package-audit 0.8.2 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e0d76f96e0ad7b87f59b178565e72e9d52dddf9f7a579e016ff6779fac6d58a
-  data.tar.gz: cb917258a2025355d73123cb76762254dd92bdac817c72375e4297fbe8cb6b8f
+  metadata.gz: 6a9f8b791f93ef77f2eecb40a1d0bacaebf40c94a06e938ef7528f26281ac30b
+  data.tar.gz: e9a24f0114518ba97deaa1687ca5c786fee0ba54dd868cbaec48c4d6d183be7b
 SHA512:
-  metadata.gz: 280d5c3c95dd19ff526723fb7b9c5b387180c63a67d64eab8be9301512c9b3f5d4e252ba1e82317fb5b95e6f86380908344ea766de9ad4539fecd20afeadd3d7
-  data.tar.gz: '09f40855f0197f00fa9fc05826da2ec42506fef23d387569dd108e4623488eb059982e47d7b0bb99f718de6e62140db3817b119b90aea473cc837a7ad2038b60'
+  metadata.gz: e106be4632777be3433e572bb60b34a9b8fa4f7e038f4be86b1d9744ffcaf2e709804bcd4ffffd2b001ee82887ea70cbb7234d2df37a4033224f155ac84b4b88
+  data.tar.gz: 400eb639d4f16d4671bc10b1e0b76ad7e49f7f3991239c8f3c5a7dbee5138fcc46d3ae819bcb06021d45a3d46e4ca2cff8e755760dda387976b2fd67d8c8aa03

data/README.md

@@ -4,7 +4,7 @@
 [![Ruby](https://img.shields.io/badge/Ruby-2.6%20to%204.0-CC342D?logo=ruby&logoColor=white)](https://github.com/vkononov/package-audit/blob/main/.github/workflows/test.yml)
 [![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/package-audit/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/package-audit/actions/workflows/test.yml)
 [![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/package-audit/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/package-audit/actions/workflows/lint.yml)
-[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/license/MIT)
 
 A useful tool for patch management and prioritization, `package-audit` produces a list of dependencies that are outdated, deprecated or have security vulnerabilities.
 
@@ -15,7 +15,7 @@ Supports **Ruby 2.6 → latest**, with the full Ruby matrix tested daily in CI.
 ## Supported Technologies
 
 * Ruby
-* Node (using Yarn)
+* Node (using npm or Yarn)
 
 ## Report Example
 
@@ -75,6 +75,9 @@ Show only specific risk types:
 # Show only deprecated packages
 package-audit [DIR] --deprecated
 
+# Show only outdated packages
+package-audit [DIR] --outdated
+
 # Show only vulnerable packages
 package-audit [DIR] --vulnerable
 
@@ -93,24 +96,15 @@ package-audit [DIR] --skip-deprecated
 # Show everything except outdated packages
 package-audit [DIR] --skip-outdated
 
+# Show everything except vulnerable packages
+package-audit [DIR] --skip-vulnerable
+
 # Show only vulnerable packages (exclude deprecated and outdated)
 package-audit [DIR] --skip-deprecated --skip-outdated
 ```
 
 **Important:** Packages with multiple risk types are handled intelligently. For example, a package that is both outdated and vulnerable will still appear when using `--skip-outdated` because it has a vulnerability.
 
-### Understanding the Flags Column
-
-The Flags column in the output shows which risk types apply to each package:
-
-- `⦗V··⦘` - Vulnerable (has security vulnerabilities)
-- `⦗·O·⦘` - Outdated (newer version available)
-- `⦗··D⦘` - Deprecated (no updates in 2+ years)
-- `⦗VO·⦘` - Both vulnerable and outdated
-- `⦗VOD⦘` - All three risk types apply
-
-The footer uses the same notation `⦗V⦘ulnerable, ⦗O⦘utdated, ⦗D⦘eprecated` as a legend.
-
 ### Scoping Options
 
 Filter by technology or group:
@@ -144,11 +138,14 @@ package-audit [DIR] --include-ignored
 ### Output Formats
 
 ```bash
-# CSV format
+# CSV format (-f is an alias for --format)
 package-audit [DIR] --format csv
 
 # Markdown format
 package-audit [DIR] --format md
+
+# CSV without the header row
+package-audit [DIR] --format csv --exclude-headers
 ```
 
 ### Other Commands
@@ -157,7 +154,7 @@ package-audit [DIR] --format md
 # Show how risk is calculated
 package-audit risk
 
-# Show version
+# Show version (-v and --version also work)
 package-audit version
 ```
 
@@ -215,4 +212,4 @@ technology:
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/license/MIT).

data/lib/package/audit/npm/node_collection.rb

@@ -1,6 +1,7 @@
 require_relative '../const/file'
 require_relative '../services/duplicate_package_merger'
 require_relative 'npm_meta_data'
+require_relative 'package_lock_parser'
 require_relative 'vulnerability_finder'
 require_relative 'yarn_lock_parser'
 
@@ -73,22 +74,27 @@ module Package
           dependencies.reject { |_name, version| local_dependency?(version) }
         end
 
+        # Packages that live in the project itself (paths, workspaces, portals)
+        # are not published to the registry and cannot be audited against it.
         def local_dependency?(version)
-          # Check for local file paths
-          version.to_s.start_with?('file:', 'link:', './', '../') ||
-            version.to_s.include?('file:') ||
-            # Check for git repositories with local paths
-            (version.to_s.start_with?('git+') && version.to_s.include?('file:'))
+          version.to_s.start_with?('file:', 'link:', 'workspace:', 'portal:', './', '../') ||
+            version.to_s.include?('file:')
         end
 
         def fetch_from_lock_file
           default_deps, dev_deps, resolutions = fetch_from_package_json
-          if File.exist?("#{@dir}/#{Const::File::YARN_LOCK}")
-            YarnLockParser.new("#{@dir}/#{Const::File::YARN_LOCK}").fetch(default_deps || {}, dev_deps || {},
-                                                                          resolutions || {})
-          else
-            []
-          end
+          parser = lock_file_parser
+          return [] if parser.nil?
+
+          parser.fetch(default_deps || {}, dev_deps || {}, resolutions || {})
+        end
+
+        def lock_file_parser
+          yarn_lock = "#{@dir}/#{Const::File::YARN_LOCK}"
+          return YarnLockParser.new(yarn_lock) if File.exist?(yarn_lock)
+
+          package_lock = "#{@dir}/#{Const::File::PACKAGE_LOCK_JSON}"
+          PackageLockParser.new(package_lock) if File.exist?(package_lock)
         end
       end
     end

data/lib/package/audit/npm/package_lock_parser.rb

@@ -0,0 +1,80 @@
+require 'json'
+
+require_relative '../enum/group'
+require_relative '../models/package'
+
+# Ruby 2.7 added this. A missing lockfile entry raises it, same as the yarn parser.
+Object.const_set(:NoMatchingPatternError, Class.new(StandardError)) unless defined?(NoMatchingPatternError)
+
+module Package
+  module Audit
+    module Npm
+      # Reads package-lock.json (lockfileVersion 1, 2 and 3) and resolves the
+      # installed version of each direct dependency.
+      class PackageLockParser
+        NODE_MODULES = 'node_modules/'
+
+        def initialize(package_lock_path)
+          @package_lock_path = package_lock_path
+          @lock = JSON.parse(File.read(package_lock_path))
+        end
+
+        def fetch(default_deps, dev_deps, _resolutions = {})
+          default_deps.merge(dev_deps).map do |dep_name, _expected_version|
+            version = direct_version(dep_name)
+            raise NoMatchingPatternError, "Unable to find \"#{dep_name}\" in #{@package_lock_path}" if version.nil?
+
+            pkg = Package.new(dep_name.to_s, version, 'node')
+            pkg.update groups: package_groups(dep_name, dev_deps)
+            pkg
+          end
+        end
+
+        # Every installed package, including transitive ones, as [name, version] pairs.
+        # Entries outside node_modules are workspace sources, not registry packages.
+        def all_packages
+          if @lock.key?('packages')
+            @lock['packages'].map do |path, entry|
+              next if entry['version'].nil? || !path.include?(NODE_MODULES)
+
+              [name_from_path(path), entry['version']]
+            end.compact
+          else
+            walk_v1(@lock['dependencies'] || {})
+          end
+        end
+
+        private
+
+        def direct_version(dep_name)
+          if @lock.key?('packages')
+            @lock.dig('packages', "#{NODE_MODULES}#{dep_name}", 'version')
+          else
+            @lock.dig('dependencies', dep_name, 'version')
+          end
+        end
+
+        def package_groups(dep_name, dev_deps)
+          if dev_deps.key?(dep_name)
+            [Enum::Group::DEV]
+          else
+            [Enum::Group::DEFAULT, Enum::Group::DEV]
+          end
+        end
+
+        # "node_modules/a/node_modules/@scope/b" => "@scope/b"
+        def name_from_path(path)
+          path.split(NODE_MODULES).last
+        end
+
+        def walk_v1(dependencies, packages = [])
+          dependencies.each do |name, entry|
+            packages << [name, entry['version']] unless entry['version'].nil?
+            walk_v1(entry['dependencies'] || {}, packages)
+          end
+          packages
+        end
+      end
+    end
+  end
+end

data/lib/package/audit/npm/semver_range.rb

@@ -0,0 +1,138 @@
+module Package
+  module Audit
+    module Npm
+      # Evaluates npm semver ranges (as used in registry advisories) against an
+      # installed version. Supports comparator sets joined by "||", hyphen
+      # ranges, caret and tilde ranges, and x-ranges. A range that cannot be
+      # understood is treated as matching, so an advisory is never silently
+      # dropped because of unusual syntax.
+      class SemverRange
+        WILDCARDS = %w[* x X].freeze
+
+        def initialize(range)
+          @range = range.to_s.strip
+        end
+
+        def satisfied_by?(version)
+          return true if @range.empty?
+
+          installed = parse_version(version)
+          return false if installed.nil?
+
+          @range.split('||').any? { |set| comparator_set_matches?(set.strip, installed) }
+        rescue ArgumentError
+          true
+        end
+
+        private
+
+        def comparator_set_matches?(set, installed)
+          return true if set.empty? || WILDCARDS.include?(set)
+
+          Gem::Requirement.new(*requirements_for(set)).satisfied_by?(installed)
+        end
+
+        def requirements_for(set)
+          return hyphen_requirements(*set.split(/\s+-\s+/, 2)) if set.match?(/\s-\s/)
+
+          set.split(/\s+/).flat_map { |comparator| comparator_requirements(comparator) }
+        end
+
+        def comparator_requirements(comparator)
+          case comparator
+          when /\A\^(.+)\z/ then caret_requirements(Regexp.last_match(1))
+          when /\A~>?(.+)\z/ then tilde_requirements(Regexp.last_match(1))
+          when /\A(>=|<=|>|<|=)\s*(.+)\z/ then operator_requirements(Regexp.last_match(1), Regexp.last_match(2))
+          else x_range_requirements(comparator)
+          end
+        end
+
+        def operator_requirements(operator, partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+          return ["#{operator} #{normalize(partial)}"] if parts.length == 3 || partial.include?('-')
+
+          partial_operator_requirements(operator, fill(parts), bump(parts))
+        end
+
+        # ">=1.2" means >=1.2.0, ">1.2" means >=1.3.0, "<=1.2" means <1.3.0, "=1.2" means 1.2.x
+        def partial_operator_requirements(operator, lower, upper)
+          case operator
+          when '>' then [">= #{upper}"]
+          when '<=' then ["< #{upper}"]
+          when '=' then [">= #{lower}", "< #{upper}"]
+          else ["#{operator} #{lower}"]
+          end
+        end
+
+        def hyphen_requirements(low, high)
+          requirements = []
+          requirements << ">= #{normalize(low)}" unless version_parts(low).empty?
+          high_parts = version_parts(high)
+          return requirements if high_parts.empty?
+
+          requirements << (high_parts.length == 3 ? "<= #{normalize(high)}" : "< #{bump(high_parts)}")
+        end
+
+        def caret_requirements(partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+
+          # Bump the leftmost non-zero part, or the last given part when all are zero.
+          index = parts.index(&:positive?) || (parts.length - 1)
+          [">= #{normalize(partial)}", "< #{bump(parts.first(index + 1))}"]
+        end
+
+        def tilde_requirements(partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+
+          upper = parts.length == 1 ? "#{parts[0] + 1}.0.0" : "#{parts[0]}.#{parts[1] + 1}.0"
+          [">= #{normalize(partial)}", "< #{upper}"]
+        end
+
+        def x_range_requirements(partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+          return ["= #{normalize(partial)}"] if parts.length == 3 && !partial.match?(/[xX*]/)
+
+          [">= #{fill(parts)}", "< #{bump(parts)}"]
+        end
+
+        # Numeric leading parts of a version, stopping at the first wildcard.
+        # "1.2.x" => [1, 2], "1.2.3-beta" => [1, 2, 3], "x" => []
+        def version_parts(partial)
+          partial.to_s.sub(/\A[v=]+/, '').sub(/[-+].*\z/, '').split('.').take_while do |part|
+            part.match?(/\A\d+\z/)
+          end.map(&:to_i)
+        end
+
+        def fill(parts)
+          (parts + [0, 0, 0]).first(3).join('.')
+        end
+
+        def bump(parts)
+          bumped = parts.dup
+          bumped[-1] += 1
+          fill(bumped)
+        end
+
+        # Gem::Version understands "1.2.3-beta.1" (as a prerelease) but not build
+        # metadata, a leading "v", or missing patch numbers.
+        def normalize(version)
+          cleaned = version.to_s.sub(/\A[v=]+/, '').sub(/\+.*\z/, '')
+          numeric, prerelease = cleaned.split('-', 2)
+          numeric = numeric.to_s
+          numeric = fill(numeric.split('.').map(&:to_i)) if numeric.match?(/\A\d+(\.\d+){0,2}\z/)
+          prerelease ? "#{numeric}-#{prerelease}" : numeric
+        end
+
+        def parse_version(version)
+          Gem::Version.new(normalize(version))
+        rescue ArgumentError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/package/audit/npm/vulnerability_finder.rb

@@ -4,6 +4,8 @@ require 'openssl'
 
 require_relative '../const/file'
 require_relative '../enum/vulnerability_type'
+require_relative 'package_lock_parser'
+require_relative 'semver_range'
 
 module Package
   module Audit
@@ -51,9 +53,16 @@ module Package
         end
 
         def lockfile_packages
-          path = "#{@dir}/#{Const::File::YARN_LOCK}"
-          return [] unless File.exist?(path)
+          yarn_lock = "#{@dir}/#{Const::File::YARN_LOCK}"
+          return yarn_lockfile_packages(yarn_lock) if File.exist?(yarn_lock)
 
+          package_lock = "#{@dir}/#{Const::File::PACKAGE_LOCK_JSON}"
+          return PackageLockParser.new(package_lock).all_packages if File.exist?(package_lock)
+
+          []
+        end
+
+        def yarn_lockfile_packages(path)
           packages = []
           current_names = []
           File.foreach(path) do |line|
@@ -136,16 +145,7 @@ module Package
         end
 
         def version_matches?(version, vulnerable_versions)
-          return true if vulnerable_versions.nil? || vulnerable_versions.empty?
-
-          vulnerable_versions.split(/\s*\|\|\s*/).any? do |range|
-            requirements = range.split(/\s+/).reject(&:empty?)
-            next true if requirements.empty?
-
-            Gem::Requirement.new(*requirements).satisfied_by?(Gem::Version.new(version))
-          rescue ArgumentError
-            true
-          end
+          SemverRange.new(vulnerable_versions).satisfied_by?(version)
         end
 
         def update_vulnerability_info(name, version, severity)

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.8.2'
+    VERSION = '0.9.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.8.2
+  version: 0.9.0
 platform: ruby
 authors:
 - Vadim Kononov
@@ -37,8 +37,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.2'
-description: A useful tool for patch management and prioritization, package-audit
-  produces a list of dependencies that are outdated, deprecated or have security vulnerabilities.
+description: Audits project dependencies across supported package managers and lists
+  those that are outdated, deprecated or have known security vulnerabilities, for
+  patch prioritization.
 email:
 - vadim@konoson.com
 executables:
@@ -73,6 +74,8 @@ files:
 - lib/package/audit/models/risk.rb
 - lib/package/audit/npm/node_collection.rb
 - lib/package/audit/npm/npm_meta_data.rb
+- lib/package/audit/npm/package_lock_parser.rb
+- lib/package/audit/npm/semver_range.rb
 - lib/package/audit/npm/vulnerability_finder.rb
 - lib/package/audit/npm/yarn_lock_parser.rb
 - lib/package/audit/ruby/bundler_specs.rb
@@ -116,5 +119,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 4.0.10
 specification_version: 4
-summary: A helper tool to find outdated, deprecated and vulnerable dependencies.
+summary: CLI that reports outdated, deprecated and vulnerable dependencies in a project
 test_files: []