package-audit 0.8.2 → 0.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e0d76f96e0ad7b87f59b178565e72e9d52dddf9f7a579e016ff6779fac6d58a
-  data.tar.gz: cb917258a2025355d73123cb76762254dd92bdac817c72375e4297fbe8cb6b8f
+  metadata.gz: f5f9a3b6c50fcbebe1832c0559eddcd5a4e99c94779d1a251ad00c540df6c6b6
+  data.tar.gz: 84c02793f8d4b6a07099179fa5deee0ee473541668eb4b9212ea62b0e61d37d5
 SHA512:
-  metadata.gz: 280d5c3c95dd19ff526723fb7b9c5b387180c63a67d64eab8be9301512c9b3f5d4e252ba1e82317fb5b95e6f86380908344ea766de9ad4539fecd20afeadd3d7
-  data.tar.gz: '09f40855f0197f00fa9fc05826da2ec42506fef23d387569dd108e4623488eb059982e47d7b0bb99f718de6e62140db3817b119b90aea473cc837a7ad2038b60'
+  metadata.gz: 197beea22db4bdc21106d235e6bf0d360d61c396498d516a1fbd8aa8cca2342348aa4bcdacbd08376199ad0ff0a0555f0e145a9d2d19d4a6e1e4f29a684c6a4f
+  data.tar.gz: 8540a1858d4ad3a094f20d77c174dafcbffe1b3af1fc1a9ead5806443efb314a7bbbcb77d7fb3ccc764aed0f921de9e71b588ea82283b06a4cf4bb1dfb3fc414

data/README.md

@@ -4,18 +4,16 @@
 [![Ruby](https://img.shields.io/badge/Ruby-2.6%20to%204.0-CC342D?logo=ruby&logoColor=white)](https://github.com/vkononov/package-audit/blob/main/.github/workflows/test.yml)
 [![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/package-audit/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/package-audit/actions/workflows/test.yml)
 [![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/package-audit/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/package-audit/actions/workflows/lint.yml)
-[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/license/MIT)
 
 A useful tool for patch management and prioritization, `package-audit` produces a list of dependencies that are outdated, deprecated or have security vulnerabilities.
 
 Supports **Ruby 2.6 → latest**, with the full Ruby matrix tested daily in CI.
 
-[!["Buy Me A Coffee"](https://www.buymeacoffee.com/assets/img/custom_images/yellow_img.png)](https://www.buymeacoffee.com/vkononov)
-
 ## Supported Technologies
 
 * Ruby
-* Node (using Yarn)
+* Node (using npm or Yarn)
 
 ## Report Example
 
@@ -75,6 +73,9 @@ Show only specific risk types:
 # Show only deprecated packages
 package-audit [DIR] --deprecated
 
+# Show only outdated packages
+package-audit [DIR] --outdated
+
 # Show only vulnerable packages
 package-audit [DIR] --vulnerable
 
@@ -93,24 +94,15 @@ package-audit [DIR] --skip-deprecated
 # Show everything except outdated packages
 package-audit [DIR] --skip-outdated
 
+# Show everything except vulnerable packages
+package-audit [DIR] --skip-vulnerable
+
 # Show only vulnerable packages (exclude deprecated and outdated)
 package-audit [DIR] --skip-deprecated --skip-outdated
 ```
 
 **Important:** Packages with multiple risk types are handled intelligently. For example, a package that is both outdated and vulnerable will still appear when using `--skip-outdated` because it has a vulnerability.
 
-### Understanding the Flags Column
-
-The Flags column in the output shows which risk types apply to each package:
-
-- `⦗V··⦘` - Vulnerable (has security vulnerabilities)
-- `⦗·O·⦘` - Outdated (newer version available)
-- `⦗··D⦘` - Deprecated (no updates in 2+ years)
-- `⦗VO·⦘` - Both vulnerable and outdated
-- `⦗VOD⦘` - All three risk types apply
-
-The footer uses the same notation `⦗V⦘ulnerable, ⦗O⦘utdated, ⦗D⦘eprecated` as a legend.
-
 ### Scoping Options
 
 Filter by technology or group:
@@ -144,11 +136,14 @@ package-audit [DIR] --include-ignored
 ### Output Formats
 
 ```bash
-# CSV format
+# CSV format (-f is an alias for --format)
 package-audit [DIR] --format csv
 
 # Markdown format
 package-audit [DIR] --format md
+
+# CSV without the header row
+package-audit [DIR] --format csv --exclude-headers
 ```
 
 ### Other Commands
@@ -157,7 +152,7 @@ package-audit [DIR] --format md
 # Show how risk is calculated
 package-audit risk
 
-# Show version
+# Show version (-v and --version also work)
 package-audit version
 ```
 
@@ -172,6 +167,8 @@ package-audit help [COMMAND]
 
 The `package-audit` gem automatically searches for `.package-audit.yml` in the current directory or in the specified `DIR` if available. However, you have the option to override the default configuration file location by using the `--config` (or `-c`) flag.
 
+When `--technology` is specified, stale exclusions are cleaned up only for the selected technologies. Configuration entries for other technologies are preserved.
+
 #### Below is an example of a configuration file:
 
 ```YAML
@@ -215,4 +212,4 @@ technology:
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/license/MIT).

data/lib/package/audit/const/cmd.rb

@@ -3,7 +3,7 @@ module Package
     module Const
       module Cmd
         BUNDLE_AUDIT = 'bundle-audit check --update'
-        BUNDLE_AUDIT_JSON = 'bundle-audit check --update --quiet --format json "%s" 2>/dev/null'
+        BUNDLE_AUDIT_JSON = %w[bundle-audit check --update --quiet --format json].freeze
 
         NPM_AUDIT = 'npm audit'
       end

data/lib/package/audit/npm/node_collection.rb

@@ -1,6 +1,7 @@
 require_relative '../const/file'
 require_relative '../services/duplicate_package_merger'
 require_relative 'npm_meta_data'
+require_relative 'package_lock_parser'
 require_relative 'vulnerability_finder'
 require_relative 'yarn_lock_parser'
 
@@ -73,22 +74,27 @@ module Package
           dependencies.reject { |_name, version| local_dependency?(version) }
         end
 
+        # Packages that live in the project itself (paths, workspaces, portals)
+        # are not published to the registry and cannot be audited against it.
         def local_dependency?(version)
-          # Check for local file paths
-          version.to_s.start_with?('file:', 'link:', './', '../') ||
-            version.to_s.include?('file:') ||
-            # Check for git repositories with local paths
-            (version.to_s.start_with?('git+') && version.to_s.include?('file:'))
+          version.to_s.start_with?('file:', 'link:', 'workspace:', 'portal:', './', '../') ||
+            version.to_s.include?('file:')
         end
 
         def fetch_from_lock_file
           default_deps, dev_deps, resolutions = fetch_from_package_json
-          if File.exist?("#{@dir}/#{Const::File::YARN_LOCK}")
-            YarnLockParser.new("#{@dir}/#{Const::File::YARN_LOCK}").fetch(default_deps || {}, dev_deps || {},
-                                                                          resolutions || {})
-          else
-            []
-          end
+          parser = lock_file_parser
+          return [] if parser.nil?
+
+          parser.fetch(default_deps || {}, dev_deps || {}, resolutions || {})
+        end
+
+        def lock_file_parser
+          yarn_lock = "#{@dir}/#{Const::File::YARN_LOCK}"
+          return YarnLockParser.new(yarn_lock) if File.exist?(yarn_lock)
+
+          package_lock = "#{@dir}/#{Const::File::PACKAGE_LOCK_JSON}"
+          PackageLockParser.new(package_lock) if File.exist?(package_lock)
         end
       end
     end

data/lib/package/audit/npm/package_lock_parser.rb

@@ -0,0 +1,80 @@
+require 'json'
+
+require_relative '../enum/group'
+require_relative '../models/package'
+
+# Ruby 2.7 added this. A missing lockfile entry raises it, same as the yarn parser.
+Object.const_set(:NoMatchingPatternError, Class.new(StandardError)) unless defined?(NoMatchingPatternError)
+
+module Package
+  module Audit
+    module Npm
+      # Reads package-lock.json (lockfileVersion 1, 2 and 3) and resolves the
+      # installed version of each direct dependency.
+      class PackageLockParser
+        NODE_MODULES = 'node_modules/'
+
+        def initialize(package_lock_path)
+          @package_lock_path = package_lock_path
+          @lock = JSON.parse(File.read(package_lock_path))
+        end
+
+        def fetch(default_deps, dev_deps, _resolutions = {})
+          default_deps.merge(dev_deps).map do |dep_name, _expected_version|
+            version = direct_version(dep_name)
+            raise NoMatchingPatternError, "Unable to find \"#{dep_name}\" in #{@package_lock_path}" if version.nil?
+
+            pkg = Package.new(dep_name.to_s, version, 'node')
+            pkg.update groups: package_groups(dep_name, dev_deps)
+            pkg
+          end
+        end
+
+        # Every installed package, including transitive ones, as [name, version] pairs.
+        # Entries outside node_modules are workspace sources, not registry packages.
+        def all_packages
+          if @lock.key?('packages')
+            @lock['packages'].map do |path, entry|
+              next if entry['version'].nil? || !path.include?(NODE_MODULES)
+
+              [name_from_path(path), entry['version']]
+            end.compact
+          else
+            walk_v1(@lock['dependencies'] || {})
+          end
+        end
+
+        private
+
+        def direct_version(dep_name)
+          if @lock.key?('packages')
+            @lock.dig('packages', "#{NODE_MODULES}#{dep_name}", 'version')
+          else
+            @lock.dig('dependencies', dep_name, 'version')
+          end
+        end
+
+        def package_groups(dep_name, dev_deps)
+          if dev_deps.key?(dep_name)
+            [Enum::Group::DEV]
+          else
+            [Enum::Group::DEFAULT, Enum::Group::DEV]
+          end
+        end
+
+        # "node_modules/a/node_modules/@scope/b" => "@scope/b"
+        def name_from_path(path)
+          path.split(NODE_MODULES).last
+        end
+
+        def walk_v1(dependencies, packages = [])
+          dependencies.each do |name, entry|
+            packages << [name, entry['version']] unless entry['version'].nil?
+            walk_v1(entry['dependencies'] || {}, packages)
+          end
+          packages
+        end
+      end
+    end
+  end
+end

data/lib/package/audit/npm/semver_range.rb

@@ -0,0 +1,138 @@
+module Package
+  module Audit
+    module Npm
+      # Evaluates npm semver ranges (as used in registry advisories) against an
+      # installed version. Supports comparator sets joined by "||", hyphen
+      # ranges, caret and tilde ranges, and x-ranges. A range that cannot be
+      # understood is treated as matching, so an advisory is never silently
+      # dropped because of unusual syntax.
+      class SemverRange
+        WILDCARDS = %w[* x X].freeze
+
+        def initialize(range)
+          @range = range.to_s.strip
+        end
+
+        def satisfied_by?(version)
+          return true if @range.empty?
+
+          installed = parse_version(version)
+          return false if installed.nil?
+
+          @range.split('||').any? { |set| comparator_set_matches?(set.strip, installed) }
+        rescue ArgumentError
+          true
+        end
+
+        private
+
+        def comparator_set_matches?(set, installed)
+          return true if set.empty? || WILDCARDS.include?(set)
+
+          Gem::Requirement.new(*requirements_for(set)).satisfied_by?(installed)
+        end
+
+        def requirements_for(set)
+          return hyphen_requirements(*set.split(/\s+-\s+/, 2)) if set.match?(/\s-\s/)
+
+          set.split(/\s+/).flat_map { |comparator| comparator_requirements(comparator) }
+        end
+
+        def comparator_requirements(comparator)
+          case comparator
+          when /\A\^(.+)\z/ then caret_requirements(Regexp.last_match(1))
+          when /\A~>?(.+)\z/ then tilde_requirements(Regexp.last_match(1))
+          when /\A(>=|<=|>|<|=)\s*(.+)\z/ then operator_requirements(Regexp.last_match(1), Regexp.last_match(2))
+          else x_range_requirements(comparator)
+          end
+        end
+
+        def operator_requirements(operator, partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+          return ["#{operator} #{normalize(partial)}"] if parts.length == 3 || partial.include?('-')
+
+          partial_operator_requirements(operator, fill(parts), bump(parts))
+        end
+
+        # ">=1.2" means >=1.2.0, ">1.2" means >=1.3.0, "<=1.2" means <1.3.0, "=1.2" means 1.2.x
+        def partial_operator_requirements(operator, lower, upper)
+          case operator
+          when '>' then [">= #{upper}"]
+          when '<=' then ["< #{upper}"]
+          when '=' then [">= #{lower}", "< #{upper}"]
+          else ["#{operator} #{lower}"]
+          end
+        end
+
+        def hyphen_requirements(low, high)
+          requirements = []
+          requirements << ">= #{normalize(low)}" unless version_parts(low).empty?
+          high_parts = version_parts(high)
+          return requirements if high_parts.empty?
+
+          requirements << (high_parts.length == 3 ? "<= #{normalize(high)}" : "< #{bump(high_parts)}")
+        end
+
+        def caret_requirements(partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+
+          # Bump the leftmost non-zero part, or the last given part when all are zero.
+          index = parts.index(&:positive?) || (parts.length - 1)
+          [">= #{normalize(partial)}", "< #{bump(parts.first(index + 1))}"]
+        end
+
+        def tilde_requirements(partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+
+          upper = parts.length == 1 ? "#{parts[0] + 1}.0.0" : "#{parts[0]}.#{parts[1] + 1}.0"
+          [">= #{normalize(partial)}", "< #{upper}"]
+        end
+
+        def x_range_requirements(partial)
+          parts = version_parts(partial)
+          return [] if parts.empty?
+          return ["= #{normalize(partial)}"] if parts.length == 3 && !partial.match?(/[xX*]/)
+
+          [">= #{fill(parts)}", "< #{bump(parts)}"]
+        end
+
+        # Numeric leading parts of a version, stopping at the first wildcard.
+        # "1.2.x" => [1, 2], "1.2.3-beta" => [1, 2, 3], "x" => []
+        def version_parts(partial)
+          partial.to_s.sub(/\A[v=]+/, '').sub(/[-+].*\z/, '').split('.').take_while do |part|
+            part.match?(/\A\d+\z/)
+          end.map(&:to_i)
+        end
+
+        def fill(parts)
+          (parts + [0, 0, 0]).first(3).join('.')
+        end
+
+        def bump(parts)
+          bumped = parts.dup
+          bumped[-1] += 1
+          fill(bumped)
+        end
+
+        # Gem::Version understands "1.2.3-beta.1" (as a prerelease) but not build
+        # metadata, a leading "v", or missing patch numbers.
+        def normalize(version)
+          cleaned = version.to_s.sub(/\A[v=]+/, '').sub(/\+.*\z/, '')
+          numeric, prerelease = cleaned.split('-', 2)
+          numeric = numeric.to_s
+          numeric = fill(numeric.split('.').map(&:to_i)) if numeric.match?(/\A\d+(\.\d+){0,2}\z/)
+          prerelease ? "#{numeric}-#{prerelease}" : numeric
+        end
+
+        def parse_version(version)
+          Gem::Version.new(normalize(version))
+        rescue ArgumentError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/package/audit/npm/vulnerability_finder.rb

@@ -4,6 +4,8 @@ require 'openssl'
 
 require_relative '../const/file'
 require_relative '../enum/vulnerability_type'
+require_relative 'package_lock_parser'
+require_relative 'semver_range'
 
 module Package
   module Audit
@@ -12,7 +14,7 @@ module Package
         BULK_ADVISORY_URL = 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk'
         BATCH_SIZE = 100
         TIMEOUT = 30
-        VERSION_LINE = /^\s+"?version"?\s+"([^"]+)"/
+        VERSION_LINE = /^\s+"?version"?(?::\s*|\s+)["']?([^"'\s]+)["']?\s*$/
 
         def initialize(dir, pkgs)
           @dir = dir
@@ -51,9 +53,16 @@ module Package
         end
 
         def lockfile_packages
-          path = "#{@dir}/#{Const::File::YARN_LOCK}"
-          return [] unless File.exist?(path)
+          yarn_lock = "#{@dir}/#{Const::File::YARN_LOCK}"
+          return yarn_lockfile_packages(yarn_lock) if File.exist?(yarn_lock)
 
+          package_lock = "#{@dir}/#{Const::File::PACKAGE_LOCK_JSON}"
+          return PackageLockParser.new(package_lock).all_packages if File.exist?(package_lock)
+
+          []
+        end
+
+        def yarn_lockfile_packages(path)
           packages = []
           current_names = []
           File.foreach(path) do |line|
@@ -96,14 +105,13 @@ module Package
           uri = URI(BULK_ADVISORY_URL)
           response = make_request(uri, versions_by_name.to_json)
           unless response.is_a?(Net::HTTPSuccess)
-            warn "Warning: Unable to fetch npm advisories (#{response.code} #{response.message})."
-            return {}
+            raise "Unable to fetch npm advisories (#{response.code} #{response.message})"
           end
 
-          JSON.parse(response.body)
-        rescue StandardError => e
-          warn "Warning: Error while fetching npm advisories: #{e.message}"
-          {}
+          advisories = JSON.parse(response.body)
+          raise 'Invalid npm advisory response' unless advisories.is_a?(Hash)
+
+          advisories
         end
 
         def make_request(uri, body)
@@ -136,16 +144,7 @@ module Package
         end
 
         def version_matches?(version, vulnerable_versions)
-          return true if vulnerable_versions.nil? || vulnerable_versions.empty?
-
-          vulnerable_versions.split(/\s*\|\|\s*/).any? do |range|
-            requirements = range.split(/\s+/).reject(&:empty?)
-            next true if requirements.empty?
-
-            Gem::Requirement.new(*requirements).satisfied_by?(Gem::Version.new(version))
-          rescue ArgumentError
-            true
-          end
+          SemverRange.new(vulnerable_versions).satisfied_by?(version)
         end
 
         def update_vulnerability_info(name, version, severity)

data/lib/package/audit/ruby/gem_meta_data.rb

@@ -17,7 +17,7 @@ module Package
         def initialize(dir, pkgs)
           @dir = dir
           @pkgs = pkgs
-          @gem_hash = {}
+          @gem_hash = @pkgs.to_h { |pkg| [pkg.name, pkg] }
         end
 
         def fetch

data/lib/package/audit/ruby/vulnerability_finder.rb

@@ -11,7 +11,9 @@ module Package
         end
 
         def run
-          json_result = `#{format(Const::Cmd::BUNDLE_AUDIT_JSON, @dir)}`
+          json_result = IO.popen(
+            [*Const::Cmd::BUNDLE_AUDIT_JSON, @dir.to_s], err: File::NULL, &:read
+          )
           vulnerability_json_array = JSON.parse(json_result, symbolize_names: true)[:results]
           vulnerability_json_array.each do |vulnerability_json|
             update_meta_data(vulnerability_json)

data/lib/package/audit/services/config_cleaner.rb

@@ -62,7 +62,10 @@ module Package
         cleaned
       end
 
-      def clean_packages_for_technology(technology, packages)
+      def clean_packages_for_technology(technology, packages) # rubocop:disable Metrics/MethodLength
+        technologies = @options[Enum::Option::TECHNOLOGY]
+        return packages if technologies && !technologies.include?(technology)
+
         return {} unless packages.is_a?(Hash)
 
         current_packages = current_packages_for_technology(technology)

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.8.2'
+    VERSION = '0.9.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.8.2
+  version: 0.9.1
 platform: ruby
 authors:
 - Vadim Kononov
@@ -37,8 +37,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.2'
-description: A useful tool for patch management and prioritization, package-audit
-  produces a list of dependencies that are outdated, deprecated or have security vulnerabilities.
+description: Audits project dependencies across supported package managers and lists
+  those that are outdated, deprecated or have known security vulnerabilities, for
+  patch prioritization.
 email:
 - vadim@konoson.com
 executables:
@@ -73,6 +74,8 @@ files:
 - lib/package/audit/models/risk.rb
 - lib/package/audit/npm/node_collection.rb
 - lib/package/audit/npm/npm_meta_data.rb
+- lib/package/audit/npm/package_lock_parser.rb
+- lib/package/audit/npm/semver_range.rb
 - lib/package/audit/npm/vulnerability_finder.rb
 - lib/package/audit/npm/yarn_lock_parser.rb
 - lib/package/audit/ruby/bundler_specs.rb
@@ -114,7 +117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
-summary: A helper tool to find outdated, deprecated and vulnerable dependencies.
+summary: CLI that reports outdated, deprecated and vulnerable dependencies in a project
 test_files: []