@conterra/vuln-scan 0.0.10 → 0.0.11

package/README.md

@@ -38,12 +38,16 @@ or reference it in your `package.json` file:
 }
 ```
 
-After that you have two commands available:
+After that you have following commands available:
 
 - `ct-vuln-scan`
   - Triggers the vulnerability scan
 - `ct-vuln-add-vex`
   - Triggers a process to add a new vex statement to a file
+- `ct-vuln-add-project`
+  - Adds a new project to the configuration file based on an existing project entry and adds it to all vex statements
+- `ct-vuln-remove-project`
+  - Removes a project from the configuration file and all vex statements related to the project
 
 ### Vulnerability scan
 
@@ -308,3 +312,50 @@ Here some valid values for the `justification` field (if status is `not_affected
 | vulnerable_code_not_in_execute_path               | The vulnerable code can not be executed. Typically this case occurs when the product includes the vulnerable code but does not call or use the vulnerable code.                                                                                                                                         |
 | vulnerable_code_cannot_be_controlled_by_adversary | The vulnerable code cannot be controlled by an attacker to exploit the vulnerability.                                                                                                                                                                                                                   |
 | inline_mitigations_already_exist                  | The product includes built-in protections or features that prevent exploitation of the vulnerability. These built-in protections cannot be subverted by the attacker and cannot be configured or disabled by the user. These mitigations completely prevent exploitation based on known attack vectors. |
+
+## Usage - Add Project
+
+To add a new project to the configuration file and all vex statements, run:
+
+```sh
+$ ct-vuln-add-project <project-name> <project-version> <project-version-to-add>
+```
+
+for example:
+
+```sh
+$ ct-vuln-add-project mapapps 4.18.2-SNAPSHOT 4.18.2
+```
+
+This will add a new project entry `mapapps` with version `4.18.2` to the configuration file clone all options from the reference project `mapapps` with version `4.18.2-SNAPSHOT`. It will also add the product-id to all vex statements, where the reference project it listed, too.
+
+This is useful if you release a snapshot version.
+
+## Usage - Remove Project
+
+To remove a project from the configuration file and all vex statements, run:
+
+```sh
+$ ct-vuln-remove-project <project-name> <project-version>
+```
+
+for example:
+
+```sh
+$ ct-vuln-remove-project mapapps 4.18.2-SNAPSHOT
+```
+
+This will remove the project entry `mapapps` with version `4.18.2-SNAPSHOT` from the configuration file and remove the product-id from all vex statements, where the project is listed.
+
+## Usage - Simulate a version release with preparation of the next dev version
+
+By combining the `ct-vuln-add-project` and `ct-vuln-remove-project` commands, you can simulate a version release.
+
+For example, you have a project `mapapps` with version `4.18.3-SNAPSHOT` and you want to release version `4.18.3`
+and prepare the next dev version `4.18.4-SNAPSHOT`, then you can run following commands:
+
+```sh
+$ ct-vuln-add-project mapapps 4.18.3-SNAPSHOT 4.18.3
+$ ct-vuln-remove-project mapapps 4.18.3-SNAPSHOT
+$ ct-vuln-add-project mapapps 4.18.3 4.18.4-SNAPSHOT
+```

package/dist/add-project.js

@@ -1,2 +1,3 @@
 #!/usr/bin/env node
-"use strict";var b=Object.create;var F=Object.defineProperty;var j=Object.getOwnPropertyDescriptor;var E=Object.getOwnPropertyNames;var D=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var V=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of E(e))!T.call(t,n)&&n!==r&&F(t,n,{get:()=>e[n],enumerable:!(i=j(e,n))||i.enumerable});return t};var N=(t,e,r)=>(r=t!=null?b(D(t)):{},V(e||!t||!t.__esModule?F(r,"default",{value:t,enumerable:!0}):r,t));var w=N(require("path"));var c=require("fs/promises");async function d(t){if(await C(t))return JSON.parse(await(0,c.readFile)(t,{encoding:"utf-8"}))}async function p(t,e){await(0,c.writeFile)(t,JSON.stringify(e,null,4),{encoding:"utf-8"})}async function C(t){try{return await(0,c.access)(t,c.constants.F_OK),!0}catch{return!1}}async function x(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=f(t.workingDir,"input/vex"),i=f(t.workingDir,"output"),n=f(t.workingDir,"cache"),u=["grype","trivy","ossindex"],o=f(t.workingDir,"vuln-scan-conf.json"),s=await d(o);if(!s)throw new Error(`Missing project configuration file '${o}'`);return{projectConfigFileLocation:o,failOnNewVulnerabilities:!1,createSubDirsForProject:s.createSubDirsForProject??!0,mavenRepo:s.mavenRepo??e,vexUrls:s.vexUrls??[],vexDir:f(t.workingDir,s.vexDir)??r,outDir:f(t.workingDir,s.outDir)??i,cacheDir:f(t.workingDir,s.cacheDir)??n,scanners:s.scanners??u,projects:(s.projects??[]).map(m=>{let a=m;if(!a.name)throw new Error("Project name is missing on entry:"+JSON.stringify(a));if(!a.version)throw new Error("Project version is missing on entry:"+JSON.stringify(a));if(!a.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(a));return a.enabled==null&&(a.enabled=!0),a.silent==null&&(a.silent=!1),a.minimumSeverity||(a.minimumSeverity="UNKNOWN"),a.sbomFile?{...a,sbomFile:f(t.workingDir,a.sbomFile)}:m})}}function f(t,e){if(e)return w.default.isAbsolute(e)?e:(0,w.resolve)(t,e)}var g=require("fs/promises"),h=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await d(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await p(this.location,e)}async delete(){await(0,g.unlink)(this.location)}};async function P(t,e){for(let r of await(0,g.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new v((0,h.resolve)(r.parentPath,r.name))):r.isDirectory()&&await P((0,h.resolve)(r.parentPath,r.name),e)}var l=process.argv[2];if(!l)throw new Error("Missing project name.");var y=process.argv[3];if(!y)throw new Error("Missing reference project version.");var S=process.argv[4];if(!S)throw new Error("Missing target project version.");(async()=>{let t=await x({workingDir:process.cwd()});if(!t.projectConfigFileLocation)throw new Error("Missing project configuration file.");let e=t.projects.find(i=>i.name===l&&i.version===y);if(!e)throw new Error(`Project ${l} with version ${y} not found.`);let r=t.projects.find(i=>i.name===l&&i.version===S);r||(r=await O(t.projectConfigFileLocation,e,S)),await $(t.vexDir,e.purl,r.purl)})();async function O(t,e,r){let i=await d(t),n=i.projects.find(s=>s.name===e.name&&s.version===e.version),u=i.projects.indexOf(n),o={...n};return o.version=r,o.purl=n.purl.replace(n.version,r),o.sbomMavenCoordinates&&(o.sbomMavenCoordinates=n.sbomMavenCoordinates.replace(n.version,r)),i.projects.splice(u+1,0,o),console.info(`Add project ${l} with version ${r} to ${t}`),await p(t,i),o}async function $(t,e,r){await P(t,async i=>{await k(i,e,r)})}async function k(t,e,r){let i=await t.read(),n=!1,u=i.statements;for(let o of u){if(!o.products||o.products.some(m=>m["@id"]===r))continue;let s=o.products.findIndex(m=>m["@id"]===e);s!==-1&&(o.products?.splice(s+1,0,{"@id":r}),n=!0)}n&&(console.info(`Add ${r} to ${t.location}`),t.write(i))}
+"use strict";var b=Object.create;var F=Object.defineProperty;var j=Object.getOwnPropertyDescriptor;var E=Object.getOwnPropertyNames;var D=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var V=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of E(e))!T.call(t,n)&&n!==r&&F(t,n,{get:()=>e[n],enumerable:!(i=j(e,n))||i.enumerable});return t};var N=(t,e,r)=>(r=t!=null?b(D(t)):{},V(e||!t||!t.__esModule?F(r,"default",{value:t,enumerable:!0}):r,t));var w=N(require("path"));var c=require("fs/promises");async function d(t){if(await C(t))return JSON.parse(await(0,c.readFile)(t,{encoding:"utf-8"}))}async function p(t,e){await(0,c.writeFile)(t,JSON.stringify(e,null,4)+`
+`,{encoding:"utf-8"})}async function C(t){try{return await(0,c.access)(t,c.constants.F_OK),!0}catch{return!1}}async function x(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=f(t.workingDir,"input/vex"),i=f(t.workingDir,"output"),n=f(t.workingDir,"cache"),u=["grype","trivy","ossindex"],o=f(t.workingDir,"vuln-scan-conf.json"),s=await d(o);if(!s)throw new Error(`Missing project configuration file '${o}'`);return{projectConfigFileLocation:o,failOnNewVulnerabilities:!1,createSubDirsForProject:s.createSubDirsForProject??!0,mavenRepo:s.mavenRepo??e,vexUrls:s.vexUrls??[],vexDir:f(t.workingDir,s.vexDir)??r,outDir:f(t.workingDir,s.outDir)??i,cacheDir:f(t.workingDir,s.cacheDir)??n,scanners:s.scanners??u,projects:(s.projects??[]).map(m=>{let a=m;if(!a.name)throw new Error("Project name is missing on entry:"+JSON.stringify(a));if(!a.version)throw new Error("Project version is missing on entry:"+JSON.stringify(a));if(!a.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(a));return a.enabled==null&&(a.enabled=!0),a.silent==null&&(a.silent=!1),a.minimumSeverity||(a.minimumSeverity="UNKNOWN"),a.sbomFile?{...a,sbomFile:f(t.workingDir,a.sbomFile)}:m})}}function f(t,e){if(e)return w.default.isAbsolute(e)?e:(0,w.resolve)(t,e)}var g=require("fs/promises"),h=require("path");var v=class{constructor(e){this.location=e}async read(){let e=await d(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await p(this.location,e)}async delete(){await(0,g.unlink)(this.location)}};async function P(t,e){for(let r of await(0,g.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new v((0,h.resolve)(r.parentPath,r.name))):r.isDirectory()&&await P((0,h.resolve)(r.parentPath,r.name),e)}var l=process.argv[2];if(!l)throw new Error("Missing project name.");var y=process.argv[3];if(!y)throw new Error("Missing reference project version.");var S=process.argv[4];if(!S)throw new Error("Missing target project version.");(async()=>{let t=await x({workingDir:process.cwd()});if(!t.projectConfigFileLocation)throw new Error("Missing project configuration file.");let e=t.projects.find(i=>i.name===l&&i.version===y);if(!e)throw new Error(`Project ${l} with version ${y} not found.`);let r=t.projects.find(i=>i.name===l&&i.version===S);r||(r=await O(t.projectConfigFileLocation,e,S)),await $(t.vexDir,e.purl,r.purl)})();async function O(t,e,r){let i=await d(t),n=i.projects.find(s=>s.name===e.name&&s.version===e.version),u=i.projects.indexOf(n),o={...n};return o.version=r,o.purl=n.purl.replace(n.version,r),o.sbomMavenCoordinates&&(o.sbomMavenCoordinates=n.sbomMavenCoordinates.replace(n.version,r)),i.projects.splice(u+1,0,o),console.info(`Add project ${l} with version ${r} to ${t}`),await p(t,i),o}async function $(t,e,r){await P(t,async i=>{await k(i,e,r)})}async function k(t,e,r){let i=await t.read(),n=!1,u=i.statements;for(let o of u){if(!o.products||o.products.some(m=>m["@id"]===r))continue;let s=o.products.findIndex(m=>m["@id"]===e);s!==-1&&(o.products?.splice(s+1,0,{"@id":r}),n=!0)}n&&(console.info(`Add ${r} to ${t.location}`),t.write(i))}

package/dist/remove-project.js

@@ -1,2 +1,3 @@
 #!/usr/bin/env node
-"use strict";var x=Object.create;var S=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var D=Object.getOwnPropertyNames;var E=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var j=(t,e,r,a)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of D(e))!T.call(t,o)&&o!==r&&S(t,o,{get:()=>e[o],enumerable:!(a=b(e,o))||a.enumerable});return t};var N=(t,e,r)=>(r=t!=null?x(E(t)):{},j(e||!t||!t.__esModule?S(r,"default",{value:t,enumerable:!0}):r,t));var p=N(require("path"));var s=require("fs/promises");async function d(t){if(await V(t))return JSON.parse(await(0,s.readFile)(t,{encoding:"utf-8"}))}async function l(t,e){await(0,s.writeFile)(t,JSON.stringify(e,null,4),{encoding:"utf-8"})}async function V(t){try{return await(0,s.access)(t,s.constants.F_OK),!0}catch{return!1}}async function F(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=c(t.workingDir,"input/vex"),a=c(t.workingDir,"output"),o=c(t.workingDir,"cache"),f=["grype","trivy","ossindex"],u=c(t.workingDir,"vuln-scan-conf.json"),i=await d(u);if(!i)throw new Error(`Missing project configuration file '${u}'`);return{projectConfigFileLocation:u,failOnNewVulnerabilities:!1,createSubDirsForProject:i.createSubDirsForProject??!0,mavenRepo:i.mavenRepo??e,vexUrls:i.vexUrls??[],vexDir:c(t.workingDir,i.vexDir)??r,outDir:c(t.workingDir,i.outDir)??a,cacheDir:c(t.workingDir,i.cacheDir)??o,scanners:i.scanners??f,projects:(i.projects??[]).map(m=>{let n=m;if(!n.name)throw new Error("Project name is missing on entry:"+JSON.stringify(n));if(!n.version)throw new Error("Project version is missing on entry:"+JSON.stringify(n));if(!n.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(n));return n.enabled==null&&(n.enabled=!0),n.silent==null&&(n.silent=!1),n.minimumSeverity||(n.minimumSeverity="UNKNOWN"),n.sbomFile?{...n,sbomFile:c(t.workingDir,n.sbomFile)}:m})}}function c(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var h=class{constructor(e){this.location=e}async read(){let e=await d(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await l(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function v(t,e){for(let r of await(0,w.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new h((0,g.resolve)(r.parentPath,r.name))):r.isDirectory()&&await v((0,g.resolve)(r.parentPath,r.name),e)}var P=process.argv[2];if(!P)throw new Error("Missing project name.");var y=process.argv[3];if(!y)throw new Error("Missing project version.");(async()=>{let t=await F({workingDir:process.cwd()});if(!t.projectConfigFileLocation)throw new Error("Missing project configuration file.");let e=t.projects.find(r=>r.name===P&&r.version===y);if(!e){console.info(`Project ${P} with version ${y} not found.`);return}await O(t.projectConfigFileLocation,e),await $(t.vexDir,e.purl)})();async function O(t,e){let r=await d(t),a=r.projects.findIndex(o=>o.name===e.name&&o.version===e.version);r.projects.splice(a,1),console.info(`Remove project ${e.name} with version ${e.version} from ${t}`),await l(t,r)}async function $(t,e){await v(t,async r=>{let a=await r.read(),o=!1,f=a.statements,u=[];for(let i of f){if(!i.products)continue;let m=i.products.findIndex(n=>n["@id"]===e);m!==-1&&(i.products.splice(m,1),o=!0,i.products.length===0&&u.push(i))}if(o){for(let i of u){let m=f.indexOf(i);f.splice(m,1)}if(f.length===0){console.info(`Remove ${e} from ${r.location} and delete file.`),await r.delete();return}console.info(`Remove ${e} from ${r.location}`),await r.write(a)}})}
+"use strict";var x=Object.create;var S=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var D=Object.getOwnPropertyNames;var E=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var j=(t,e,r,a)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of D(e))!T.call(t,o)&&o!==r&&S(t,o,{get:()=>e[o],enumerable:!(a=b(e,o))||a.enumerable});return t};var N=(t,e,r)=>(r=t!=null?x(E(t)):{},j(e||!t||!t.__esModule?S(r,"default",{value:t,enumerable:!0}):r,t));var p=N(require("path"));var s=require("fs/promises");async function d(t){if(await V(t))return JSON.parse(await(0,s.readFile)(t,{encoding:"utf-8"}))}async function l(t,e){await(0,s.writeFile)(t,JSON.stringify(e,null,4)+`
+`,{encoding:"utf-8"})}async function V(t){try{return await(0,s.access)(t,s.constants.F_OK),!0}catch{return!1}}async function F(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=c(t.workingDir,"input/vex"),a=c(t.workingDir,"output"),o=c(t.workingDir,"cache"),f=["grype","trivy","ossindex"],u=c(t.workingDir,"vuln-scan-conf.json"),i=await d(u);if(!i)throw new Error(`Missing project configuration file '${u}'`);return{projectConfigFileLocation:u,failOnNewVulnerabilities:!1,createSubDirsForProject:i.createSubDirsForProject??!0,mavenRepo:i.mavenRepo??e,vexUrls:i.vexUrls??[],vexDir:c(t.workingDir,i.vexDir)??r,outDir:c(t.workingDir,i.outDir)??a,cacheDir:c(t.workingDir,i.cacheDir)??o,scanners:i.scanners??f,projects:(i.projects??[]).map(m=>{let n=m;if(!n.name)throw new Error("Project name is missing on entry:"+JSON.stringify(n));if(!n.version)throw new Error("Project version is missing on entry:"+JSON.stringify(n));if(!n.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(n));return n.enabled==null&&(n.enabled=!0),n.silent==null&&(n.silent=!1),n.minimumSeverity||(n.minimumSeverity="UNKNOWN"),n.sbomFile?{...n,sbomFile:c(t.workingDir,n.sbomFile)}:m})}}function c(t,e){if(e)return p.default.isAbsolute(e)?e:(0,p.resolve)(t,e)}var w=require("fs/promises"),g=require("path");var h=class{constructor(e){this.location=e}async read(){let e=await d(this.location);if(!e)throw new Error("Invalid VEX file");return e}async write(e){await l(this.location,e)}async delete(){await(0,w.unlink)(this.location)}};async function v(t,e){for(let r of await(0,w.readdir)(t,{withFileTypes:!0}))r.name.endsWith(".json")?await e(new h((0,g.resolve)(r.parentPath,r.name))):r.isDirectory()&&await v((0,g.resolve)(r.parentPath,r.name),e)}var P=process.argv[2];if(!P)throw new Error("Missing project name.");var y=process.argv[3];if(!y)throw new Error("Missing project version.");(async()=>{let t=await F({workingDir:process.cwd()});if(!t.projectConfigFileLocation)throw new Error("Missing project configuration file.");let e=t.projects.find(r=>r.name===P&&r.version===y);if(!e){console.info(`Project ${P} with version ${y} not found.`);return}await O(t.projectConfigFileLocation,e),await $(t.vexDir,e.purl)})();async function O(t,e){let r=await d(t),a=r.projects.findIndex(o=>o.name===e.name&&o.version===e.version);r.projects.splice(a,1),console.info(`Remove project ${e.name} with version ${e.version} from ${t}`),await l(t,r)}async function $(t,e){await v(t,async r=>{let a=await r.read(),o=!1,f=a.statements,u=[];for(let i of f){if(!i.products)continue;let m=i.products.findIndex(n=>n["@id"]===e);m!==-1&&(i.products.splice(m,1),o=!0,i.products.length===0&&u.push(i))}if(o){for(let i of u){let m=f.indexOf(i);f.splice(m,1)}if(f.length===0){console.info(`Remove ${e} from ${r.location} and delete file.`),await r.delete();return}console.info(`Remove ${e} from ${r.location}`),await r.write(a)}})}

package/dist/vuln-scan.js

@@ -5,7 +5,8 @@ GFS4: `),console.error(t)});k[M]||(At=global[M]||[],Rt(k,At),k.close=function(t)
 	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:i,destStat:n}=await Se.checkPaths(t,e,"copy",r);if(await Se.checkParentPaths(t,i,e,"copy"),!await er(t,e,r))return;let s=he.dirname(e);await bn(s)||await xn(s),await tr(n,t,e,r)}async function er(t,e,r){return r.filter?r.filter(t,e):!0}async function tr(t,e,r,i){let o=await(i.dereference?C.stat:C.lstat)(e);if(o.isDirectory())return Fn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return kn(o,t,e,r,i);if(o.isSymbolicLink())return jn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function kn(t,e,r,i,n){if(!e)return Zt(t,r,i,n);if(n.overwrite)return await C.unlink(i),Zt(t,r,i,n);if(n.errorOnExist)throw new Error(`'${i}' already exists`)}async function Zt(t,e,r,i){if(await C.copyFile(e,r),i.preserveTimestamps){En(t.mode)&&await On(r,t.mode);let n=await C.stat(e);await Ln(r,n.atime,n.mtime)}return C.chmod(r,t.mode)}function En(t){return(t&128)===0}function On(t,e){return C.chmod(t,e|128)}async function Fn(t,e,r,i,n){e||await C.mkdir(i);let o=await C.readdir(r);await Promise.all(o.map(async s=>{let c=he.join(r,s),u=he.join(i,s);if(!await er(c,u,n))return;let{destStat:a}=await Se.checkPaths(c,u,"copy",n);return tr(a,c,u,n)})),e||await C.chmod(i,t.mode)}async function jn(t,e,r,i){let n=await C.readlink(e);if(i.dereference&&(n=he.resolve(process.cwd(),n)),!t)return C.symlink(n,r);let o=null;try{o=await C.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return C.symlink(n,r);throw s}if(i.dereference&&(o=he.resolve(process.cwd(),o)),Se.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(Se.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return await C.unlink(r),C.symlink(n,r)}rr.exports=Pn});var cr=h((sa,ar)=>{"use strict";var V=ce(),ge=require("path"),Dn=X().mkdirsSync,Tn=ct().utimesMillisSync,ve=ne();function In(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
 
 	see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:i,destStat:n}=ve.checkPathsSync(t,e,"copy",r);if(ve.checkParentPathsSync(t,i,e,"copy"),r.filter&&!r.filter(t,e))return;let o=ge.dirname(e);return V.existsSync(o)||Dn(o),nr(n,t,e,r)}function nr(t,e,r,i){let o=(i.dereference?V.statSync:V.lstatSync)(e);if(o.isDirectory())return qn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Mn(o,t,e,r,i);if(o.isSymbolicLink())return Xn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function Mn(t,e,r,i,n){return e?Cn(t,r,i,n):or(t,r,i,n)}function Cn(t,e,r,i){if(i.overwrite)return V.unlinkSync(r),or(t,e,r,i);if(i.errorOnExist)throw new Error(`'${r}' already exists`)}function or(t,e,r,i){return V.copyFileSync(e,r),i.preserveTimestamps&&An(t.mode,e,r),ut(r,t.mode)}function An(t,e,r){return Nn(t)&&Rn(r,t),Vn(e,r)}function Nn(t){return(t&128)===0}function Rn(t,e){return ut(t,e|128)}function ut(t,e){return V.chmodSync(t,e)}function Vn(t,e){let r=V.statSync(t);return Tn(e,r.atime,r.mtime)}function qn(t,e,r,i,n){return e?sr(r,i,n):_n(t.mode,r,i,n)}function _n(t,e,r,i){return V.mkdirSync(r),sr(e,r,i),ut(r,t)}function sr(t,e,r){V.readdirSync(t).forEach(i=>$n(i,t,e,r))}function $n(t,e,r,i){let n=ge.join(e,t),o=ge.join(r,t);if(i.filter&&!i.filter(n,o))return;let{destStat:s}=ve.checkPathsSync(n,o,"copy",i);return nr(s,n,o,i)}function Xn(t,e,r,i){let n=V.readlinkSync(e);if(i.dereference&&(n=ge.resolve(process.cwd(),n)),t){let o;try{o=V.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return V.symlinkSync(n,r);throw s}if(i.dereference&&(o=ge.resolve(process.cwd(),o)),ve.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(ve.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return Un(n,r)}else return V.symlinkSync(n,r)}function Un(t,e){return V.unlinkSync(e),V.symlinkSync(t,e)}ar.exports=In});var De=h((aa,lr)=>{"use strict";var Bn=F().fromPromise;lr.exports={copy:Bn(ir()),copySync:cr()}});var we=h((ca,fr)=>{"use strict";var ur=ce(),Gn=F().fromCallback;function Wn(t,e){ur.rm(t,{recursive:!0,force:!0},e)}function Jn(t){ur.rmSync(t,{recursive:!0,force:!0})}fr.exports={remove:Gn(Wn),removeSync:Jn}});var vr=h((la,gr)=>{"use strict";var Hn=F().fromPromise,dr=R(),yr=require("path"),hr=X(),Sr=we(),mr=Hn(async function(e){let r;try{r=await dr.readdir(e)}catch{return hr.mkdirs(e)}return Promise.all(r.map(i=>Sr.remove(yr.join(e,i))))});function pr(t){let e;try{e=dr.readdirSync(t)}catch{return hr.mkdirsSync(t)}e.forEach(r=>{r=yr.join(t,r),Sr.removeSync(r)})}gr.exports={emptyDirSync:pr,emptydirSync:pr,emptyDir:mr,emptydir:mr}});var Lr=h((ua,br)=>{"use strict";var Qn=F().fromPromise,wr=require("path"),Q=R(),xr=X();async function Yn(t){let e;try{e=await Q.stat(t)}catch{}if(e&&e.isFile())return;let r=wr.dirname(t),i=null;try{i=await Q.stat(r)}catch(n){if(n.code==="ENOENT"){await xr.mkdirs(r),await Q.writeFile(t,"");return}else throw n}i.isDirectory()?await Q.writeFile(t,""):await Q.readdir(r)}function Kn(t){let e;try{e=Q.statSync(t)}catch{}if(e&&e.isFile())return;let r=wr.dirname(t);try{Q.statSync(r).isDirectory()||Q.readdirSync(r)}catch(i){if(i&&i.code==="ENOENT")xr.mkdirsSync(r);else throw i}Q.writeFileSync(t,"")}br.exports={createFile:Qn(Yn),createFileSync:Kn}});var Fr=h((fa,Or)=>{"use strict";var zn=F().fromPromise,Pr=require("path"),Z=R(),kr=X(),{pathExists:Zn}=z(),{areIdentical:Er}=ne();async function eo(t,e){let r;try{r=await Z.lstat(e)}catch{}let i;try{i=await Z.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&Er(i,r))return;let n=Pr.dirname(e);await Zn(n)||await kr.mkdirs(n),await Z.link(t,e)}function to(t,e){let r;try{r=Z.lstatSync(e)}catch{}try{let o=Z.lstatSync(t);if(r&&Er(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let i=Pr.dirname(e);return Z.existsSync(i)||kr.mkdirsSync(i),Z.linkSync(t,e)}Or.exports={createLink:zn(eo),createLinkSync:to}});var Dr=h((ma,jr)=>{"use strict";var ee=require("path"),xe=R(),{pathExists:ro}=z(),io=F().fromPromise;async function no(t,e){if(ee.isAbsolute(t)){try{await xe.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=ee.dirname(e),i=ee.join(r,t);if(await ro(i))return{toCwd:i,toDst:t};try{await xe.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:ee.relative(r,t)}}function oo(t,e){if(ee.isAbsolute(t)){if(!xe.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=ee.dirname(e),i=ee.join(r,t);if(xe.existsSync(i))return{toCwd:i,toDst:t};if(!xe.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:ee.relative(r,t)}}jr.exports={symlinkPaths:io(no),symlinkPathsSync:oo}});var Mr=h((pa,Ir)=>{"use strict";var Tr=R(),so=F().fromPromise;async function ao(t,e){if(e)return e;let r;try{r=await Tr.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function co(t,e){if(e)return e;let r;try{r=Tr.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Ir.exports={symlinkType:so(ao),symlinkTypeSync:co}});var Rr=h((da,Nr)=>{"use strict";var lo=F().fromPromise,Cr=require("path"),B=R(),{mkdirs:uo,mkdirsSync:fo}=X(),{symlinkPaths:mo,symlinkPathsSync:po}=Dr(),{symlinkType:yo,symlinkTypeSync:ho}=Mr(),{pathExists:So}=z(),{areIdentical:Ar}=ne();async function go(t,e,r){let i;try{i=await B.lstat(e)}catch{}if(i&&i.isSymbolicLink()){let[c,u]=await Promise.all([B.stat(t),B.stat(e)]);if(Ar(c,u))return}let n=await mo(t,e);t=n.toDst;let o=await yo(n.toCwd,r),s=Cr.dirname(e);return await So(s)||await uo(s),B.symlink(t,e,o)}function vo(t,e,r){let i;try{i=B.lstatSync(e)}catch{}if(i&&i.isSymbolicLink()){let c=B.statSync(t),u=B.statSync(e);if(Ar(c,u))return}let n=po(t,e);t=n.toDst,r=ho(n.toCwd,r);let o=Cr.dirname(e);return B.existsSync(o)||fo(o),B.symlinkSync(t,e,r)}Nr.exports={createSymlink:lo(go),createSymlinkSync:vo}});var Gr=h((ya,Br)=>{"use strict";var{createFile:Vr,createFileSync:qr}=Lr(),{createLink:_r,createLinkSync:$r}=Fr(),{createSymlink:Xr,createSymlinkSync:Ur}=Rr();Br.exports={createFile:Vr,createFileSync:qr,ensureFile:Vr,ensureFileSync:qr,createLink:_r,createLinkSync:$r,ensureLink:_r,ensureLinkSync:$r,createSymlink:Xr,createSymlinkSync:Ur,ensureSymlink:Xr,ensureSymlinkSync:Ur}});var Te=h((ha,Wr)=>{function wo(t,{EOL:e=`
-`,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function xo(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Wr.exports={stringify:wo,stripBom:xo}});var Yr=h((Sa,Qr)=>{var fe;try{fe=ce()}catch{fe=require("fs")}var Ie=F(),{stringify:Jr,stripBom:Hr}=Te();async function bo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||fe,i="throws"in e?e.throws:!0,n=await Ie.fromCallback(r.readFile)(t,e);n=Hr(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Lo=Ie.fromPromise(bo);function Po(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||fe,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=Hr(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function ko(t,e,r={}){let i=r.fs||fe,n=Jr(e,r);await Ie.fromCallback(i.writeFile)(t,n,r)}var Eo=Ie.fromPromise(ko);function Oo(t,e,r={}){let i=r.fs||fe,n=Jr(e,r);return i.writeFileSync(t,n,r)}var Fo={readFile:Lo,readFileSync:Po,writeFile:Eo,writeFileSync:Oo};Qr.exports=Fo});var zr=h((ga,Kr)=>{"use strict";var Me=Yr();Kr.exports={readJson:Me.readFile,readJsonSync:Me.readFileSync,writeJson:Me.writeFile,writeJsonSync:Me.writeFileSync}});var Ce=h((va,ti)=>{"use strict";var jo=F().fromPromise,ft=R(),Zr=require("path"),ei=X(),Do=z().pathExists;async function To(t,e,r="utf-8"){let i=Zr.dirname(t);return await Do(i)||await ei.mkdirs(i),ft.writeFile(t,e,r)}function Io(t,...e){let r=Zr.dirname(t);ft.existsSync(r)||ei.mkdirsSync(r),ft.writeFileSync(t,...e)}ti.exports={outputFile:jo(To),outputFileSync:Io}});var ii=h((wa,ri)=>{"use strict";var{stringify:Mo}=Te(),{outputFile:Co}=Ce();async function Ao(t,e,r={}){let i=Mo(e,r);await Co(t,i,r)}ri.exports=Ao});var oi=h((xa,ni)=>{"use strict";var{stringify:No}=Te(),{outputFileSync:Ro}=Ce();function Vo(t,e,r){let i=No(e,r);Ro(t,i,r)}ni.exports=Vo});var ai=h((ba,si)=>{"use strict";var qo=F().fromPromise,q=zr();q.outputJson=qo(ii());q.outputJsonSync=oi();q.outputJSON=q.outputJson;q.outputJSONSync=q.outputJsonSync;q.writeJSON=q.writeJson;q.writeJSONSync=q.writeJsonSync;q.readJSON=q.readJson;q.readJSONSync=q.readJsonSync;si.exports=q});var mi=h((La,fi)=>{"use strict";var _o=R(),ci=require("path"),{copy:$o}=De(),{remove:ui}=we(),{mkdirp:Xo}=X(),{pathExists:Uo}=z(),li=ne();async function Bo(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await li.checkPaths(t,e,"move",r);await li.checkParentPaths(t,n,e,"move");let s=ci.dirname(e);return ci.parse(s).root!==s&&await Xo(s),Go(t,e,i,o)}async function Go(t,e,r,i){if(!i){if(r)await ui(e);else if(await Uo(e))throw new Error("dest already exists.")}try{await _o.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await Wo(t,e,r)}}async function Wo(t,e,r){return await $o(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),ui(t)}fi.exports=Bo});var Si=h((Pa,hi)=>{"use strict";var di=ce(),pt=require("path"),Jo=De().copySync,yi=we().removeSync,Ho=X().mkdirpSync,pi=ne();function Qo(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=pi.checkPathsSync(t,e,"move",r);return pi.checkParentPathsSync(t,n,e,"move"),Yo(e)||Ho(pt.dirname(e)),Ko(t,e,i,o)}function Yo(t){let e=pt.dirname(t);return pt.parse(e).root===e}function Ko(t,e,r,i){if(i)return mt(t,e,r);if(r)return yi(e),mt(t,e,r);if(di.existsSync(e))throw new Error("dest already exists.");return mt(t,e,r)}function mt(t,e,r){try{di.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return zo(t,e,r)}}function zo(t,e,r){return Jo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),yi(t)}hi.exports=Qo});var vi=h((ka,gi)=>{"use strict";var Zo=F().fromPromise;gi.exports={move:Zo(mi()),moveSync:Si()}});var xi=h((Ea,wi)=>{"use strict";wi.exports={...R(),...De(),...vr(),...Gr(),...ai(),...X(),...vi(),...Ce(),...z(),...we()}});var bi=h(Ae=>{"use strict";Object.defineProperty(Ae,"__esModule",{value:!0});Ae.EXTENSIONS_LANGUAGES=void 0;Ae.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var be=h(dt=>{"use strict";Object.defineProperty(dt,"__esModule",{value:!0});dt.setOptionValues=es;function es(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var Pi=h(Ne=>{"use strict";Object.defineProperty(Ne,"__esModule",{value:!0});Ne.SarifBuilder=void 0;var ts=require("path"),Li=xi(),rs=bi(),is=be(),yt=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,is.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();Li.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await Li.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let l of u.locations||[])if(!((i=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0)&&i.uri&&e.artifacts.filter(a=>{var p;return((p=a?.location)===null||p===void 0?void 0:p.uri)===l.physicalLocation.artifactLocation.uri}).length===0){let a=ts.extname(l.physicalLocation.artifactLocation.uri).replace(".",""),p=rs.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:p,location:{uri:l.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var l;return(l=u?.location)===null||l===void 0?void 0:l.uri}),c=(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(l=>{var a,p;let f=(p=(a=l?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||p===void 0?void 0:p.uri;return f&&s.indexOf(f)>-1&&(l.physicalLocation.artifactLocation.index=s.indexOf(f)),l})),u)),e}};Ne.SarifBuilder=yt});var ki=h(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.SarifResultBuilder=void 0;var ns=be(),ht=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,ns.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};Re.SarifResultBuilder=ht});var Ei=h(Ve=>{"use strict";Object.defineProperty(Ve,"__esModule",{value:!0});Ve.SarifRuleBuilder=void 0;var os=be(),St=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,os.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};Ve.SarifRuleBuilder=St});var Oi=h(qe=>{"use strict";Object.defineProperty(qe,"__esModule",{value:!0});qe.SarifRunBuilder=void 0;var ss=be(),gt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,ss.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};qe.SarifRunBuilder=gt});var Fi=h(G=>{"use strict";Object.defineProperty(G,"__esModule",{value:!0});G.SarifResultBuilder=G.SarifRuleBuilder=G.SarifRunBuilder=G.SarifBuilder=void 0;var as=Pi();Object.defineProperty(G,"SarifBuilder",{enumerable:!0,get:function(){return as.SarifBuilder}});var cs=ki();Object.defineProperty(G,"SarifResultBuilder",{enumerable:!0,get:function(){return cs.SarifResultBuilder}});var ls=Ei();Object.defineProperty(G,"SarifRuleBuilder",{enumerable:!0,get:function(){return ls.SarifRuleBuilder}});var us=Oi();Object.defineProperty(G,"SarifRunBuilder",{enumerable:!0,get:function(){return us.SarifRunBuilder}})});var Di=h((Ca,ji)=>{"use strict";var fs=/["'&<>]/;ji.exports=ms;function ms(t){var e=""+t,r=fs.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i="&quot;";break;case 38:i="&amp;";break;case 39:i="&#39;";break;case 60:i="&lt;";break;case 62:i="&gt;";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var He=require("zx"),oe=require("fs/promises");var W={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var Le=class{allById=new Map;getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=kt(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById;if(!n.has(i))n.set(i,e);else{let o=n.get(i);o.title=o.title||e.title,o.severity=Yi(o.severity,e.severity),o.scannerSeverity[r]=e.severity,o.detectedBy=Ke(o.detectedBy,r),o.components=Ke(o.components,e.components[0]),o.refs=Ke(o.refs,e.refs[0])}}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id);if(!n){r.push({id:i.id,severity:i.severity});continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function Yi(t,e){return kt(t,e)>0?t:e}function kt(t,e){return W[t]-W[e]}function Ke(t,e){return e?Array.from(new Set([...t,e]).values()):t}var Pe=Ye(require("path"));var $=require("fs/promises"),ze=require("path");async function U(t){if(await re(t))return JSON.parse(await(0,$.readFile)(t,{encoding:"utf-8"}))}async function Et(t,e){await(0,$.writeFile)(t,JSON.stringify(e,null,4),{encoding:"utf-8"})}function J(t){return t&&t.replace(/\?.*$/,"")}async function re(t){try{return await(0,$.access)(t,$.constants.F_OK),!0}catch{return!1}}async function Ze(t){let e=(0,ze.resolve)(t),r=await(0,$.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,ze.resolve)(i.parentPath,i.name);i.isDirectory()?await Ze(n):await(0,$.rm)(n)}await(0,$.rmdir)(e)}async function de(t,e){let r=e?.user&&e?.pw?{Authorization:`Basic ${Buffer.from(`${e.user}:${e.pw}`).toString("base64")}`}:{},i=await fetch(t,{headers:r});if(!i.ok){let n="";try{n=await i.text()}catch(o){n=`${o}`}throw new Error(`Failed to fetch: ${t}: ${i.status} - ${i.statusText}: ${n}`)}return i}async function Ot(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=Y(t.workingDir,"input/vex"),i=Y(t.workingDir,"output"),n=Y(t.workingDir,"cache"),o=["grype","trivy","ossindex"],s=Y(t.workingDir,"vuln-scan-conf.json"),c=await U(s);if(!c)throw new Error(`Missing project configuration file '${s}'`);return{projectConfigFileLocation:s,failOnNewVulnerabilities:!1,createSubDirsForProject:c.createSubDirsForProject??!0,mavenRepo:c.mavenRepo??e,vexUrls:c.vexUrls??[],vexDir:Y(t.workingDir,c.vexDir)??r,outDir:Y(t.workingDir,c.outDir)??i,cacheDir:Y(t.workingDir,c.cacheDir)??n,scanners:c.scanners??o,projects:(c.projects??[]).map(u=>{let l=u;if(!l.name)throw new Error("Project name is missing on entry:"+JSON.stringify(l));if(!l.version)throw new Error("Project version is missing on entry:"+JSON.stringify(l));if(!l.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(l));return l.enabled==null&&(l.enabled=!0),l.silent==null&&(l.silent=!1),l.minimumSeverity||(l.minimumSeverity="UNKNOWN"),l.sbomFile?{...l,sbomFile:Y(t.workingDir,l.sbomFile)}:u})}}function Y(t,e){if(e)return Pe.default.isAbsolute(e)?e:(0,Pe.resolve)(t,e)}var te=Ye(Fi());var Ti=Ye(Di());function Ii(t,e){let r=new te.SarifRunBuilder().initSimple({toolDriverName:`${e.name} - ${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=ds(o.severity),c=o.id,u=ps(o.refs),l=new te.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,p,f="new",m="";a?(s="none",f="updated",m=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(m="--- UNDER INVESTIGATION --- ")):W[e.minimumSeverity]>W[o.severity]?(s="none",f="updated",m=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(s="none",f="updated",m="--- PROJECT SILENT ---"),Object.assign(l.rule,{name:`${m}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:ys(o,u,m)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(l);for(let d of o.components){let S=new te.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${d}`});S.result.message.id="default",S.result.locations=[{logicalLocations:[{fullyQualifiedName:d}]}],S.result.baselineState=f,S.result.suppressions=p,r.addResult(S)}}let n=new te.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function ps(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function ds(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"note";default:return"note"}}function ys(t,e,r){let i=t.vexStatement,n=i?`
+`,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function xo(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Wr.exports={stringify:wo,stripBom:xo}});var Yr=h((Sa,Qr)=>{var fe;try{fe=ce()}catch{fe=require("fs")}var Ie=F(),{stringify:Jr,stripBom:Hr}=Te();async function bo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||fe,i="throws"in e?e.throws:!0,n=await Ie.fromCallback(r.readFile)(t,e);n=Hr(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Lo=Ie.fromPromise(bo);function Po(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||fe,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=Hr(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function ko(t,e,r={}){let i=r.fs||fe,n=Jr(e,r);await Ie.fromCallback(i.writeFile)(t,n,r)}var Eo=Ie.fromPromise(ko);function Oo(t,e,r={}){let i=r.fs||fe,n=Jr(e,r);return i.writeFileSync(t,n,r)}var Fo={readFile:Lo,readFileSync:Po,writeFile:Eo,writeFileSync:Oo};Qr.exports=Fo});var zr=h((ga,Kr)=>{"use strict";var Me=Yr();Kr.exports={readJson:Me.readFile,readJsonSync:Me.readFileSync,writeJson:Me.writeFile,writeJsonSync:Me.writeFileSync}});var Ce=h((va,ti)=>{"use strict";var jo=F().fromPromise,ft=R(),Zr=require("path"),ei=X(),Do=z().pathExists;async function To(t,e,r="utf-8"){let i=Zr.dirname(t);return await Do(i)||await ei.mkdirs(i),ft.writeFile(t,e,r)}function Io(t,...e){let r=Zr.dirname(t);ft.existsSync(r)||ei.mkdirsSync(r),ft.writeFileSync(t,...e)}ti.exports={outputFile:jo(To),outputFileSync:Io}});var ii=h((wa,ri)=>{"use strict";var{stringify:Mo}=Te(),{outputFile:Co}=Ce();async function Ao(t,e,r={}){let i=Mo(e,r);await Co(t,i,r)}ri.exports=Ao});var oi=h((xa,ni)=>{"use strict";var{stringify:No}=Te(),{outputFileSync:Ro}=Ce();function Vo(t,e,r){let i=No(e,r);Ro(t,i,r)}ni.exports=Vo});var ai=h((ba,si)=>{"use strict";var qo=F().fromPromise,q=zr();q.outputJson=qo(ii());q.outputJsonSync=oi();q.outputJSON=q.outputJson;q.outputJSONSync=q.outputJsonSync;q.writeJSON=q.writeJson;q.writeJSONSync=q.writeJsonSync;q.readJSON=q.readJson;q.readJSONSync=q.readJsonSync;si.exports=q});var mi=h((La,fi)=>{"use strict";var _o=R(),ci=require("path"),{copy:$o}=De(),{remove:ui}=we(),{mkdirp:Xo}=X(),{pathExists:Uo}=z(),li=ne();async function Bo(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await li.checkPaths(t,e,"move",r);await li.checkParentPaths(t,n,e,"move");let s=ci.dirname(e);return ci.parse(s).root!==s&&await Xo(s),Go(t,e,i,o)}async function Go(t,e,r,i){if(!i){if(r)await ui(e);else if(await Uo(e))throw new Error("dest already exists.")}try{await _o.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await Wo(t,e,r)}}async function Wo(t,e,r){return await $o(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),ui(t)}fi.exports=Bo});var Si=h((Pa,hi)=>{"use strict";var di=ce(),pt=require("path"),Jo=De().copySync,yi=we().removeSync,Ho=X().mkdirpSync,pi=ne();function Qo(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=pi.checkPathsSync(t,e,"move",r);return pi.checkParentPathsSync(t,n,e,"move"),Yo(e)||Ho(pt.dirname(e)),Ko(t,e,i,o)}function Yo(t){let e=pt.dirname(t);return pt.parse(e).root===e}function Ko(t,e,r,i){if(i)return mt(t,e,r);if(r)return yi(e),mt(t,e,r);if(di.existsSync(e))throw new Error("dest already exists.");return mt(t,e,r)}function mt(t,e,r){try{di.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return zo(t,e,r)}}function zo(t,e,r){return Jo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),yi(t)}hi.exports=Qo});var vi=h((ka,gi)=>{"use strict";var Zo=F().fromPromise;gi.exports={move:Zo(mi()),moveSync:Si()}});var xi=h((Ea,wi)=>{"use strict";wi.exports={...R(),...De(),...vr(),...Gr(),...ai(),...X(),...vi(),...Ce(),...z(),...we()}});var bi=h(Ae=>{"use strict";Object.defineProperty(Ae,"__esModule",{value:!0});Ae.EXTENSIONS_LANGUAGES=void 0;Ae.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var be=h(dt=>{"use strict";Object.defineProperty(dt,"__esModule",{value:!0});dt.setOptionValues=es;function es(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var Pi=h(Ne=>{"use strict";Object.defineProperty(Ne,"__esModule",{value:!0});Ne.SarifBuilder=void 0;var ts=require("path"),Li=xi(),rs=bi(),is=be(),yt=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,is.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();Li.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await Li.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let l of u.locations||[])if(!((i=(r=l?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0)&&i.uri&&e.artifacts.filter(a=>{var p;return((p=a?.location)===null||p===void 0?void 0:p.uri)===l.physicalLocation.artifactLocation.uri}).length===0){let a=ts.extname(l.physicalLocation.artifactLocation.uri).replace(".",""),p=rs.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:p,location:{uri:l.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var l;return(l=u?.location)===null||l===void 0?void 0:l.uri}),c=(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(l=>{var a,p;let f=(p=(a=l?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||p===void 0?void 0:p.uri;return f&&s.indexOf(f)>-1&&(l.physicalLocation.artifactLocation.index=s.indexOf(f)),l})),u)),e}};Ne.SarifBuilder=yt});var ki=h(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.SarifResultBuilder=void 0;var ns=be(),ht=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,ns.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};Re.SarifResultBuilder=ht});var Ei=h(Ve=>{"use strict";Object.defineProperty(Ve,"__esModule",{value:!0});Ve.SarifRuleBuilder=void 0;var os=be(),St=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,os.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};Ve.SarifRuleBuilder=St});var Oi=h(qe=>{"use strict";Object.defineProperty(qe,"__esModule",{value:!0});qe.SarifRunBuilder=void 0;var ss=be(),gt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,ss.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};qe.SarifRunBuilder=gt});var Fi=h(G=>{"use strict";Object.defineProperty(G,"__esModule",{value:!0});G.SarifResultBuilder=G.SarifRuleBuilder=G.SarifRunBuilder=G.SarifBuilder=void 0;var as=Pi();Object.defineProperty(G,"SarifBuilder",{enumerable:!0,get:function(){return as.SarifBuilder}});var cs=ki();Object.defineProperty(G,"SarifResultBuilder",{enumerable:!0,get:function(){return cs.SarifResultBuilder}});var ls=Ei();Object.defineProperty(G,"SarifRuleBuilder",{enumerable:!0,get:function(){return ls.SarifRuleBuilder}});var us=Oi();Object.defineProperty(G,"SarifRunBuilder",{enumerable:!0,get:function(){return us.SarifRunBuilder}})});var Di=h((Ca,ji)=>{"use strict";var fs=/["'&<>]/;ji.exports=ms;function ms(t){var e=""+t,r=fs.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i="&quot;";break;case 38:i="&amp;";break;case 39:i="&#39;";break;case 60:i="&lt;";break;case 62:i="&gt;";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var He=require("zx"),oe=require("fs/promises");var W={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var Le=class{allById=new Map;getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=kt(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById;if(!n.has(i))n.set(i,e);else{let o=n.get(i);o.title=o.title||e.title,o.severity=Yi(o.severity,e.severity),o.scannerSeverity[r]=e.severity,o.detectedBy=Ke(o.detectedBy,r),o.components=Ke(o.components,e.components[0]),o.refs=Ke(o.refs,e.refs[0])}}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id);if(!n){r.push({id:i.id,severity:i.severity});continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function Yi(t,e){return kt(t,e)>0?t:e}function kt(t,e){return W[t]-W[e]}function Ke(t,e){return e?Array.from(new Set([...t,e]).values()):t}var Pe=Ye(require("path"));var $=require("fs/promises"),ze=require("path");async function U(t){if(await re(t))return JSON.parse(await(0,$.readFile)(t,{encoding:"utf-8"}))}async function Et(t,e){await(0,$.writeFile)(t,JSON.stringify(e,null,4)+`
+`,{encoding:"utf-8"})}function J(t){return t&&t.replace(/\?.*$/,"")}async function re(t){try{return await(0,$.access)(t,$.constants.F_OK),!0}catch{return!1}}async function Ze(t){let e=(0,ze.resolve)(t),r=await(0,$.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,ze.resolve)(i.parentPath,i.name);i.isDirectory()?await Ze(n):await(0,$.rm)(n)}await(0,$.rmdir)(e)}async function de(t,e){let r=e?.user&&e?.pw?{Authorization:`Basic ${Buffer.from(`${e.user}:${e.pw}`).toString("base64")}`}:{},i=await fetch(t,{headers:r});if(!i.ok){let n="";try{n=await i.text()}catch(o){n=`${o}`}throw new Error(`Failed to fetch: ${t}: ${i.status} - ${i.statusText}: ${n}`)}return i}async function Ot(t){let e="https://repository.conterra.de/repository/maven-mirror-ct",r=Y(t.workingDir,"input/vex"),i=Y(t.workingDir,"output"),n=Y(t.workingDir,"cache"),o=["grype","trivy","ossindex"],s=Y(t.workingDir,"vuln-scan-conf.json"),c=await U(s);if(!c)throw new Error(`Missing project configuration file '${s}'`);return{projectConfigFileLocation:s,failOnNewVulnerabilities:!1,createSubDirsForProject:c.createSubDirsForProject??!0,mavenRepo:c.mavenRepo??e,vexUrls:c.vexUrls??[],vexDir:Y(t.workingDir,c.vexDir)??r,outDir:Y(t.workingDir,c.outDir)??i,cacheDir:Y(t.workingDir,c.cacheDir)??n,scanners:c.scanners??o,projects:(c.projects??[]).map(u=>{let l=u;if(!l.name)throw new Error("Project name is missing on entry:"+JSON.stringify(l));if(!l.version)throw new Error("Project version is missing on entry:"+JSON.stringify(l));if(!l.purl)throw new Error("Project purl is missing on entry:"+JSON.stringify(l));return l.enabled==null&&(l.enabled=!0),l.silent==null&&(l.silent=!1),l.minimumSeverity||(l.minimumSeverity="UNKNOWN"),l.sbomFile?{...l,sbomFile:Y(t.workingDir,l.sbomFile)}:u})}}function Y(t,e){if(e)return Pe.default.isAbsolute(e)?e:(0,Pe.resolve)(t,e)}var te=Ye(Fi());var Ti=Ye(Di());function Ii(t,e){let r=new te.SarifRunBuilder().initSimple({toolDriverName:`${e.name} - ${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=ds(o.severity),c=o.id,u=ps(o.refs),l=new te.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,p,f="new",m="";a?(s="none",f="updated",m=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(m="--- UNDER INVESTIGATION --- ")):W[e.minimumSeverity]>W[o.severity]?(s="none",f="updated",m=`--- BELOW MINIMUM SEVERITY '${e.minimumSeverity}' ---`):e.silent&&(s="none",f="updated",m="--- PROJECT SILENT ---"),Object.assign(l.rule,{name:`${m}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:ys(o,u,m)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(l);for(let d of o.components){let S=new te.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${d}`});S.result.message.id="default",S.result.locations=[{logicalLocations:[{fullyQualifiedName:d}]}],S.result.baselineState=f,S.result.suppressions=p,r.addResult(S)}}let n=new te.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function ps(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function ds(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"note";default:return"note"}}function ys(t,e,r){let i=t.vexStatement,n=i?`
 ${r}
 ${i.justification??""}
 ${i.impact_statement??""}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@conterra/vuln-scan",
-    "version": "0.0.10",
+    "version": "0.0.11",
     "description": "con terra vulnerability scan process",
     "author": "con terra GmbH",
     "license": "Apache-2.0",