@openrewrite/recipes-nodejs 0.36.0-20251211-170937 → 0.36.0-20251212-115638

package/dist/security/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./vulnerability";
+export * from "./dependency-vulnerability-check";
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAMA,cAAc,iBAAiB,CAAC;AAChC,cAAc,kCAAkC,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./vulnerability"), exports);
+__exportStar(require("./dependency-vulnerability-check"), exports);
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAMA,kDAAgC;AAChC,mEAAiD"}

package/dist/security/vulnerability.d.ts

@@ -0,0 +1,33 @@
+export declare enum Severity {
+    LOW = "LOW",
+    MODERATE = "MODERATE",
+    HIGH = "HIGH",
+    CRITICAL = "CRITICAL"
+}
+export declare function severityOrdinal(severity: Severity): number;
+export declare function parseSeverity(value: string): Severity;
+export interface Vulnerability {
+    readonly cve: string;
+    readonly publishedAt: string;
+    readonly summary: string;
+    readonly packageName: string;
+    readonly introducedVersion: string;
+    readonly fixedVersion: string;
+    readonly lastAffectedVersion: string;
+    readonly severity: Severity;
+    readonly cwes: string;
+}
+export declare class VulnerabilityDatabase {
+    private readonly byPackage;
+    private constructor();
+    getVulnerabilities(packageName: string): Vulnerability[];
+    hasVulnerabilities(packageName: string): boolean;
+    getAffectedPackages(): string[];
+    get size(): number;
+    static load(): VulnerabilityDatabase;
+    static loadFromFile(filePath: string): VulnerabilityDatabase;
+    static loadFromString(content: string): VulnerabilityDatabase;
+    static empty(): VulnerabilityDatabase;
+    static fromList(vulnerabilities: Vulnerability[]): VulnerabilityDatabase;
+}
+//# sourceMappingURL=vulnerability.d.ts.map

package/dist/security/vulnerability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability.d.ts","sourceRoot":"","sources":["../../src/security/vulnerability.ts"],"names":[],"mappings":"AAYA,oBAAY,QAAQ;IAChB,GAAG,QAAQ;IACX,QAAQ,aAAa;IACrB,IAAI,SAAS;IACb,QAAQ,aAAa;CACxB;AAKD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAO1D;AAKD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAMrD;AAWD,MAAM,WAAW,aAAa;IAE1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAGrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAG7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAGzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAG7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAGnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAG9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAGrC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAG5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAqED,qBAAa,qBAAqB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+B;IAEzD,OAAO;IAeP,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,EAAE;IAOxD,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAOhD,mBAAmB,IAAI,MAAM,EAAE;IAO/B,IAAI,IAAI,IAAI,MAAM,CAMjB;IAKD,MAAM,CAAC,IAAI,IAAI,qBAAqB;IA6BpC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB;IAQ5D,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB;IAoB7D,MAAM,CAAC,KAAK,IAAI,qBAAqB;IAOrC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,aAAa,EAAE,GAAG,qBAAqB;CAG3E"}

package/dist/security/vulnerability.js

@@ -0,0 +1,182 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VulnerabilityDatabase = exports.Severity = void 0;
+exports.severityOrdinal = severityOrdinal;
+exports.parseSeverity = parseSeverity;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+var Severity;
+(function (Severity) {
+    Severity["LOW"] = "LOW";
+    Severity["MODERATE"] = "MODERATE";
+    Severity["HIGH"] = "HIGH";
+    Severity["CRITICAL"] = "CRITICAL";
+})(Severity || (exports.Severity = Severity = {}));
+function severityOrdinal(severity) {
+    switch (severity) {
+        case Severity.LOW: return 0;
+        case Severity.MODERATE: return 1;
+        case Severity.HIGH: return 2;
+        case Severity.CRITICAL: return 3;
+    }
+}
+function parseSeverity(value) {
+    const upper = value.toUpperCase();
+    if (upper in Severity) {
+        return Severity[upper];
+    }
+    return Severity.LOW;
+}
+function parseCsvLine(line) {
+    const fields = [];
+    let current = '';
+    let inQuotes = false;
+    for (let i = 0; i < line.length; i++) {
+        const char = line[i];
+        if (char === '"') {
+            if (inQuotes && line[i + 1] === '"') {
+                current += '"';
+                i++;
+            }
+            else {
+                inQuotes = !inQuotes;
+            }
+        }
+        else if (char === ',' && !inQuotes) {
+            fields.push(current);
+            current = '';
+        }
+        else {
+            current += char;
+        }
+    }
+    fields.push(current);
+    return fields;
+}
+function parseVulnerability(line) {
+    const fields = parseCsvLine(line);
+    if (fields.length < 9) {
+        return undefined;
+    }
+    const [cve, publishedAt, summary, packageName, introducedVersion, fixedVersion, lastAffectedVersion, severity, cwes] = fields;
+    if (!cve || !packageName) {
+        return undefined;
+    }
+    return {
+        cve,
+        publishedAt,
+        summary,
+        packageName,
+        introducedVersion: introducedVersion || '0',
+        fixedVersion: fixedVersion || '',
+        lastAffectedVersion: lastAffectedVersion || '',
+        severity: parseSeverity(severity),
+        cwes: cwes || ''
+    };
+}
+class VulnerabilityDatabase {
+    constructor(vulnerabilities) {
+        this.byPackage = new Map();
+        for (const v of vulnerabilities) {
+            const existing = this.byPackage.get(v.packageName);
+            if (existing) {
+                existing.push(v);
+            }
+            else {
+                this.byPackage.set(v.packageName, [v]);
+            }
+        }
+    }
+    getVulnerabilities(packageName) {
+        return this.byPackage.get(packageName) || [];
+    }
+    hasVulnerabilities(packageName) {
+        return this.byPackage.has(packageName);
+    }
+    getAffectedPackages() {
+        return Array.from(this.byPackage.keys());
+    }
+    get size() {
+        let count = 0;
+        for (const vulns of this.byPackage.values()) {
+            count += vulns.length;
+        }
+        return count;
+    }
+    static load() {
+        const possiblePaths = [
+            path.join(__dirname, '..', '..', 'resources', 'advisories-npm.csv'),
+            path.join(__dirname, '..', '..', '..', 'resources', 'advisories-npm.csv'),
+        ];
+        let csvPath;
+        for (const p of possiblePaths) {
+            if (fs.existsSync(p)) {
+                csvPath = p;
+                break;
+            }
+        }
+        if (!csvPath) {
+            return new VulnerabilityDatabase([]);
+        }
+        return VulnerabilityDatabase.loadFromFile(csvPath);
+    }
+    static loadFromFile(filePath) {
+        const content = fs.readFileSync(filePath, 'utf-8');
+        return VulnerabilityDatabase.loadFromString(content);
+    }
+    static loadFromString(content) {
+        const vulnerabilities = [];
+        const lines = content.split('\n');
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            const vuln = parseVulnerability(trimmed);
+            if (vuln) {
+                vulnerabilities.push(vuln);
+            }
+        }
+        return new VulnerabilityDatabase(vulnerabilities);
+    }
+    static empty() {
+        return new VulnerabilityDatabase([]);
+    }
+    static fromList(vulnerabilities) {
+        return new VulnerabilityDatabase(vulnerabilities);
+    }
+}
+exports.VulnerabilityDatabase = VulnerabilityDatabase;
+//# sourceMappingURL=vulnerability.js.map

package/dist/security/vulnerability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability.js","sourceRoot":"","sources":["../../src/security/vulnerability.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,0CAOC;AAKD,sCAMC;AAlCD,uCAAyB;AACzB,2CAA6B;AAK7B,IAAY,QAKX;AALD,WAAY,QAAQ;IAChB,uBAAW,CAAA;IACX,iCAAqB,CAAA;IACrB,yBAAa,CAAA;IACb,iCAAqB,CAAA;AACzB,CAAC,EALW,QAAQ,wBAAR,QAAQ,QAKnB;AAKD,SAAgB,eAAe,CAAC,QAAkB;IAC9C,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;QACjC,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7B,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACL,CAAC;AAKD,SAAgB,aAAa,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,KAA8B,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC;AACxB,CAAC;AA2CD,SAAS,YAAY,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAElC,OAAO,IAAI,GAAG,CAAC;gBACf,CAAC,EAAE,CAAC;YACR,CAAC;iBAAM,CAAC;gBAEJ,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACzB,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,GAAG,EAAE,CAAC;QACjB,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,IAAI,CAAC;QACpB,CAAC;IACL,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAErB,OAAO,MAAM,CAAC;AAClB,CAAC;AAQD,SAAS,kBAAkB,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC;IAG9H,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,OAAO;QACH,GAAG;QACH,WAAW;QACX,OAAO;QACP,WAAW;QACX,iBAAiB,EAAE,iBAAiB,IAAI,GAAG;QAC3C,YAAY,EAAE,YAAY,IAAI,EAAE;QAChC,mBAAmB,EAAE,mBAAmB,IAAI,EAAE;QAC9C,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC;QACjC,IAAI,EAAE,IAAI,IAAI,EAAE;KACnB,CAAC;AACN,CAAC;AAKD,MAAa,qBAAqB;IAG9B,YAAoB,eAAgC;QAChD,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;QACL,CAAC;IACL,CAAC;IAKD,kBAAkB,CAAC,WAAmB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAKD,kBAAkB,CAAC,WAAmB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAKD,mBAAmB;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAKD,IAAI,IAAI;QACJ,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAKD,MAAM,CAAC,IAAI;QAIP,MAAM,aAAa,GAAG;YAClB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,CAAC;SAC5E,CAAC;QAEF,IAAI,OAA2B,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,OAAO,GAAG,CAAC,CAAC;gBACZ,MAAM;YACV,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YAGX,OAAO,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,qBAAqB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAKD,MAAM,CAAC,YAAY,CAAC,QAAgB;QAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,qBAAqB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAKD,MAAM,CAAC,cAAc,CAAC,OAAe;QACjC,MAAM,eAAe,GAAoB,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,IAAI,EAAE,CAAC;gBACP,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;QAED,OAAO,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtD,CAAC;IAKD,MAAM,CAAC,KAAK;QACR,OAAO,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAKD,MAAM,CAAC,QAAQ,CAAC,eAAgC;QAC5C,OAAO,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtD,CAAC;CACJ;AArHD,sDAqHC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrewrite/recipes-nodejs",
-  "version": "0.36.0-20251211-170937",
+  "version": "0.36.0-20251212-115638",
   "license": "Moderne Source Available License",
   "description": "OpenRewrite recipes for Node.js library migrations.",
   "homepage": "https://github.com/moderneinc/rewrite-node",
@@ -17,17 +17,20 @@
     "access": "public"
   },
   "scripts": {
-    "build": "rm -rf ./dist tsconfig.build.tsbuildinfo && tsc --build tsconfig.build.json",
+    "build": "rm -rf ./dist tsconfig.build.tsbuildinfo && tsc --build tsconfig.build.json && cp -rL resources dist/",
     "dev": "tsc --watch -p tsconfig.json",
     "test": "npm run build && jest",
     "ci:test": "jest"
   },
   "dependencies": {
-    "@openrewrite/rewrite": "next"
+    "@openrewrite/rewrite": "next",
+    "immer": "^11.0.1",
+    "semver": "^7.7.3"
   },
   "devDependencies": {
     "@types/jest": "^29.5.13",
     "@types/node": "^22.5.4",
+    "@types/semver": "^7.7.1",
     "jest": "^29.7.0",
     "jest-junit": "^16.0.0",
     "tmp-promise": "^3.0.3",

package/src/index.ts

@@ -19,6 +19,7 @@ import {ReplaceOutgoingMessageHeaders} from "./migrate/outgoing-message-headers"
 import {ReplaceTlsInternalModules} from "./migrate/tls-internal-modules";
 import {UpgradeNode22} from "./migrate/upgrade-node-22";
 import {UpgradeNode24} from "./migrate/upgrade-node-24";
+import {DependencyVulnerabilityCheck} from "./security";
 
 
 export function activate(registry: RecipeRegistry) {
@@ -42,4 +43,5 @@ export function activate(registry: RecipeRegistry) {
     registry.register(ReplaceTlsInternalModules);
     registry.register(UpgradeNode22);
     registry.register(UpgradeNode24);
+    registry.register(DependencyVulnerabilityCheck);
 }