package-audit 0.9.0 → 0.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a9f8b791f93ef77f2eecb40a1d0bacaebf40c94a06e938ef7528f26281ac30b
-  data.tar.gz: e9a24f0114518ba97deaa1687ca5c786fee0ba54dd868cbaec48c4d6d183be7b
+  metadata.gz: f5f9a3b6c50fcbebe1832c0559eddcd5a4e99c94779d1a251ad00c540df6c6b6
+  data.tar.gz: 84c02793f8d4b6a07099179fa5deee0ee473541668eb4b9212ea62b0e61d37d5
 SHA512:
-  metadata.gz: e106be4632777be3433e572bb60b34a9b8fa4f7e038f4be86b1d9744ffcaf2e709804bcd4ffffd2b001ee82887ea70cbb7234d2df37a4033224f155ac84b4b88
-  data.tar.gz: 400eb639d4f16d4671bc10b1e0b76ad7e49f7f3991239c8f3c5a7dbee5138fcc46d3ae819bcb06021d45a3d46e4ca2cff8e755760dda387976b2fd67d8c8aa03
+  metadata.gz: 197beea22db4bdc21106d235e6bf0d360d61c396498d516a1fbd8aa8cca2342348aa4bcdacbd08376199ad0ff0a0555f0e145a9d2d19d4a6e1e4f29a684c6a4f
+  data.tar.gz: 8540a1858d4ad3a094f20d77c174dafcbffe1b3af1fc1a9ead5806443efb314a7bbbcb77d7fb3ccc764aed0f921de9e71b588ea82283b06a4cf4bb1dfb3fc414

data/README.md

@@ -10,8 +10,6 @@ A useful tool for patch management and prioritization, `package-audit` produces
 
 Supports **Ruby 2.6 → latest**, with the full Ruby matrix tested daily in CI.
 
-[!["Buy Me A Coffee"](https://www.buymeacoffee.com/assets/img/custom_images/yellow_img.png)](https://www.buymeacoffee.com/vkononov)
-
 ## Supported Technologies
 
 * Ruby
@@ -169,6 +167,8 @@ package-audit help [COMMAND]
 
 The `package-audit` gem automatically searches for `.package-audit.yml` in the current directory or in the specified `DIR` if available. However, you have the option to override the default configuration file location by using the `--config` (or `-c`) flag.
 
+When `--technology` is specified, stale exclusions are cleaned up only for the selected technologies. Configuration entries for other technologies are preserved.
+
 #### Below is an example of a configuration file:
 
 ```YAML

data/lib/package/audit/const/cmd.rb

@@ -3,7 +3,7 @@ module Package
     module Const
       module Cmd
         BUNDLE_AUDIT = 'bundle-audit check --update'
-        BUNDLE_AUDIT_JSON = 'bundle-audit check --update --quiet --format json "%s" 2>/dev/null'
+        BUNDLE_AUDIT_JSON = %w[bundle-audit check --update --quiet --format json].freeze
 
         NPM_AUDIT = 'npm audit'
       end

data/lib/package/audit/npm/vulnerability_finder.rb

@@ -14,7 +14,7 @@ module Package
         BULK_ADVISORY_URL = 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk'
         BATCH_SIZE = 100
         TIMEOUT = 30
-        VERSION_LINE = /^\s+"?version"?\s+"([^"]+)"/
+        VERSION_LINE = /^\s+"?version"?(?::\s*|\s+)["']?([^"'\s]+)["']?\s*$/
 
         def initialize(dir, pkgs)
           @dir = dir
@@ -105,14 +105,13 @@ module Package
           uri = URI(BULK_ADVISORY_URL)
           response = make_request(uri, versions_by_name.to_json)
           unless response.is_a?(Net::HTTPSuccess)
-            warn "Warning: Unable to fetch npm advisories (#{response.code} #{response.message})."
-            return {}
+            raise "Unable to fetch npm advisories (#{response.code} #{response.message})"
           end
 
-          JSON.parse(response.body)
-        rescue StandardError => e
-          warn "Warning: Error while fetching npm advisories: #{e.message}"
-          {}
+          advisories = JSON.parse(response.body)
+          raise 'Invalid npm advisory response' unless advisories.is_a?(Hash)
+
+          advisories
         end
 
         def make_request(uri, body)

data/lib/package/audit/ruby/gem_meta_data.rb

@@ -17,7 +17,7 @@ module Package
         def initialize(dir, pkgs)
           @dir = dir
           @pkgs = pkgs
-          @gem_hash = {}
+          @gem_hash = @pkgs.to_h { |pkg| [pkg.name, pkg] }
         end
 
         def fetch

data/lib/package/audit/ruby/vulnerability_finder.rb

@@ -11,7 +11,9 @@ module Package
         end
 
         def run
-          json_result = `#{format(Const::Cmd::BUNDLE_AUDIT_JSON, @dir)}`
+          json_result = IO.popen(
+            [*Const::Cmd::BUNDLE_AUDIT_JSON, @dir.to_s], err: File::NULL, &:read
+          )
           vulnerability_json_array = JSON.parse(json_result, symbolize_names: true)[:results]
           vulnerability_json_array.each do |vulnerability_json|
             update_meta_data(vulnerability_json)

data/lib/package/audit/services/config_cleaner.rb

@@ -62,7 +62,10 @@ module Package
         cleaned
       end
 
-      def clean_packages_for_technology(technology, packages)
+      def clean_packages_for_technology(technology, packages) # rubocop:disable Metrics/MethodLength
+        technologies = @options[Enum::Option::TECHNOLOGY]
+        return packages if technologies && !technologies.include?(technology)
+
         return {} unless packages.is_a?(Hash)
 
         current_packages = current_packages_for_technology(technology)

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.9.0'
+    VERSION = '0.9.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.9.1
 platform: ruby
 authors:
 - Vadim Kononov
@@ -117,7 +117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: CLI that reports outdated, deprecated and vulnerable dependencies in a project
 test_files: []