@nodesecure/scanner 3.1.1-rc.0 → 3.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/README.md +95 -95
  2. package/package.json +1 -1
  3. package/src/depWalker.js +304 -304
  4. package/src/utils/index.js +16 -16
  5. package/src/utils/isGitDependency.js +20 -20
  6. package/src/utils/mergeDependencies.js +26 -26
  7. package/src/utils/warnings.js +9 -0
  8. package/types/scanner.d.ts +185 -185
package/README.md CHANGED
@@ -1,95 +1,95 @@
1
- # NodeSecure Scanner
2
- ![version](https://img.shields.io/badge/dynamic/json.svg?url=https://raw.githubusercontent.com/NodeSecure/scanner/master/package.json&query=$.version&label=Version)
3
- [![Maintenance](https://img.shields.io/badge/Maintained%3F-yes-green.svg)](https://github.com/NodeSecure/scanner/commit-activity)
4
- [![Security Responsible Disclosure](https://img.shields.io/badge/Security-Responsible%20Disclosure-yellow.svg)](https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md
5
- )
6
- [![mit](https://img.shields.io/github/license/Naereen/StrapDown.js.svg)](https://github.com/NodeSecure/scanner/blob/master/LICENSE)
7
- ![build](https://img.shields.io/github/workflow/status/NodeSecure/scanner/Node.js%20CI)
8
-
9
- ⚡️ Run a static analysis of your module's dependencies.
10
-
11
- ## Requirements
12
-
13
- - [Node.js](https://nodejs.org/en/) version 16 or higher
14
-
15
- ## Getting Started
16
-
17
- This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).
18
-
19
- ```bash
20
- $ npm i @nodesecure/scanner
21
- # or
22
- $ yarn add @nodesecure/scanner
23
- ```
24
-
25
- ## Usage example
26
-
27
- ```js
28
- import * as scanner from "@nodesecure/scanner";
29
- import fs from "fs/promises";
30
-
31
- // CONSTANTS
32
- const kPackagesToAnalyze = ["mocha", "cacache", "is-wsl"];
33
-
34
- const payloads = await Promise.all(
35
- kPackagesToAnalyze.map((name) => scanner.from(name))
36
- );
37
-
38
- const promises = [];
39
- for (let i = 0; i < kPackagesToAnalyze.length; i++) {
40
- const data = JSON.stringify(payloads[i], null, 2);
41
-
42
- promises.push(fs.writeFile(`${kPackagesToAnalyze[i]}.json`, data));
43
- }
44
- await Promise.allSettled(promises);
45
- ```
46
-
47
- ## API
48
-
49
- See `types/api.d.ts` for a complete TypeScript definition.
50
-
51
- ```ts
52
- function cwd(path: string, options?: Scanner.Options): Promise<Scanner.Payload>;
53
- function from(packageName: string, options?: Scanner.Options): Promise<Scanner.Payload>;
54
- function verify(packageName: string): Promise<Scanner.VerifyPayload>;
55
- ```
56
-
57
- `Options` is described with the following TypeScript interface:
58
-
59
- ```ts
60
- interface Options {
61
- readonly maxDepth?: number;
62
- readonly usePackageLock?: boolean;
63
- readonly vulnerabilityStrategy: Strategy.Kind;
64
- readonly forceRootAnalysis?: boolean;
65
- readonly fullLockMode?: boolean;
66
- }
67
- ```
68
-
69
- ## Contributors ✨
70
-
71
- <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
72
- [![All Contributors](https://img.shields.io/badge/all_contributors-4-orange.svg?style=flat-square)](#contributors-)
73
- <!-- ALL-CONTRIBUTORS-BADGE:END -->
74
-
75
- Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
76
-
77
- <!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
78
- <!-- prettier-ignore-start -->
79
- <!-- markdownlint-disable -->
80
- <table>
81
- <tr>
82
- <td align="center"><a href="https://www.linkedin.com/in/thomas-gentilhomme/"><img src="https://avatars.githubusercontent.com/u/4438263?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Gentilhomme</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Afraxken" title="Reviewed Pull Requests">👀</a> <a href="#security-fraxken" title="Security">🛡️</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Afraxken" title="Bug reports">🐛</a></td>
83
- <td align="center"><a href="http://tonygo.dev"><img src="https://avatars.githubusercontent.com/u/22824417?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Tony Gorez</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Atony-go" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Atony-go" title="Bug reports">🐛</a></td>
84
- <td align="center"><a href="https://mickaelcroquet.fr"><img src="https://avatars.githubusercontent.com/u/23740372?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Haze</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=CroquetMickael" title="Code">💻</a></td>
85
- <td align="center"><a href="https://github.com/mbalabash"><img src="https://avatars.githubusercontent.com/u/16868922?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Maksim Balabash</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=mbalabash" title="Code">💻</a></td>
86
- </tr>
87
- </table>
88
-
89
- <!-- markdownlint-restore -->
90
- <!-- prettier-ignore-end -->
91
-
92
- <!-- ALL-CONTRIBUTORS-LIST:END -->
93
-
94
- ## License
95
- MIT
1
+ # NodeSecure Scanner
2
+ ![version](https://img.shields.io/badge/dynamic/json.svg?url=https://raw.githubusercontent.com/NodeSecure/scanner/master/package.json&query=$.version&label=Version)
3
+ [![Maintenance](https://img.shields.io/badge/Maintained%3F-yes-green.svg)](https://github.com/NodeSecure/scanner/commit-activity)
4
+ [![Security Responsible Disclosure](https://img.shields.io/badge/Security-Responsible%20Disclosure-yellow.svg)](https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md
5
+ )
6
+ [![mit](https://img.shields.io/github/license/Naereen/StrapDown.js.svg)](https://github.com/NodeSecure/scanner/blob/master/LICENSE)
7
+ ![build](https://img.shields.io/github/workflow/status/NodeSecure/scanner/Node.js%20CI)
8
+
9
+ ⚡️ Run a static analysis of your module's dependencies.
10
+
11
+ ## Requirements
12
+
13
+ - [Node.js](https://nodejs.org/en/) version 16 or higher
14
+
15
+ ## Getting Started
16
+
17
+ This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).
18
+
19
+ ```bash
20
+ $ npm i @nodesecure/scanner
21
+ # or
22
+ $ yarn add @nodesecure/scanner
23
+ ```
24
+
25
+ ## Usage example
26
+
27
+ ```js
28
+ import * as scanner from "@nodesecure/scanner";
29
+ import fs from "fs/promises";
30
+
31
+ // CONSTANTS
32
+ const kPackagesToAnalyze = ["mocha", "cacache", "is-wsl"];
33
+
34
+ const payloads = await Promise.all(
35
+ kPackagesToAnalyze.map((name) => scanner.from(name))
36
+ );
37
+
38
+ const promises = [];
39
+ for (let i = 0; i < kPackagesToAnalyze.length; i++) {
40
+ const data = JSON.stringify(payloads[i], null, 2);
41
+
42
+ promises.push(fs.writeFile(`${kPackagesToAnalyze[i]}.json`, data));
43
+ }
44
+ await Promise.allSettled(promises);
45
+ ```
46
+
47
+ ## API
48
+
49
+ See `types/api.d.ts` for a complete TypeScript definition.
50
+
51
+ ```ts
52
+ function cwd(path: string, options?: Scanner.Options): Promise<Scanner.Payload>;
53
+ function from(packageName: string, options?: Scanner.Options): Promise<Scanner.Payload>;
54
+ function verify(packageName: string): Promise<Scanner.VerifyPayload>;
55
+ ```
56
+
57
+ `Options` is described with the following TypeScript interface:
58
+
59
+ ```ts
60
+ interface Options {
61
+ readonly maxDepth?: number;
62
+ readonly usePackageLock?: boolean;
63
+ readonly vulnerabilityStrategy: Strategy.Kind;
64
+ readonly forceRootAnalysis?: boolean;
65
+ readonly fullLockMode?: boolean;
66
+ }
67
+ ```
68
+
69
+ ## Contributors ✨
70
+
71
+ <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
72
+ [![All Contributors](https://img.shields.io/badge/all_contributors-4-orange.svg?style=flat-square)](#contributors-)
73
+ <!-- ALL-CONTRIBUTORS-BADGE:END -->
74
+
75
+ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
76
+
77
+ <!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
78
+ <!-- prettier-ignore-start -->
79
+ <!-- markdownlint-disable -->
80
+ <table>
81
+ <tr>
82
+ <td align="center"><a href="https://www.linkedin.com/in/thomas-gentilhomme/"><img src="https://avatars.githubusercontent.com/u/4438263?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Gentilhomme</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=fraxken" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Afraxken" title="Reviewed Pull Requests">👀</a> <a href="#security-fraxken" title="Security">🛡️</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Afraxken" title="Bug reports">🐛</a></td>
83
+ <td align="center"><a href="http://tonygo.dev"><img src="https://avatars.githubusercontent.com/u/22824417?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Tony Gorez</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Code">💻</a> <a href="https://github.com/NodeSecure/scanner/commits?author=tony-go" title="Documentation">📖</a> <a href="https://github.com/NodeSecure/scanner/pulls?q=is%3Apr+reviewed-by%3Atony-go" title="Reviewed Pull Requests">👀</a> <a href="https://github.com/NodeSecure/scanner/issues?q=author%3Atony-go" title="Bug reports">🐛</a></td>
84
+ <td align="center"><a href="https://mickaelcroquet.fr"><img src="https://avatars.githubusercontent.com/u/23740372?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Haze</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=CroquetMickael" title="Code">💻</a></td>
85
+ <td align="center"><a href="https://github.com/mbalabash"><img src="https://avatars.githubusercontent.com/u/16868922?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Maksim Balabash</b></sub></a><br /><a href="https://github.com/NodeSecure/scanner/commits?author=mbalabash" title="Code">💻</a></td>
86
+ </tr>
87
+ </table>
88
+
89
+ <!-- markdownlint-restore -->
90
+ <!-- prettier-ignore-end -->
91
+
92
+ <!-- ALL-CONTRIBUTORS-LIST:END -->
93
+
94
+ ## License
95
+ MIT
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@nodesecure/scanner",
3
- "version": "3.1.1-rc.0",
3
+ "version": "3.2.0",
4
4
  "description": "A package API to run a static analysis of your module's dependencies.",
5
5
  "exports": "./index.js",
6
6
  "engines": {