates by author for at least #{Const::Time::YEARS_ELAPSED_TO_BE_OUTDATED} years"
       method_option :csv, type: :boolean, default: false, desc: 'Output using comma separated values (CSV)'
       method_option :'exclude-headers', type: :boolean, default: false, desc: 'Hide headers if when using CSV'
 
-      def deprecated
+      def deprecated(dir = Dir.pwd)
         within_rescue_block do
-          exit CommandService.new(Dir.pwd, options).deprecated
+          exit CommandService.new(dir, options).deprecated
         end
       end
 
-      desc 'outdated', 'Show packages that are out of date'
+      desc 'outdated [DIR]', 'Show packages that are out of date'
       method_option :csv, type: :boolean, default: false, desc: 'Output using comma separated values (CSV)'
       method_option :'exclude-headers', type: :boolean, default: false, desc: 'Hide headers if when using CSV'
 
-      def outdated
+      def outdated(dir = Dir.pwd)
         within_rescue_block do
-          exit CommandService.new(Dir.pwd, options).outdated
+          exit CommandService.new(dir, options).outdated
         end
       end
 
-      desc 'vulnerable', 'Show packages and their dependencies that have security vulnerabilities'
+      desc 'vulnerable [DIR]', 'Show packages and their dependencies that have security vulnerabilities'
       method_option :csv, type: :boolean, default: false, desc: 'Output using comma separated values (CSV)'
       method_option :'exclude-headers', type: :boolean, default: false, desc: 'Hide headers if when using CSV'
 
-      def vulnerable
+      def vulnerable(dir = Dir.pwd)
         within_rescue_block do
-          exit CommandService.new(Dir.pwd, options).vulnerable
+          exit CommandService.new(dir, options).vulnerable
         end
       end
 

data/lib/package/audit/command_service.rb

@@ -1,5 +1,5 @@
-require_relative './const/cmd'
-require_relative './const/file'
+require_relative 'const/cmd'
+require_relative 'const/file'
 
 module Package
   module Audit
@@ -16,7 +16,7 @@ module Package
         pkgs = []
 
         if ruby?
-          gems = Ruby::GemCollection.all
+          gems = Ruby::GemCollection.new(@dir).all
           pkgs += gems
           Printer.new(gems, @options).print(Const::Fields::REPORT)
 
@@ -52,7 +52,7 @@ module Package
         pkgs = []
 
         if ruby?
-          gems = Ruby::GemCollection.vulnerable
+          gems = Ruby::GemCollection.new(@dir).vulnerable
           pkgs += gems
           Printer.new(gems, @options).print(Const::Fields::VULNERABLE)
 
@@ -88,7 +88,7 @@ module Package
         pkgs = []
 
         if ruby?
-          gems = Ruby::GemCollection.outdated
+          gems = Ruby::GemCollection.new(@dir).outdated
           pkgs += gems
           Printer.new(gems, @options).print(Const::Fields::OUTDATED)
 
@@ -122,7 +122,7 @@ module Package
         pkgs = []
 
         if ruby?
-          gems = Ruby::GemCollection.deprecated
+          gems = Ruby::GemCollection.new(@dir).deprecated
           pkgs += gems
           Printer.new(gems, @options).print(Const::Fields::OUTDATED)
 

data/lib/package/audit/const/cmd.rb

@@ -2,14 +2,14 @@ module Package
   module Audit
     module Const
       module Cmd
-        BUNDLE_AUDIT = 'bundle exec bundle-audit check --update'
-        BUNDLE_AUDIT_JSON = 'bundle exec bundle-audit check --update --quiet --format json'
+        BUNDLE_AUDIT = 'bundle-audit check --update'
+        BUNDLE_AUDIT_JSON = 'bundle-audit check --update --quiet --format json %s'
 
         NPM_AUDIT = 'npm audit'
         NPM_AUDIT_JSON = 'npm audit --json'
 
         YARN_AUDIT = 'yarn audit'
-        YARN_AUDIT_JSON = 'yarn audit --json'
+        YARN_AUDIT_JSON = 'yarn audit --json --cwd %s'
       end
     end
   end

data/lib/package/audit/formatter/risk.rb

@@ -1,4 +1,4 @@
-require_relative './base'
+require_relative 'base'
 require_relative '../util/bash_color'
 
 module Package

data/lib/package/audit/formatter/version.rb

@@ -1,4 +1,4 @@
-require_relative './base'
+require_relative 'base'
 require_relative '../util/bash_color'
 
 module Package

data/lib/package/audit/formatter/version_date.rb

@@ -1,4 +1,4 @@
-require_relative './base'
+require_relative 'base'
 require_relative '../const/time'
 require_relative '../util/bash_color'
 

data/lib/package/audit/formatter/vulnerability.rb

@@ -1,4 +1,4 @@
-require_relative './base'
+require_relative 'base'
 require_relative '../enum/vulnerability_type'
 require_relative '../util/bash_color'
 

data/lib/package/audit/npm/node_collection.rb

@@ -1,6 +1,6 @@
-require_relative './yarn_lock_parser'
-require_relative './npm_meta_data'
-require_relative './vulnerability_finder'
+require_relative 'yarn_lock_parser'
+require_relative 'npm_meta_data'
+require_relative 'vulnerability_finder'
 require_relative '../duplicate_package_merger'
 
 module Package
@@ -17,7 +17,7 @@ module Package
 
         def all
           implicit_pkgs = fetch_from_lock_file
-          vulnerable_pkgs = VulnerabilityFinder.new(implicit_pkgs).run
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir, implicit_pkgs).run
           pkgs = NpmMetaData.new(vulnerable_pkgs + implicit_pkgs).fetch.filter(&:risk?)
           DuplicatePackageMerger.new(pkgs).run
         end
@@ -36,7 +36,7 @@ module Package
 
         def vulnerable
           implicit_pkgs = fetch_from_lock_file
-          vulnerable_pkgs = VulnerabilityFinder.new(implicit_pkgs).run
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir, implicit_pkgs).run
           pkgs = NpmMetaData.new(vulnerable_pkgs).fetch
           DuplicatePackageMerger.new(pkgs).run
         end

data/lib/package/audit/npm/vulnerability_finder.rb

@@ -7,13 +7,14 @@ module Package
       class VulnerabilityFinder
         AUDIT_ADVISORY_REGEX = /^{"type":"auditAdvisory".*$/
 
-        def initialize(pkgs)
+        def initialize(dir, pkgs)
+          @dir = dir
           @pkg_hash = pkgs.to_h { |pkg| [pkg.name, pkg] }
           @vuln_hash = {}
         end
 
         def run
-          json_string_lines = `#{Const::Cmd::YARN_AUDIT_JSON}`
+          json_string_lines = `#{format(Const::Cmd::YARN_AUDIT_JSON, @dir)}`
           array = json_string_lines.scan(AUDIT_ADVISORY_REGEX)
 
           vulnerability_json_array = JSON.parse("[#{array.join(',')}]", symbolize_names: true)

data/lib/package/audit/npm/yarn_lock_parser.rb

@@ -3,7 +3,8 @@ module Package
     module Npm
       class YarnLockParser
         def initialize(yarn_lock_path)
-          @yarn_lock_path = File.read(yarn_lock_path)
+          @yarn_lock_file = File.read(yarn_lock_path)
+          @yarn_lock_path = yarn_lock_path
         end
 
         def fetch(default_deps, dev_deps)
@@ -22,17 +23,20 @@ module Package
 
         def fetch_package_block(dep_name, expected_version)
           regex = /#{Regexp.escape(dep_name)}@#{Regexp.escape(expected_version)}.*?:.*?(\n\n|\z)/m
-          blocks = @yarn_lock_path.match(regex)
+          blocks = @yarn_lock_file.match(regex)
           if blocks.nil? || blocks[0].nil?
-            raise NoMatchingPatternError, "Unable to find #{dep_name} in #{@yarn_lock_path}"
+            raise NoMatchingPatternError, "Unable to find \"#{dep_name}\" in #{@yarn_lock_path}"
           end
 
           blocks[0] || ''
         end
 
         def fetch_package_version(dep_name, pkg_block)
-          version = pkg_block.match(/version "(.*?)"/)&.[](1)
-          raise NoMatchingPatternError, "Unable to find #{dep_name} version in #{@yarn_lock_path}" if version.nil?
+          version = pkg_block.match(/version"?\s*"(.*?)"/)&.captures&.[](0)
+          if version.nil?
+            raise NoMatchingPatternError,
+                  "Unable to find the version of \"#{dep_name}\" in #{@yarn_lock_path}"
+          end
 
           version || '0.0.0.0'
         end

data/lib/package/audit/package.rb

@@ -1,8 +1,8 @@
-require_relative './risk'
-require_relative './risk_calculator'
-require_relative './enum/environment'
-require_relative './enum/risk_type'
-require_relative './enum/risk_explanation'
+require_relative 'risk'
+require_relative 'risk_calculator'
+require_relative 'enum/environment'
+require_relative 'enum/risk_type'
+require_relative 'enum/risk_explanation'
 
 module Package
   module Audit

data/lib/package/audit/printer.rb

@@ -1,8 +1,8 @@
-require_relative './const/fields'
-require_relative './formatter/risk'
-require_relative './formatter/version'
-require_relative './formatter/version_date'
-require_relative './formatter/vulnerability'
+require_relative 'const/fields'
+require_relative 'formatter/risk'
+require_relative 'formatter/version'
+require_relative 'formatter/version_date'
+require_relative 'formatter/vulnerability'
 
 module Package
   module Audit

data/lib/package/audit/risk_calculator.rb

@@ -1,4 +1,4 @@
-require_relative './const/time'
+require_relative 'const/time'
 
 module Package
   module Audit

data/lib/package/audit/ruby/bundler_specs.rb

@@ -1,6 +1,6 @@
 require_relative '../package'
-require_relative './gem_meta_data'
-require_relative './vulnerability_finder'
+require_relative 'gem_meta_data'
+require_relative 'vulnerability_finder'
 
 require 'bundler'
 
@@ -8,16 +8,23 @@ module Package
   module Audit
     module Ruby
       class BundlerSpecs
-        def self.all
-          Bundler.ui.silence { Bundler.definition.resolve }
+        def self.all(dir)
+          Bundler.with_unbundled_env do
+            ENV['BUNDLE_GEMFILE'] = "#{dir}/Gemfile"
+            Bundler.ui.silence { Bundler.definition.resolve }
+          end
         end
 
-        def self.gemfile
-          current_dependencies = Bundler.ui.silence do
-            Bundler.load.dependencies.to_h { |dep| [dep.name, dep] }
+        def self.gemfile(dir)
+          current_dependencies = Bundler.with_unbundled_env do
+            ENV['BUNDLE_GEMFILE'] = "#{dir}/Gemfile"
+            Bundler.reset!
+            Bundler.ui.silence do
+              Bundler.load.dependencies.to_h { |dep| [dep.name, dep] }
+            end
           end
 
-          gemfile_specs, = all.partition do |spec|
+          gemfile_specs, = all(dir).partition do |spec|
             current_dependencies.key? spec.name
           end
           gemfile_specs

data/lib/package/audit/ruby/gem_collection.rb

@@ -1,35 +1,39 @@
-require_relative './bundler_specs'
-require_relative './../enum/risk_type'
+require_relative 'bundler_specs'
+require_relative '../enum/risk_type'
 require_relative '../duplicate_package_merger'
 
 module Package
   module Audit
     module Ruby
       class GemCollection
-        def self.all
-          specs = BundlerSpecs.gemfile
+        def initialize(dir)
+          @dir = dir
+        end
+
+        def all
+          specs = BundlerSpecs.gemfile(@dir)
           pkgs = specs.map { |spec| Package.new(spec.name, spec.version) }
-          vulnerable_pkgs = VulnerabilityFinder.new.run
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir).run
           pkgs = GemMetaData.new(pkgs + vulnerable_pkgs).fetch.filter(&:risk?)
           DuplicatePackageMerger.new(pkgs).run
         end
 
-        def self.deprecated
-          specs = BundlerSpecs.gemfile
+        def deprecated
+          specs = BundlerSpecs.gemfile(@dir)
           pkgs = specs.map { |spec| Package.new(spec.name, spec.version) }
           pkgs = GemMetaData.new(pkgs).fetch.filter(&:deprecated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 
-        def self.outdated(include_implicit: false)
-          specs = include_implicit ? BundlerSpecs.all : BundlerSpecs.gemfile
+        def outdated(include_implicit: false)
+          specs = include_implicit ? BundlerSpecs.all(@dir) : BundlerSpecs.gemfile(@dir)
           pkgs = specs.map { |spec| Package.new(spec.name, spec.version) }
           pkgs = GemMetaData.new(pkgs).fetch.filter(&:outdated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 
-        def self.vulnerable
-          pkgs = VulnerabilityFinder.new.run
+        def vulnerable
+          pkgs = VulnerabilityFinder.new(@dir).run
           pkgs = GemMetaData.new(pkgs).fetch.filter(&:vulnerable?)
           DuplicatePackageMerger.new(pkgs).run
         end

data/lib/package/audit/ruby/vulnerability_finder.rb

@@ -5,12 +5,13 @@ module Package
   module Audit
     module Ruby
       class VulnerabilityFinder
-        def initialize
+        def initialize(dir)
+          @dir = dir
           @vuln_hash = {}
         end
 
         def run
-          json_result = `#{Const::Cmd::BUNDLE_AUDIT_JSON}`
+          json_result = `#{format(Const::Cmd::BUNDLE_AUDIT_JSON, @dir)}`
           vulnerability_json_array = JSON.parse(json_result, symbolize_names: true)[:results]
           vulnerability_json_array.each do |vulnerability_json|
             update_meta_data(vulnerability_json)

data/lib/package/audit/util/summary_printer.rb

@@ -1,5 +1,5 @@
 require_relative '../const/time'
-require_relative './bash_color'
+require_relative 'bash_color'
 
 module Package
   module Audit
@@ -8,7 +8,7 @@ module Package
         def self.report
           printf("\n%<info>s\n%<cmd>s\n\n",
                  info: Util::BashColor.blue('To show how risk is calculated run:'),
-                 cmd: Util::BashColor.magenta(' > bundle exec package-audit risk'))
+                 cmd: Util::BashColor.magenta(' > package-audit risk'))
         end
 
         def self.deprecated

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.2.0'
+    VERSION = '0.3.0'
   end
 end

data/sig/package/audit/npm/vulnerability_finder.rbs

@@ -4,10 +4,11 @@ module Package
       class VulnerabilityFinder
         AUDIT_ADVISORY_REGEX: Regexp
 
+        @dir: String
         @pkg_hash: Hash[String, Package]
         @vuln_hash: Hash[String?, Package]
 
-        def initialize: (Array[Package]) -> void
+        def initialize: (String, Array[Package]) -> void
 
         def run: -> Array[Package]
 

data/sig/package/audit/npm/yarn_lock_parser.rbs

@@ -2,6 +2,7 @@ module Package
   module Audit
     module Npm
       class YarnLockParser
+        @yarn_lock_file: String
         @yarn_lock_path: String
 
         def initialize: (String) -> void

data/sig/package/audit/ruby/bundler_specs.rbs

@@ -2,9 +2,9 @@ module Package
   module Audit
     module Ruby
       class BundlerSpecs
-        def self.all: -> untyped
+        def self.all: (String) -> untyped
 
-        def self.gemfile: -> untyped
+        def self.gemfile: (String) -> untyped
       end
     end
   end

data/sig/package/audit/ruby/gem_collection.rbs

@@ -2,13 +2,17 @@ module Package
   module Audit
     module Ruby
       class GemCollection
-        def self.all: -> Array[Package]
+        @dir: String
 
-        def self.deprecated: -> Array[Package]
+        def initialize: (String) -> void
 
-        def self.outdated: (?include_implicit: bool) -> Array[Package]
+        def all: -> Array[Package]
 
-        def self.vulnerable: -> Array[Package]
+        def deprecated: -> Array[Package]
+
+        def outdated: (?include_implicit: bool) -> Array[Package]
+
+        def vulnerable: -> Array[Package]
       end
     end
   end

data/sig/package/audit/ruby/vulnerability_finder.rbs

@@ -2,8 +2,11 @@ module Package
   module Audit
     module Ruby
       class VulnerabilityFinder
+        @dir: String
         @vuln_hash: Hash[String?, Package]
 
+        def initialize: (String) -> void
+
         def run: -> Array[Package]
 
         private

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Vadim Kononov
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-05-03 00:00:00.000000000 Z
+date: 2023-07-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-audit