package-audit 0.7.1 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a14d75d3c6f64af8c327c492e0d0c1bcf98fc3119964e63d944fc33fc6ce6b8e
-  data.tar.gz: 01f5eaac43d53a65ac42a46a736793b8dbe56f4ad3531a8e649d9516b85a5027
+  metadata.gz: 7305fff5b318e2831908713c3d49b984787b99baaca769115339518297dee6e4
+  data.tar.gz: 6db0ad1ecece32ddc3b93ea89fc9366b1fba59861e925d9e6955708173f3f32d
 SHA512:
-  metadata.gz: 9f2599769354017f84a5eb4f5da8cb6b67b69be12ed6f67126ed0701b1746461960c24ecd1ba7d2cf81d5719ca18234f1f9bdcb645a5bb9d8916faaca040ee96
-  data.tar.gz: 9eeeb933dd6e5535c0fdcdfca6fea339ca34fc1a611460b68ea0274da083ec08be63424eb82c7229ed939cf05fe49621bbf9f4d04af9abffc6001f7a43e507cb
+  metadata.gz: 32b8c325d2f938ead2ab5ab8ab190ac94f4591667cbf0eaf884258b64e8ac06dc9a367ca7ecefab5a8688e1713378543ae5834ce6a8dbdab6874fdccded4b528
+  data.tar.gz: ca7e0687952bd9bcb7708b159e2551ad6cfa84bec8636eb05e954cb5763bb714d407ef190651ef764756f2a333c83e33b694a52e07dbff633019ba2f1d5a5563

data/lib/package/audit/cli.rb

@@ -14,15 +14,24 @@ module Package
     class CLI < Thor
       default_task :default
 
-      class_option Enum::Option::CONFIG,
-                   aliases: '-c', banner: 'FILE',
-                   desc: "Path to a custom configuration file, default: #{Const::File::CONFIG})"
-      class_option Enum::Option::GROUP,
-                   aliases: '-g', repeatable: true,
-                   desc: 'Group to be audited (repeat this flag for each group)'
+      class_option Enum::Option::DEPRECATED,
+                   type: :boolean,
+                   desc: 'Filter to show only deprecated packages (or use --skip-deprecated to exclude them)'
+      class_option Enum::Option::OUTDATED,
+                   type: :boolean,
+                   desc: 'Filter to show only outdated packages (or use --skip-outdated to exclude them)'
+      class_option Enum::Option::VULNERABLE,
+                   type: :boolean,
+                   desc: 'Filter to show only vulnerable packages (or use --skip-vulnerable to exclude them)'
       class_option Enum::Option::TECHNOLOGY,
                    aliases: '-t', repeatable: true,
                    desc: 'Technology to be audited (repeat this flag for each technology)'
+      class_option Enum::Option::GROUP,
+                   aliases: '-g', repeatable: true,
+                   desc: 'Group to be audited (repeat this flag for each group)'
+      class_option Enum::Option::CONFIG,
+                   aliases: '-c', banner: 'FILE',
+                   desc: "Path to a custom configuration file, default: #{Const::File::CONFIG})"
       class_option Enum::Option::INCLUDE_IGNORED,
                    type: :boolean, default: false,
                    desc: 'Include packages ignored by a configuration file'
@@ -38,23 +47,8 @@ module Package
 
       desc '[DIR]', 'Show a report of potentially deprecated, outdated or vulnerable packages'
       def default(dir = Dir.pwd)
-        within_rescue_block { exit CommandParser.new(dir, options, Enum::Report::ALL).run }
-      end
-
-      desc 'deprecated [DIR]',
-           "Show packages with no updates by author for at least #{Const::Time::YEARS_ELAPSED_TO_BE_OUTDATED} years"
-      def deprecated(dir = Dir.pwd)
-        within_rescue_block { exit CommandParser.new(dir, options, Enum::Report::DEPRECATED).run }
-      end
-
-      desc 'outdated [DIR]', 'Show packages that are out of date'
-      def outdated(dir = Dir.pwd)
-        within_rescue_block { exit CommandParser.new(dir, options, Enum::Report::OUTDATED).run }
-      end
-
-      desc 'vulnerable [DIR]', 'Show packages and their dependencies that have security vulnerabilities'
-      def vulnerable(dir = Dir.pwd)
-        within_rescue_block { exit CommandParser.new(dir, options, Enum::Report::VULNERABLE).run }
+        report = determine_report_type
+        within_rescue_block { exit CommandParser.new(dir, options, report).run }
       end
 
       desc 'risk', 'Print information on how risk is calculated'
@@ -81,6 +75,37 @@ module Package
 
       private
 
+      def determine_report_type # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+        deprecated = options[Enum::Option::DEPRECATED]
+        outdated = options[Enum::Option::OUTDATED]
+        vulnerable = options[Enum::Option::VULNERABLE]
+
+        # Count positive filters (true) and negative filters (false)
+        positive_filters = [deprecated, outdated, vulnerable].count(true)
+        negative_filters = [deprecated, outdated, vulnerable].count(false)
+
+        # If any explicit filters are set (positive or negative), we need to filter
+        # Otherwise all are nil (not specified) and we show everything
+        has_explicit_filters = [deprecated, outdated, vulnerable].any? { |v| !v.nil? }
+
+        # If no filters specified at all, return ALL
+        return Enum::Report::ALL unless has_explicit_filters
+
+        # If only positive filters, handle them
+        if positive_filters.positive? && negative_filters.zero?
+          # Single positive filter - use specific report type
+          return Enum::Report::DEPRECATED if positive_filters == 1 && deprecated
+          return Enum::Report::OUTDATED if positive_filters == 1 && outdated
+          return Enum::Report::VULNERABLE if positive_filters == 1 && vulnerable
+
+          # Multiple positive filters - fetch ALL and filter in CommandParser
+          return Enum::Report::ALL
+        end
+
+        # If we have any filters (positive or negative), fetch ALL and filter in CommandParser
+        Enum::Report::ALL
+      end
+
       def within_rescue_block
         yield
       rescue StandardError => e

data/lib/package/audit/const/fields.rb

@@ -8,13 +8,12 @@ module Package
           version_date
           latest_version
           latest_version_date
-          groups
+          flags
           vulnerabilities
           risk_type
-          risk_explanation
         ]
 
-        DEFAULT = %i[name version latest_version latest_version_date groups vulnerabilities risk_type risk_explanation]
+        DEFAULT = %i[name version latest_version latest_version_date flags vulnerabilities risk_type]
 
         # the names of these fields must match the instance variables in the Dependency class
         HEADERS = {
@@ -23,10 +22,9 @@ module Package
           version_date: 'Version Date',
           latest_version: 'Latest',
           latest_version_date: 'Latest Date',
-          groups: 'Groups',
+          flags: 'Flags',
           vulnerabilities: 'Vulnerabilities',
-          risk_type: 'Risk',
-          risk_explanation: 'Risk Explanation'
+          risk_type: 'Risk'
         }
       end
     end

data/lib/package/audit/enum/option.rb

@@ -8,6 +8,9 @@ module Package
         GROUP = 'group'
         INCLUDE_IGNORED = 'include-ignored'
         TECHNOLOGY = 'technology'
+        DEPRECATED = 'deprecated'
+        OUTDATED = 'outdated'
+        VULNERABLE = 'vulnerable'
       end
     end
   end

data/lib/package/audit/models/package.rb

@@ -80,6 +80,13 @@ module Package
         false
       end
 
+      def flags
+        v = vulnerable? ? 'V' : '·'
+        o = outdated? ? 'O' : '·'
+        d = deprecated? ? 'D' : '·'
+        "⦗#{v}#{o}#{d}⦘"
+      end
+
       def to_csv(fields)
         fields.map { |field| send(field) }.join(',')
       end

data/lib/package/audit/services/command_parser.rb

@@ -52,6 +52,7 @@ module Package
             all_pkgs, ignored_pkgs = PackageFinder.new(@config, @dir, @report, @groups).run(technology)
             ignored_pkgs = [] if @options[Enum::Option::INCLUDE_IGNORED]
             active_pkgs = (all_pkgs || []) - (ignored_pkgs || [])
+            active_pkgs = filter_by_flags(active_pkgs) if any_filters_set?
             cumulative_pkgs += active_pkgs
             mutex.synchronize { all_packages_for_config += all_pkgs || [] }
 
@@ -74,6 +75,8 @@ module Package
         @spinner.stop # Stop spinner before cleaning config to ensure clean output
         clean_config(all_packages_for_config)
 
+        puts unless @options[Enum::Option::FORMAT] # Add final blank line for default format
+
         cumulative_pkgs.any? ? 1 : 0
       ensure
         @spinner.stop
@@ -147,6 +150,66 @@ module Package
 
         "#{array[0..-2].join(', ')}, and #{array.last}"
       end
+
+      def any_filters_set?
+        deprecated = @options[Enum::Option::DEPRECATED]
+        outdated = @options[Enum::Option::OUTDATED]
+        vulnerable = @options[Enum::Option::VULNERABLE]
+
+        # Check if any filter was explicitly set (not nil)
+        [deprecated, outdated, vulnerable].any? { |v| !v.nil? }
+      end
+
+      def filter_by_flags(pkgs) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+        deprecated = @options[Enum::Option::DEPRECATED]
+        outdated = @options[Enum::Option::OUTDATED]
+        vulnerable = @options[Enum::Option::VULNERABLE]
+
+        # Determine which filters are positive (include) vs negative (exclude)
+        positive_filters = []
+        negative_filters = []
+
+        positive_filters << :deprecated if deprecated == true
+        positive_filters << :outdated if outdated == true
+        positive_filters << :vulnerable if vulnerable == true
+
+        negative_filters << :deprecated if deprecated == false
+        negative_filters << :outdated if outdated == false
+        negative_filters << :vulnerable if vulnerable == false
+
+        pkgs.select do |pkg|
+          # If we have positive filters, package must match at least one
+          if positive_filters.any?
+            matches_positive = positive_filters.any? do |filter|
+              case filter
+              when :deprecated then pkg.deprecated?
+              when :outdated then pkg.outdated?
+              when :vulnerable then pkg.vulnerable?
+              end
+            end
+            next false unless matches_positive
+          end
+
+          # If we have negative filters (skip flags), use different logic:
+          # A package should be excluded ONLY if ALL of its risk types are being skipped
+          if negative_filters.any?
+            # Determine which risk types we're showing (not skipping)
+            showing_deprecated = deprecated != false
+            showing_outdated = outdated != false
+            showing_vulnerable = vulnerable != false
+
+            # Check if package has at least one risk type that we're showing
+            has_shown_risk = false
+            has_shown_risk = true if pkg.deprecated? && showing_deprecated
+            has_shown_risk = true if pkg.outdated? && showing_outdated
+            has_shown_risk = true if pkg.vulnerable? && showing_vulnerable
+
+            next false unless has_shown_risk
+          end
+
+          true
+        end
+      end
     end
   end
 end

data/lib/package/audit/services/package_printer.rb

@@ -24,12 +24,13 @@ module Package
         case @options[Enum::Option::FORMAT]
         when Enum::Format::CSV
           csv(fields, exclude_headers: @options[Enum::Option::CSV_EXCLUDE_HEADERS])
+          puts
         when Enum::Format::MARKDOWN
           markdown(fields)
+          puts
         else
           pretty(fields)
         end
-        puts
       end
 
       private
@@ -47,19 +48,24 @@ module Package
         header = fields.map.with_index do |field, index|
           Const::Fields::HEADERS[field].gsub(BASH_FORMATTING_REGEX, '').ljust(max_widths[index])
         end.join(' ' * COLUMN_GAP)
-        separator = max_widths.map { |width| '=' * width }.join('=' * COLUMN_GAP)
+        separator_plain = max_widths.map { |width| '─' * width }.join('─' * COLUMN_GAP)
+        separator = Util::BashColor.light_green(separator_plain)
 
-        puts separator
-        puts header
-        puts separator
+        puts ' '
+        puts " #{separator}"
+        puts " #{header}"
+        puts " #{separator}"
 
         @pkgs.each do |pkg|
-          puts fields.map.with_index { |key, index|
+          row = fields.map.with_index do |key, index|
             val = get_field_value(pkg, key)
             formatting_length = val.length - val.gsub(BASH_FORMATTING_REGEX, '').length
             val.ljust(max_widths[index] + formatting_length)
-          }.join(' ' * COLUMN_GAP)
+          end.join(' ' * COLUMN_GAP)
+          puts " #{row}"
         end
+
+        puts " #{separator}"
       end
 
       def csv(fields = Const::Fields::DEFAULT, exclude_headers: false)
@@ -99,10 +105,8 @@ module Package
         end
       end
 
-      def get_field_value(pkg, field) # rubocop:disable Metrics/MethodLength
+      def get_field_value(pkg, field)
         case field
-        when :groups
-          pkg.group_list
         when :risk_type
           Formatter::Risk.new(pkg.risk_type).format
         when :version

data/lib/package/audit/util/bash_color.rb

@@ -29,6 +29,10 @@ module Package
         def self.blue(str)
           "\e[34m#{str}\e[0m"
         end
+
+        def self.light_green(str)
+          "\e[38;5;154m#{str}\e[0m"
+        end
       end
     end
   end

data/lib/package/audit/util/risk_legend.rb

@@ -6,42 +6,42 @@ module Package
     module Util
       module RiskLegend
         def self.print # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
-          puts Util::BashColor.blue('1. Check if the package has a security vulnerability.')
-          puts '   If yes, the following vulnerability -> risk mapping is used:'
-          puts "      - #{Util::BashColor.red('unknown')} vulnerability\t-> #{Util::BashColor.red('high')} risk"
-          puts "      - #{Util::BashColor.red('critical')} vulnerability\t-> #{Util::BashColor.red('high')} risk"
-          puts "      - #{Util::BashColor.red('high')} vulnerability\t-> #{Util::BashColor.red('high')} risk"
-          puts "      - #{Util::BashColor.orange('medium')} vulnerability\t-> #{Util::BashColor.orange('medium')} risk"
-          puts "      - #{Util::BashColor.orange('moderate')} vulnerability\t-> #{Util::BashColor.orange('medium')} risk" # rubocop:disable Layout/LineLength
-          puts "      - #{Util::BashColor.yellow('low')} vulnerability\t-> #{Util::BashColor.yellow('low')} risk"
+          puts " #{Util::BashColor.blue('1. Check if the package has a security vulnerability.')}"
+          puts '    If yes, the following vulnerability -> risk mapping is used:'
+          puts "       - #{Util::BashColor.red('unknown')} vulnerability\t-> #{Util::BashColor.red('high')} risk"
+          puts "       - #{Util::BashColor.red('critical')} vulnerability\t-> #{Util::BashColor.red('high')} risk"
+          puts "       - #{Util::BashColor.red('high')} vulnerability\t-> #{Util::BashColor.red('high')} risk"
+          puts "       - #{Util::BashColor.orange('medium')} vulnerability\t-> #{Util::BashColor.orange('medium')} risk"
+          puts "       - #{Util::BashColor.orange('moderate')} vulnerability\t-> #{Util::BashColor.orange('medium')} risk" # rubocop:disable Layout/LineLength
+          puts "       - #{Util::BashColor.yellow('low')} vulnerability\t-> #{Util::BashColor.yellow('low')} risk"
 
           puts
 
-          puts Util::BashColor.blue('2. Check the package for potential deprecation.')
-          puts "   If no new releases by author for at least #{Const::Time::YEARS_ELAPSED_TO_BE_OUTDATED} years:"
-          puts "      - assign the risk to\t-> #{Util::BashColor.orange('medium')} risk"
+          puts " #{Util::BashColor.blue('2. Check the package for potential deprecation.')}"
+          puts "    If no new releases by author for at least #{Const::Time::YEARS_ELAPSED_TO_BE_OUTDATED} years:"
+          puts "       - assign the risk to\t-> #{Util::BashColor.orange('medium')} risk"
 
           puts
 
-          puts Util::BashColor.blue('3. Check if a newer version of the package is available.')
+          puts " #{Util::BashColor.blue('3. Check if a newer version of the package is available.')}"
 
-          puts '   If yes, assign risk as follows:'
-          puts "      - #{Util::BashColor.orange('major version')} mismatch\t-> #{Util::BashColor.orange('medium')} risk" # rubocop:disable Layout/LineLength
-          puts "      - #{Util::BashColor.yellow('minor version')} mismatch\t-> #{Util::BashColor.yellow('low')} risk"
-          puts "      - #{Util::BashColor.green('patch version')} mismatch\t-> #{Util::BashColor.yellow('low')} risk"
-          puts "      - #{Util::BashColor.green('build version')} mismatch\t-> #{Util::BashColor.yellow('low')} risk"
+          puts '    If yes, assign risk as follows:'
+          puts "       - #{Util::BashColor.orange('major version')} mismatch\t-> #{Util::BashColor.orange('medium')} risk" # rubocop:disable Layout/LineLength
+          puts "       - #{Util::BashColor.yellow('minor version')} mismatch\t-> #{Util::BashColor.yellow('low')} risk"
+          puts "       - #{Util::BashColor.green('patch version')} mismatch\t-> #{Util::BashColor.yellow('low')} risk"
+          puts "       - #{Util::BashColor.green('build version')} mismatch\t-> #{Util::BashColor.yellow('low')} risk"
 
           puts
 
-          puts Util::BashColor.blue('4. Take the highest risk from the first 3 steps.')
-          puts '   If two risks match in severity, use the following precedence:'
-          puts "      - #{Util::BashColor.red('vulnerability')} > #{Util::BashColor.orange('deprecation')} > #{Util::BashColor.yellow('outdatedness')}" # rubocop:disable Layout/LineLength
+          puts " #{Util::BashColor.blue('4. Take the highest risk from the first 3 steps.')}"
+          puts '    If two risks match in severity, use the following precedence:'
+          puts "       - #{Util::BashColor.red('vulnerability')} > #{Util::BashColor.orange('deprecation')} > #{Util::BashColor.yellow('outdatedness')}" # rubocop:disable Layout/LineLength
 
           puts
 
-          puts Util::BashColor.blue('5. Check whether the package is used in production or not.')
-          puts '   If a package is limited to a non-production group:'
-          puts "      - cap risk severity to\t -> #{Util::BashColor.yellow('low')} risk"
+          puts " #{Util::BashColor.blue('5. Check whether the package is used in production or not.')}"
+          puts '    If a package is limited to a non-production group:'
+          puts "       - cap risk severity to\t -> #{Util::BashColor.yellow('low')} risk"
         end
       end
     end

data/lib/package/audit/util/summary_printer.rb

@@ -6,31 +6,34 @@ module Package
     module Util
       module SummaryPrinter
         def self.all
-          printf("\n%<info>s\n%<cmd>s\n\n",
+          printf(" %<info>s\n %<cmd>s\n",
                  info: Util::BashColor.blue('To show how risk is calculated run:'),
                  cmd: Util::BashColor.magenta(' > package-audit risk'))
         end
 
         def self.deprecated
-          puts Util::BashColor.blue('Although the packages above have no recent updates, they may not be deprecated.')
-          puts Util::BashColor.blue("Please contact the package author for more information about its status.\n")
+          puts " #{Util::BashColor.blue('Although the packages above have no recent updates, ' \
+                                        'they may not be deprecated.')}"
+          puts " #{Util::BashColor.blue('Please contact the package author for more information about its status.')}"
+          puts
         end
 
         def self.vulnerable(technology, cmd)
-          printf("%<info>s\n%<cmd>s\n\n",
+          printf(" %<info>s\n %<cmd>s\n",
                  info: Util::BashColor.blue("For more information about #{technology.capitalize} vulnerabilities run:"),
                  cmd: Util::BashColor.magenta(" > #{cmd}"))
         end
 
         def self.total(technology, report, pkgs, ignored_pkgs)
           if ignored_pkgs.any?
-            puts Util::BashColor.cyan("Found a total of #{pkgs.length} #{technology.capitalize} packages " \
-                                      "(#{ignored_pkgs.length} ignored).\n")
+            puts " #{Util::BashColor.cyan("Found a total of #{pkgs.length} #{technology.capitalize} packages " \
+                                          "(#{ignored_pkgs.length} ignored).")}"
           elsif pkgs.any?
-            puts Util::BashColor.cyan("Found a total of #{pkgs.length} #{technology.capitalize} packages.\n")
+            puts " #{Util::BashColor.cyan("Found a total of #{pkgs.length} #{technology.capitalize} packages.")}"
           else
-            puts Util::BashColor.green("There are no #{report} #{technology.capitalize} packages!\n")
+            puts " #{Util::BashColor.green("There are no #{report} #{technology.capitalize} packages!")}"
           end
+          puts
         end
 
         def self.statistics(format, technology, report, pkgs, ignored_pkgs)
@@ -58,26 +61,28 @@ module Package
 
         private_class_method def self.display_results(format, technology, report, pkgs, ignored_pkgs, stats) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/ParameterLists
           if pkgs.any?
-            print status_message(stats)
+            print " #{status_message(stats)}"
             print Util::BashColor.cyan(' \\') if format == Enum::Format::MARKDOWN
             puts
             total(technology, report, pkgs, ignored_pkgs)
           elsif ignored_pkgs.any?
-            print status_message(stats)
+            print " #{status_message(stats)}"
             print Util::BashColor.cyan(' \\') if format == Enum::Format::MARKDOWN
             puts
-            puts Util::BashColor.green("There are no deprecated, outdated or vulnerable #{technology.capitalize} " \
-                                       "packages (#{ignored_pkgs.length} ignored)!\n")
+            puts " #{Util::BashColor.green('There are no deprecated, outdated or vulnerable ' \
+                                           "#{technology.capitalize} packages (#{ignored_pkgs.length} ignored)!")}"
+            puts
           else
-            puts Util::BashColor.green("There are no deprecated, outdated or vulnerable #{technology.capitalize} " \
-                                       "packages!\n")
+            puts " #{Util::BashColor.green('There are no deprecated, outdated or vulnerable ' \
+                                           "#{technology.capitalize} packages!")}"
+            puts
           end
         end
 
         private_class_method def self.status_message(stats)
-          outdated_str = "#{stats[:outdated]} outdated" + outdated_details(stats)
-          deprecated_str = "#{stats[:deprecated]} deprecated" + deprecated_details(stats)
-          vulnerable_str = "#{stats[:vulnerable]} vulnerable" + vulnerability_details(stats)
+          outdated_str = "#{stats[:outdated]} ⦗O⦘utdated" + outdated_details(stats)
+          deprecated_str = "#{stats[:deprecated]} ⦗D⦘eprecated" + deprecated_details(stats)
+          vulnerable_str = "#{stats[:vulnerable]} ⦗V⦘ulnerable" + vulnerability_details(stats)
 
           Util::BashColor.cyan("#{vulnerable_str}, #{outdated_str}, #{deprecated_str}.")
         end

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.7.1'
+    VERSION = '0.8.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.8.0
 platform: ruby
 authors:
 - Vadim Kononov
@@ -111,7 +111,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.7.2
 specification_version: 4
 summary: A helper tool to find outdated, deprecated and vulnerable dependencies.
 test_files: []