package-audit 0.8.0 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7305fff5b318e2831908713c3d49b984787b99baaca769115339518297dee6e4
-  data.tar.gz: 6db0ad1ecece32ddc3b93ea89fc9366b1fba59861e925d9e6955708173f3f32d
+  metadata.gz: d613e9a49c48ae22ef6e156b7f6a6ba1f2ebe8172e30589cc2eabbb5530bfdc1
+  data.tar.gz: aad9e813b4e6d2b73f15b19626fbc70631312d8965823a27d44cceef4c5115aa
 SHA512:
-  metadata.gz: 32b8c325d2f938ead2ab5ab8ab190ac94f4591667cbf0eaf884258b64e8ac06dc9a367ca7ecefab5a8688e1713378543ae5834ce6a8dbdab6874fdccded4b528
-  data.tar.gz: ca7e0687952bd9bcb7708b159e2551ad6cfa84bec8636eb05e954cb5763bb714d407ef190651ef764756f2a333c83e33b694a52e07dbff633019ba2f1d5a5563
+  metadata.gz: e6b3406928eb792637f7fbf5de5745a83ae1ce7181febc24d95882c6e38281002bcb953b3f727e18cf983606285f4df428aa36c203ed874a9d919c47c53dad9f
+  data.tar.gz: c6abc41931c2c26b91443474262353b35a0c64b0d2372258fec255f4f9569c127c3e48a172a219ec1fbd5a71fb7d4e3f15a6bbd6e2f717bb8b65ae0da74ec31f

data/lib/package/audit/npm/node_collection.rb

@@ -35,13 +35,15 @@ module Package
 
         def deprecated
           implicit_pkgs = fetch_from_lock_file
-          pkgs = NpmMetaData.new(implicit_pkgs).fetch.filter(&:deprecated?)
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir, implicit_pkgs).run
+          pkgs = NpmMetaData.new(vulnerable_pkgs + implicit_pkgs).fetch.filter(&:deprecated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 
         def outdated
           implicit_pkgs = fetch_from_lock_file
-          pkgs = NpmMetaData.new(implicit_pkgs).fetch.filter(&:outdated?)
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir, implicit_pkgs).run
+          pkgs = NpmMetaData.new(vulnerable_pkgs + implicit_pkgs).fetch.filter(&:outdated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 

data/lib/package/audit/ruby/gem_collection.rb

@@ -38,14 +38,16 @@ module Package
         def deprecated
           specs = BundlerSpecs.gemfile(@dir)
           pkgs = specs.map { |spec| Package.new(spec.name, spec.version, Enum::Technology::RUBY) }
-          pkgs = GemMetaData.new(@dir, pkgs).fetch.filter(&:deprecated?)
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir).run
+          pkgs = GemMetaData.new(@dir, pkgs + vulnerable_pkgs).fetch.filter(&:deprecated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 
         def outdated(include_implicit: false)
           specs = include_implicit ? BundlerSpecs.all(@dir) : BundlerSpecs.gemfile(@dir)
           pkgs = specs.map { |spec| Package.new(spec.name, spec.version, Enum::Technology::RUBY) }
-          pkgs = GemMetaData.new(@dir, pkgs).fetch.filter(&:outdated?)
+          vulnerable_pkgs = VulnerabilityFinder.new(@dir).run
+          pkgs = GemMetaData.new(@dir, pkgs + vulnerable_pkgs).fetch.filter(&:outdated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 

data/lib/package/audit/services/command_parser.rb

@@ -47,6 +47,7 @@ module Package
         thread_index = 0
 
         @spinner.start
+        @any_section_printed = false
         threads = @technologies.map.with_index do |technology, technology_index|
           Thread.new do
             all_pkgs, ignored_pkgs = PackageFinder.new(@config, @dir, @report, @groups).run(technology)
@@ -56,7 +57,14 @@ module Package
             cumulative_pkgs += active_pkgs
             mutex.synchronize { all_packages_for_config += all_pkgs || [] }
 
-            sleep 0.1 while technology_index != thread_index # print each technology in order
+            # Wait for our turn to print (synchronized read of thread_index)
+            loop do
+              ready = mutex.synchronize { technology_index == thread_index }
+              break if ready
+
+              sleep 0.05
+            end
+
             mutex.synchronize do
               @spinner.stop
               print_results(technology, active_pkgs, ignored_pkgs || [])
@@ -82,17 +90,39 @@ module Package
         @spinner.stop
       end
 
-      def print_results(technology, pkgs, ignored_pkgs)
+      def print_results(technology, pkgs, ignored_pkgs) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        format = @options[Enum::Option::FORMAT]
+        is_pretty = format.nil?
+        is_csv = format == Enum::Format::CSV
+        has_packages = pkgs.any?
+
+        # Pretty format: blank line before each section
+        # CSV/Markdown: blank line between sections (only if previous section had output)
+        puts if is_pretty || (@any_section_printed && has_packages)
+
         PackagePrinter.new(@options, pkgs).print(Const::Fields::DEFAULT)
-        print_summary(technology, pkgs, ignored_pkgs) unless @options[Enum::Option::FORMAT] == Enum::Format::CSV
-        print_disclaimer(technology) unless @options[Enum::Option::FORMAT] || pkgs.empty?
+
+        # Markdown: blank line between table and summary (when there's a table)
+        puts if !is_pretty && !is_csv && has_packages
+
+        print_summary(technology, pkgs, ignored_pkgs) unless is_csv
+
+        # Pretty format: blank line before disclaimer
+        puts if is_pretty && has_packages
+
+        print_disclaimer(technology) unless format || pkgs.empty?
+
+        # Track that this section produced output (for CSV/Markdown separator logic)
+        # Pretty and Markdown always print summary, CSV only prints if there are packages
+        @any_section_printed = true if has_packages || !is_csv
       end
 
       def print_summary(technology, pkgs, ignored_pkgs)
+        format = @options[Enum::Option::FORMAT]
         if @report == Enum::Report::ALL
-          Util::SummaryPrinter.statistics(@options[Enum::Option::FORMAT], technology, @report, pkgs, ignored_pkgs)
+          Util::SummaryPrinter.statistics(format, technology, @report, pkgs, ignored_pkgs)
         else
-          Util::SummaryPrinter.total(technology, @report, pkgs, ignored_pkgs)
+          Util::SummaryPrinter.total(format, technology, @report, pkgs, ignored_pkgs)
         end
       end
 

data/lib/package/audit/services/package_printer.rb

@@ -24,10 +24,8 @@ module Package
         case @options[Enum::Option::FORMAT]
         when Enum::Format::CSV
           csv(fields, exclude_headers: @options[Enum::Option::CSV_EXCLUDE_HEADERS])
-          puts
         when Enum::Format::MARKDOWN
           markdown(fields)
-          puts
         else
           pretty(fields)
         end
@@ -51,7 +49,6 @@ module Package
         separator_plain = max_widths.map { |width| '─' * width }.join('─' * COLUMN_GAP)
         separator = Util::BashColor.light_green(separator_plain)
 
-        puts ' '
         puts " #{separator}"
         puts " #{header}"
         puts " #{separator}"

data/lib/package/audit/util/summary_printer.rb

@@ -15,7 +15,6 @@ module Package
           puts " #{Util::BashColor.blue('Although the packages above have no recent updates, ' \
                                         'they may not be deprecated.')}"
           puts " #{Util::BashColor.blue('Please contact the package author for more information about its status.')}"
-          puts
         end
 
         def self.vulnerable(technology, cmd)
@@ -24,16 +23,22 @@ module Package
                  cmd: Util::BashColor.magenta(" > #{cmd}"))
         end
 
-        def self.total(technology, report, pkgs, ignored_pkgs)
+        def self.total(format, technology, report, pkgs, ignored_pkgs) # rubocop:disable Metrics/MethodLength
+          prefix = format.nil? ? ' ' : ''
           if ignored_pkgs.any?
-            puts " #{Util::BashColor.cyan("Found a total of #{pkgs.length} #{technology.capitalize} packages " \
-                                          "(#{ignored_pkgs.length} ignored).")}"
+            puts "#{prefix}#{Util::BashColor.cyan(
+              "Found a total of #{pkgs.length} #{technology.capitalize} packages " \
+              "(#{ignored_pkgs.length} ignored)."
+            )}"
           elsif pkgs.any?
-            puts " #{Util::BashColor.cyan("Found a total of #{pkgs.length} #{technology.capitalize} packages.")}"
+            puts "#{prefix}#{Util::BashColor.cyan(
+              "Found a total of #{pkgs.length} #{technology.capitalize} packages."
+            )}"
           else
-            puts " #{Util::BashColor.green("There are no #{report} #{technology.capitalize} packages!")}"
+            puts "#{prefix}#{Util::BashColor.green(
+              "There are no #{report} #{technology.capitalize} packages!"
+            )}"
           end
-          puts
         end
 
         def self.statistics(format, technology, report, pkgs, ignored_pkgs)
@@ -60,22 +65,23 @@ module Package
         end
 
         private_class_method def self.display_results(format, technology, report, pkgs, ignored_pkgs, stats) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/ParameterLists
+          prefix = format.nil? ? ' ' : ''
           if pkgs.any?
-            print " #{status_message(stats)}"
+            print "#{prefix}#{status_message(stats)}"
             print Util::BashColor.cyan(' \\') if format == Enum::Format::MARKDOWN
             puts
-            total(technology, report, pkgs, ignored_pkgs)
+            total(format, technology, report, pkgs, ignored_pkgs)
           elsif ignored_pkgs.any?
-            print " #{status_message(stats)}"
+            print "#{prefix}#{status_message(stats)}"
             print Util::BashColor.cyan(' \\') if format == Enum::Format::MARKDOWN
             puts
-            puts " #{Util::BashColor.green('There are no deprecated, outdated or vulnerable ' \
-                                           "#{technology.capitalize} packages (#{ignored_pkgs.length} ignored)!")}"
-            puts
+            puts "#{prefix}#{Util::BashColor.green(
+              'There are no deprecated, outdated or vulnerable ' \
+              "#{technology.capitalize} packages (#{ignored_pkgs.length} ignored)!"
+            )}"
           else
-            puts " #{Util::BashColor.green('There are no deprecated, outdated or vulnerable ' \
-                                           "#{technology.capitalize} packages!")}"
-            puts
+            puts "#{prefix}#{Util::BashColor.green('There are no deprecated, outdated or vulnerable ' \
+                                                   "#{technology.capitalize} packages!")}"
           end
         end
 

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.8.0'
+    VERSION = '0.8.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.8.1
 platform: ruby
 authors:
 - Vadim Kononov