@blamejs/exceptd-skills 0.18.12 → 0.18.14

package/sources/validators/cve-validator.js

@@ -272,7 +272,13 @@ async function validateCve(cveId, localEntry) {
   const disputed = (fetched.cve_tags || []).some(t => /disputed/i.test(t)) ||
     /disputed/i.test(fetched.nvd_vuln_status || '');
   if (cveFoundInNvd && disputed) {
-    pushDiscrepancy(discrepancies, 'cve_status', local?.status ?? null, 'disputed', 'high');
+    // `local` is the projected shape (cvss_*, cisa_kev*, epss_*) and never
+    // carries a status field — reading local?.status here always yielded null,
+    // so the local side of a disputed discrepancy reported nothing. Read the
+    // catalog's own status/cve_status off the RAW input so an entry that
+    // already records the dispute (or a stale "active" status) is surfaced.
+    const localCveStatus = localEntry?.cve_status ?? localEntry?.status ?? null;
+    pushDiscrepancy(discrepancies, 'cve_status', localCveStatus, 'disputed', 'high');
   }
 
   // --- Compare CVSS (only if NVD reachable & has data) ---

package/sources/validators/rfc-validator.js

@@ -13,6 +13,10 @@
  *   drift        — at least one of those fields disagrees.
  *   missing      — Datatracker does not have this RFC / draft.
  *   unreachable  — network failed or the request timed out.
+ *   skipped      — the catalog key is not an IETF RFC/DRAFT (e.g. CSAF-2.0,
+ *                  ISO-29147, ISO-30111). Datatracker only tracks IETF
+ *                  documents, so these have no upstream to compare against —
+ *                  they are intentionally not validated here, NOT drift.
  *
  * Zero external dependencies. Node 24 stdlib (fetch + AbortController).
  *
@@ -107,15 +111,26 @@ function compareEntry(local, upstream) {
   return discrepancies;
 }
 
+// Datatracker only tracks IETF RFCs and Internet-Drafts. A catalog key that is
+// neither (CSAF-2.0, ISO-29147, ISO-30111, …) has no IETF upstream to compare
+// against, so it is out of scope for this validator rather than a discrepancy.
+function isIetfKey(id) {
+  return typeof id === 'string' && (id.startsWith('RFC-') || id.startsWith('DRAFT-'));
+}
+
 async function validateRfc(id, entry) {
   let docName;
   if (id.startsWith('RFC-')) docName = rfcNumberFromKey(id);
   else if (id.startsWith('DRAFT-')) docName = draftSlugFromKey(id);
   else {
+    // Not an IETF document — there is nothing on Datatracker to diff against.
+    // Report a distinct, non-drift status with no discrepancies so callers
+    // don't surface a permanent false-positive "drift" for every ISO/CSAF
+    // reference the catalog carries.
     return {
       id,
-      status: 'drift',
-      discrepancies: [`unrecognized catalog key shape: ${id}`],
+      status: 'skipped',
+      discrepancies: [],
       local: entry,
       fetched: null,
     };
@@ -150,7 +165,10 @@ async function validateRfc(id, entry) {
 }
 
 async function validateAllRfcs(refs, { concurrency = 4 } = {}) {
-  const ids = Object.keys(refs).filter(k => !k.startsWith('_'));
+  // Skip "_"-prefixed meta keys AND any non-IETF reference (ISO/CSAF/etc.):
+  // Datatracker has no record of those, so validating them only ever produced
+  // permanent false-positive "drift". They are simply out of scope here.
+  const ids = Object.keys(refs).filter(k => !k.startsWith('_') && isIetfKey(k));
   const results = [];
   for (let i = 0; i < ids.length; i += concurrency) {
     const batch = ids.slice(i, i + concurrency);

package/sources/validators/version-pin-validator.js

@@ -7,8 +7,17 @@
  *
  *   - MITRE ATLAS:     GitHub releases (mitre-atlas/atlas-data)
  *   - MITRE ATT&CK:    GitHub releases (mitre-attack/attack-stix-data)
- *   - MITRE D3FEND:    GitHub releases (mitre-d3fend/d3fend-data)
- *   - MITRE CWE:       GitHub releases (mitre/cwe)
+ *
+ * MITRE D3FEND and MITRE CWE do NOT publish tagged GitHub releases — D3FEND
+ * ships its ontology from d3fend/d3fend-ontology untagged, and CWE distributes
+ * XML from cwe.mitre.org. Their pin currency is tracked on the upstream-check
+ * path (lib/upstream-check.js) against those canonical mitre.org endpoints, not
+ * via the GitHub releases API. They remain enumerated here for completeness but
+ * are flagged `github_releases: false`, so the GitHub-release check is skipped
+ * for them and they are reported as `tracked_elsewhere` rather than emitting a
+ * spurious `unreachable` (a release API call for a repo with no releases always
+ * fails). This keeps the live path checking the same two GitHub-release repos
+ * the cache path (pinsDiffFromCache) checks.
  *
  * Each check returns:
  *   { pin_name, local_version, latest_version, drift: bool, source_url, error? }
@@ -29,24 +38,35 @@ const PINS = [
     repo: "mitre-atlas/atlas-data",
     local_path_hint: "manifest.json — atlas_version",
     strip_v_prefix: true,
+    github_releases: true,
   },
   {
     pin_name: "attack_version",
     repo: "mitre-attack/attack-stix-data",
     local_path_hint: "manifest.json — attack_version",
     strip_v_prefix: true,
+    github_releases: true,
   },
   {
+    // D3FEND does not tag GitHub releases — currency is tracked via
+    // lib/upstream-check.js against the canonical mitre.org endpoint. Listed
+    // here for completeness; the GitHub-release check is skipped.
     pin_name: "d3fend_version",
     repo: "d3fend/d3fend-data",
     local_path_hint: "data/d3fend-catalog.json _meta.version",
     strip_v_prefix: true,
+    github_releases: false,
+    tracked_via: "lib/upstream-check.js (d3fend.mitre.org)",
   },
   {
+    // CWE distributes XML from cwe.mitre.org with no tagged GitHub releases —
+    // currency is tracked via lib/upstream-check.js. GitHub-release check skipped.
     pin_name: "cwe_version",
     repo: "mitre/cwe",
     local_path_hint: "data/cwe-catalog.json _meta.version",
     strip_v_prefix: true,
+    github_releases: false,
+    tracked_via: "lib/upstream-check.js (cwe.mitre.org)",
   },
 ];
 
@@ -113,6 +133,23 @@ async function checkAllPins(ctx) {
   const out = [];
   for (const pin of PINS) {
     const local = normalize(resolveLocalVersion(pin.pin_name, ctx), pin.strip_v_prefix);
+    // Pins whose upstream does not publish GitHub releases (D3FEND, CWE) have
+    // no release tag to compare against — calling the releases API would always
+    // fail and surface a spurious `unreachable`. Report them as tracked
+    // elsewhere (drift:null, no error) so the live path checks exactly the same
+    // GitHub-release repos as the cache path.
+    if (pin.github_releases === false) {
+      out.push({
+        pin_name: pin.pin_name,
+        local_version: local,
+        latest_version: null,
+        drift: null,
+        tracked_elsewhere: true,
+        tracked_via: pin.tracked_via || null,
+        local_path_hint: pin.local_path_hint,
+      });
+      continue;
+    }
     const release = await latestGithubRelease(pin.repo);
     if (release.error) {
       out.push({

package/vendor/blamejs/_PROVENANCE.json

@@ -34,7 +34,7 @@
     },
     "worker-pool.js": {
       "vendored_path": "vendor/blamejs/worker-pool.js",
-      "vendored_sha256": "fa9814c2d18db221a2dc552cf2a5047467d87a2590cbc9d64b8a0a340e545b55",
+      "vendored_sha256": "948549d82e481f241e5babb6bdddd27bf7148fb8ed1c389b9f2f7ad035e4e56b",
       "upstream_path": "lib/worker-pool.js",
       "upstream_sha256_at_pin": "262f99e9cc3d4a8f4eba9ad3e28401e8a1f47f78040afa63c9b17eb998437171",
       "stripped": [
@@ -50,7 +50,8 @@
         "worker recycle on uncaught error / timeout / exit"
       ],
       "exceptd_deltas": [
-        "scriptPath validator rejects Windows UNC + extended-path prefixes (\\\\?\\, \\\\.\\, \\\\<server>\\) — defense-in-depth against worker-spawn from network shares on win32 platforms"
+        "scriptPath validator rejects Windows UNC + extended-path prefixes (\\\\?\\, \\\\.\\, \\\\<server>\\) — defense-in-depth against worker-spawn from network shares on win32 platforms",
+        "_onWorkerExit respawn branch: call _maybeResolveDrain() after _drainQueue() so drain() settles when a worker recycles with an empty queue (the no-respawn branch already did; the respawn branch could hang pending drain waiters)."
       ]
     },
     "codepoint-class.js": {

package/vendor/blamejs/worker-pool.js

@@ -322,6 +322,12 @@ function create(scriptPath, opts) {
     if (!terminated && workerSlots.length < size) {
       try { _spawnWorker(); } catch (_e) { /* already audited */ }
       _drainQueue();
+      // exceptd delta: also settle pending drain() waiters after a respawn.
+      // _drainQueue() only schedules queued tasks; if the queue is already
+      // empty (a worker recycled with nothing left to do) the pool is now idle
+      // and a caller awaiting drain() must be resolved, exactly as the
+      // no-respawn branch below does — otherwise drain() hangs forever.
+      _maybeResolveDrain();
     } else {
       _maybeResolveDrain();
     }