package-audit 0.8.0 → 0.8.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7305fff5b318e2831908713c3d49b984787b99baaca769115339518297dee6e4
-  data.tar.gz: 6db0ad1ecece32ddc3b93ea89fc9366b1fba59861e925d9e6955708173f3f32d
+  metadata.gz: 7e0d76f96e0ad7b87f59b178565e72e9d52dddf9f7a579e016ff6779fac6d58a
+  data.tar.gz: cb917258a2025355d73123cb76762254dd92bdac817c72375e4297fbe8cb6b8f
 SHA512:
-  metadata.gz: 32b8c325d2f938ead2ab5ab8ab190ac94f4591667cbf0eaf884258b64e8ac06dc9a367ca7ecefab5a8688e1713378543ae5834ce6a8dbdab6874fdccded4b528
-  data.tar.gz: ca7e0687952bd9bcb7708b159e2551ad6cfa84bec8636eb05e954cb5763bb714d407ef190651ef764756f2a333c83e33b694a52e07dbff633019ba2f1d5a5563
+  metadata.gz: 280d5c3c95dd19ff526723fb7b9c5b387180c63a67d64eab8be9301512c9b3f5d4e252ba1e82317fb5b95e6f86380908344ea766de9ad4539fecd20afeadd3d7
+  data.tar.gz: '09f40855f0197f00fa9fc05826da2ec42506fef23d387569dd108e4623488eb059982e47d7b0bb99f718de6e62140db3817b119b90aea473cc837a7ad2038b60'

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2023 Vadim Kononov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,218 @@
+# Package::Audit
+
+[![Gem Version](https://img.shields.io/gem/v/package-audit.svg?label=Gem&logo=rubygems&logoColor=white)](https://rubygems.org/gems/package-audit)
+[![Ruby](https://img.shields.io/badge/Ruby-2.6%20to%204.0-CC342D?logo=ruby&logoColor=white)](https://github.com/vkononov/package-audit/blob/main/.github/workflows/test.yml)
+[![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/package-audit/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/package-audit/actions/workflows/test.yml)
+[![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/package-audit/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/package-audit/actions/workflows/lint.yml)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+
+A useful tool for patch management and prioritization, `package-audit` produces a list of dependencies that are outdated, deprecated or have security vulnerabilities.
+
+Supports **Ruby 2.6 → latest**, with the full Ruby matrix tested daily in CI.
+
+[!["Buy Me A Coffee"](https://www.buymeacoffee.com/assets/img/custom_images/yellow_img.png)](https://www.buymeacoffee.com/vkononov)
+
+## Supported Technologies
+
+* Ruby
+* Node (using Yarn)
+
+## Report Example
+
+![Example Output](docs/example.png)
+
+### Understanding the Flags Column
+
+The Flags column shows which risk types apply to each package:
+
+- `⦗V··⦘` - Vulnerable (has security vulnerabilities)
+- `⦗·O·⦘` - Outdated (newer version available)
+- `⦗··D⦘` - Deprecated (no updates in 2+ years)
+- `⦗VO·⦘` - Both vulnerable and outdated
+- `⦗VOD⦘` - All three risk types apply
+
+The footer uses the same notation (⦗V⦘ulnerable, ⦗O⦘utdated, ⦗D⦘eprecated) as a legend.
+
+## Continuous Integration
+
+This gem provides a return code of `0` to indicate success and `1` to indicate failure. It is specifically designed for seamless integration into continuous integration pipelines.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'package-audit', require: false
+```
+
+And then execute:
+
+```bash
+bundle
+```
+
+Or install it yourself as:
+
+```bash
+gem install package-audit
+```
+
+## Usage
+
+### Basic Report
+
+Run a full audit (`DIR` defaults to current directory):
+
+```bash
+package-audit [DIR]
+```
+
+### Filtering by Risk Type
+
+Show only specific risk types:
+
+```bash
+# Show only deprecated packages
+package-audit [DIR] --deprecated
+
+# Show only vulnerable packages
+package-audit [DIR] --vulnerable
+
+# Show packages that are deprecated and/or vulnerable
+package-audit [DIR] --deprecated --vulnerable
+```
+
+### Excluding Risk Types
+
+Exclude specific risk types from the report:
+
+```bash
+# Show everything except deprecated packages
+package-audit [DIR] --skip-deprecated
+
+# Show everything except outdated packages
+package-audit [DIR] --skip-outdated
+
+# Show only vulnerable packages (exclude deprecated and outdated)
+package-audit [DIR] --skip-deprecated --skip-outdated
+```
+
+**Important:** Packages with multiple risk types are handled intelligently. For example, a package that is both outdated and vulnerable will still appear when using `--skip-outdated` because it has a vulnerability.
+
+### Understanding the Flags Column
+
+The Flags column in the output shows which risk types apply to each package:
+
+- `⦗V··⦘` - Vulnerable (has security vulnerabilities)
+- `⦗·O·⦘` - Outdated (newer version available)
+- `⦗··D⦘` - Deprecated (no updates in 2+ years)
+- `⦗VO·⦘` - Both vulnerable and outdated
+- `⦗VOD⦘` - All three risk types apply
+
+The footer uses the same notation `⦗V⦘ulnerable, ⦗O⦘utdated, ⦗D⦘eprecated` as a legend.
+
+### Scoping Options
+
+Filter by technology or group:
+
+```bash
+# Specific technologies
+package-audit [DIR] -t node -t ruby
+package-audit [DIR] --technology node --technology ruby
+
+# Specific groups
+package-audit [DIR] -g staging -g production
+package-audit [DIR] --group staging --group production
+```
+
+**Note:** `Package::Audit` will attempt to automatically detect the technologies used by the project.
+
+### Configuration
+
+Use a custom configuration file (see [Configuration File](#configuration-file) for details):
+
+```bash
+package-audit [DIR] --config .package-audit.yml
+```
+
+Include packages normally ignored by configuration:
+
+```bash
+package-audit [DIR] --include-ignored
+```
+
+### Output Formats
+
+```bash
+# CSV format
+package-audit [DIR] --format csv
+
+# Markdown format
+package-audit [DIR] --format md
+```
+
+### Other Commands
+
+```bash
+# Show how risk is calculated
+package-audit risk
+
+# Show version
+package-audit version
+```
+
+### Getting Help
+
+```bash
+package-audit help
+package-audit help [COMMAND]
+```
+
+## Configuration File
+
+The `package-audit` gem automatically searches for `.package-audit.yml` in the current directory or in the specified `DIR` if available. However, you have the option to override the default configuration file location by using the `--config` (or `-c`) flag.
+
+#### Below is an example of a configuration file:
+
+```YAML
+technology:
+  node:
+    nth-check:
+      version: 1.0.2
+      vulnerable: false
+  ruby:
+    devise-async:
+      version: 1.0.0
+      deprecated: false
+    puma:
+      version: 6.3.0
+      deprecated: false
+    selenium-webdriver:
+      version: 4.1.0
+      outdated: false
+```
+
+#### This configuration file allows you to specify the following exclusions:
+
+
+* Ignore all security vulnerabilities associated with `nth-check@1.0.2`.
+* Suppress messages regarding potential deprecations for  `device-async@1.0.0` and `puma@6.3.0`.
+* Disable warnings about newer available versions of  `selenium-webdriver@4.1.0`
+
+**Note:** If the installed package version differs from the expected package version specified in the configuration file, the exclusion settings will not apply to that particular package.
+
+**Note:** If a package is reported for multiple reasons (e.g. vulnerable and outdated), it will still be reported unless the exclusion criteria match every reason for being on the report.
+
+> By design, wildcard (`*`) version exclusions are not supported to prevent developers from inadvertently overlooking crucial messages when packages are updated.
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).

data/lib/package/audit/const/cmd.rb

@@ -6,10 +6,6 @@ module Package
         BUNDLE_AUDIT_JSON = 'bundle-audit check --update --quiet --format json "%s" 2>/dev/null'
 
         NPM_AUDIT = 'npm audit'
-        NPM_AUDIT_JSON = 'npm audit --json'
-
-        YARN_AUDIT = 'yarn audit'
-        YARN_AUDIT_JSON = 'yarn audit --json --cwd "%s"'
       end
     end
   end

data/lib/package/audit/npm/node_collection.rb

@@ -35,13 +35,15 @@ module Package
 
         def deprecated
           implicit_pkgs = fetch_from_lock_file
-          pkgs = NpmMetaData.new(implicit_pkgs).fetch.filter(&:deprecated?)
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir, implicit_pkgs).run
+          pkgs = NpmMetaData.new(vulnerable_pkgs + implicit_pkgs).fetch.filter(&:deprecated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 
         def outdated
           implicit_pkgs = fetch_from_lock_file
-          pkgs = NpmMetaData.new(implicit_pkgs).fetch.filter(&:outdated?)
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir, implicit_pkgs).run
+          pkgs = NpmMetaData.new(vulnerable_pkgs + implicit_pkgs).fetch.filter(&:outdated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 

data/lib/package/audit/npm/vulnerability_finder.rb

@@ -1,13 +1,18 @@
-require 'open3'
+require 'json'
+require 'net/http'
+require 'openssl'
 
-require_relative '../const/cmd'
+require_relative '../const/file'
 require_relative '../enum/vulnerability_type'
 
 module Package
   module Audit
     module Npm
-      class VulnerabilityFinder
-        AUDIT_ADVISORY_REGEX = /^{"type":"auditAdvisory".*$/
+      class VulnerabilityFinder # rubocop:disable Metrics/ClassLength
+        BULK_ADVISORY_URL = 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk'
+        BATCH_SIZE = 100
+        TIMEOUT = 30
+        VERSION_LINE = /^\s+"?version"?\s+"([^"]+)"/
 
         def initialize(dir, pkgs)
           @dir = dir
@@ -16,48 +21,142 @@ module Package
         end
 
         def run
-          # Suppress Node.js url.parse deprecation warnings from yarn audit command
-          command = format(Const::Cmd::YARN_AUDIT_JSON, @dir)
-          env_vars = { 'NODE_NO_WARNINGS' => '1' }
+          versions_by_name = collect_versions_by_name
+          return [] if versions_by_name.empty?
 
-          json_string_lines, = Open3.capture3(env_vars, command)
-          array = json_string_lines.scan(AUDIT_ADVISORY_REGEX)
-
-          vulnerability_json_array = JSON.parse("[#{array.join(',')}]", symbolize_names: true)
-          vulnerability_json_array.each do |vulnerability_json|
-            update_meta_data(vulnerability_json)
+          versions_by_name.each_slice(BATCH_SIZE) do |batch|
+            batch_versions = batch.to_h
+            fetch_advisories(batch_versions).each do |name, advisories|
+              package_name = name.to_s
+              apply_advisories(package_name, Array(advisories), batch_versions[package_name] || [])
+            end
           end
+
           @vuln_hash.values
         end
 
         private
 
-        def update_meta_data(json)
-          resolution_path = json.dig(:data, :resolution, :path)
-          return unless resolution_path # Skip if no resolution path (private package)
+        def collect_versions_by_name
+          versions_by_name = {}
+
+          (lockfile_packages + @pkg_hash.values.map { |pkg| [pkg.name, pkg.version] }).each do |name, version|
+            next if version.to_s.empty? || version == 'unknown'
+
+            versions = versions_by_name[name] ||= []
+            versions << version unless versions.include?(version)
+          end
+
+          versions_by_name
+        end
+
+        def lockfile_packages
+          path = "#{@dir}/#{Const::File::YARN_LOCK}"
+          return [] unless File.exist?(path)
+
+          packages = []
+          current_names = []
+          File.foreach(path) do |line|
+            current_names, packages = process_lockfile_line(line, current_names, packages)
+          end
+          packages
+        end
+
+        def process_lockfile_line(line, current_names, packages)
+          if lockfile_key_line?(line)
+            [package_names_from_lock_key(line.strip.chomp(':')), packages]
+          elsif (match = line.match(VERSION_LINE))
+            match_version = match[1]
+            current_names.each { |name| packages << [name, match_version] }
+            [[], packages]
+          else
+            [current_names, packages]
+          end
+        end
 
-          parent_name = resolution_path.split('>').first
-          advisory = json[:data][:advisory]
-          package_info = extract_package_info(advisory)
-          update_vulnerability_info(package_info, parent_name, advisory[:severity])
+        def lockfile_key_line?(line)
+          line.match?(/^\S/) && line.include?('@') && line.strip.end_with?(':')
         end
 
-        def extract_package_info(advisory)
-          {
-            name: advisory[:module_name],
-            version: advisory[:findings][0][:version]
-          }
+        def package_names_from_lock_key(key)
+          key.split(',').map do |entry|
+            package_name_from_spec(entry.strip.gsub(/\A["']|["']\z/, ''))
+          end.uniq
+        end
+
+        def package_name_from_spec(spec)
+          if spec.start_with?('@')
+            "@#{spec.split('@', 3)[1]}"
+          else
+            spec.split('@', 2).first
+          end
+        end
+
+        def fetch_advisories(versions_by_name)
+          uri = URI(BULK_ADVISORY_URL)
+          response = make_request(uri, versions_by_name.to_json)
+          unless response.is_a?(Net::HTTPSuccess)
+            warn "Warning: Unable to fetch npm advisories (#{response.code} #{response.message})."
+            return {}
+          end
+
+          JSON.parse(response.body)
+        rescue StandardError => e
+          warn "Warning: Error while fetching npm advisories: #{e.message}"
+          {}
+        end
+
+        def make_request(uri, body)
+          request = Net::HTTP::Post.new(uri)
+          request['Content-Type'] = 'application/json'
+          request['Accept'] = 'application/json'
+          request.body = body
+          create_http_client(uri).request(request)
+        end
+
+        def create_http_client(uri)
+          Net::HTTP.new(uri.host, uri.port).tap do |http|
+            http.use_ssl = true
+            http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+            http.cert_store = OpenSSL::X509::Store.new
+            http.cert_store.set_default_paths
+            http.read_timeout = TIMEOUT
+            http.open_timeout = TIMEOUT
+          end
+        end
+
+        def apply_advisories(name, advisories, versions)
+          advisories.each do |advisory|
+            Array(versions).each do |version|
+              next unless version_matches?(version, advisory['vulnerable_versions'])
+
+              update_vulnerability_info(name, version, advisory['severity'])
+            end
+          end
+        end
+
+        def version_matches?(version, vulnerable_versions)
+          return true if vulnerable_versions.nil? || vulnerable_versions.empty?
+
+          vulnerable_versions.split(/\s*\|\|\s*/).any? do |range|
+            requirements = range.split(/\s+/).reject(&:empty?)
+            next true if requirements.empty?
+
+            Gem::Requirement.new(*requirements).satisfied_by?(Gem::Version.new(version))
+          rescue ArgumentError
+            true
+          end
         end
 
-        def update_vulnerability_info(package_info, parent_name, severity)
-          name = package_info[:name]
-          version = package_info[:version]
+        def update_vulnerability_info(name, version, severity)
           full_name = "#{name}@#{version}"
           vulnerability = severity || Enum::VulnerabilityType::UNKNOWN
 
           @vuln_hash[full_name] ||= Package.new(name, version, 'node')
-          @vuln_hash[full_name].update vulnerabilities: @vuln_hash[full_name].vulnerabilities + [vulnerability]
-          @vuln_hash[full_name].update groups: @pkg_hash[parent_name]&.groups&.map(&:to_s) || []
+          @vuln_hash[full_name].update(
+            vulnerabilities: @vuln_hash[full_name].vulnerabilities + [vulnerability],
+            groups: @pkg_hash[name]&.groups&.map(&:to_s) || []
+          )
         end
       end
     end

data/lib/package/audit/ruby/gem_collection.rb

@@ -38,14 +38,16 @@ module Package
         def deprecated
           specs = BundlerSpecs.gemfile(@dir)
           pkgs = specs.map { |spec| Package.new(spec.name, spec.version, Enum::Technology::RUBY) }
-          pkgs = GemMetaData.new(@dir, pkgs).fetch.filter(&:deprecated?)
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir).run
+          pkgs = GemMetaData.new(@dir, pkgs + vulnerable_pkgs).fetch.filter(&:deprecated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 
         def outdated(include_implicit: false)
           specs = include_implicit ? BundlerSpecs.all(@dir) : BundlerSpecs.gemfile(@dir)
           pkgs = specs.map { |spec| Package.new(spec.name, spec.version, Enum::Technology::RUBY) }
-          pkgs = GemMetaData.new(@dir, pkgs).fetch.filter(&:outdated?)
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir).run
+          pkgs = GemMetaData.new(@dir, pkgs + vulnerable_pkgs).fetch.filter(&:outdated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 

data/lib/package/audit/ruby/gem_meta_data.rb

@@ -226,8 +226,8 @@ module Package
 
         def parse_version_dates(response_body)
           versions = JSON.parse(response_body)
-          versions.each_with_object({}) do |version_info, dates|
-            dates[version_info['number']] = version_info['created_at']
+          versions.to_h do |version_info|
+            [version_info['number'], version_info['created_at']]
           end
         end
 

data/lib/package/audit/services/command_parser.rb

@@ -47,6 +47,7 @@ module Package
         thread_index = 0
 
         @spinner.start
+        @any_section_printed = false
         threads = @technologies.map.with_index do |technology, technology_index|
           Thread.new do
             all_pkgs, ignored_pkgs = PackageFinder.new(@config, @dir, @report, @groups).run(technology)
@@ -56,7 +57,14 @@ module Package
             cumulative_pkgs += active_pkgs
             mutex.synchronize { all_packages_for_config += all_pkgs || [] }
 
-            sleep 0.1 while technology_index != thread_index # print each technology in order
+            # Wait for our turn to print (synchronized read of thread_index)
+            loop do
+              ready = mutex.synchronize { technology_index == thread_index }
+              break if ready
+
+              sleep 0.05
+            end
+
             mutex.synchronize do
               @spinner.stop
               print_results(technology, active_pkgs, ignored_pkgs || [])
@@ -82,17 +90,39 @@ module Package
         @spinner.stop
       end
 
-      def print_results(technology, pkgs, ignored_pkgs)
+      def print_results(technology, pkgs, ignored_pkgs) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        format = @options[Enum::Option::FORMAT]
+        is_pretty = format.nil?
+        is_csv = format == Enum::Format::CSV
+        has_packages = pkgs.any?
+
+        # Pretty format: blank line before each section
+        # CSV/Markdown: blank line between sections (only if previous section had output)
+        puts if is_pretty || (@any_section_printed && has_packages)
+
         PackagePrinter.new(@options, pkgs).print(Const::Fields::DEFAULT)
-        print_summary(technology, pkgs, ignored_pkgs) unless @options[Enum::Option::FORMAT] == Enum::Format::CSV
-        print_disclaimer(technology) unless @options[Enum::Option::FORMAT] || pkgs.empty?
+
+        # Markdown: blank line between table and summary (when there's a table)
+        puts if !is_pretty && !is_csv && has_packages
+
+        print_summary(technology, pkgs, ignored_pkgs) unless is_csv
+
+        # Pretty format: blank line before disclaimer
+        puts if is_pretty && has_packages
+
+        print_disclaimer(technology) unless format || pkgs.empty?
+
+        # Track that this section produced output (for CSV/Markdown separator logic)
+        # Pretty and Markdown always print summary, CSV only prints if there are packages
+        @any_section_printed = true if has_packages || !is_csv
       end
 
       def print_summary(technology, pkgs, ignored_pkgs)
+        format = @options[Enum::Option::FORMAT]
         if @report == Enum::Report::ALL
-          Util::SummaryPrinter.statistics(@options[Enum::Option::FORMAT], technology, @report, pkgs, ignored_pkgs)
+          Util::SummaryPrinter.statistics(format, technology, @report, pkgs, ignored_pkgs)
         else
-          Util::SummaryPrinter.total(technology, @report, pkgs, ignored_pkgs)
+          Util::SummaryPrinter.total(format, technology, @report, pkgs, ignored_pkgs)
         end
       end
 
@@ -110,7 +140,7 @@ module Package
         when Enum::Technology::RUBY
           Const::Cmd::BUNDLE_AUDIT
         when Enum::Technology::NODE
-          Const::Cmd::YARN_AUDIT
+          Const::Cmd::NPM_AUDIT
         else
           raise ArgumentError, "Unexpected technology \"#{technology}\" found in #{__method__}"
         end

data/lib/package/audit/services/package_printer.rb

@@ -24,10 +24,8 @@ module Package
         case @options[Enum::Option::FORMAT]
         when Enum::Format::CSV
           csv(fields, exclude_headers: @options[Enum::Option::CSV_EXCLUDE_HEADERS])
-          puts
         when Enum::Format::MARKDOWN
           markdown(fields)
-          puts
         else
           pretty(fields)
         end
@@ -51,7 +49,6 @@ module Package
         separator_plain = max_widths.map { |width| '─' * width }.join('─' * COLUMN_GAP)
         separator = Util::BashColor.light_green(separator_plain)
 
-        puts ' '
         puts " #{separator}"
         puts " #{header}"
         puts " #{separator}"

data/lib/package/audit/util/summary_printer.rb

@@ -15,7 +15,6 @@ module Package
           puts " #{Util::BashColor.blue('Although the packages above have no recent updates, ' \
                                         'they may not be deprecated.')}"
           puts " #{Util::BashColor.blue('Please contact the package author for more information about its status.')}"
-          puts
         end
 
         def self.vulnerable(technology, cmd)
@@ -24,16 +23,22 @@ module Package
                  cmd: Util::BashColor.magenta(" > #{cmd}"))
         end
 
-        def self.total(technology, report, pkgs, ignored_pkgs)
+        def self.total(format, technology, report, pkgs, ignored_pkgs) # rubocop:disable Metrics/MethodLength
+          prefix = format.nil? ? ' ' : ''
           if ignored_pkgs.any?
-            puts " #{Util::BashColor.cyan("Found a total of #{pkgs.length} #{technology.capitalize} packages " \
-                                          "(#{ignored_pkgs.length} ignored).")}"
+            puts "#{prefix}#{Util::BashColor.cyan(
+              "Found a total of #{pkgs.length} #{technology.capitalize} packages " \
+              "(#{ignored_pkgs.length} ignored)."
+            )}"
           elsif pkgs.any?
-            puts " #{Util::BashColor.cyan("Found a total of #{pkgs.length} #{technology.capitalize} packages.")}"
+            puts "#{prefix}#{Util::BashColor.cyan(
+              "Found a total of #{pkgs.length} #{technology.capitalize} packages."
+            )}"
           else
-            puts " #{Util::BashColor.green("There are no #{report} #{technology.capitalize} packages!")}"
+            puts "#{prefix}#{Util::BashColor.green(
+              "There are no #{report} #{technology.capitalize} packages!"
+            )}"
           end
-          puts
         end
 
         def self.statistics(format, technology, report, pkgs, ignored_pkgs)
@@ -60,22 +65,23 @@ module Package
         end
 
         private_class_method def self.display_results(format, technology, report, pkgs, ignored_pkgs, stats) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/ParameterLists
+          prefix = format.nil? ? ' ' : ''
           if pkgs.any?
-            print " #{status_message(stats)}"
+            print "#{prefix}#{status_message(stats)}"
             print Util::BashColor.cyan(' \\') if format == Enum::Format::MARKDOWN
             puts
-            total(technology, report, pkgs, ignored_pkgs)
+            total(format, technology, report, pkgs, ignored_pkgs)
           elsif ignored_pkgs.any?
-            print " #{status_message(stats)}"
+            print "#{prefix}#{status_message(stats)}"
             print Util::BashColor.cyan(' \\') if format == Enum::Format::MARKDOWN
             puts
-            puts " #{Util::BashColor.green('There are no deprecated, outdated or vulnerable ' \
-                                           "#{technology.capitalize} packages (#{ignored_pkgs.length} ignored)!")}"
-            puts
+            puts "#{prefix}#{Util::BashColor.green(
+              'There are no deprecated, outdated or vulnerable ' \
+              "#{technology.capitalize} packages (#{ignored_pkgs.length} ignored)!"
+            )}"
           else
-            puts " #{Util::BashColor.green('There are no deprecated, outdated or vulnerable ' \
-                                           "#{technology.capitalize} packages!")}"
-            puts
+            puts "#{prefix}#{Util::BashColor.green('There are no deprecated, outdated or vulnerable ' \
+                                                   "#{technology.capitalize} packages!")}"
           end
         end
 

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.8.0'
+    VERSION = '0.8.2'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.2
 platform: ruby
 authors:
 - Vadim Kononov
@@ -46,6 +46,9 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- LICENSE.txt
+- README.md
+- docs/example.png
 - exe/package-audit
 - lib/package/audit/cli.rb
 - lib/package/audit/const/cmd.rb
@@ -111,7 +114,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.10
 specification_version: 4
 summary: A helper tool to find outdated, deprecated and vulnerable dependencies.
 test_files: []