package-audit 0.8.1 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d613e9a49c48ae22ef6e156b7f6a6ba1f2ebe8172e30589cc2eabbb5530bfdc1
-  data.tar.gz: aad9e813b4e6d2b73f15b19626fbc70631312d8965823a27d44cceef4c5115aa
+  metadata.gz: 6a9f8b791f93ef77f2eecb40a1d0bacaebf40c94a06e938ef7528f26281ac30b
+  data.tar.gz: e9a24f0114518ba97deaa1687ca5c786fee0ba54dd868cbaec48c4d6d183be7b
 SHA512:
-  metadata.gz: e6b3406928eb792637f7fbf5de5745a83ae1ce7181febc24d95882c6e38281002bcb953b3f727e18cf983606285f4df428aa36c203ed874a9d919c47c53dad9f
-  data.tar.gz: c6abc41931c2c26b91443474262353b35a0c64b0d2372258fec255f4f9569c127c3e48a172a219ec1fbd5a71fb7d4e3f15a6bbd6e2f717bb8b65ae0da74ec31f
+  metadata.gz: e106be4632777be3433e572bb60b34a9b8fa4f7e038f4be86b1d9744ffcaf2e709804bcd4ffffd2b001ee82887ea70cbb7234d2df37a4033224f155ac84b4b88
+  data.tar.gz: 400eb639d4f16d4671bc10b1e0b76ad7e49f7f3991239c8f3c5a7dbee5138fcc46d3ae819bcb06021d45a3d46e4ca2cff8e755760dda387976b2fd67d8c8aa03

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2023 Vadim Kononov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,215 @@
+# Package::Audit
+
+[![Gem Version](https://img.shields.io/gem/v/package-audit.svg?label=Gem&logo=rubygems&logoColor=white)](https://rubygems.org/gems/package-audit)
+[![Ruby](https://img.shields.io/badge/Ruby-2.6%20to%204.0-CC342D?logo=ruby&logoColor=white)](https://github.com/vkononov/package-audit/blob/main/.github/workflows/test.yml)
+[![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/package-audit/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/package-audit/actions/workflows/test.yml)
+[![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/package-audit/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/package-audit/actions/workflows/lint.yml)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/license/MIT)
+
+A useful tool for patch management and prioritization, `package-audit` produces a list of dependencies that are outdated, deprecated or have security vulnerabilities.
+
+Supports **Ruby 2.6 → latest**, with the full Ruby matrix tested daily in CI.
+
+[!["Buy Me A Coffee"](https://www.buymeacoffee.com/assets/img/custom_images/yellow_img.png)](https://www.buymeacoffee.com/vkononov)
+
+## Supported Technologies
+
+* Ruby
+* Node (using npm or Yarn)
+
+## Report Example
+
+![Example Output](docs/example.png)
+
+### Understanding the Flags Column
+
+The Flags column shows which risk types apply to each package:
+
+- `⦗V··⦘` - Vulnerable (has security vulnerabilities)
+- `⦗·O·⦘` - Outdated (newer version available)
+- `⦗··D⦘` - Deprecated (no updates in 2+ years)
+- `⦗VO·⦘` - Both vulnerable and outdated
+- `⦗VOD⦘` - All three risk types apply
+
+The footer uses the same notation (⦗V⦘ulnerable, ⦗O⦘utdated, ⦗D⦘eprecated) as a legend.
+
+## Continuous Integration
+
+This gem provides a return code of `0` to indicate success and `1` to indicate failure. It is specifically designed for seamless integration into continuous integration pipelines.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'package-audit', require: false
+```
+
+And then execute:
+
+```bash
+bundle
+```
+
+Or install it yourself as:
+
+```bash
+gem install package-audit
+```
+
+## Usage
+
+### Basic Report
+
+Run a full audit (`DIR` defaults to current directory):
+
+```bash
+package-audit [DIR]
+```
+
+### Filtering by Risk Type
+
+Show only specific risk types:
+
+```bash
+# Show only deprecated packages
+package-audit [DIR] --deprecated
+
+# Show only outdated packages
+package-audit [DIR] --outdated
+
+# Show only vulnerable packages
+package-audit [DIR] --vulnerable
+
+# Show packages that are deprecated and/or vulnerable
+package-audit [DIR] --deprecated --vulnerable
+```
+
+### Excluding Risk Types
+
+Exclude specific risk types from the report:
+
+```bash
+# Show everything except deprecated packages
+package-audit [DIR] --skip-deprecated
+
+# Show everything except outdated packages
+package-audit [DIR] --skip-outdated
+
+# Show everything except vulnerable packages
+package-audit [DIR] --skip-vulnerable
+
+# Show only vulnerable packages (exclude deprecated and outdated)
+package-audit [DIR] --skip-deprecated --skip-outdated
+```
+
+**Important:** Packages with multiple risk types are handled intelligently. For example, a package that is both outdated and vulnerable will still appear when using `--skip-outdated` because it has a vulnerability.
+
+### Scoping Options
+
+Filter by technology or group:
+
+```bash
+# Specific technologies
+package-audit [DIR] -t node -t ruby
+package-audit [DIR] --technology node --technology ruby
+
+# Specific groups
+package-audit [DIR] -g staging -g production
+package-audit [DIR] --group staging --group production
+```
+
+**Note:** `Package::Audit` will attempt to automatically detect the technologies used by the project.
+
+### Configuration
+
+Use a custom configuration file (see [Configuration File](#configuration-file) for details):
+
+```bash
+package-audit [DIR] --config .package-audit.yml
+```
+
+Include packages normally ignored by configuration:
+
+```bash
+package-audit [DIR] --include-ignored
+```
+
+### Output Formats
+
+```bash
+# CSV format (-f is an alias for --format)
+package-audit [DIR] --format csv
+
+# Markdown format
+package-audit [DIR] --format md
+
+# CSV without the header row
+package-audit [DIR] --format csv --exclude-headers
+```
+
+### Other Commands
+
+```bash
+# Show how risk is calculated
+package-audit risk
+
+# Show version (-v and --version also work)
+package-audit version
+```
+
+### Getting Help
+
+```bash
+package-audit help
+package-audit help [COMMAND]
+```
+
+## Configuration File
+
+The `package-audit` gem automatically searches for `.package-audit.yml` in the current directory or in the specified `DIR` if available. However, you have the option to override the default configuration file location by using the `--config` (or `-c`) flag.
+
+#### Below is an example of a configuration file:
+
+```YAML
+technology:
+  node:
+    nth-check:
+      version: 1.0.2
+      vulnerable: false
+  ruby:
+    devise-async:
+      version: 1.0.0
+      deprecated: false
+    puma:
+      version: 6.3.0
+      deprecated: false
+    selenium-webdriver:
+      version: 4.1.0
+      outdated: false
+```
+
+#### This configuration file allows you to specify the following exclusions:
+
+
+* Ignore all security vulnerabilities associated with `nth-check@1.0.2`.
+* Suppress messages regarding potential deprecations for  `device-async@1.0.0` and `puma@6.3.0`.
+* Disable warnings about newer available versions of  `selenium-webdriver@4.1.0`
+
+**Note:** If the installed package version differs from the expected package version specified in the configuration file, the exclusion settings will not apply to that particular package.
+
+**Note:** If a package is reported for multiple reasons (e.g. vulnerable and outdated), it will still be reported unless the exclusion criteria match every reason for being on the report.
+
+> By design, wildcard (`*`) version exclusions are not supported to prevent developers from inadvertently overlooking crucial messages when packages are updated.
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/license/MIT).

data/lib/package/audit/const/cmd.rb

@@ -6,10 +6,6 @@ module Package
         BUNDLE_AUDIT_JSON = 'bundle-audit check --update --quiet --format json "%s" 2>/dev/null'
 
         NPM_AUDIT = 'npm audit'
-        NPM_AUDIT_JSON = 'npm audit --json'
-
-        YARN_AUDIT = 'yarn audit'
-        YARN_AUDIT_JSON = 'yarn audit --json --cwd "%s"'
       end
     end
   end

data/lib/package/audit/npm/node_collection.rb

@@ -1,6 +1,7 @@
 require_relative '../const/file'
 require_relative '../services/duplicate_package_merger'
 require_relative 'npm_meta_data'
+require_relative 'package_lock_parser'
 require_relative 'vulnerability_finder'
 require_relative 'yarn_lock_parser'
 
@@ -73,22 +74,27 @@ module Package
           dependencies.reject { |_name, version| local_dependency?(version) }
         end
 
+        # Packages that live in the project itself (paths, workspaces, portals)
+        # are not published to the registry and cannot be audited against it.
         def local_dependency?(version)
-          # Check for local file paths
-          version.to_s.start_with?('file:', 'link:', './', '../') ||
-            version.to_s.include?('file:') ||
-            # Check for git repositories with local paths
-            (version.to_s.start_with?('git+') && version.to_s.include?('file:'))
+          version.to_s.start_with?('file:', 'link:', 'workspace:', 'portal:', './', '../') ||
+            version.to_s.include?('file:')
         end
 
         def fetch_from_lock_file
           default_deps, dev_deps, resolutions = fetch_from_package_json
-          if File.exist?("#{@dir}/#{Const::File::YARN_LOCK}")
-            YarnLockParser.new("#{@dir}/#{Const::File::YARN_LOCK}").fetch(default_deps || {}, dev_deps || {},
-                                                                          resolutions || {})
-          else
-            []
-          end
+          parser = lock_file_parser
+          return [] if parser.nil?
+
+          parser.fetch(default_deps || {}, dev_deps || {}, resolutions || {})
+        end
+
+        def lock_file_parser
+          yarn_lock = "#{@dir}/#{Const::File::YARN_LOCK}"
+          return YarnLockParser.new(yarn_lock) if File.exist?(yarn_lock)
+
+          package_lock = "#{@dir}/#{Const::File::PACKAGE_LOCK_JSON}"
+          PackageLockParser.new(package_lock) if File.exist?(package_lock)
         end
       end
     end

data/lib/package/audit/npm/package_lock_parser.rb

@@ -0,0 +1,80 @@
+require 'json'
+
+require_relative '../enum/group'
+require_relative '../models/package'
+
+# Ruby 2.7 added this. A missing lockfile entry raises it, same as the yarn parser.
+Object.const_set(:NoMatchingPatternError, Class.new(StandardError)) unless defined?(NoMatchingPatternError)
+
+module Package
+  module Audit
+    module Npm
+      # Reads package-lock.json (lockfileVersion 1, 2 and 3) and resolves the
+      # installed version of each direct dependency.
+      class PackageLockParser
+        NODE_MODULES = 'node_modules/'
+
+        def initialize(package_lock_path)
+          @package_lock_path = package_lock_path
+          @lock = JSON.parse(File.read(package_lock_path))
+        end
+
+        def fetch(default_deps, dev_deps, _resolutions = {})
+          default_deps.merge(dev_deps).map do |dep_name, _expected_version|
+            version = direct_version(dep_name)
+            raise NoMatchingPatternError, "Unable to find \"#{dep_name}\" in #{@package_lock_path}" if version.nil?
+
+            pkg = Package.new(dep_name.to_s, version, 'node')
+            pkg.update groups: package_groups(dep_name, dev_deps)
+            pkg
+          end
+        end
+
+        # Every installed package, including transitive ones, as [name, version] pairs.
+        # Entries outside node_modules are workspace sources, not registry packages.
+        def all_packages
+          if @lock.key?('packages')
+            @lock['packages'].map do |path, entry|
+              next if entry['version'].nil? || !path.include?(NODE_MODULES)
+
+              [name_from_path(path), entry['version']]
+            end.compact
+          else
+            walk_v1(@lock['dependencies'] || {})
+          end
+        end
+
+        private
+
+        def direct_version(dep_name)
+          if @lock.key?('packages')
+            @lock.dig('packages', "#{NODE_MODULES}#{dep_name}", 'version')
+          else
+            @lock.dig('dependencies', dep_name, 'version')
+          end
+        end
+
+        def package_groups(dep_name, dev_deps)
+          if dev_deps.key?(dep_name)
+            [Enum::Group::DEV]
+          else
+            [Enum::Group::DEFAULT, Enum::Group::DEV]
+          end
+        end
+
+        # "node_modules/a/node_modules/@scope/b" => "@scope/b"
+        def name_from_path(path)
+          path.split(NODE_MODULES).last
+        end
+
+        def walk_v1(dependencies, packages = [])
+          dependencies.each do |name, entry|
+            packages << [name, entry['version']] unless entry['version'].nil?
+            walk_v1(entry['dependencies'] || {}, packages)
+          end
+          packages
+        end
+      end
+    end
+  end
+end

data/lib/package/audit/npm/semver_range.rb

@@ -0,0 +1,138 @@
+module Package
+  module Audit
+    module Npm
+      # Evaluates npm semver ranges (as used in registry advisories) against an
+      # installed version. Supports comparator sets joined by "||", hyphen
+      # ranges, caret and tilde ranges, and x-ranges. A range that cannot be
+      # understood is treated as matching, so an advisory is never silently
+      # dropped because of unusual syntax.
+      class SemverRange
+        WILDCARDS = %w[* x X].freeze
+
+        def initialize(range)
+          @range = range.to_s.strip
+        end
+
+        def satisfied_by?(version)
+          return true if @range.empty?
+
+          installed = parse_version(version)
+          return false if installed.nil?
+
+          @range.split('||').any? { |set| comparator_set_matches?(set.strip, installed) }
+        rescue ArgumentError
+          true
+        end
+
+        private
+
+        def comparator_set_matches?(set, installed)
+          return true if set.empty? || WILDCARDS.include?(set)
+
+          Gem::Requirement.new(*requirements_for(set)).satisfied_by?(installed)
+        end
+
+        def requirements_for(set)
+          return hyphen_requirements(*set.split(/\s+-\s+/, 2)) if set.match?(/\s-\s/)
+
+          set.split(/\s+/).flat_map { |comparator| comparator_requirements(comparator) }
+        end
+
+        def comparator_requirements(comparator)
+          case comparator
+          when /\A\^(.+)\z/ then caret_requirements(Regexp.last_match(1))
+          when /\A~>?(.+)\z/ then tilde_requirements(Regexp.last_match(1))
+          when /\A(>=|<=|>|<|=)\s*(.+)\z/ then operator_requirements(Regexp.last_match(1), Regexp.last_match(2))
+          else x_range_requirements(comparator)
+          end
+        end
+
+        def operator_requirements(operator, partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+          return ["#{operator} #{normalize(partial)}"] if parts.length == 3 || partial.include?('-')
+
+          partial_operator_requirements(operator, fill(parts), bump(parts))
+        end
+
+        # ">=1.2" means >=1.2.0, ">1.2" means >=1.3.0, "<=1.2" means <1.3.0, "=1.2" means 1.2.x
+        def partial_operator_requirements(operator, lower, upper)
+          case operator
+          when '>' then [">= #{upper}"]
+          when '<=' then ["< #{upper}"]
+          when '=' then [">= #{lower}", "< #{upper}"]
+          else ["#{operator} #{lower}"]
+          end
+        end
+
+        def hyphen_requirements(low, high)
+          requirements = []
+          requirements << ">= #{normalize(low)}" unless version_parts(low).empty?
+          high_parts = version_parts(high)
+          return requirements if high_parts.empty?
+
+          requirements << (high_parts.length == 3 ? "<= #{normalize(high)}" : "< #{bump(high_parts)}")
+        end
+
+        def caret_requirements(partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+
+          # Bump the leftmost non-zero part, or the last given part when all are zero.
+          index = parts.index(&:positive?) || (parts.length - 1)
+          [">= #{normalize(partial)}", "< #{bump(parts.first(index + 1))}"]
+        end
+
+        def tilde_requirements(partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+
+          upper = parts.length == 1 ? "#{parts[0] + 1}.0.0" : "#{parts[0]}.#{parts[1] + 1}.0"
+          [">= #{normalize(partial)}", "< #{upper}"]
+        end
+
+        def x_range_requirements(partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+          return ["= #{normalize(partial)}"] if parts.length == 3 && !partial.match?(/[xX*]/)
+
+          [">= #{fill(parts)}", "< #{bump(parts)}"]
+        end
+
+        # Numeric leading parts of a version, stopping at the first wildcard.
+        # "1.2.x" => [1, 2], "1.2.3-beta" => [1, 2, 3], "x" => []
+        def version_parts(partial)
+          partial.to_s.sub(/\A[v=]+/, '').sub(/[-+].*\z/, '').split('.').take_while do |part|
+            part.match?(/\A\d+\z/)
+          end.map(&:to_i)
+        end
+
+        def fill(parts)
+          (parts + [0, 0, 0]).first(3).join('.')
+        end
+
+        def bump(parts)
+          bumped = parts.dup
+          bumped[-1] += 1
+          fill(bumped)
+        end
+
+        # Gem::Version understands "1.2.3-beta.1" (as a prerelease) but not build
+        # metadata, a leading "v", or missing patch numbers.
+        def normalize(version)
+          cleaned = version.to_s.sub(/\A[v=]+/, '').sub(/\+.*\z/, '')
+          numeric, prerelease = cleaned.split('-', 2)
+          numeric = numeric.to_s
+          numeric = fill(numeric.split('.').map(&:to_i)) if numeric.match?(/\A\d+(\.\d+){0,2}\z/)
+          prerelease ? "#{numeric}-#{prerelease}" : numeric
+        end
+
+        def parse_version(version)
+          Gem::Version.new(normalize(version))
+        rescue ArgumentError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/package/audit/npm/vulnerability_finder.rb

@@ -1,13 +1,20 @@
-require 'open3'
+require 'json'
+require 'net/http'
+require 'openssl'
 
-require_relative '../const/cmd'
+require_relative '../const/file'
 require_relative '../enum/vulnerability_type'
+require_relative 'package_lock_parser'
+require_relative 'semver_range'
 
 module Package
   module Audit
     module Npm
-      class VulnerabilityFinder
-        AUDIT_ADVISORY_REGEX = /^{"type":"auditAdvisory".*$/
+      class VulnerabilityFinder # rubocop:disable Metrics/ClassLength
+        BULK_ADVISORY_URL = 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk'
+        BATCH_SIZE = 100
+        TIMEOUT = 30
+        VERSION_LINE = /^\s+"?version"?\s+"([^"]+)"/
 
         def initialize(dir, pkgs)
           @dir = dir
@@ -16,48 +23,140 @@ module Package
         end
 
         def run
-          # Suppress Node.js url.parse deprecation warnings from yarn audit command
-          command = format(Const::Cmd::YARN_AUDIT_JSON, @dir)
-          env_vars = { 'NODE_NO_WARNINGS' => '1' }
+          versions_by_name = collect_versions_by_name
+          return [] if versions_by_name.empty?
 
-          json_string_lines, = Open3.capture3(env_vars, command)
-          array = json_string_lines.scan(AUDIT_ADVISORY_REGEX)
-
-          vulnerability_json_array = JSON.parse("[#{array.join(',')}]", symbolize_names: true)
-          vulnerability_json_array.each do |vulnerability_json|
-            update_meta_data(vulnerability_json)
+          versions_by_name.each_slice(BATCH_SIZE) do |batch|
+            batch_versions = batch.to_h
+            fetch_advisories(batch_versions).each do |name, advisories|
+              package_name = name.to_s
+              apply_advisories(package_name, Array(advisories), batch_versions[package_name] || [])
+            end
           end
+
           @vuln_hash.values
         end
 
         private
 
-        def update_meta_data(json)
-          resolution_path = json.dig(:data, :resolution, :path)
-          return unless resolution_path # Skip if no resolution path (private package)
+        def collect_versions_by_name
+          versions_by_name = {}
+
+          (lockfile_packages + @pkg_hash.values.map { |pkg| [pkg.name, pkg.version] }).each do |name, version|
+            next if version.to_s.empty? || version == 'unknown'
+
+            versions = versions_by_name[name] ||= []
+            versions << version unless versions.include?(version)
+          end
+
+          versions_by_name
+        end
+
+        def lockfile_packages
+          yarn_lock = "#{@dir}/#{Const::File::YARN_LOCK}"
+          return yarn_lockfile_packages(yarn_lock) if File.exist?(yarn_lock)
+
+          package_lock = "#{@dir}/#{Const::File::PACKAGE_LOCK_JSON}"
+          return PackageLockParser.new(package_lock).all_packages if File.exist?(package_lock)
 
-          parent_name = resolution_path.split('>').first
-          advisory = json[:data][:advisory]
-          package_info = extract_package_info(advisory)
-          update_vulnerability_info(package_info, parent_name, advisory[:severity])
+          []
+        end
+
+        def yarn_lockfile_packages(path)
+          packages = []
+          current_names = []
+          File.foreach(path) do |line|
+            current_names, packages = process_lockfile_line(line, current_names, packages)
+          end
+          packages
+        end
+
+        def process_lockfile_line(line, current_names, packages)
+          if lockfile_key_line?(line)
+            [package_names_from_lock_key(line.strip.chomp(':')), packages]
+          elsif (match = line.match(VERSION_LINE))
+            match_version = match[1]
+            current_names.each { |name| packages << [name, match_version] }
+            [[], packages]
+          else
+            [current_names, packages]
+          end
+        end
+
+        def lockfile_key_line?(line)
+          line.match?(/^\S/) && line.include?('@') && line.strip.end_with?(':')
+        end
+
+        def package_names_from_lock_key(key)
+          key.split(',').map do |entry|
+            package_name_from_spec(entry.strip.gsub(/\A["']|["']\z/, ''))
+          end.uniq
+        end
+
+        def package_name_from_spec(spec)
+          if spec.start_with?('@')
+            "@#{spec.split('@', 3)[1]}"
+          else
+            spec.split('@', 2).first
+          end
+        end
+
+        def fetch_advisories(versions_by_name)
+          uri = URI(BULK_ADVISORY_URL)
+          response = make_request(uri, versions_by_name.to_json)
+          unless response.is_a?(Net::HTTPSuccess)
+            warn "Warning: Unable to fetch npm advisories (#{response.code} #{response.message})."
+            return {}
+          end
+
+          JSON.parse(response.body)
+        rescue StandardError => e
+          warn "Warning: Error while fetching npm advisories: #{e.message}"
+          {}
+        end
+
+        def make_request(uri, body)
+          request = Net::HTTP::Post.new(uri)
+          request['Content-Type'] = 'application/json'
+          request['Accept'] = 'application/json'
+          request.body = body
+          create_http_client(uri).request(request)
+        end
+
+        def create_http_client(uri)
+          Net::HTTP.new(uri.host, uri.port).tap do |http|
+            http.use_ssl = true
+            http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+            http.cert_store = OpenSSL::X509::Store.new
+            http.cert_store.set_default_paths
+            http.read_timeout = TIMEOUT
+            http.open_timeout = TIMEOUT
+          end
+        end
+
+        def apply_advisories(name, advisories, versions)
+          advisories.each do |advisory|
+            Array(versions).each do |version|
+              next unless version_matches?(version, advisory['vulnerable_versions'])
+
+              update_vulnerability_info(name, version, advisory['severity'])
+            end
+          end
         end
 
-        def extract_package_info(advisory)
-          {
-            name: advisory[:module_name],
-            version: advisory[:findings][0][:version]
-          }
+        def version_matches?(version, vulnerable_versions)
+          SemverRange.new(vulnerable_versions).satisfied_by?(version)
         end
 
-        def update_vulnerability_info(package_info, parent_name, severity)
-          name = package_info[:name]
-          version = package_info[:version]
+        def update_vulnerability_info(name, version, severity)
           full_name = "#{name}@#{version}"
           vulnerability = severity || Enum::VulnerabilityType::UNKNOWN
 
           @vuln_hash[full_name] ||= Package.new(name, version, 'node')
-          @vuln_hash[full_name].update vulnerabilities: @vuln_hash[full_name].vulnerabilities + [vulnerability]
-          @vuln_hash[full_name].update groups: @pkg_hash[parent_name]&.groups&.map(&:to_s) || []
+          @vuln_hash[full_name].update(
+            vulnerabilities: @vuln_hash[full_name].vulnerabilities + [vulnerability],
+            groups: @pkg_hash[name]&.groups&.map(&:to_s) || []
+          )
         end
       end
     end

data/lib/package/audit/ruby/gem_meta_data.rb

@@ -226,8 +226,8 @@ module Package
 
         def parse_version_dates(response_body)
           versions = JSON.parse(response_body)
-          versions.each_with_object({}) do |version_info, dates|
-            dates[version_info['number']] = version_info['created_at']
+          versions.to_h do |version_info|
+            [version_info['number'], version_info['created_at']]
           end
         end
 

data/lib/package/audit/services/command_parser.rb

@@ -140,7 +140,7 @@ module Package
         when Enum::Technology::RUBY
           Const::Cmd::BUNDLE_AUDIT
         when Enum::Technology::NODE
-          Const::Cmd::YARN_AUDIT
+          Const::Cmd::NPM_AUDIT
         else
           raise ArgumentError, "Unexpected technology \"#{technology}\" found in #{__method__}"
         end

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.8.1'
+    VERSION = '0.9.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.8.1
+  version: 0.9.0
 platform: ruby
 authors:
 - Vadim Kononov
@@ -37,8 +37,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.2'
-description: A useful tool for patch management and prioritization, package-audit
-  produces a list of dependencies that are outdated, deprecated or have security vulnerabilities.
+description: Audits project dependencies across supported package managers and lists
+  those that are outdated, deprecated or have known security vulnerabilities, for
+  patch prioritization.
 email:
 - vadim@konoson.com
 executables:
@@ -46,6 +47,9 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- LICENSE.txt
+- README.md
+- docs/example.png
 - exe/package-audit
 - lib/package/audit/cli.rb
 - lib/package/audit/const/cmd.rb
@@ -70,6 +74,8 @@ files:
 - lib/package/audit/models/risk.rb
 - lib/package/audit/npm/node_collection.rb
 - lib/package/audit/npm/npm_meta_data.rb
+- lib/package/audit/npm/package_lock_parser.rb
+- lib/package/audit/npm/semver_range.rb
 - lib/package/audit/npm/vulnerability_finder.rb
 - lib/package/audit/npm/yarn_lock_parser.rb
 - lib/package/audit/ruby/bundler_specs.rb
@@ -111,7 +117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.10
 specification_version: 4
-summary: A helper tool to find outdated, deprecated and vulnerable dependencies.
+summary: CLI that reports outdated, deprecated and vulnerable dependencies in a project
 test_files: []