@kaynooo/pkg-tools 0.5.0 → 0.6.0

package/README.md

@@ -12,9 +12,9 @@ pkg left-pad@1.3.0 @types/node --json
 
 - Whether the name exists, the version the request resolves to (an exact version, a dist-tag or a range), the latest version, and the highest stable version at least two weeks old (`safe`), each with its publish date.
 - Weekly downloads (public registry only), licence and repository.
-- Warnings for a version under the minimum age (with the `safe` version to use instead), `preinstall`, `install` and `postinstall` scripts, a deprecated version, and a name that is a near miss of a popular package (one or two edits, other separators or case, or the same name under another scope).
+- Warnings for a version under the minimum age (with the `safe` version to use instead; a fresh version clear of an advisory at `blockSeverity` or above that `safe` has is let through, with a warning naming the GHSAs it fixes), `preinstall`, `install` and `postinstall` scripts, a deprecated version, and a name that is a near miss of a popular package (one or two edits, other separators or case, or the same name under another scope).
 
-`pkg` exits 1 when a package is blocked (missing, the request matches no version or is not a valid range, the resolved version is too fresh or has no publish date on npmjs.org, its licence is outside the allowlist, or an advisory reaches the threshold), 2 when it could not check (the registry unreachable, slower than 10 s or answering badly, a broken `.pkgrc.json`, `bunfig.toml` or `.npmrc`) or on a usage error; other warnings exit 0. `--json` prints one report, or an array for several names, `--min-age <days>` changes the 14 days.
+`pkg` exits 1 when a package is blocked (missing, the request matches no version or is not a valid range, the resolved version is too fresh (unless it fixes an advisory of the safe version at the threshold) or has no publish date on npmjs.org, its licence is outside the allowlist, or an advisory reaches the threshold), 2 when it could not check (the registry unreachable, slower than 10 s or answering badly, a broken `.pkgrc.json`, `bunfig.toml` or `.npmrc`) or on a usage error; other warnings exit 0. `--json` prints one report, or an array for several names, `--min-age <days>` changes the 14 days.
 
 ## Config: licence allowlist and advisory threshold
 
@@ -38,6 +38,7 @@ pkg audit ~/Workspace/app --audit-level high --ignore GHSA-238p-pmpm-9mq7 --json
 
 - `--audit-level <low|moderate|high|critical>` (`low`) keeps only the advisories at that severity or above, and `--ignore <GHSA or id>` (repeatable) skips an advisory; `blockSeverity` is for `pkg check` and does not apply here.
 - `--json` prints the packages with a finding as `[{name, version, license, blocked, warnings, advisories}]`; `--min-age <days>` changes the 14 days.
+- A pin under the minimum age fixing an advisory of the `safe` version at `blockSeverity` or above (not one `--ignore` skips) is let through as `pkg check` lets it, a warning naming the GHSAs.
 - It exits 1 when a package is missing, too fresh or outside the allowlist, or an advisory remains after the level and the ignores; install scripts and near misses alone exit 0. When the advisories of a registry could not be read it warns which, never prints a clean result for them, and exits 2 unless something already blocks.
 - An `npm:` alias (`"lodash": "npm:other@1.0.0"`) is audited as the package it names.
 

package/dist/cli.js

@@ -1143,6 +1143,14 @@ var init_secrets = __esm(() => {
   SECRET_WORDS = new Set(["key", "pass", "pwd", "auth", "salt", "cookie", "session", "jwt", "ssn", "iban", "card", "cvv", "otp"]);
 });
 
+// ../kit/src/sessions.ts
+var {Glob } = globalThis.Bun;
+var SESSION_FILES, ACCOUNT_DIRS;
+var init_sessions = __esm(() => {
+  SESSION_FILES = new Glob("*.json");
+  ACCOUNT_DIRS = new Glob("*/sessions");
+});
+
 // ../kit/src/index.ts
 var init_src = __esm(() => {
   init_args();
@@ -1156,6 +1164,7 @@ var init_src = __esm(() => {
   init_logs();
   init_process();
   init_secrets();
+  init_sessions();
   init_style();
   init_text();
   init_tool();
@@ -2062,6 +2071,9 @@ function ageDays(published, now) {
   const at = Date.parse(published ?? "");
   return Number.isNaN(at) ? undefined : (now - at) / DAY;
 }
+function daysAgo(age) {
+  return age < 1 ? "less than a day" : `${Math.floor(age)} day${Math.floor(age) === 1 ? "" : "s"}`;
+}
 function installScriptsOf(version) {
   return Object.fromEntries(INSTALL_SCRIPTS.flatMap((name) => version?.scripts?.[name] === undefined ? [] : [[name, version.scripts[name]]]));
 }
@@ -2072,7 +2084,7 @@ function safeRelease(packument, now, minAgeDays) {
 }
 function analyze(input) {
   const { spec, packument, registry, now = Date.now(), minAgeDays = DEFAULT_MIN_AGE_DAYS } = input;
-  const report = { name: spec.name, registry, exists: packument !== undefined, requested: spec.request, installScripts: {}, nearMisses: nearMisses(spec.name), advisories: input.advisories ?? [], warnings: [], blocked: false, downloads: input.downloads };
+  const report = { name: spec.name, registry, exists: packument !== undefined, requested: spec.request, installScripts: {}, nearMisses: nearMisses(spec.name), advisories: input.advisories ?? [], fixes: [], warnings: [], blocked: false, downloads: input.downloads };
   if (report.nearMisses.length > 0)
     report.warnings.push(`name looks like ${report.nearMisses.join("; ")}, check it is the package meant`);
   if (packument === undefined) {
@@ -2098,13 +2110,17 @@ function analyze(input) {
     return report;
   }
   const age = ageDays(report.published, now);
+  const kept = new Set(report.advisories.map((each) => each.id));
+  report.fixes = report.safe?.version === version ? [] : (input.safeAdvisories ?? []).filter((each) => !kept.has(each.id));
   if (age === undefined) {
     const isBlocking = minAgeDays > 0 && registry === PUBLIC_HOST;
     report.blocked ||= isBlocking;
     report.warnings.push(`${registry} gives no publish date for ${version}, its age cannot be checked${isBlocking ? " and it is refused" : ""}`);
+  } else if (age < minAgeDays && report.fixes.length > 0) {
+    report.warnings.push(`${version} was published ${daysAgo(age)} ago, under ${minAgeDays} days, but it fixes ${report.fixes.map((each) => `${each.ghsa ?? each.id} (${each.severity})`).join(", ")} that ${report.safe?.version} has, so its age does not hold it back`);
   } else if (age < minAgeDays) {
     report.blocked = true;
-    report.warnings.push(`${version} was published ${age < 1 ? "less than a day" : `${Math.floor(age)} day${Math.floor(age) === 1 ? "" : "s"}`} ago, under ${minAgeDays} days${report.safe === undefined ? ", and no older stable version exists" : `, use ${spec.name}@${report.safe.version}`}`);
+    report.warnings.push(`${version} was published ${daysAgo(age)} ago, under ${minAgeDays} days${report.safe === undefined ? ", and no older stable version exists" : `, use ${spec.name}@${report.safe.version}`}`);
   }
   const scripts = Object.keys(report.installScripts);
   if (scripts.length > 0)
@@ -2159,10 +2175,11 @@ async function checkPackage(text, context) {
   const blockSeverity = context.settings?.blockSeverity ?? DEFAULT_BLOCK_SEVERITY;
   if (report.version === undefined)
     return report;
-  const { found, unavailable, isUnsupported } = await fetchAdvisories({ [spec.name]: [report.version] }, registry, context.fetcher);
+  const safe = report.safe?.version;
+  const { found, unavailable, isUnsupported } = await fetchAdvisories({ [spec.name]: safe === undefined || safe === report.version ? [report.version] : [report.version, safe] }, registry, context.fetcher);
   if (unavailable !== undefined && isUnsupported !== true)
     return unreachable(unavailable);
-  const checked = analyze({ ...input, blockSeverity, advisories: advisoriesFor(found[spec.name], report.version) });
+  const checked = analyze({ ...input, blockSeverity, advisories: advisoriesFor(found[spec.name], report.version), safeAdvisories: safe === undefined ? [] : filterAdvisories(advisoriesFor(found[spec.name], safe), blockSeverity) });
   if (unavailable !== undefined)
     checked.warnings.push(`${unavailable}, so its known advisories are not checked`);
   return checked;
@@ -2274,11 +2291,18 @@ async function auditPackages(packages, context) {
       packuments.set(key, fetchPackument(name, registry, context.fetcher));
     return packuments.get(key);
   };
+  const looked = [];
+  for (let start = 0;start < packages.length; start += BATCH) {
+    looked.push(...await Promise.all(packages.slice(start, start + BATCH).map(async ({ name, version }) => {
+      const registry = registryFor(name, context.configs);
+      const input = { spec: { name, request: version }, packument: await lookup(name, registry), registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays, licenses: context.settings.licenses };
+      return { name, version, registry, input, safe: analyze(input).safe?.version };
+    })));
+  }
   const registries = new Map;
-  for (const { name, version } of packages) {
-    const registry = registryFor(name, context.configs);
+  for (const { name, version, registry, safe } of looked) {
     const group = registries.get(registry.url) ?? { registry, versions: {} };
-    group.versions[name] = [...group.versions[name] ?? [], version];
+    group.versions[name] = [...group.versions[name] ?? [], version, ...safe === undefined || safe === version ? [] : [safe]];
     registries.set(registry.url, group);
   }
   const advisories = {};
@@ -2289,15 +2313,13 @@ async function auditPackages(packages, context) {
     if (fetched.unavailable !== undefined)
       unavailable.push(fetched.unavailable);
   }
-  const audited = [];
-  for (let start = 0;start < packages.length; start += BATCH) {
-    audited.push(...await Promise.all(packages.slice(start, start + BATCH).map(async ({ name, version }) => {
-      const registry = registryFor(name, context.configs);
-      const found = filterAdvisories(advisoriesFor(advisories[name], version), context.level, context.ignore);
-      const report = analyze({ spec: { name, request: version }, packument: await lookup(name, registry), registry: new URL(registry.url).host, now: context.now, minAgeDays: context.minAgeDays, licenses: context.settings.licenses });
-      return { name, version, license: report.license, blocked: report.blocked || found.length > 0, warnings: report.warnings, advisories: found };
-    })));
-  }
+  const blockSeverity = context.settings.blockSeverity ?? DEFAULT_BLOCK_SEVERITY;
+  const audited = looked.map(({ name, version, input, safe }) => {
+    const found = filterAdvisories(advisoriesFor(advisories[name], version), context.level, context.ignore);
+    const safeAdvisories = safe === undefined ? [] : filterAdvisories(advisoriesFor(advisories[name], safe), blockSeverity, context.ignore);
+    const report = analyze({ ...input, advisories: advisoriesFor(advisories[name], version), safeAdvisories });
+    return { name, version, license: report.license, blocked: report.blocked || found.length > 0, warnings: report.warnings, advisories: found };
+  });
   return { audited, unavailable };
 }
 function renderAudit(findings, total) {
@@ -2727,7 +2749,7 @@ var init_consumers2 = __esm(() => {
 init_src();
 import process10 from "process";
 // package.json
-var version = "0.5.0";
+var version = "0.6.0";
 
 // src/cli.ts
 process10.exitCode = await runCli({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kaynooo/pkg-tools",
   "type": "module",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "pkg: check an npm package before it is added, for a guessed name, a version under two weeks old and install scripts.",
   "author": "Kaynooo <contact@kaynooo.fr>",
   "license": "MIT",