@mongodb-js/sbom-tools 0.3.0 → 0.5.0

package/README.md

@@ -58,6 +58,15 @@ dependencies.json
 
 Outputs a markdown report of vulnerabilities given one or more `dependencies.json` files and the output of one or more multiple `snyk test`.
 
+If `--create-jira-issues` is set then each vulnerability that is not ignored will be also reported as a jira issue.
+
+The jira issue creation must be configured setting the following environment variables:
+
+- `JIRA_BASE_URL` (required): The base url of the jira api (excluded the `/rest/api/...`).
+- `JIRA_API_TOKEN` (required): A jira PAT.
+- `JIRA_PROJECT` (required): The project used to create the ticket.
+- `JIRA_VULNERABILITY_BUILD_INFO`: Additional build info added to the ticket description (for example the commit id).
+
 #### Usage
 
 ```
@@ -67,19 +76,19 @@ Generate vulnerabilities report
 
 Options:
   --dependencies <paths>     Comma-separated list of dependency files (default: [])
-  --snyk-reports <paths>         Comma-separated list of snyk
+  --snyk-reports <paths>     Comma-separated list of snyk
 result files (default: [])
-  --fail-on [level]              Fail on the specified severity
+  --fail-on [level]          Fail on the specified severity
 level
-
-  -h, --help                     display help for command
+  --create-jira-issues       Create Jira issues for the vulnerabilities found
+  -h, --help                 display help for command
 ```
 
 **Example output:**
 
 ```md
-| dep@version  | id                    | score        | fixed in | origin               | ignored |
-| ------------ | --------------------- | ------------ | -------- | -------------------- | ------- |
+| dep@version  | id                    | score        | fixed in | ignored              |
+| ------------ | --------------------- | ------------ | -------- | -------------------- |
 | jquery@2.2.4 | SNYK-JS-JQUERY-567880 | 6.5 (Medium) | 3.5.0    | -                    |
 | got@10.7.0   | SNYK-JS-GOT-2932019   | 5.4 (Medium) | 11.8.5   | Ignored. Reason: ... |
 ```

package/dist/commands/generate-vulnerability-report.d.ts

@@ -1,11 +1,14 @@
-import type { KnownSeverity, SnykTestProjectResult } from '../snyk-vulnerability';
+import type { KnownSeverity, SnykTestProjectResult, VulnerabilityInfo } from '../vulnerability';
 import { Command } from 'commander';
 export declare function loadReports(files: string[]): Promise<SnykTestProjectResult[]>;
+export declare function formatIgnored(vuln: VulnerabilityInfo): string;
+export declare function generateVulnerabilityTable(vulnerabilities: VulnerabilityInfo[]): string;
 export declare function generateVulnerabilityReport(options: {
     dependencyFiles: string[];
     snykReports: string[];
     snykPolicyPath?: string;
     failOn?: KnownSeverity;
+    createJiraIssues?: boolean;
     printResult?: (result: string) => void;
 }): Promise<void>;
 export declare const command: Command;

package/dist/commands/generate-vulnerability-report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-vulnerability-report.d.ts","sourceRoot":"","sources":["../../src/commands/generate-vulnerability-report.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EAEtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAUlC;AAiJD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAMD,eAAO,MAAM,OAAO,SAyBhB,CAAC"}
+{"version":3,"file":"generate-vulnerability-report.d.ts","sourceRoot":"","sources":["../../src/commands/generate-vulnerability-report.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,aAAa,EAEb,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAY1B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAUlC;AA6ED,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAW7D;AAED,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,iBAAiB,EAAE,GACnC,MAAM,CAwBR;AAED,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhB;AAMD,eAAO,MAAM,OAAO,SA8BhB,CAAC"}

package/dist/commands/generate-vulnerability-report.js

@@ -3,115 +3,94 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.command = exports.generateVulnerabilityReport = exports.loadReports = void 0;
+exports.command = exports.generateVulnerabilityReport = exports.generateVulnerabilityTable = exports.formatIgnored = exports.loadReports = void 0;
 const fs_1 = require("fs");
-const snykPolicy = require('snyk-policy');
 const lodash_1 = __importDefault(require("lodash"));
 const load_dependency_files_1 = require("../load-dependency-files");
-const snyk_vulnerability_1 = require("../snyk-vulnerability");
+const vulnerability_1 = require("../vulnerability");
 const commander_1 = require("commander");
+const jira_1 = require("../jira");
 async function loadReports(files) {
     return (await Promise.all(files.map(async (fileName) => JSON.parse(await fs_1.promises.readFile(fileName, 'utf-8'))))).flat();
 }
 exports.loadReports = loadReports;
 function filterApplicableVulnerabilities(snykTestResults, dependencies, rules) {
-    const affectedDependencies = [];
+    const uniqueVulnerabilities = new Map();
     snykTestResults.forEach((projectResult) => {
-        projectResult.vulnerabilities.forEach((vuln) => {
-            dependencies.forEach((dep) => {
-                if (vuln.moduleName === dep.name &&
-                    vuln.from.includes(`${dep.name}@${dep.version}`)) {
-                    affectedDependencies.push(vuln);
+        projectResult.vulnerabilities.forEach((snykVulnerability) => {
+            if (snykVulnerability.type === 'license') {
+                return;
+            }
+            const newVulnerability = (0, vulnerability_1.vulnerabilityFromSnyk)(snykVulnerability, rules);
+            for (const dep of dependencies) {
+                if (newVulnerability.packageName !== dep.name ||
+                    newVulnerability.packageVersion !== dep.version) {
+                    continue;
+                }
+                const key = `${newVulnerability.packageName}@${newVulnerability.packageVersion}_${newVulnerability.id}`;
+                const previouslyAdded = uniqueVulnerabilities.get(key);
+                if (previouslyAdded) {
+                    previouslyAdded.origins = Array.from(new Set([...previouslyAdded.origins, ...newVulnerability.origins]));
+                }
+                else {
+                    uniqueVulnerabilities.set(key, newVulnerability);
                 }
-            });
-        });
-    });
-    const uniqueVulnerabilities = new Map();
-    affectedDependencies.forEach((vuln) => {
-        const key = `${vuln.name}@${vuln.version}_${vuln.id}`;
-        const origin = '-';
-        if (uniqueVulnerabilities.has(key)) {
-            const existingVuln = uniqueVulnerabilities.get(key);
-            if (!existingVuln.origins.includes(origin)) {
-                existingVuln.origins.push(origin);
             }
-        }
-        else {
-            uniqueVulnerabilities.set(key, {
-                name: `${vuln.name}@${vuln.version}`,
-                id: vuln.id,
-                score: vuln.cvssScore,
-                severity: `${vuln.severity
-                    .charAt(0)
-                    .toUpperCase()}${vuln.severity.slice(1)}`,
-                fixedIn: vuln.fixedIn.join(', '),
-                origins: [origin],
-                policy: snykPolicy.getByVuln(rules, vuln),
-            });
-        }
+        });
     });
-    const sortedVulnerabilities = Array.from(uniqueVulnerabilities.values()).sort((a, b) => a.name.localeCompare(b.name));
+    const sortedVulnerabilities = Array.from(uniqueVulnerabilities.values()).sort((a, b) => `${a.packageName}@${a.packageVersion}`.localeCompare(`${b.packageName}@${b.packageVersion}`));
     return sortedVulnerabilities;
 }
+function fail(failOn, bundleVulnerabilities) {
+    var _a;
+    const minScore = (_a = (0, vulnerability_1.severityToScore)(failOn)) !== null && _a !== void 0 ? _a : 0;
+    for (const vuln of bundleVulnerabilities) {
+        if ((vuln.score === undefined || vuln.score >= minScore) &&
+            (0, vulnerability_1.hasKnownRemediation)(vuln) &&
+            !(0, vulnerability_1.isIgnored)(vuln)) {
+            throw new Error(`Vulnerabilities check failed: found vulnerabilities >= "${failOn}"`);
+        }
+    }
+}
 function formatIgnored(vuln) {
     var _a, _b;
-    if (!hasKnownRemediation(vuln)) {
+    if (!(0, vulnerability_1.hasKnownRemediation)(vuln)) {
         return 'Reason: Remediation not available yet';
     }
-    if (hasIgnorePolicy(vuln)) {
-        const expired = hasExpiredPolicy(vuln) ? ' (Expired)' : '';
+    if ((0, vulnerability_1.hasIgnorePolicy)(vuln)) {
+        const expired = (0, vulnerability_1.hasExpiredPolicy)(vuln) ? ' (Expired)' : '';
         return `Reason: ${(_b = (_a = vuln.policy) === null || _a === void 0 ? void 0 : _a.reason) !== null && _b !== void 0 ? _b : 'unknown'}${expired}`;
     }
     return '-';
 }
-function generateTable(vulnerabilities) {
+exports.formatIgnored = formatIgnored;
+function generateVulnerabilityTable(vulnerabilities) {
     var _a;
     let output = '';
-    output += `## Vulnerabilities Report (${vulnerabilities.length} vulnerabilities)\n`;
-    output += '| dep@version | id | score | fixed in | origin | ignored |\n';
-    output += '| ----------- | -- | ----- | -------- | ------ | ------- |\n';
+    output += '| dep@version | id | score | fixed in | ignored |\n';
+    output += '| ----------- | -- | ----- | -------- | ------- |\n';
     const sortedVulns = lodash_1.default.orderBy(vulnerabilities, ['score', 'name'], ['desc', 'asc']);
     for (const vuln of sortedVulns) {
-        const severity = `${(_a = vuln.score) !== null && _a !== void 0 ? _a : '?'} (${vuln.severity})`;
+        const severity = `${(_a = vuln.score) !== null && _a !== void 0 ? _a : '?'} (${vuln.severity
+            .charAt(0)
+            .toUpperCase()}${vuln.severity.slice(1)})`;
         const ignored = formatIgnored(vuln);
-        output += `| ${vuln.name} | ${vuln.id} | ${severity} | ${vuln.fixedIn || 'N/A'} | ${ignored} |\n`;
+        output += `| ${vuln.packageName}@${vuln.packageVersion} | ${vuln.id} | ${severity} | ${vuln.fixedIn.join(', ') || 'N/A'} | ${ignored} |\n`;
     }
     return output;
 }
-function isIgnored(vuln) {
-    return hasIgnorePolicy(vuln) && !hasExpiredPolicy(vuln);
-}
-function hasIgnorePolicy(vuln) {
-    var _a;
-    return ((_a = vuln.policy) === null || _a === void 0 ? void 0 : _a.type) === 'ignore';
-}
-function hasExpiredPolicy(vuln) {
-    var _a;
-    return new Date() >= ((_a = vuln.policy) === null || _a === void 0 ? void 0 : _a.expires);
-}
-function hasKnownRemediation(vuln) {
-    return !!vuln.fixedIn;
-}
-function fail(failOn, bundleVulnerabilities) {
-    var _a;
-    const minScore = (_a = (0, snyk_vulnerability_1.severityToScore)(failOn)) !== null && _a !== void 0 ? _a : 0;
-    for (const vuln of bundleVulnerabilities) {
-        if ((vuln.score === undefined || vuln.score >= minScore) &&
-            hasKnownRemediation(vuln) &&
-            !isIgnored(vuln)) {
-            throw new Error(`Vulnerabilities check failed: found vulnerabilities >= "${failOn}"`);
-        }
-    }
-}
+exports.generateVulnerabilityTable = generateVulnerabilityTable;
 async function generateVulnerabilityReport(options) {
-    var _a, _b;
+    var _a;
     const productionDependencies = await (0, load_dependency_files_1.loadDependencyFiles)(options.dependencyFiles);
     const snykTestResult = await loadReports(options.snykReports);
-    const rules = await snykPolicy.load((_a = options.snykPolicyPath) !== null && _a !== void 0 ? _a : process.cwd(), {
-        loose: true,
-    });
+    const rules = await (0, vulnerability_1.loadSnykPolicyRules)(options.snykPolicyPath);
     const applicableVulnerabilities = filterApplicableVulnerabilities(snykTestResult, productionDependencies, rules);
-    ((_b = options.printResult) !== null && _b !== void 0 ? _b : console.info)(generateTable(applicableVulnerabilities));
+    ((_a = options.printResult) !== null && _a !== void 0 ? _a : console.info)(`## Vulnerabilities Report (${applicableVulnerabilities.length} vulnerabilities)
+${generateVulnerabilityTable(applicableVulnerabilities)}`);
+    if (options.createJiraIssues) {
+        await (0, jira_1.createVulnerabilityTickets)(applicableVulnerabilities);
+    }
     if (options.failOn) {
         fail(options.failOn, applicableVulnerabilities);
     }
@@ -126,12 +105,14 @@ exports.command = new commander_1.Command('generate-vulnerability-report')
     .option('--snyk-reports <paths>', 'Comma-separated list of snyk result files', commaSeparatedList, [])
     .option('--fail-on [level]', 'Fail on the specified severity level')
     .option('--snyk-policy-path [path]', 'Snyk policy path')
+    .option('--create-jira-issues', 'Create Jira issues for the vulnerabilities found')
     .action(async (options) => {
     await generateVulnerabilityReport({
         dependencyFiles: options.dependencies,
         snykReports: options.snykReports,
         failOn: options.failOn,
         snykPolicyPath: options.snykPolicyPath,
+        createJiraIssues: options.createJiraIssues,
     });
 });
 //# sourceMappingURL=generate-vulnerability-report.js.map

package/dist/commands/generate-vulnerability-report.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate-vulnerability-report.js","sourceRoot":"","sources":["../../src/commands/generate-vulnerability-report.ts"],"names":[],"mappings":";;;;;;AAAA,2BAAoC;AAGpC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AAC1C,oDAAuB;AAEvB,oEAA+D;AAM/D,8DAAwD;AACxD,yCAAoC;AAE7B,KAAK,UAAU,WAAW,CAC/B,KAAe;IAIf,OAAO,CACL,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,aAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CACjD,CACF,CACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAZD,kCAYC;AAuBD,SAAS,+BAA+B,CACtC,eAAwC,EACxC,YAA0B,EAC1B,KAAsB;IAEtB,MAAM,oBAAoB,GAAwB,EAAE,CAAC;IAErD,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE;QACxC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7C,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC3B,IACE,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,IAAI;oBAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,EAChD;oBACA,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACjC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAE,CAAC;IAExC,oBAAoB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,GAAG,CAAC;QAEnB,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YAClC,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;gBAC1C,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;aACnC;SACF;aAAM;YACL,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC7B,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE;gBACpC,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,SAAS;gBACrB,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ;qBACvB,MAAM,CAAC,CAAC,CAAC;qBACT,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChC,OAAO,EAAE,CAAC,MAAM,CAAC;gBACjB,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;aAC1C,CAAC,CAAC;SACJ;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,qBAAqB,GAAG,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC3E,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CACvC,CAAC;IAEF,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,IAAmB;;IACxC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE;QAC9B,OAAO,uCAAuC,CAAC;KAChD;IAED,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE;QACzB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,WAAW,MAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,MAAM,mCAAI,SAAS,GAAG,OAAO,EAAE,CAAC;KAChE;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,eAAgC;;IACrD,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,MAAM,IAAI,8BAA8B,eAAe,CAAC,MAAM,qBAAqB,CAAC;IACpF,MAAM,IAAI,8DAA8D,CAAC;IACzE,MAAM,IAAI,8DAA8D,CAAC;IAEzE,MAAM,WAAW,GAAG,gBAAC,CAAC,OAAO,CAC3B,eAAe,EACf,CAAC,OAAO,EAAE,MAAM,CAAC,EACjB,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE;QAC9B,MAAM,QAAQ,GAAG,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,GAAG,KAAK,IAAI,CAAC,QAAQ,GAAG,CAAC;QAC3D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEpC,MAAM,IAAI,KAAK,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,MAAM,QAAQ,MACjD,IAAI,CAAC,OAAO,IAAI,KAClB,MAAM,OAAO,MAAM,CAAC;KACrB;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,IAAmB;IACpC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,IAAmB;;IAC1C,OAAO,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,IAAI,MAAK,QAAQ,CAAC;AACxC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAmB;;IAC3C,OAAO,IAAI,IAAI,EAAE,KAAI,MAAA,IAAI,CAAC,MAAM,0CAAE,OAAO,CAAA,CAAC;AAC5C,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAmB;IAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,SAAS,IAAI,CAAC,MAAqB,EAAE,qBAAsC;;IACzE,MAAM,QAAQ,GAAG,MAAA,IAAA,oCAAe,EAAC,MAAM,CAAC,mCAAI,CAAC,CAAC;IAE9C,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE;QACxC,IACE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;YACpD,mBAAmB,CAAC,IAAI,CAAC;YACzB,CAAC,SAAS,CAAC,IAAI,CAAC,EAChB;YACA,MAAM,IAAI,KAAK,CACb,2DAA2D,MAAM,GAAG,CACrE,CAAC;SACH;KACF;AACH,CAAC;AAEM,KAAK,UAAU,2BAA2B,CAAC,OAMjD;;IACC,MAAM,sBAAsB,GAAG,MAAM,IAAA,2CAAmB,EACtD,OAAO,CAAC,eAAe,CACxB,CAAC;IAEF,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAA,OAAO,CAAC,cAAc,mCAAI,OAAO,CAAC,GAAG,EAAE,EAAE;QAC3E,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IAEH,MAAM,yBAAyB,GAAG,+BAA+B,CAC/D,cAAc,EACd,sBAAsB,EACtB,KAAK,CACN,CAAC;IAEF,CAAC,MAAA,OAAO,CAAC,WAAW,mCAAI,OAAO,CAAC,IAAI,CAAC,CACnC,aAAa,CAAC,yBAAyB,CAAC,CACzC,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,EAAE;QAClB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;KACjD;AACH,CAAC;AA7BD,kEA6BC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAEY,QAAA,OAAO,GAAG,IAAI,mBAAO,CAAC,+BAA+B,CAAC;KAChE,WAAW,CACV,gFAAgF,CACjF;KACA,MAAM,CACL,wBAAwB,EACxB,0CAA0C,EAC1C,kBAAkB,EAClB,EAAE,CACH;KACA,MAAM,CACL,wBAAwB,EACxB,2CAA2C,EAC3C,kBAAkB,EAClB,EAAE,CACH;KACA,MAAM,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;KACnE,MAAM,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;KACvD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,2BAA2B,CAAC;QAChC,eAAe,EAAE,OAAO,CAAC,YAAY;QACrC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"generate-vulnerability-report.js","sourceRoot":"","sources":["../../src/commands/generate-vulnerability-report.ts"],"names":[],"mappings":";;;;;;AAAA,2BAAoC;AACpC,oDAAuB;AAEvB,oEAA+D;AAS/D,oDAQ0B;AAE1B,yCAAoC;AACpC,kCAAqD;AAE9C,KAAK,UAAU,WAAW,CAC/B,KAAe;IAIf,OAAO,CACL,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,aAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CACjD,CACF,CACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAZD,kCAYC;AAOD,SAAS,+BAA+B,CACtC,eAAwC,EACxC,YAA0B,EAC1B,KAAsB;IAEtB,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEnE,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE;QACxC,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,EAAE;YAC1D,IAAI,iBAAiB,CAAC,IAAI,KAAK,SAAS,EAAE;gBACxC,OAAO;aACR;YAED,MAAM,gBAAgB,GAAsB,IAAA,qCAAqB,EAC/D,iBAAiB,EACjB,KAAK,CACN,CAAC;YAEF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE;gBAC9B,IACE,gBAAgB,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI;oBACzC,gBAAgB,CAAC,cAAc,KAAK,GAAG,CAAC,OAAO,EAC/C;oBACA,SAAS;iBACV;gBAED,MAAM,GAAG,GAAG,GAAG,gBAAgB,CAAC,WAAW,IAAI,gBAAgB,CAAC,cAAc,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBAExG,MAAM,eAAe,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACvD,IAAI,eAAe,EAAE;oBAEnB,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAClC,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,CACnE,CAAC;iBACH;qBAAM;oBACL,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;iBAClD;aACF;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,qBAAqB,GAAG,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC3E,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,aAAa,CAClD,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,cAAc,EAAE,CACvC,CACJ,CAAC;IAEF,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI,CACX,MAAqB,EACrB,qBAA0C;;IAE1C,MAAM,QAAQ,GAAG,MAAA,IAAA,+BAAe,EAAC,MAAM,CAAC,mCAAI,CAAC,CAAC;IAE9C,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE;QACxC,IACE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;YACpD,IAAA,mCAAmB,EAAC,IAAI,CAAC;YACzB,CAAC,IAAA,yBAAS,EAAC,IAAI,CAAC,EAChB;YACA,MAAM,IAAI,KAAK,CACb,2DAA2D,MAAM,GAAG,CACrE,CAAC;SACH;KACF;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,IAAuB;;IACnD,IAAI,CAAC,IAAA,mCAAmB,EAAC,IAAI,CAAC,EAAE;QAC9B,OAAO,uCAAuC,CAAC;KAChD;IAED,IAAI,IAAA,+BAAe,EAAC,IAAI,CAAC,EAAE;QACzB,MAAM,OAAO,GAAG,IAAA,gCAAgB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,WAAW,MAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,MAAM,mCAAI,SAAS,GAAG,OAAO,EAAE,CAAC;KAChE;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAXD,sCAWC;AAED,SAAgB,0BAA0B,CACxC,eAAoC;;IAEpC,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,MAAM,IAAI,qDAAqD,CAAC;IAChE,MAAM,IAAI,qDAAqD,CAAC;IAEhE,MAAM,WAAW,GAAG,gBAAC,CAAC,OAAO,CAC3B,eAAe,EACf,CAAC,OAAO,EAAE,MAAM,CAAC,EACjB,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE;QAC9B,MAAM,QAAQ,GAAG,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,GAAG,KAAK,IAAI,CAAC,QAAQ;aACpD,MAAM,CAAC,CAAC,CAAC;aACT,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEpC,MAAM,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,cAAc,MACpD,IAAI,CAAC,EACP,MAAM,QAAQ,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,OAAO,MAAM,CAAC;KACzE;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AA1BD,gEA0BC;AAEM,KAAK,UAAU,2BAA2B,CAAC,OAOjD;;IACC,MAAM,sBAAsB,GAAG,MAAM,IAAA,2CAAmB,EACtD,OAAO,CAAC,eAAe,CACxB,CAAC;IAEF,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,IAAA,mCAAmB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAEhE,MAAM,yBAAyB,GAAG,+BAA+B,CAC/D,cAAc,EACd,sBAAsB,EACtB,KAAK,CACN,CAAC;IAEF,CAAC,MAAA,OAAO,CAAC,WAAW,mCAAI,OAAO,CAAC,IAAI,CAAC,CACnC,8BACE,yBAAyB,CAAC,MAC5B;EACF,0BAA0B,CAAC,yBAAyB,CAAC,EAAE,CACtD,CAAC;IAEF,IAAI,OAAO,CAAC,gBAAgB,EAAE;QAC5B,MAAM,IAAA,iCAA0B,EAAC,yBAAyB,CAAC,CAAC;KAC7D;IAED,IAAI,OAAO,CAAC,MAAM,EAAE;QAClB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;KACjD;AACH,CAAC;AAnCD,kEAmCC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAEY,QAAA,OAAO,GAAG,IAAI,mBAAO,CAAC,+BAA+B,CAAC;KAChE,WAAW,CACV,gFAAgF,CACjF;KACA,MAAM,CACL,wBAAwB,EACxB,0CAA0C,EAC1C,kBAAkB,EAClB,EAAE,CACH;KACA,MAAM,CACL,wBAAwB,EACxB,2CAA2C,EAC3C,kBAAkB,EAClB,EAAE,CACH;KACA,MAAM,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;KACnE,MAAM,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;KACvD,MAAM,CACL,sBAAsB,EACtB,kDAAkD,CACnD;KACA,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,2BAA2B,CAAC;QAChC,eAAe,EAAE,OAAO,CAAC,YAAY;QACrC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/scan-node-js.d.ts

@@ -1,4 +1,4 @@
-import type { SnykTestProjectResult } from '../snyk-vulnerability';
+import type { SnykTestProjectResult } from '../vulnerability';
 import { Command } from 'commander';
 export declare function scanNodeJs({ version, }: {
     version: string;

package/dist/commands/scan-node-js.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan-node-js.d.ts","sourceRoot":"","sources":["../../src/commands/scan-node-js.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsHpC,wBAAsB,UAAU,CAAC,EAC/B,OAAO,GACR,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsBjC;AAED,eAAO,MAAM,OAAO,SAgBhB,CAAC"}
+{"version":3,"file":"scan-node-js.d.ts","sourceRoot":"","sources":["../../src/commands/scan-node-js.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuHpC,wBAAsB,UAAU,CAAC,EAC/B,OAAO,GACR,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsBjC;AAED,eAAO,MAAM,OAAO,SAgBhB,CAAC"}

package/dist/commands/scan-node-js.js

@@ -7,17 +7,21 @@ exports.command = exports.scanNodeJs = void 0;
 const node_fetch_1 = __importDefault(require("node-fetch"));
 const semver_1 = __importDefault(require("semver"));
 const nv_1 = __importDefault(require("@pkgjs/nv"));
-const snyk_vulnerability_1 = require("../snyk-vulnerability");
+const vulnerability_1 = require("../vulnerability");
+const vulnerability_2 = require("../vulnerability");
 const commander_1 = require("commander");
 async function formatVulnerability(id, nodeVulnerability, nodeVersion) {
     const score = await fetchScore(`NSWG-COR-${id}`, nodeVulnerability);
-    return (0, snyk_vulnerability_1.buildSnykVulnerability)({
+    return (0, vulnerability_2.vulnerabilityToSnyk)({
         id: `NSWG-COR-${id}`,
+        title: `NSWG-COR-${id}`,
         cves: nodeVulnerability.cve,
         fixedIn: (nodeVulnerability.patched || '').split(' || '),
         packageName: '.node.js',
         score,
-        url: nodeVulnerability.ref,
+        severity: (0, vulnerability_1.scoreToSeverity)(score),
+        urls: [{ title: 'Ref', url: nodeVulnerability.ref }],
+        origins: [`.node.js@${nodeVersion}`],
         packageVersion: nodeVersion,
         description: nodeVulnerability.overview,
         vulnerableSemver: nodeVulnerability.vulnerable,

package/dist/commands/scan-node-js.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan-node-js.js","sourceRoot":"","sources":["../../src/commands/scan-node-js.ts"],"names":[],"mappings":";;;;;;AAAA,4DAA+B;AAC/B,oDAA4B;AAC5B,mDAA2B;AAK3B,8DAA+D;AAC/D,yCAAoC;AAYpC,KAAK,UAAU,mBAAmB,CAChC,EAAU,EACV,iBAAoC,EACpC,WAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAEpE,OAAO,IAAA,2CAAsB,EAAC;QAC5B,EAAE,EAAE,YAAY,EAAE,EAAE;QACpB,IAAI,EAAE,iBAAiB,CAAC,GAAG;QAC3B,OAAO,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QAExD,WAAW,EAAE,UAAU;QACvB,KAAK;QAEL,GAAG,EAAE,iBAAiB,CAAC,GAAG;QAC1B,cAAc,EAAE,WAAW;QAC3B,WAAW,EAAE,iBAAiB,CAAC,QAAQ;QACvC,gBAAgB,EAAE,iBAAiB,CAAC,UAAU;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,iBAAoC;IAEpC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAChC,IAAA,oBAAK,EACH,0DAA0D,GAAG,EAAE,CAChE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,EAAE;QACJ,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;QACZ,CAAC,CAAC,OAAO,CAAC,MAAM,CACZ,IAAI,KAAK,CAAC,SAAS,GAAG,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC,CACxD,CACN,CACF,CACF,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,OAAO,CAAC,KAAK,CACX,4BAA4B,MAAM,KAAM,CAAW,CAAC,OAAO,EAAE,CAC9D,CAAC;QAEF,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,CAC7B,WAGG,EACH,EAAE;;QACF,OAAO,CACL,MAAA,MAAA,MAAA,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,0CAAE,QAAQ,0CAAE,SAAS,mCAClE,MAAA,MAAA,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,0CAAE,QAAQ,0CAAE,SAAS,CACrE,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,OAAO,GAA2B,IAAI,CAAC,GAAG,CAC9C,CAAC,GAAG,EAAE,EAAE;;QACN,OAAA,MAAA,MAAA,sBAAsB,CACpB,MAAA,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,eAAe,CAAC,CAAC,CAAC,0CAAE,GAAG,0CAAE,OAAO,0CAAE,aAAa,mCAAI,EAAE,CAC3D,mCACD,sBAAsB,CACpB,MAAA,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,eAAe,CAAC,CAAC,CAAC,0CAAE,GAAG,0CAAE,OAAO,0CAAE,aAAa,mCAAI,EAAE,CAC3D,mCACD,sBAAsB,CACpB,MAAA,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,eAAe,CAAC,CAAC,CAAC,0CAAE,GAAG,0CAAE,OAAO,0CAAE,YAAY,mCAAI,EAAE,CAC1D,CAAA;KAAA,CACJ,CAAC;IAEF,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE;QAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;YAC5B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACtB;KACF;IAKD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,GAAG,GACP,gFAAgF,CAAC;IAEnF,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAK,EAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;QAChB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;KACxD;IAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAA,YAAE,EAAC,WAAW,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;SAC1B,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,OAAO,gBAAM,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,EAC/B,OAAO,GAGR;IAGC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE;QACjC,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,4BAA4B,CAAC,CAAC;KACzE;IAED,MAAM,mBAAmB,GAAG,MAAM,cAAc,EAAE,CAAC;IAEnD,MAAM,UAAU,GAAG,EAAE,CAAC;IAEtB,KAAK,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE;QACrE,IACE,gBAAM,CAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC;YACnD,aAAa,CAAC,OAAO;YACrB,CAAC,gBAAM,CAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EACjD;YACA,UAAU,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;SACxE;KACF;IAED,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AA1BD,gCA0BC;AAEY,QAAA,OAAO,GAAG,IAAI,mBAAO,CAAC,cAAc,CAAC;KAC/C,WAAW,CAAC,gDAAgD,CAAC;KAC7D,MAAM,CACL,qBAAqB,EACrB,kEAAkE,CACnE;KACA,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CACZ,MAAM,UAAU,CAAC;QACf,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,EACF,IAAI,EACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"scan-node-js.js","sourceRoot":"","sources":["../../src/commands/scan-node-js.ts"],"names":[],"mappings":";;;;;;AAAA,4DAA+B;AAC/B,oDAA4B;AAC5B,mDAA2B;AAK3B,oDAAmD;AACnD,oDAAuD;AACvD,yCAAoC;AAYpC,KAAK,UAAU,mBAAmB,CAChC,EAAU,EACV,iBAAoC,EACpC,WAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAEpE,OAAO,IAAA,mCAAmB,EAAC;QACzB,EAAE,EAAE,YAAY,EAAE,EAAE;QACpB,KAAK,EAAE,YAAY,EAAE,EAAE;QACvB,IAAI,EAAE,iBAAiB,CAAC,GAAG;QAC3B,OAAO,EAAE,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACxD,WAAW,EAAE,UAAU;QACvB,KAAK;QACL,QAAQ,EAAE,IAAA,+BAAe,EAAC,KAAK,CAAC;QAChC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,CAAC,GAAG,EAAE,CAAC;QACpD,OAAO,EAAE,CAAC,YAAY,WAAW,EAAE,CAAC;QACpC,cAAc,EAAE,WAAW;QAC3B,WAAW,EAAE,iBAAiB,CAAC,QAAQ;QACvC,gBAAgB,EAAE,iBAAiB,CAAC,UAAU;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,iBAAoC;IAEpC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAChC,IAAA,oBAAK,EACH,0DAA0D,GAAG,EAAE,CAChE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,EAAE;QACJ,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;QACZ,CAAC,CAAC,OAAO,CAAC,MAAM,CACZ,IAAI,KAAK,CAAC,SAAS,GAAG,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC,CACxD,CACN,CACF,CACF,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,OAAO,CAAC,KAAK,CACX,4BAA4B,MAAM,KAAM,CAAW,CAAC,OAAO,EAAE,CAC9D,CAAC;QAEF,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,CAC7B,WAGG,EACH,EAAE;;QACF,OAAO,CACL,MAAA,MAAA,MAAA,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,0CAAE,QAAQ,0CAAE,SAAS,mCAClE,MAAA,MAAA,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,0CAAE,QAAQ,0CAAE,SAAS,CACrE,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,OAAO,GAA2B,IAAI,CAAC,GAAG,CAC9C,CAAC,GAAG,EAAE,EAAE;;QACN,OAAA,MAAA,MAAA,sBAAsB,CACpB,MAAA,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,eAAe,CAAC,CAAC,CAAC,0CAAE,GAAG,0CAAE,OAAO,0CAAE,aAAa,mCAAI,EAAE,CAC3D,mCACD,sBAAsB,CACpB,MAAA,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,eAAe,CAAC,CAAC,CAAC,0CAAE,GAAG,0CAAE,OAAO,0CAAE,aAAa,mCAAI,EAAE,CAC3D,mCACD,sBAAsB,CACpB,MAAA,MAAA,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,eAAe,CAAC,CAAC,CAAC,0CAAE,GAAG,0CAAE,OAAO,0CAAE,YAAY,mCAAI,EAAE,CAC1D,CAAA;KAAA,CACJ,CAAC;IAEF,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE;QAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;YAC5B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACtB;KACF;IAKD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,GAAG,GACP,gFAAgF,CAAC;IAEnF,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAK,EAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;QAChB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;KACxD;IAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAA,YAAE,EAAC,WAAW,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;SAC1B,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,OAAO,gBAAM,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,EAC/B,OAAO,GAGR;IAGC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE;QACjC,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,4BAA4B,CAAC,CAAC;KACzE;IAED,MAAM,mBAAmB,GAAG,MAAM,cAAc,EAAE,CAAC;IAEnD,MAAM,UAAU,GAAG,EAAE,CAAC;IAEtB,KAAK,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE;QACrE,IACE,gBAAM,CAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC;YACnD,aAAa,CAAC,OAAO;YACrB,CAAC,gBAAM,CAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EACjD;YACA,UAAU,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;SACxE;KACF;IAED,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AA1BD,gCA0BC;AAEY,QAAA,OAAO,GAAG,IAAI,mBAAO,CAAC,cAAc,CAAC;KAC/C,WAAW,CAAC,gDAAgD,CAAC;KAC7D,MAAM,CACL,qBAAqB,EACrB,kEAAkE,CACnE;KACA,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CACZ,MAAM,UAAU,CAAC;QACf,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,EACF,IAAI,EACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/jira.d.ts

@@ -0,0 +1,4 @@
+import type { VulnerabilityInfo } from './vulnerability';
+export declare const buildJiraDescription: (vulnerability: VulnerabilityInfo) => string;
+export declare function createVulnerabilityTickets(vulnerabilities: VulnerabilityInfo[]): Promise<void>;
+//# sourceMappingURL=jira.d.ts.map

package/dist/jira.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jira.d.ts","sourceRoot":"","sources":["../src/jira.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAY,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAwInE,eAAO,MAAM,oBAAoB,kBAChB,iBAAiB,KAC/B,MAkCF,CAAC;AAEF,wBAAsB,0BAA0B,CAC9C,eAAe,EAAE,iBAAiB,EAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAyCf"}

package/dist/jira.js

@@ -0,0 +1,161 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createVulnerabilityTickets = exports.buildJiraDescription = void 0;
+const node_fetch_1 = __importDefault(require("node-fetch"));
+const vulnerability_1 = require("./vulnerability");
+const vulnerability_2 = require("./vulnerability");
+const formatDueDate = (date) => {
+    const yy = date.getFullYear();
+    const MM = String(date.getMonth() + 1).padStart(2, '0');
+    const dd = String(date.getDate()).padStart(2, '0');
+    return `${yy}-${MM}-${dd}`;
+};
+async function createJiraTicket(jiraBaseUrl, auth, issue) {
+    var _a, _b;
+    jiraBaseUrl = jiraBaseUrl.replace(/\/$/, '');
+    const issueApiUrl = `${jiraBaseUrl}/rest/api/2/issue/`;
+    const headers = {
+        Authorization: `Bearer ${auth.token}`,
+        Accept: 'application/json',
+    };
+    const jqlQuery = new URLSearchParams({
+        jql: `project="${issue.project}" AND issuetype="${issue.issueType}" AND resolution=Unresolved AND summary~"${issue.summary}"`,
+    }).toString();
+    const searchApiUrl = `${jiraBaseUrl}/rest/api/2/search?${jqlQuery}`;
+    const exists = await (0, node_fetch_1.default)(searchApiUrl, {
+        method: 'GET',
+        headers: {
+            ...headers,
+        },
+    }).then(async (res) => res.ok
+        ? (await res.json()).total > 0
+        : Promise.reject(new Error(`HTTP error: ${res.status}. ${await res.text()}`)));
+    if (exists) {
+        console.info(`The ${issue.issueType} ticket ${issue.project} - ${issue.summary}, already exists.`);
+        return;
+    }
+    const response = await (0, node_fetch_1.default)(issueApiUrl, {
+        method: 'POST',
+        headers: {
+            ...headers,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+            fields: {
+                project: {
+                    key: issue.project,
+                },
+                summary: issue.summary,
+                description: issue.description,
+                issuetype: {
+                    name: issue.issueType,
+                },
+                components: issue.components.length
+                    ? issue.components.map((c) => ({ name: c }))
+                    : undefined,
+                labels: issue.labels.length ? issue.labels : undefined,
+                priority: {
+                    name: issue.priority,
+                },
+                duedate: formatDueDate(issue.dueDate),
+            },
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`HTTP error: ${response.status}.`);
+    }
+    const key = (_b = (_a = (await response.json())) === null || _a === void 0 ? void 0 : _a.res) === null || _b === void 0 ? void 0 : _b.key;
+    console.info('Created issue: ', `${jiraBaseUrl}/browse/${key}`);
+}
+const JIRA_ISSUE_TYPE = 'Build Failure';
+function severityToJiraPriority(severity) {
+    if (severity === 'high') {
+        return 'Critical - P2';
+    }
+    if (severity === 'medium') {
+        return 'Major - P3';
+    }
+    if (severity === 'low') {
+        return 'Minor - P4';
+    }
+    return 'Blocker - P1';
+}
+function severityToDueDate(severity) {
+    const triageSlaDays = 2;
+    const resolutionSlaDays = severity === 'high'
+        ? 5
+        : severity === 'medium'
+            ? 6 * 7
+            : severity === 'low'
+                ? 12 * 7
+                :
+                    1;
+    return new Date(new Date().getTime() +
+        triageSlaDays +
+        resolutionSlaDays * 24 * 60 * 60 * 1000);
+}
+const buildJiraDescription = (vulnerability) => {
+    var _a, _b;
+    return (`h4. Vulnerability Details
+
+- *Affected Package*: ${vulnerability.packageName}
+- *Affected Version*: ${vulnerability.packageVersion}
+- *Fixed In*: ${((_a = vulnerability.fixedIn) === null || _a === void 0 ? void 0 : _a.length) ? vulnerability.fixedIn.join(', ') : 'N/A'}
+- *Severity*: ${vulnerability.severity}
+- *Cvss score*: ${(_b = vulnerability.score) !== null && _b !== void 0 ? _b : '-'}
+
+h4. Vulnerability Description
+
+{panel:title=${vulnerability.title}}
+${vulnerability.description}
+{panel}
+
+h4. Vulnerable Paths
+
+${vulnerability.origins.map((o) => `# {{${o}}}`).join('\n')}
+
+h4. Links
+
+${vulnerability.urls.map((l) => `- [${l.title}|${l.url}]`).join('\n')}
+` +
+        (process.env.JIRA_VULNERABILITY_BUILD_INFO
+            ? `
+h4. Build Info
+
+${process.env.JIRA_VULNERABILITY_BUILD_INFO}
+`
+            : ''));
+};
+exports.buildJiraDescription = buildJiraDescription;
+async function createVulnerabilityTickets(vulnerabilities) {
+    if (!process.env.JIRA_BASE_URL ||
+        !process.env.JIRA_API_TOKEN ||
+        !process.env.JIRA_PROJECT) {
+        const missingEnv = ['JIRA_BASE_URL', 'JIRA_API_TOKEN', 'JIRA_PROJECT']
+            .filter((k) => !process.env[k])
+            .join(', ');
+        throw new Error(`Missing required variables to create Jira tickets: ${missingEnv}`);
+    }
+    for (const vulnerability of vulnerabilities) {
+        if ((0, vulnerability_2.isIgnored)(vulnerability)) {
+            return;
+        }
+        await createJiraTicket(process.env.JIRA_BASE_URL, {
+            token: process.env.JIRA_API_TOKEN,
+        }, {
+            project: process.env.JIRA_PROJECT,
+            summary: `Vulnerability ${vulnerability.id} found on ${vulnerability.packageName}@${vulnerability.packageVersion}${(0, vulnerability_1.hasExpiredPolicy)(vulnerability) ? ' (Policy Expired)' : ''}`,
+            description: (0, exports.buildJiraDescription)(vulnerability),
+            components: ['Vulnerability Management'],
+            labels: [],
+            priority: severityToJiraPriority(vulnerability.severity),
+            issueType: JIRA_ISSUE_TYPE,
+            dueDate: severityToDueDate(vulnerability.severity),
+        });
+    }
+}
+exports.createVulnerabilityTickets = createVulnerabilityTickets;
+//# sourceMappingURL=jira.js.map

package/dist/jira.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jira.js","sourceRoot":"","sources":["../src/jira.ts"],"names":[],"mappings":";;;;;;AAAA,4DAA+B;AAE/B,mDAAmD;AACnD,mDAA4C;AAE5C,MAAM,aAAa,GAAG,CAAC,IAAU,EAAU,EAAE;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEnD,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;AAC7B,CAAC,CAAC;AAEF,KAAK,UAAU,gBAAgB,CAC7B,WAAmB,EACnB,IAEC,EACD,KASC;;IAED,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,GAAG,WAAW,oBAAoB,CAAC;IAEvD,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;QACrC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;QACnC,GAAG,EAAE,YAAY,KAAK,CAAC,OAAO,oBAAoB,KAAK,CAAC,SAAS,4CAA4C,KAAK,CAAC,OAAO,GAAG;KAC9H,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,MAAM,YAAY,GAAG,GAAG,WAAW,sBAAsB,QAAQ,EAAE,CAAC;IAEpE,MAAM,MAAM,GAAG,MAAM,IAAA,oBAAK,EAAC,YAAY,EAAE;QACvC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,GAAG,OAAO;SACX;KACF,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACpB,GAAG,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC;QAC9B,CAAC,CAAC,OAAO,CAAC,MAAM,CACZ,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAC5D,CACN,CAAC;IAEF,IAAI,MAAM,EAAE;QACV,OAAO,CAAC,IAAI,CACV,OAAO,KAAK,CAAC,SAAS,WAAW,KAAK,CAAC,OAAO,MAAM,KAAK,CAAC,OAAO,mBAAmB,CACrF,CAAC;QACF,OAAO;KACR;IAED,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAK,EAAC,WAAW,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,GAAG,OAAO;YACV,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,MAAM,EAAE;gBACN,OAAO,EAAE;oBACP,GAAG,EAAE,KAAK,CAAC,OAAO;iBACnB;gBACD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE;oBACT,IAAI,EAAE,KAAK,CAAC,SAAS;iBACtB;gBACD,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;oBACjC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;oBACpD,CAAC,CAAC,SAAS;gBACb,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBACtD,QAAQ,EAAE;oBACR,IAAI,EAAE,KAAK,CAAC,QAAQ;iBACrB;gBACD,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;aACtC;SACF,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;QAChB,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;KACpD;IAED,MAAM,GAAG,GAAW,MAAA,MAAA,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,0CAAE,GAAG,0CAAE,GAAG,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,WAAW,WAAW,GAAG,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,eAAe,GAAG,eAAe,CAAC;AAExC,SAAS,sBAAsB,CAAC,QAAkB;IAChD,IAAI,QAAQ,KAAK,MAAM,EAAE;QACvB,OAAO,eAAe,CAAC;KACxB;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE;QACzB,OAAO,YAAY,CAAC;KACrB;IAED,IAAI,QAAQ,KAAK,KAAK,EAAE;QACtB,OAAO,YAAY,CAAC;KACrB;IAGD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAkB;IAC3C,MAAM,aAAa,GAAG,CAAC,CAAC;IACxB,MAAM,iBAAiB,GACrB,QAAQ,KAAK,MAAM;QACjB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,QAAQ,KAAK,QAAQ;YACvB,CAAC,CAAC,CAAC,GAAe,CAAC;YACnB,CAAC,CAAC,QAAQ,KAAK,KAAK;gBACpB,CAAC,CAAC,EAAE,GAAe,CAAC;gBACpB,CAAC;oBACC,CAAC,CAAC;IAER,OAAO,IAAI,IAAI,CACb,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE;QAClB,aAAa;QACb,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAC1C,CAAC;AACJ,CAAC;AAEM,MAAM,oBAAoB,GAAG,CAClC,aAAgC,EACxB,EAAE;;IACV,OAAO,CACL;;wBAEoB,aAAa,CAAC,WAAW;wBACzB,aAAa,CAAC,cAAc;gBAE9C,CAAA,MAAA,aAAa,CAAC,OAAO,0CAAE,MAAM,EAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KACrE;gBACY,aAAa,CAAC,QAAQ;kBACpB,MAAA,aAAa,CAAC,KAAK,mCAAI,GAAG;;;;eAI7B,aAAa,CAAC,KAAK;EAChC,aAAa,CAAC,WAAW;;;;;EAKzB,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;EAIzD,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CACpE;QACG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B;YACxC,CAAC,CAAC;;;EAGN,OAAO,CAAC,GAAG,CAAC,6BAA6B;CAC1C;YACK,CAAC,CAAC,EAAE,CAAC,CACR,CAAC;AACJ,CAAC,CAAC;AApCW,QAAA,oBAAoB,wBAoC/B;AAEK,KAAK,UAAU,0BAA0B,CAC9C,eAAoC;IAEpC,IACE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;QAC1B,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;QAC3B,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EACzB;QACA,MAAM,UAAU,GAAG,CAAC,eAAe,EAAE,gBAAgB,EAAE,cAAc,CAAC;aACnE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aAC9B,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,EAAE,CACnE,CAAC;KACH;IAED,KAAK,MAAM,aAAa,IAAI,eAAe,EAAE;QAC3C,IAAI,IAAA,yBAAS,EAAC,aAAa,CAAC,EAAE;YAC5B,OAAO;SACR;QAED,MAAM,gBAAgB,CACpB,OAAO,CAAC,GAAG,CAAC,aAAa,EACzB;YACE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;SAClC,EACD;YACE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;YACjC,OAAO,EAAE,iBAAiB,aAAa,CAAC,EAAE,aACxC,aAAa,CAAC,WAChB,IAAI,aAAa,CAAC,cAAc,GAC9B,IAAA,gCAAgB,EAAC,aAAa,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAC1D,EAAE;YACF,WAAW,EAAE,IAAA,4BAAoB,EAAC,aAAa,CAAC;YAChD,UAAU,EAAE,CAAC,0BAA0B,CAAC;YACxC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC;YACxD,SAAS,EAAE,eAAe;YAC1B,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC;SACnD,CACF,CAAC;KACH;AACH,CAAC;AA3CD,gEA2CC"}

package/dist/{snyk-vulnerability.d.ts → vulnerability.d.ts}

@@ -1,10 +1,31 @@
 export declare type KnownSeverity = 'low' | 'medium' | 'high' | 'critical';
 export declare type Severity = KnownSeverity | 'unknown';
-declare type Score = number | undefined;
-export declare function severityToScore(severity: Severity): Score;
-export declare function scoreToSeverity(score: number | undefined): Severity;
+export declare type SnykPolicyRules = any;
+export declare type VulnerabilityInfo = {
+    id: string;
+    score?: number;
+    fixedIn: string[];
+    origins: string[];
+    severity: Severity;
+    title: string;
+    description: string;
+    packageName: string;
+    packageVersion: string;
+    vulnerableSemver: string;
+    cves: string[];
+    policy?: {
+        type: 'ignore';
+        reason: string;
+        expires: any;
+    };
+    urls: {
+        title: string;
+        url: string;
+    }[];
+};
 export declare type SnykVulnerability = {
     id: string;
+    type?: 'license';
     title: string;
     CVSSv3: string;
     credit: string[];
@@ -54,16 +75,15 @@ export declare type SnykVulnerability = {
 export declare type SnykTestProjectResult = {
     vulnerabilities: SnykVulnerability[];
 };
-export declare function buildSnykVulnerability({ id, packageName, packageVersion, score, cves, vulnerableSemver, fixedIn, description, url, }: {
-    cves: string[];
-    fixedIn: string[];
-    id: string;
-    description?: string;
-    packageName: string;
-    score: number | undefined;
-    url?: string;
-    packageVersion: string;
-    vulnerableSemver: string;
-}): SnykVulnerability | PromiseLike<SnykVulnerability>;
+declare type Score = number | undefined;
+export declare function severityToScore(severity: Severity): Score;
+export declare function scoreToSeverity(score: number | undefined): Severity;
+export declare function vulnerabilityToSnyk(vulnerability: VulnerabilityInfo): SnykVulnerability | PromiseLike<SnykVulnerability>;
+export declare function vulnerabilityFromSnyk(snykVulnerability: SnykVulnerability, rules: SnykPolicyRules): VulnerabilityInfo;
+export declare const loadSnykPolicyRules: (snykPolicyPath: string | undefined) => Promise<SnykPolicyRules>;
+export declare function isIgnored(vulnerability: VulnerabilityInfo): boolean;
+export declare function hasIgnorePolicy(vulnerability: VulnerabilityInfo): boolean;
+export declare function hasExpiredPolicy(vulnerability: VulnerabilityInfo): boolean;
+export declare function hasKnownRemediation(vulnerability: VulnerabilityInfo): boolean;
 export {};
-//# sourceMappingURL=snyk-vulnerability.d.ts.map
+//# sourceMappingURL=vulnerability.d.ts.map

package/dist/vulnerability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability.d.ts","sourceRoot":"","sources":["../src/vulnerability.ts"],"names":[],"mappings":"AAGA,oBAAY,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AACnE,oBAAY,QAAQ,GAAG,aAAa,GAAG,SAAS,CAAC;AAEjD,oBAAY,eAAe,GAAG,GAAG,CAAC;AAElC,oBAAY,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,GAAG,CAAC;KACd,CAAC;IACF,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxC,CAAC;AAEF,oBAAY,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE;QACN,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE;QACR,YAAY,EAAE,IAAI,CAAC;KACpB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,KAAK,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE;QACV,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;KACf,EAAE,CAAC;IACJ,WAAW,EAAE,KAAK,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,EAAE;QACX,GAAG,EAAE,MAAM,EAAE,CAAC;KACf,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,KAAK,EAAE,CAAC;IACvB,cAAc,EAAE,KAAK,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,QAAQ,CAAC;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,KAAK,EAAE,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,oBAAY,qBAAqB,GAAG;IAClC,eAAe,EAAE,iBAAiB,EAAE,CAAC;CACtC,CAAC;AAEF,aAAK,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAUhC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAEzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAenE;AAED,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,iBAAiB,GAC/B,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,CAAC,CA2DpD;AAED,wBAAgB,qBAAqB,CACnC,iBAAiB,EAAE,iBAAiB,EACpC,KAAK,EAAE,eAAe,GACrB,iBAAiB,CAwCnB;AAED,eAAO,MAAM,mBAAmB,mBACd,MAAM,GAAG,SAAS,KACjC,QAAQ,eAAe,CAGtB,CAAC;AAEL,wBAAgB,SAAS,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAEnE;AAED,wBAAgB,eAAe,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAEzE;AAED,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAE1E;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAE7E"}

package/dist/vulnerability.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasKnownRemediation = exports.hasExpiredPolicy = exports.hasIgnorePolicy = exports.isIgnored = exports.loadSnykPolicyRules = exports.vulnerabilityFromSnyk = exports.vulnerabilityToSnyk = exports.scoreToSeverity = exports.severityToScore = void 0;
+const snykPolicy = require('snyk-policy');
+const SEVERITY_TO_SCORE = {
+    low: 0,
+    medium: 4,
+    high: 7,
+    critical: 9,
+    unknown: undefined,
+};
+function severityToScore(severity) {
+    return SEVERITY_TO_SCORE[severity];
+}
+exports.severityToScore = severityToScore;
+function scoreToSeverity(score) {
+    if (score === undefined) {
+        return 'unknown';
+    }
+    if (score >= 9) {
+        return 'critical';
+    }
+    if (score >= 7) {
+        return 'high';
+    }
+    if (score >= 4) {
+        return 'medium';
+    }
+    return 'low';
+}
+exports.scoreToSeverity = scoreToSeverity;
+function vulnerabilityToSnyk(vulnerability) {
+    const { id, packageName, packageVersion, score, cves, vulnerableSemver, fixedIn, description, urls, } = vulnerability;
+    const severity = scoreToSeverity(score);
+    return {
+        id,
+        title: id,
+        CVSSv3: '-',
+        credit: ['-'],
+        semver: {
+            vulnerable: vulnerableSemver,
+        },
+        exploit: '-',
+        patched: fixedIn,
+        patches: [],
+        fixedIn: fixedIn,
+        insights: {
+            triageAdvice: null,
+        },
+        language: 'js',
+        severity: severity,
+        cvssScore: score,
+        functions: [],
+        moduleName: packageName,
+        references: urls,
+        cvssDetails: [],
+        description: description !== null && description !== void 0 ? description : '',
+        epssDetails: null,
+        identifiers: {
+            CVE: cves,
+        },
+        packageName: packageName,
+        proprietary: true,
+        creationTime: '-',
+        functions_new: [],
+        alternativeIds: [],
+        disclosureTime: '-',
+        packageManager: 'npm',
+        publicationTime: '-',
+        modificationTime: '-',
+        socialTrendAlert: false,
+        severityWithCritical: severity,
+        from: [`${packageName}@${packageVersion}`],
+        upgradePath: [],
+        isUpgradable: true,
+        isPatchable: false,
+        name: packageName,
+        version: packageVersion,
+    };
+}
+exports.vulnerabilityToSnyk = vulnerabilityToSnyk;
+function vulnerabilityFromSnyk(snykVulnerability, rules) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const urls = [];
+    if ((_a = snykVulnerability.id) === null || _a === void 0 ? void 0 : _a.startsWith('NSWG-COR-')) {
+        const id = snykVulnerability.id.split('-').reverse()[0];
+        urls.push({
+            title: snykVulnerability.id,
+            url: `https://github.com/nodejs/security-wg/blob/main/vuln/core/${id}.json`,
+        });
+    }
+    else {
+        urls.push({
+            title: snykVulnerability.id,
+            url: `https://security.snyk.io/vuln/${snykVulnerability.id}`,
+        });
+        urls.push({
+            title: `${snykVulnerability.name}@${snykVulnerability.version} vulnerabilities`,
+            url: `https://security.snyk.io/package/npm/${snykVulnerability.name}/${snykVulnerability.version}`,
+        });
+    }
+    for (const cve of (_c = (_b = snykVulnerability.identifiers) === null || _b === void 0 ? void 0 : _b.CVE) !== null && _c !== void 0 ? _c : []) {
+        urls.push({ title: cve, url: `https://nvd.nist.gov/vuln/detail/${cve}` });
+    }
+    return {
+        packageName: snykVulnerability.name,
+        packageVersion: snykVulnerability.version,
+        id: snykVulnerability.id,
+        score: snykVulnerability.cvssScore,
+        severity: snykVulnerability.severity,
+        title: snykVulnerability.title,
+        description: snykVulnerability.description,
+        fixedIn: snykVulnerability.fixedIn,
+        cves: (_e = (_d = snykVulnerability.identifiers) === null || _d === void 0 ? void 0 : _d.CVE) !== null && _e !== void 0 ? _e : [],
+        origins: snykVulnerability.from ? [snykVulnerability.from.join(' > ')] : [],
+        vulnerableSemver: (_g = (_f = snykVulnerability.semver) === null || _f === void 0 ? void 0 : _f.vulnerable) !== null && _g !== void 0 ? _g : snykVulnerability.version,
+        policy: snykPolicy.getByVuln(rules, snykVulnerability),
+        urls: urls,
+    };
+}
+exports.vulnerabilityFromSnyk = vulnerabilityFromSnyk;
+const loadSnykPolicyRules = async (snykPolicyPath) => await snykPolicy.load(snykPolicyPath !== null && snykPolicyPath !== void 0 ? snykPolicyPath : process.cwd(), {
+    loose: true,
+});
+exports.loadSnykPolicyRules = loadSnykPolicyRules;
+function isIgnored(vulnerability) {
+    return hasIgnorePolicy(vulnerability) && !hasExpiredPolicy(vulnerability);
+}
+exports.isIgnored = isIgnored;
+function hasIgnorePolicy(vulnerability) {
+    var _a;
+    return ((_a = vulnerability.policy) === null || _a === void 0 ? void 0 : _a.type) === 'ignore';
+}
+exports.hasIgnorePolicy = hasIgnorePolicy;
+function hasExpiredPolicy(vulnerability) {
+    var _a;
+    return new Date() >= ((_a = vulnerability.policy) === null || _a === void 0 ? void 0 : _a.expires);
+}
+exports.hasExpiredPolicy = hasExpiredPolicy;
+function hasKnownRemediation(vulnerability) {
+    return !!vulnerability.fixedIn.length;
+}
+exports.hasKnownRemediation = hasKnownRemediation;
+//# sourceMappingURL=vulnerability.js.map

package/dist/vulnerability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability.js","sourceRoot":"","sources":["../src/vulnerability.ts"],"names":[],"mappings":";;;AACA,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AAmF1C,MAAM,iBAAiB,GAA4B;IACjD,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,SAAS;CACnB,CAAC;AAEF,SAAgB,eAAe,CAAC,QAAkB;IAChD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAFD,0CAEC;AAED,SAAgB,eAAe,CAAC,KAAyB;IACvD,IAAI,KAAK,KAAK,SAAS,EAAE;QACvB,OAAO,SAAS,CAAC;KAClB;IAED,IAAI,KAAK,IAAI,CAAC,EAAE;QACd,OAAO,UAAU,CAAC;KACnB;IACD,IAAI,KAAK,IAAI,CAAC,EAAE;QACd,OAAO,MAAM,CAAC;KACf;IACD,IAAI,KAAK,IAAI,CAAC,EAAE;QACd,OAAO,QAAQ,CAAC;KACjB;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAfD,0CAeC;AAED,SAAgB,mBAAmB,CACjC,aAAgC;IAEhC,MAAM,EACJ,EAAE,EACF,WAAW,EACX,cAAc,EACd,KAAK,EACL,IAAI,EACJ,gBAAgB,EAChB,OAAO,EACP,WAAW,EACX,IAAI,GACL,GAAG,aAAa,CAAC;IAElB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO;QACL,EAAE;QACF,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,CAAC,GAAG,CAAC;QACb,MAAM,EAAE;YACN,UAAU,EAAE,gBAAgB;SAC7B;QACD,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE;YACR,YAAY,EAAE,IAAI;SACnB;QACD,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,EAAE;QAC9B,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE;YACX,GAAG,EAAE,IAAI;SACV;QACD,WAAW,EAAE,WAAW;QACxB,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,GAAG;QACnB,cAAc,EAAE,KAAK;QACrB,eAAe,EAAE,GAAG;QACpB,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,KAAK;QACvB,oBAAoB,EAAE,QAAQ;QAC9B,IAAI,EAAE,CAAC,GAAG,WAAW,IAAI,cAAc,EAAE,CAAC;QAC1C,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,KAAK;QAClB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC;AACJ,CAAC;AA7DD,kDA6DC;AAED,SAAgB,qBAAqB,CACnC,iBAAoC,EACpC,KAAsB;;IAEtB,MAAM,IAAI,GAAG,EAAE,CAAC;IAEhB,IAAI,MAAA,iBAAiB,CAAC,EAAE,0CAAE,UAAU,CAAC,WAAW,CAAC,EAAE;QACjD,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC;YACR,KAAK,EAAE,iBAAiB,CAAC,EAAE;YAC3B,GAAG,EAAE,6DAA6D,EAAE,OAAO;SAC5E,CAAC,CAAC;KACJ;SAAM;QACL,IAAI,CAAC,IAAI,CAAC;YACR,KAAK,EAAE,iBAAiB,CAAC,EAAE;YAC3B,GAAG,EAAE,iCAAiC,iBAAiB,CAAC,EAAE,EAAE;SAC7D,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC;YACR,KAAK,EAAE,GAAG,iBAAiB,CAAC,IAAI,IAAI,iBAAiB,CAAC,OAAO,kBAAkB;YAC/E,GAAG,EAAE,wCAAwC,iBAAiB,CAAC,IAAI,IAAI,iBAAiB,CAAC,OAAO,EAAE;SACnG,CAAC,CAAC;KACJ;IAED,KAAK,MAAM,GAAG,IAAI,MAAA,MAAA,iBAAiB,CAAC,WAAW,0CAAE,GAAG,mCAAI,EAAE,EAAE;QAC1D,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,oCAAoC,GAAG,EAAE,EAAE,CAAC,CAAC;KAC3E;IAED,OAAO;QACL,WAAW,EAAE,iBAAiB,CAAC,IAAI;QACnC,cAAc,EAAE,iBAAiB,CAAC,OAAO;QACzC,EAAE,EAAE,iBAAiB,CAAC,EAAE;QACxB,KAAK,EAAE,iBAAiB,CAAC,SAAS;QAClC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;QACpC,KAAK,EAAE,iBAAiB,CAAC,KAAK;QAC9B,WAAW,EAAE,iBAAiB,CAAC,WAAW;QAC1C,OAAO,EAAE,iBAAiB,CAAC,OAAO;QAClC,IAAI,EAAE,MAAA,MAAA,iBAAiB,CAAC,WAAW,0CAAE,GAAG,mCAAI,EAAE;QAC9C,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QAC3E,gBAAgB,EACd,MAAA,MAAA,iBAAiB,CAAC,MAAM,0CAAE,UAAU,mCAAI,iBAAiB,CAAC,OAAO;QACnE,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC;QACtD,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AA3CD,sDA2CC;AAEM,MAAM,mBAAmB,GAAG,KAAK,EACtC,cAAkC,EACR,EAAE,CAC5B,MAAM,UAAU,CAAC,IAAI,CAAC,cAAc,aAAd,cAAc,cAAd,cAAc,GAAI,OAAO,CAAC,GAAG,EAAE,EAAE;IACrD,KAAK,EAAE,IAAI;CACZ,CAAC,CAAC;AALQ,QAAA,mBAAmB,uBAK3B;AAEL,SAAgB,SAAS,CAAC,aAAgC;IACxD,OAAO,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;AAC5E,CAAC;AAFD,8BAEC;AAED,SAAgB,eAAe,CAAC,aAAgC;;IAC9D,OAAO,CAAA,MAAA,aAAa,CAAC,MAAM,0CAAE,IAAI,MAAK,QAAQ,CAAC;AACjD,CAAC;AAFD,0CAEC;AAED,SAAgB,gBAAgB,CAAC,aAAgC;;IAC/D,OAAO,IAAI,IAAI,EAAE,KAAI,MAAA,aAAa,CAAC,MAAM,0CAAE,OAAO,CAAA,CAAC;AACrD,CAAC;AAFD,4CAEC;AAED,SAAgB,mBAAmB,CAAC,aAAgC;IAClE,OAAO,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;AACxC,CAAC;AAFD,kDAEC"}

package/dist/webpack-dependencies-plugin.d.ts

@@ -13,7 +13,8 @@ export declare class WebpackDependenciesPlugin implements WebpackPluginInstance
     includePackages: string[];
     constructor(options?: WebpackDependenciesPluginOptions);
     private isThirdPartyModule;
-    private handleTap;
+    private getWebpackModulePath;
+    private addIncludedPackages;
     apply(compiler: Compiler): void;
 }
 export default WebpackDependenciesPlugin;

package/dist/webpack-dependencies-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webpack-dependencies-plugin.d.ts","sourceRoot":"","sources":["../src/webpack-dependencies-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAe,QAAQ,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAW5E,oBAAY,gCAAgC,GAAG;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,qCAAqC,CAAC,EAAE,OAAO,CAAC;CACjD,CAAC;AAMF,qBAAa,yBAA0B,YAAW,qBAAqB;IAOzD,OAAO,CAAC,OAAO;IAN3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,cAAqB;IACpC,qCAAqC,EAAE,OAAO,CAAC;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAM;gBAEX,OAAO,GAAE,gCAAqC;IAOlE,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,SAAS,CA8Bf;IAEF,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;CA4BhC;AAED,eAAe,yBAAyB,CAAC"}
+{"version":3,"file":"webpack-dependencies-plugin.d.ts","sourceRoot":"","sources":["../src/webpack-dependencies-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAa/D,oBAAY,gCAAgC,GAAG;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,qCAAqC,CAAC,EAAE,OAAO,CAAC;CACjD,CAAC;AAMF,qBAAa,yBAA0B,YAAW,qBAAqB;IAOzD,OAAO,CAAC,OAAO;IAN3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,cAAqB;IACpC,qCAAqC,EAAE,OAAO,CAAC;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAM;gBAEX,OAAO,GAAE,gCAAqC;IAOlE,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,mBAAmB;IAmB3B,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI;CAwDhC;AAED,eAAe,yBAAyB,CAAC"}

package/dist/webpack-dependencies-plugin.js

@@ -7,6 +7,7 @@ exports.WebpackDependenciesPlugin = void 0;
 const path_1 = __importDefault(require("path"));
 const fs_1 = require("fs");
 const lodash_1 = __importDefault(require("lodash"));
+const error_stack_parser_1 = __importDefault(require("error-stack-parser"));
 const production_deps_1 = require("./production-deps");
 const get_package_info_1 = require("./get-package-info");
 const PLUGIN_NAME = 'WebpackDependenciesPlugin';
@@ -17,30 +18,6 @@ class WebpackDependenciesPlugin {
         this.pluginName = PLUGIN_NAME;
         this.resolvedModules = new Set();
         this.includePackages = [];
-        this.handleTap = (compilation) => {
-            for (const module of compilation.modules) {
-                const resource = module.resource;
-                if (resource) {
-                    const modulePath = resource;
-                    if (typeof modulePath === 'string' &&
-                        this.isThirdPartyModule(modulePath)) {
-                        this.resolvedModules.add(modulePath);
-                    }
-                }
-            }
-            const includePackages = [
-                ...(this.includeExternalProductionDependencies
-                    ? (0, production_deps_1.findAllProdDepsTreeLocations)(compilation.compiler.context)
-                    : []),
-                ...(this.includePackages || []).map((packageName) => (0, production_deps_1.findPackageLocation)(packageName, compilation.compiler.context)),
-            ];
-            for (const includedPackagePath of includePackages) {
-                const packageJsonPath = path_1.default.join(includedPackagePath, 'package.json');
-                if (packageJsonPath) {
-                    this.resolvedModules.add(packageJsonPath);
-                }
-            }
-        };
         this.includeExternalProductionDependencies =
             (_a = options.includeExternalProductionDependencies) !== null && _a !== void 0 ? _a : false;
         this.includePackages = (_b = options.includePackages) !== null && _b !== void 0 ? _b : [];
@@ -49,7 +26,46 @@ class WebpackDependenciesPlugin {
     isThirdPartyModule(modulePath) {
         return modulePath.split(path_1.default.sep).includes('node_modules');
     }
+    getWebpackModulePath(error) {
+        const stack = error_stack_parser_1.default.parse(error);
+        const webpackEntry = stack.find((entry) => {
+            var _a;
+            return (_a = entry.fileName) === null || _a === void 0 ? void 0 : _a.split(path_1.default.win32.sep).join(path_1.default.posix.sep).includes('node_modules/webpack');
+        });
+        return webpackEntry === null || webpackEntry === void 0 ? void 0 : webpackEntry.fileName;
+    }
+    addIncludedPackages(compiler) {
+        const includePackages = [
+            ...(this.includeExternalProductionDependencies
+                ? (0, production_deps_1.findAllProdDepsTreeLocations)(compiler.context)
+                : []),
+            ...(this.includePackages || []).map((packageName) => (0, production_deps_1.findPackageLocation)(packageName, compiler.context)),
+        ];
+        for (const includedPackagePath of includePackages) {
+            const packageJsonPath = path_1.default.join(includedPackagePath, 'package.json');
+            if (packageJsonPath) {
+                this.resolvedModules.add(packageJsonPath);
+            }
+        }
+    }
     apply(compiler) {
+        const webpackModulePath = this.getWebpackModulePath(new Error());
+        this.addIncludedPackages(compiler);
+        compiler.hooks.done.tapAsync(PLUGIN_NAME, (stats, done) => {
+            const { modules } = stats.toJson();
+            modules === null || modules === void 0 ? void 0 : modules.forEach(({ type, nameForCondition }) => {
+                if (type === 'module' &&
+                    nameForCondition &&
+                    this.isThirdPartyModule(nameForCondition)) {
+                    this.resolvedModules.add(nameForCondition);
+                }
+            });
+            if ((modules === null || modules === void 0 ? void 0 : modules.find((m) => { var _a; return m.moduleType === 'runtime' && ((_a = m.name) === null || _a === void 0 ? void 0 : _a.startsWith('webpack/runtime')); })) &&
+                webpackModulePath) {
+                this.resolvedModules.add(webpackModulePath);
+            }
+            done();
+        });
         compiler.hooks.shutdown.tapPromise(PLUGIN_NAME, async () => {
             var _a;
             const dependencyList = await Promise.all(Array.from(this.resolvedModules).map(get_package_info_1.getPackageInfo));
@@ -61,7 +77,6 @@ class WebpackDependenciesPlugin {
             });
             await fs_1.promises.writeFile(outputPath, JSON.stringify(sortedList, null, 2));
         });
-        compiler.hooks.emit.tap(PLUGIN_NAME, this.handleTap);
     }
 }
 exports.WebpackDependenciesPlugin = WebpackDependenciesPlugin;

package/dist/webpack-dependencies-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"webpack-dependencies-plugin.js","sourceRoot":"","sources":["../src/webpack-dependencies-plugin.ts"],"names":[],"mappings":";;;;;;AAAA,gDAAwB;AACxB,2BAAoC;AAEpC,oDAAuB;AAEvB,uDAG2B;AAC3B,yDAAoD;AAEpD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAYhD,MAAa,yBAAyB;IAOpC,YAAoB,UAA4C,EAAE;;QAA9C,YAAO,GAAP,OAAO,CAAuC;QANjD,eAAU,GAAG,WAAW,CAAC;QAE1C,oBAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAEpC,oBAAe,GAAa,EAAE,CAAC;QAavB,cAAS,GAAG,CAAC,WAAwB,EAAE,EAAE;YAC/C,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE;gBACxC,MAAM,QAAQ,GAAI,MAAyB,CAAC,QAAQ,CAAC;gBACrD,IAAI,QAAQ,EAAE;oBACZ,MAAM,UAAU,GAAG,QAAQ,CAAC;oBAC5B,IACE,OAAO,UAAU,KAAK,QAAQ;wBAC9B,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EACnC;wBACA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;qBACtC;iBACF;aACF;YAED,MAAM,eAAe,GAAG;gBACtB,GAAG,CAAC,IAAI,CAAC,qCAAqC;oBAC5C,CAAC,CAAC,IAAA,8CAA4B,EAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAC5D,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAClD,IAAA,qCAAmB,EAAC,WAAW,EAAE,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC/D;aACF,CAAC;YAEF,KAAK,MAAM,mBAAmB,IAAI,eAAe,EAAE;gBACjD,MAAM,eAAe,GAAG,cAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;gBAEvE,IAAI,eAAe,EAAE;oBACnB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;iBAC3C;aACF;QACH,CAAC,CAAC;QAxCA,IAAI,CAAC,qCAAqC;YACxC,MAAA,OAAO,CAAC,qCAAqC,mCAAI,KAAK,CAAC;QACzD,IAAI,CAAC,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,EAAE,CAAC;QACrD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAC3C,CAAC;IAEO,kBAAkB,CAAC,UAAkB;QAC3C,OAAO,UAAU,CAAC,KAAK,CAAC,cAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC7D,CAAC;IAkCD,KAAK,CAAC,QAAkB;QACtB,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;;YACzD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,iCAAc,CAAC,CACrD,CAAC;YAEF,MAAM,UAAU,GAAG,gBAAC,CAAC,MAAM,CACzB,cAAc,EACd,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAC5C,CAAC;YAEF,MAAM,UAAU,GAAG,gBAAC,CAAC,MAAM,CACzB,UAAU,EACV,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAC5C,CAAC;YAEF,MAAM,UAAU,GACd,MAAA,IAAI,CAAC,UAAU,mCAAI,cAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAEtE,MAAM,aAAE,CAAC,KAAK,CAAC,cAAI,CAAC,OAAO,CAAC,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE;gBACrD,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,aAAE,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;CACF;AA9ED,8DA8EC;AAED,kBAAe,yBAAyB,CAAC"}
+{"version":3,"file":"webpack-dependencies-plugin.js","sourceRoot":"","sources":["../src/webpack-dependencies-plugin.ts"],"names":[],"mappings":";;;;;;AAAA,gDAAwB;AACxB,2BAAoC;AAEpC,oDAAuB;AAEvB,4EAAkD;AAElD,uDAG2B;AAC3B,yDAAoD;AAEpD,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAYhD,MAAa,yBAAyB;IAOpC,YAAoB,UAA4C,EAAE;;QAA9C,YAAO,GAAP,OAAO,CAAuC;QANjD,eAAU,GAAG,WAAW,CAAC;QAE1C,oBAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAEpC,oBAAe,GAAa,EAAE,CAAC;QAG7B,IAAI,CAAC,qCAAqC;YACxC,MAAA,OAAO,CAAC,qCAAqC,mCAAI,KAAK,CAAC;QACzD,IAAI,CAAC,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,EAAE,CAAC;QACrD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAC3C,CAAC;IAEO,kBAAkB,CAAC,UAAkB;QAC3C,OAAO,UAAU,CAAC,KAAK,CAAC,cAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC7D,CAAC;IAEO,oBAAoB,CAAC,KAAY;QACvC,MAAM,KAAK,GAAG,4BAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;;YACxC,OAAA,MAAA,KAAK,CAAC,QAAQ,0CACV,KAAK,CAAC,cAAI,CAAC,KAAK,CAAC,GAAG,EACrB,IAAI,CAAC,cAAI,CAAC,KAAK,CAAC,GAAG,EACnB,QAAQ,CAAC,sBAAsB,CAAC,CAAA;SAAA,CACpC,CAAC;QAEF,OAAO,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,QAAQ,CAAC;IAChC,CAAC;IAEO,mBAAmB,CAAC,QAAkB;QAC5C,MAAM,eAAe,GAAG;YACtB,GAAG,CAAC,IAAI,CAAC,qCAAqC;gBAC5C,CAAC,CAAC,IAAA,8CAA4B,EAAC,QAAQ,CAAC,OAAO,CAAC;gBAChD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAClD,IAAA,qCAAmB,EAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CACnD;SACF,CAAC;QAEF,KAAK,MAAM,mBAAmB,IAAI,eAAe,EAAE;YACjD,MAAM,eAAe,GAAG,cAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;YAEvE,IAAI,eAAe,EAAE;gBACnB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;aAC3C;SACF;IACH,CAAC;IAED,KAAK,CAAC,QAAkB;QACtB,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;QAEjE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAEnC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACxD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAEnC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE;gBAC9C,IACE,IAAI,KAAK,QAAQ;oBACjB,gBAAgB;oBAChB,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EACzC;oBACA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;iBAC5C;YACH,CAAC,CAAC,CAAC;YAEH,IACE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CACX,CAAC,CAAC,EAAE,EAAE,WACJ,OAAA,CAAC,CAAC,UAAU,KAAK,SAAS,KAAI,MAAA,CAAC,CAAC,IAAI,0CAAE,UAAU,CAAC,iBAAiB,CAAC,CAAA,CAAA,EAAA,CACtE;gBACD,iBAAiB,EACjB;gBACA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;aAC7C;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;;YACzD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,iCAAc,CAAC,CACrD,CAAC;YAEF,MAAM,UAAU,GAAG,gBAAC,CAAC,MAAM,CACzB,cAAc,EACd,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAC5C,CAAC;YAEF,MAAM,UAAU,GAAG,gBAAC,CAAC,MAAM,CACzB,UAAU,EACV,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAC5C,CAAC;YAEF,MAAM,UAAU,GACd,MAAA,IAAI,CAAC,UAAU,mCAAI,cAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAEtE,MAAM,aAAE,CAAC,KAAK,CAAC,cAAI,CAAC,OAAO,CAAC,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE;gBACrD,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,aAAE,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA1GD,8DA0GC;AAED,kBAAe,yBAAyB,CAAC"}

package/package.json

@@ -16,7 +16,7 @@
     "email": "compass@mongodb.com"
   },
   "homepage": "https://github.com/mongodb-js/devtools-shared",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/mongodb-js/devtools-shared.git"
@@ -76,6 +76,7 @@
   "dependencies": {
     "@pkgjs/nv": "^0.2.1",
     "commander": "^10.0.1",
+    "error-stack-parser": "^2.1.4",
     "find-up": "^4.1.0",
     "lodash": "^4.17.21",
     "node-fetch": "^2.6.7",
@@ -83,5 +84,5 @@
     "snyk-policy": "^2.0.4",
     "spdx-satisfies": "^5.0.1"
   },
-  "gitHead": "8588f88041f201c21d9d17980b50779fc68dfd88"
+  "gitHead": "000ec0937538c434a346e2a5c92c1d402e100581"
 }

package/dist/snyk-vulnerability.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"snyk-vulnerability.d.ts","sourceRoot":"","sources":["../src/snyk-vulnerability.ts"],"names":[],"mappings":"AAAA,oBAAY,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AACnE,oBAAY,QAAQ,GAAG,aAAa,GAAG,SAAS,CAAC;AAEjD,aAAK,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAUhC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAEzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAenE;AAED,oBAAY,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE;QACN,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE;QACR,YAAY,EAAE,IAAI,CAAC;KACpB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,KAAK,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE;QACV,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;KACf,EAAE,CAAC;IACJ,WAAW,EAAE,KAAK,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,EAAE;QACX,GAAG,EAAE,MAAM,EAAE,CAAC;KACf,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,KAAK,EAAE,CAAC;IACvB,cAAc,EAAE,KAAK,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,QAAQ,CAAC;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,KAAK,EAAE,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,oBAAY,qBAAqB,GAAG;IAClC,eAAe,EAAE,iBAAiB,EAAE,CAAC;CACtC,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,EACrC,EAAE,EACF,WAAW,EACX,cAAc,EACd,KAAK,EACL,IAAI,EACJ,gBAAgB,EAChB,OAAO,EACP,WAAW,EACX,GAAG,GACJ,EAAE;IACD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAsDrD"}

package/dist/snyk-vulnerability.js

@@ -1,87 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildSnykVulnerability = exports.scoreToSeverity = exports.severityToScore = void 0;
-const SEVERITY_TO_SCORE = {
-    low: 0,
-    medium: 4,
-    high: 7,
-    critical: 9,
-    unknown: undefined,
-};
-function severityToScore(severity) {
-    return SEVERITY_TO_SCORE[severity];
-}
-exports.severityToScore = severityToScore;
-function scoreToSeverity(score) {
-    if (score === undefined) {
-        return 'unknown';
-    }
-    if (score >= 9) {
-        return 'critical';
-    }
-    if (score >= 7) {
-        return 'high';
-    }
-    if (score >= 4) {
-        return 'medium';
-    }
-    return 'low';
-}
-exports.scoreToSeverity = scoreToSeverity;
-function buildSnykVulnerability({ id, packageName, packageVersion, score, cves, vulnerableSemver, fixedIn, description, url, }) {
-    const severity = scoreToSeverity(score);
-    return {
-        id,
-        title: id,
-        CVSSv3: '-',
-        credit: ['-'],
-        semver: {
-            vulnerable: vulnerableSemver,
-        },
-        exploit: '-',
-        patched: fixedIn,
-        patches: [],
-        fixedIn: fixedIn,
-        insights: {
-            triageAdvice: null,
-        },
-        language: 'js',
-        severity: severity,
-        cvssScore: score,
-        functions: [],
-        moduleName: packageName,
-        references: url
-            ? [
-                {
-                    url: url,
-                    title: 'Ref',
-                },
-            ]
-            : [],
-        cvssDetails: [],
-        description: description !== null && description !== void 0 ? description : '',
-        epssDetails: null,
-        identifiers: {
-            CVE: cves,
-        },
-        packageName: packageName,
-        proprietary: true,
-        creationTime: '-',
-        functions_new: [],
-        alternativeIds: [],
-        disclosureTime: '-',
-        packageManager: 'npm',
-        publicationTime: '-',
-        modificationTime: '-',
-        socialTrendAlert: false,
-        severityWithCritical: severity,
-        from: [`${packageName}@${packageVersion}`],
-        upgradePath: [],
-        isUpgradable: true,
-        isPatchable: false,
-        name: packageName,
-        version: packageVersion,
-    };
-}
-exports.buildSnykVulnerability = buildSnykVulnerability;
-//# sourceMappingURL=snyk-vulnerability.js.map

package/dist/snyk-vulnerability.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"snyk-vulnerability.js","sourceRoot":"","sources":["../src/snyk-vulnerability.ts"],"names":[],"mappings":";;;AAKA,MAAM,iBAAiB,GAA4B;IACjD,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,SAAS;CACnB,CAAC;AAEF,SAAgB,eAAe,CAAC,QAAkB;IAChD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAFD,0CAEC;AAED,SAAgB,eAAe,CAAC,KAAyB;IACvD,IAAI,KAAK,KAAK,SAAS,EAAE;QACvB,OAAO,SAAS,CAAC;KAClB;IAED,IAAI,KAAK,IAAI,CAAC,EAAE;QACd,OAAO,UAAU,CAAC;KACnB;IACD,IAAI,KAAK,IAAI,CAAC,EAAE;QACd,OAAO,MAAM,CAAC;KACf;IACD,IAAI,KAAK,IAAI,CAAC,EAAE;QACd,OAAO,QAAQ,CAAC;KACjB;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAfD,0CAeC;AAuDD,SAAgB,sBAAsB,CAAC,EACrC,EAAE,EACF,WAAW,EACX,cAAc,EACd,KAAK,EACL,IAAI,EACJ,gBAAgB,EAChB,OAAO,EACP,WAAW,EACX,GAAG,GAWJ;IACC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO;QACL,EAAE;QACF,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,CAAC,GAAG,CAAC;QACb,MAAM,EAAE;YACN,UAAU,EAAE,gBAAgB;SAC7B;QACD,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE;YACR,YAAY,EAAE,IAAI;SACnB;QACD,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,GAAG;YACb,CAAC,CAAC;gBACE;oBACE,GAAG,EAAE,GAAG;oBACR,KAAK,EAAE,KAAK;iBACb;aACF;YACH,CAAC,CAAC,EAAE;QACN,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,EAAE;QAC9B,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE;YACX,GAAG,EAAE,IAAI;SACV;QACD,WAAW,EAAE,WAAW;QACxB,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,GAAG;QACnB,cAAc,EAAE,KAAK;QACrB,eAAe,EAAE,GAAG;QACpB,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,KAAK;QACvB,oBAAoB,EAAE,QAAQ;QAC9B,IAAI,EAAE,CAAC,GAAG,WAAW,IAAI,cAAc,EAAE,CAAC;QAC1C,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,KAAK;QAClB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC;AACJ,CAAC;AA1ED,wDA0EC"}