@renovatebot/osv-offline-db 1.1.0 → 1.3.0

package/README.md

@@ -1,7 +1,7 @@
 # osv-offline-db
 
 [![Package version](https://img.shields.io/npm/v/@renovatebot/osv-offline-db?style=for-the-badge)](https://www.npmjs.com/package/@renovatebot/osv-offline-db)
-[![Build status](https://img.shields.io/github/workflow/status/jamiemagee/osv-offline/Build?style=for-the-badge)](https://github.com/jamiemagee/osv-offline/actions/workflows/build.yml)
+[![Build status](https://img.shields.io/github/actions/workflow/status/renovatebot/osv-offline/build.yml?branch=main&style=for-the-badge)](https://github.com/renovatebot/osv-offline/actions/workflows/build.yml)
 [![MIT license](https://img.shields.io/badge/license-MIT-blue?style=for-the-badge)](./LICENSE)
 ![Stability experimental](https://img.shields.io/badge/stability-experimental-orange.svg?style=for-the-badge)
 

package/dist/lib/db.js

@@ -8,6 +8,7 @@ const os_1 = require("os");
 const path_1 = __importDefault(require("path"));
 const nedb_1 = __importDefault(require("@seald-io/nedb"));
 const ecosystem_1 = require("./ecosystem");
+const purl_helper_1 = require("./purl-helper");
 class OsvOfflineDb {
     // eslint-disable-next-line @typescript-eslint/no-empty-function
     constructor() {
@@ -33,7 +34,7 @@ class OsvOfflineDb {
                     package: {
                         name: packageName,
                         ecosystem,
-                        purl: `pkg:${ecosystem.toLowerCase()}/${packageName}`,
+                        purl: (0, purl_helper_1.packageToPurl)(ecosystem, packageName),
                     },
                 },
             },

package/dist/lib/ecosystem.d.ts

@@ -1,5 +1,2 @@
-/**
- * https://github.com/google/osv/blob/b9f0d1c1b377b0ab5804808f24032be965a571b8/lib/osv/ecosystems.py#L313-L321
- */
-export declare const ecosystems: readonly ["crates.io", "Go", "Maven", "npm", "NuGet", "PyPI", "RubyGems"];
+export declare const ecosystems: readonly ["crates.io", "Go", "Hex", "Maven", "npm", "NuGet", "Packagist", "PyPI", "RubyGems"];
 export type Ecosystem = typeof ecosystems[number];

package/dist/lib/ecosystem.js

@@ -1,15 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ecosystems = void 0;
-/**
- * https://github.com/google/osv/blob/b9f0d1c1b377b0ab5804808f24032be965a571b8/lib/osv/ecosystems.py#L313-L321
- */
+// https://github.com/google/osv.dev/blob/edacbd3c32b1d632bad8c5b506a14d0850b2e537/osv/ecosystems.py#L659-L679
 exports.ecosystems = [
     'crates.io',
     'Go',
+    'Hex',
     'Maven',
     'npm',
     'NuGet',
+    'Packagist',
     'PyPI',
     'RubyGems',
 ];

package/dist/lib/osv.d.ts

@@ -1,62 +1,69 @@
 /**
  * A schema for describing a vulnerability in an open source package.
+ *
+ * https://github.com/ossf/osv-schema/blob/main/validation/schema.json
  */
 export interface Vulnerability {
-    affected?: Affected[];
+    schema_version?: string;
+    id: string;
+    modified: string;
+    published?: string;
+    withdrawn?: string;
     aliases?: string[];
+    related?: string[];
+    summary?: string;
+    details?: string;
+    severity?: Severity[];
+    affected?: Affected[];
+    references?: Reference[];
     credits?: Credit[];
-    databaseSpecific?: {
+    database_specific?: {
         [key: string]: unknown;
     };
-    details?: string;
-    id: string;
-    modified: Date;
-    published?: Date;
-    references?: Reference[];
-    related?: string[];
-    schemaVersion?: string;
-    severity?: Severity[];
-    summary?: string;
-    withdrawn?: Date;
 }
 export interface Affected {
-    databaseSpecific?: {
+    package?: Package;
+    severity?: Severity[];
+    ranges?: Range[];
+    versions?: string[];
+    ecosystem_specific?: {
         [key: string]: unknown;
     };
-    ecosystemSpecific?: {
+    database_specific?: {
         [key: string]: unknown;
     };
-    package?: Package;
-    ranges?: Range[];
-    versions?: string[];
 }
+export interface Severity {
+    type: SeverityType;
+    score: string;
+}
+export type SeverityType = 'CVSS_V3' | 'CVSS_V2';
 export interface Package {
     ecosystem: string;
     name: string;
     purl?: string;
 }
 export interface Range {
-    events: Event[];
-    repo?: string;
     type: RangeType;
+    repo?: string;
+    events: Event[];
+    database_specific?: {
+        [key: string]: unknown;
+    };
 }
+export type RangeType = 'ECOSYSTEM' | 'GIT' | 'SEMVER';
 export interface Event {
     introduced?: string;
     fixed?: string;
+    last_affected?: string;
     limit?: string;
 }
-export type RangeType = 'ECOSYSTEM' | 'GIT' | 'SEMVER';
-export interface Credit {
-    contact?: string[];
-    name: string;
-}
 export interface Reference {
     type: ReferenceType;
     url: string;
 }
-export type ReferenceType = 'ADVISORY' | 'ARTICLE' | 'FIX' | 'GIT' | 'PACKAGE' | 'REPORT' | 'WEB';
-export interface Severity {
-    score: string;
-    type: SeverityType;
+export interface Credit {
+    name: string;
+    contact?: string[];
 }
-export type SeverityType = 'CVSS_V3';
+export type ReferenceType = 'ADVISORY' | 'ARTICLE' | 'REPORT' | 'FIX' | 'GIT' | 'PACKAGE' | 'EVIDENCE' | 'WEB';

package/dist/lib/purl-helper.d.ts

@@ -0,0 +1,2 @@
+import type { Ecosystem } from './ecosystem';
+export declare function packageToPurl(ecosystem: Ecosystem, packageName: string): string;

package/dist/lib/purl-helper.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageToPurl = void 0;
+// https://github.com/google/osv.dev/blob/edacbd3c32b1d632bad8c5b506a14d0850b2e537/osv/purl_helpers.py#L18-L30
+const PURL_ECOSYSTEMS = {
+    'crates.io': 'cargo',
+    Go: 'golang',
+    Hex: 'hex',
+    Maven: 'maven',
+    NuGet: 'nuget',
+    npm: 'npm',
+    Packagist: 'composer',
+    PyPI: 'pypi',
+    RubyGems: 'gem',
+};
+function urlEncode(packageName) {
+    const parts = packageName.split('/');
+    return parts.map(encodeURIComponent).join('/');
+}
+function packageToPurl(ecosystem, packageName) {
+    let packageNamePurl = packageName;
+    const purlType = PURL_ECOSYSTEMS[ecosystem];
+    if (purlType === 'maven') {
+        packageNamePurl = packageName.replace(':', '/');
+    }
+    return `pkg:${purlType}/${urlEncode(packageNamePurl)}`;
+}
+exports.packageToPurl = packageToPurl;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@renovatebot/osv-offline-db",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "license": "MIT",
@@ -13,7 +13,7 @@
   "devDependencies": {
     "@tsconfig/node14": "1.0.3",
     "@types/node": "18.11.18",
-    "prettier": "2.8.1",
+    "prettier": "2.8.3",
     "ts-node": "10.9.1",
     "typescript": "4.9.4"
   }