rubion 0.3.17 → 0.3.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d382653589bad6b28b68444b231efafa582f375cf1d4c7284d8df5faae04d50
-  data.tar.gz: 3edfba9269ed3024943544887422101b7512cd4309c5e689fbd6f8a7cf655a60
+  metadata.gz: c02b3b976c548af77be89141a6abb06ee9ee8431606512361fce0375bae02f91
+  data.tar.gz: 77032534958a027081fdf213339eb43456cb5891b009ffe6a9200b39f851d7bd
 SHA512:
-  metadata.gz: a5f3c72e3d1f257c426e0df25efb3b1ae62751527324bd5a8991986dd12aa6652cb0ca81aecd2941c3b00a19a5ceff090d1718ff5d540e59c0ddbc509707dd73
-  data.tar.gz: bc17b9ebd3c5081cb040deba4358eae42f4a941169fa7a5db919ea9ef92065dfa33fcb11dcc0a2925e58a62ebbb9ea4dad3364c69ff46133b7a2f79447885503
+  metadata.gz: a02452fc1e9bf2587eedee8146c3fa4d4427434ed2dd7cc9d78fbfb94646179ea466b9de047d02502d92f410f21a944e6e8da3b18cff44b23d775112992fe407
+  data.tar.gz: b04981ce97169f9b8727beea93beb88b9f78bf1d8dc5075317355645f67ba7d47f87c0107f4da6ad1d1ca7dcf5a4f8dbd164de3095d7996f1d2668dd1d2900e8

data/lib/rubion/scanner.rb

@@ -151,12 +151,16 @@ module Rubion
       if status.exitstatus.nil?
         # Command not found or failed to execute
         raise "#{@package_manager} audit command failed or is not available. Error: #{stderr}"
-      elsif !status.success? && status.exitstatus != 1 && status.exitstatus != 4
-        # Exit code 1 (npm) or 4 (yarn) is expected when vulnerabilities are found
-        # Other non-zero codes are errors
+      elsif @package_manager == 'npm' && !status.success? && status.exitstatus != 1
+        # For npm, exit code 1 means vulnerabilities were found; any other non-zero code is an error
         raise "#{@package_manager} audit failed with exit code #{status.exitstatus}. Output: #{stdout}#{unless stderr.empty?
                                                                                                           "\nError: #{stderr}"
                                                                                                         end}"
+      elsif @package_manager == 'yarn' && !status.success?
+        # For Yarn (classic), any non-zero exit code is a bitmask of severities:
+        # 1=info, 2=low, 4=moderate, 8=high, 16=critical. The exit code is the sum of severities found.
+        # Non-zero here indicates vulnerabilities were found; we'll still try to parse the JSON output below.
+        # Do not raise here so that vulnerabilities are handled gracefully.
       end
 
       begin
@@ -168,6 +172,30 @@ module Rubion
           parse_npm_audit_output(data)
         end
       rescue JSON::ParserError => e
+        # npm audit can emit human-readable errors plus a JSON error object when there is
+        # no lockfile (ENOLOCK) or similar issues. Because we redirect stderr to stdout
+        # (2>&1), the mixed output may not be valid JSON.
+        if @package_manager == 'npm'
+          json_start = stdout.index('{')
+          json_end = stdout.rindex('}')
+
+          if json_start && json_end && json_end > json_start
+            json_str = stdout[json_start..json_end]
+
+            begin
+              error_data = JSON.parse(json_str)
+
+              if error_data.is_a?(Hash) && error_data.dig('error', 'code') == 'ENOLOCK'
+                puts "\n  ℹ️  npm audit requires a package-lock.json. Skipping npm vulnerability check.\n"
+                @result.package_vulnerabilities = []
+                return
+              end
+            rescue JSON::ParserError
+              # Fall through to the generic error below
+            end
+          end
+        end
+
         raise "Failed to parse #{@package_manager} audit JSON output: #{e.message}. Raw output: #{stdout}"
       end
     end

data/lib/rubion/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Rubion
-  VERSION = "0.3.17"
+  VERSION = "0.3.19"
 end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rubion
 version: !ruby/object:Gem::Version
-  version: 0.3.17
+  version: 0.3.19
 platform: ruby
 authors:
 - bipashant
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-11-17 00:00:00.000000000 Z
+date: 2025-11-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: terminal-table