@security-alert/share 1.1.1 → 1.6.0

package/lib/VulnerabilityAlerts.js

@@ -1,61 +1,64 @@
 "use strict";
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
         function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
         function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : new P(function (resolve) { resolve(result.value); }).then(fulfilled, rejected); }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const graphql = require("@octokit/graphql");
+exports.fetchVulnerabilityAlerts = void 0;
+const graphql_1 = require("@octokit/graphql");
 function fetchVulnerabilityAlerts(options) {
     return __awaiter(this, void 0, void 0, function* () {
         // https://developer.github.com/v4/object/repository/#connections
-        const { repository } = yield graphql(`
-query vulnerabilityAlerts($owner: String!, $repo: String!) {
-  repository(owner:$owner, name:$repo) {
-    vulnerabilityAlerts(first:100) {
-      edges {
-        node {
-          id
-          vulnerableManifestFilename
-          vulnerableManifestPath
-          vulnerableRequirements
-          dismissReason
-          dismissedAt
-          dismisser {
-            login
-          }
-          securityAdvisory {
-            ghsaId
-            description
-            severity
-            summary
-            identifiers {
-              type
-              value
+        const { repository } = yield (0, graphql_1.graphql)(`
+            query vulnerabilityAlerts($owner: String!, $repo: String!) {
+                repository(owner: $owner, name: $repo) {
+                    vulnerabilityAlerts(first: 100) {
+                        edges {
+                            node {
+                                id
+                                vulnerableManifestFilename
+                                vulnerableManifestPath
+                                vulnerableRequirements
+                                dismissReason
+                                dismissedAt
+                                dismisser {
+                                    login
+                                }
+                                securityAdvisory {
+                                    ghsaId
+                                    description
+                                    severity
+                                    summary
+                                    identifiers {
+                                        type
+                                        value
+                                    }
+                                    references {
+                                        url
+                                    }
+                                }
+                                securityVulnerability {
+                                    firstPatchedVersion {
+                                        identifier
+                                    }
+                                    vulnerableVersionRange
+                                    severity
+                                    package {
+                                        name
+                                        ecosystem
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
             }
-            references {
-              url
-            }
-          }
-          securityVulnerability {
-            firstPatchedVersion {
-              identifier
-            }
-            vulnerableVersionRange
-            severity
-            package {
-              name
-              ecosystem
-            }
-          }
-        }
-      }
-    }
-  }
-}`, {
+        `, {
             owner: options.owner,
             repo: options.repo,
             headers: {

package/lib/VulnerabilityAlerts.js.map

@@ -1 +1 @@
-{"version":3,"file":"VulnerabilityAlerts.js","sourceRoot":"","sources":["../src/VulnerabilityAlerts.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAuC5C,SAAsB,wBAAwB,CAAC,OAAwC;;QACnF,iEAAiE;QACjE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2CvC,EAAE;YACI,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE;gBACL,aAAa,EAAE,SAAS,OAAO,CAAC,KAAK,EAAE;gBACvC,MAAM,EAAE,2CAA2C;aACtD;SACJ,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE;YAC1D,OAAO,IAAI,CAAC,IAAI,CAAC;QACrB,CAAC,CAAC,CAAC;IACP,CAAC;CAAA;AAxDD,4DAwDC"}
+{"version":3,"file":"VulnerabilityAlerts.js","sourceRoot":"","sources":["../src/VulnerabilityAlerts.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAA2C;AAuC3C,SAAsB,wBAAwB,CAC1C,OAAwC;;QAExC,iEAAiE;QACjE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAA,iBAAO,EAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA4CC,EACD;YACI,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE;gBACL,aAAa,EAAE,SAAS,OAAO,CAAC,KAAK,EAAE;gBACvC,MAAM,EAAE,2CAA2C;aACtD;SACJ,CACJ,CAAC;QACF,OAAO,UAAU,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE;YAC1D,OAAO,IAAI,CAAC,IAAI,CAAC;QACrB,CAAC,CAAC,CAAC;IACP,CAAC;CAAA;AA9DD,4DA8DC"}

package/lib/fetchPackageDetails.js

@@ -1,24 +1,25 @@
 "use strict";
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
         function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
         function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : new P(function (resolve) { resolve(result.value); }).then(fulfilled, rejected); }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const rest_1 = __importDefault(require("@octokit/rest"));
+exports.fetchPackageDetails = void 0;
+const rest_1 = require("@octokit/rest");
 const package_json_1 = require("./parser/package.json");
 const package_lock_json_1 = require("./parser/package-lock.json");
+const yarn_lock_1 = require("./parser/yarn-lock");
+const lockfile = require("@yarnpkg/lockfile");
 const cacheMap = new Map();
 function fetchPackageDetails(options) {
     return __awaiter(this, void 0, void 0, function* () {
         const { token } = options;
-        const octokit = new rest_1.default({
+        const octokit = new rest_1.Octokit({
             auth: token
         });
         const cacheKey = `${options.owner}.${options.repo}.${options.packageFilePath}`;
@@ -26,42 +27,57 @@ function fetchPackageDetails(options) {
         const pkg = cachedValue
             ? cachedValue
             : yield octokit.repos
-                .getContents({
+                .getContent({
                 repo: options.repo,
                 owner: options.owner,
                 path: options.packageFilePath
             })
-                .then(res => {
+                .then((res) => {
                 if (res.data.type !== "file") {
                     throw new Error("This is not file:" + options.packageFilePath);
                 }
                 if (res.data.encoding === "base64") {
-                    const content = JSON.parse(Buffer.from(res.data.content, "base64").toString());
+                    const content = Buffer.from(res.data.content, "base64").toString();
                     cacheMap.set(cacheKey, {
                         html_url: res.data.html_url,
-                        content
+                        content: content
                     });
                     return {
                         html_url: res.data.html_url,
-                        content
+                        content: content
                     };
                 }
                 throw new Error("Unknown file type" + res.data.type + ":" + res.data.encoding);
             });
-        if (package_lock_json_1.isPackageLock(options.packageFilePath)) {
-            return Object.assign({}, package_lock_json_1.lookupPackageLockDetails({
+        if ((0, package_lock_json_1.isPackageLock)(options.packageFilePath)) {
+            return Object.assign(Object.assign({}, (0, package_lock_json_1.lookupPackageLockDetails)({
                 packageName: options.packageName,
                 packageFilePath: options.packageFilePath,
-                pkg: pkg.content
-            }), { packageManifestUrl: pkg.html_url });
+                pkg: JSON.parse(pkg.content)
+            })), { packageManifestUrl: pkg.html_url });
         }
-        else {
-            return Object.assign({}, package_json_1.lookupPackageDetails({
+        else if ((0, package_json_1.isPackage)(options.packageFilePath)) {
+            return Object.assign(Object.assign({}, (0, package_json_1.lookupPackageDetails)({
                 packageName: options.packageName,
                 packageFilePath: options.packageFilePath,
-                pkg: pkg.content
-            }), { packageManifestUrl: pkg.html_url });
+                pkg: JSON.parse(pkg.content)
+            })), { packageManifestUrl: pkg.html_url });
         }
+        else if ((0, yarn_lock_1.isYarnLock)(options.packageFilePath)) {
+            return Object.assign(Object.assign({}, (0, yarn_lock_1.lookupYarnLockDetails)({
+                packageName: options.packageName,
+                packageFilePath: options.packageFilePath,
+                pkg: lockfile.parse(pkg.content)
+            })), { packageManifestUrl: pkg.html_url });
+        }
+        // unknown
+        return Promise.resolve({
+            name: options.packageName,
+            version: "0.0.0",
+            packageFilePath: options.packageFilePath,
+            dependenciesType: "unknown",
+            packageManifestUrl: pkg.html_url
+        });
     });
 }
 exports.fetchPackageDetails = fetchPackageDetails;

package/lib/fetchPackageDetails.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetchPackageDetails.js","sourceRoot":"","sources":["../src/fetchPackageDetails.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,yDAAoC;AACpC,wDAA6D;AAC7D,kEAAqF;AAWrF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAGpB,CAAC;AAML,SAAsB,mBAAmB,CAAC,OAA4B;;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC;YACxB,IAAI,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/E,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,WAAW;YACnB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK;iBAChB,WAAW,CAAC;gBACT,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,eAAe;aAChC,CAAC;iBACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBACR,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE;oBAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;iBAClE;gBACD,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE;oBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC/E,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE;wBACnB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;wBAC3B,OAAO;qBACV,CAAC,CAAC;oBACH,OAAO;wBACH,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;wBAC3B,OAAO;qBACV,CAAC;iBACL;gBACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnF,CAAC,CAAC,CAAC;QACX,IAAI,iCAAa,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;YACxC,yBACO,4CAAwB,CAAC;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,GAAG,EAAE,GAAG,CAAC,OAAO;aACnB,CAAC,IACF,kBAAkB,EAAE,GAAG,CAAC,QAAQ,IAClC;SACL;aAAM;YACH,yBACO,mCAAoB,CAAC;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,GAAG,EAAE,GAAG,CAAC,OAAO;aACnB,CAAC,IACF,kBAAkB,EAAE,GAAG,CAAC,QAAQ,IAClC;SACL;IACL,CAAC;CAAA;AAnDD,kDAmDC"}
+{"version":3,"file":"fetchPackageDetails.js","sourceRoot":"","sources":["../src/fetchPackageDetails.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAAwC;AACxC,wDAAwE;AACxE,kEAAqF;AAErF,kDAAuE;AAEvE,MAAM,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAU9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAMrB,CAAC;AAMJ,SAAsB,mBAAmB,CAAC,OAA4B;;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,cAAO,CAAC;YACxB,IAAI,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/E,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,WAAW;YACnB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK;iBACd,UAAU,CAAC;gBACR,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,eAAe;aAChC,CAAC;iBACD,IAAI,CAAC,CAAC,GAAQ,EAAO,EAAE;gBACpB,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE;oBAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;iBAClE;gBACD,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE;oBAChC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACnE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE;wBACnB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;wBAC3B,OAAO,EAAE,OAAO;qBACnB,CAAC,CAAC;oBACH,OAAO;wBACH,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;wBAC3B,OAAO,EAAE,OAAO;qBACnB,CAAC;iBACL;gBACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnF,CAAC,CAAC,CAAC;QACb,IAAI,IAAA,iCAAa,EAAC,OAAO,CAAC,eAAe,CAAC,EAAE;YACxC,uCACO,IAAA,4CAAwB,EAAC;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;aAC/B,CAAC,KACF,kBAAkB,EAAE,GAAG,CAAC,QAAQ,IAClC;SACL;aAAM,IAAI,IAAA,wBAAS,EAAC,OAAO,CAAC,eAAe,CAAC,EAAE;YAC3C,uCACO,IAAA,mCAAoB,EAAC;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;aAC/B,CAAC,KACF,kBAAkB,EAAE,GAAG,CAAC,QAAQ,IAClC;SACL;aAAM,IAAI,IAAA,sBAAU,EAAC,OAAO,CAAC,eAAe,CAAC,EAAE;YAC5C,uCACO,IAAA,iCAAqB,EAAC;gBACrB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;aACnC,CAAC,KACF,kBAAkB,EAAE,GAAG,CAAC,QAAQ,IAClC;SACL;QACD,UAAU;QACV,OAAO,OAAO,CAAC,OAAO,CAAC;YACnB,IAAI,EAAE,OAAO,CAAC,WAAW;YACzB,OAAO,EAAE,OAAO;YAChB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,gBAAgB,EAAE,SAAS;YAC3B,kBAAkB,EAAE,GAAG,CAAC,QAAQ;SACnC,CAAC,CAAC;IACP,CAAC;CAAA;AApED,kDAoEC"}

package/lib/index.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchVulnerabilityAlerts = exports.fetchPackageDetails = void 0;
 var fetchPackageDetails_1 = require("./fetchPackageDetails");
-exports.fetchPackageDetails = fetchPackageDetails_1.fetchPackageDetails;
+Object.defineProperty(exports, "fetchPackageDetails", { enumerable: true, get: function () { return fetchPackageDetails_1.fetchPackageDetails; } });
 var VulnerabilityAlerts_1 = require("./VulnerabilityAlerts");
-exports.fetchVulnerabilityAlerts = VulnerabilityAlerts_1.fetchVulnerabilityAlerts;
+Object.defineProperty(exports, "fetchVulnerabilityAlerts", { enumerable: true, get: function () { return VulnerabilityAlerts_1.fetchVulnerabilityAlerts; } });
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAAA,6DAA+E;AAAlD,oDAAA,mBAAmB,CAAA;AAChD,6DAAwH;AAA/E,yDAAA,wBAAwB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,6DAAiF;AAAnD,0HAAA,mBAAmB,OAAA;AACjD,6DAI+B;AAF3B,+HAAA,wBAAwB,OAAA"}

package/lib/parser/package-lock.json.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.lookupPackageLockDetails = exports.isPackageLock = void 0;
 function isPackageLock(packageFilePath) {
     return /package-lock.json$/.test(packageFilePath);
 }

package/lib/parser/package-lock.json.js.map

@@ -1 +1 @@
-{"version":3,"file":"package-lock.json.js","sourceRoot":"","sources":["../../src/parser/package-lock.json.ts"],"names":[],"mappings":";;AAGA,SAAgB,aAAa,CAAC,eAAuB;IACjD,OAAO,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACtD,CAAC;AAFD,sCAEC;AAED,SAAgB,wBAAwB,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,EAI3E;IACG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE;QACnB,OAAO;YACH,IAAI,EAAE,WAAW;YACjB,eAAe;YACf,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,SAAS;SAC9B,CAAC;KACL;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE;QACb,OAAO;YACH,IAAI,EAAE,WAAW;YACjB,eAAe;YACf,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,SAAS;SAC9B,CAAC;KACL;IACD,MAAM,IAAI,GAAqB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC;IACnF,OAAO;QACH,IAAI,EAAE,WAAW;QACjB,eAAe;QACf,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,gBAAgB,EAAE,IAAI;KACzB,CAAC;AACN,CAAC;AA7BD,4DA6BC"}
+{"version":3,"file":"package-lock.json.js","sourceRoot":"","sources":["../../src/parser/package-lock.json.ts"],"names":[],"mappings":";;;AAGA,SAAgB,aAAa,CAAC,eAAuB;IACjD,OAAO,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACtD,CAAC;AAFD,sCAEC;AAED,SAAgB,wBAAwB,CAAC,EACrC,WAAW,EACX,eAAe,EACf,GAAG,EAKN;IACG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE;QACnB,OAAO;YACH,IAAI,EAAE,WAAW;YACjB,eAAe;YACf,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,SAAS;SAC9B,CAAC;KACL;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE;QACb,OAAO;YACH,IAAI,EAAE,WAAW;YACjB,eAAe;YACf,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,SAAS;SAC9B,CAAC;KACL;IACD,MAAM,IAAI,GAAqB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC;IACnF,OAAO;QACH,IAAI,EAAE,WAAW;QACjB,eAAe;QACf,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,gBAAgB,EAAE,IAAI;KACzB,CAAC;AACN,CAAC;AAjCD,4DAiCC"}

package/lib/parser/package.json.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.lookupPackageDetails = exports.isPackage = void 0;
 function isPackage(packageFilePath) {
     return /pacakge.json$/.test(packageFilePath);
 }

package/lib/parser/package.json.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.json.js","sourceRoot":"","sources":["../../src/parser/package.json.ts"],"names":[],"mappings":";;AAGA,SAAgB,SAAS,CAAC,eAAuB;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACjD,CAAC;AAFD,8BAEC;AAED,SAAgB,oBAAoB,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,EAIvE;IACG,4CAA4C;IAC5C,MAAM,YAAY,GAAI,GAAW,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,eAAe,GAAG,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAA4D,EAAE;QAC1E,IAAI,YAAY,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE;YAC1C,OAAO;gBACH,gBAAgB,EAAE,cAAc;gBAChC,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC;aACrC,CAAC;SACL;QACD,IAAI,eAAe,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE;YAC7C,OAAO;gBACH,gBAAgB,EAAE,iBAAiB;gBACnC,OAAO,EAAE,eAAe,CAAC,WAAW,CAAC;aACxC,CAAC;SACL;QACD,OAAO;YACH,gBAAgB,EAAE,SAAS;YAC3B,OAAO,EAAE,OAAO;SACnB,CAAC;IACN,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACH,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe;QACf,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC5C,CAAC;AACN,CAAC;AAhCD,oDAgCC"}
+{"version":3,"file":"package.json.js","sourceRoot":"","sources":["../../src/parser/package.json.ts"],"names":[],"mappings":";;;AAGA,SAAgB,SAAS,CAAC,eAAuB;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACjD,CAAC;AAFD,8BAEC;AAED,SAAgB,oBAAoB,CAAC,EACjC,WAAW,EACX,eAAe,EACf,GAAG,EAKN;IACG,4CAA4C;IAC5C,MAAM,YAAY,GAAI,GAAW,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,eAAe,GAAG,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAA4D,EAAE;QAC1E,IAAI,YAAY,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE;YAC1C,OAAO;gBACH,gBAAgB,EAAE,cAAc;gBAChC,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC;aACrC,CAAC;SACL;QACD,IAAI,eAAe,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE;YAC7C,OAAO;gBACH,gBAAgB,EAAE,iBAAiB;gBACnC,OAAO,EAAE,eAAe,CAAC,WAAW,CAAC;aACxC,CAAC;SACL;QACD,OAAO;YACH,gBAAgB,EAAE,SAAS;YAC3B,OAAO,EAAE,OAAO;SACnB,CAAC;IACN,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACH,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe;QACf,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC5C,CAAC;AACN,CAAC;AApCD,oDAoCC"}

package/lib/parser/yarn-lock.d.ts

@@ -0,0 +1,17 @@
+import { PackageDetails } from "./Details";
+export declare function isYarnLock(packageFilePath: string): boolean;
+export declare function lookupYarnLockDetails({ packageName, packageFilePath, pkg }: {
+    packageName: string;
+    packageFilePath: string;
+    pkg: {
+        type: string;
+        object: {
+            [index: string]: {
+                version: string;
+                resolve: string;
+                integrity: string;
+                dependencies: object;
+            };
+        };
+    };
+}): PackageDetails;

package/lib/parser/yarn-lock.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lookupYarnLockDetails = exports.isYarnLock = void 0;
+function isYarnLock(packageFilePath) {
+    return /yarn.lock$/.test(packageFilePath);
+}
+exports.isYarnLock = isYarnLock;
+function lookupYarnLockDetails({ packageName, packageFilePath, pkg }) {
+    if (pkg.type !== "success") {
+        return {
+            name: packageName,
+            packageFilePath,
+            version: "0.0.0",
+            dependenciesType: "unknown"
+        };
+    }
+    const matchKey = Object.keys(pkg.object).find((key) => {
+        const keyName = key.slice(0, key.lastIndexOf("@"));
+        return keyName === packageName;
+    });
+    if (!matchKey) {
+        return {
+            name: packageName,
+            packageFilePath,
+            version: "0.0.0",
+            dependenciesType: "unknown"
+        };
+    }
+    const dep = pkg.object[matchKey];
+    return {
+        name: packageName,
+        packageFilePath,
+        version: dep.version,
+        dependenciesType: "unknown"
+    };
+}
+exports.lookupYarnLockDetails = lookupYarnLockDetails;
+//# sourceMappingURL=yarn-lock.js.map

package/lib/parser/yarn-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yarn-lock.js","sourceRoot":"","sources":["../../src/parser/yarn-lock.ts"],"names":[],"mappings":";;;AAEA,SAAgB,UAAU,CAAC,eAAuB;IAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC9C,CAAC;AAFD,gCAEC;AAED,SAAgB,qBAAqB,CAAC,EAClC,WAAW,EACX,eAAe,EACf,GAAG,EAQN;IACG,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE;QACxB,OAAO;YACH,IAAI,EAAE,WAAW;YACjB,eAAe;YACf,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,SAAS;SAC9B,CAAC;KACL;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,OAAO,OAAO,KAAK,WAAW,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE;QACX,OAAO;YACH,IAAI,EAAE,WAAW;YACjB,eAAe;YACf,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,SAAS;SAC9B,CAAC;KACL;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO;QACH,IAAI,EAAE,WAAW;QACjB,eAAe;QACf,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,gBAAgB,EAAE,SAAS;KAC9B,CAAC;AACN,CAAC;AAvCD,sDAuCC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@security-alert/share",
-  "version": "1.1.1",
-  "description": "[GitHub] Create an issue from security alert's url.",
+  "version": "1.6.0",
+  "description": "security alert shared lib",
   "keywords": [
     "cli",
     "console",
@@ -34,55 +34,34 @@
   "scripts": {
     "build": "cross-env NODE_ENV=production tsc -p .",
     "clean": "rimraf lib/",
-    "prettier": "prettier --write \"**/*.{js,jsx,ts,tsx,css}\"",
     "prepublish": "npm run --if-present build",
-    "test": "# jest",
-    "test:watch": "jest --watch --notify --notifyMode=change --coverage",
+    "test": "mocha \"test/**/*.ts\"",
     "watch": "tsc -p . --watch"
   },
-  "jest": {
-    "testEnvironment": "node"
-  },
-  "husky": {
-    "hooks": {
-      "precommit": "lint-staged"
-    }
-  },
-  "lint-staged": {
-    "*.{js,jsx,ts,tsx,css}": [
-      "prettier --write",
-      "git add"
-    ]
-  },
-  "prettier": {
-    "printWidth": 120,
-    "singleQuote": false,
-    "tabWidth": 4
-  },
   "devDependencies": {
-    "@types/jest": "^24.0.0",
-    "@types/lodash": "^4.14.134",
+    "@types/lodash": "^4.14.158",
     "@types/meow": "^5.0.0",
-    "@types/nock": "^10.0.3",
-    "@types/node": "^12.0.10",
-    "cross-env": "^5.2.0",
-    "husky": "^2.5.0",
-    "jest": "^24.0.0",
-    "lint-staged": "^8.2.1",
-    "nock": "^10.0.6",
-    "prettier": "^1.18.2",
-    "rimraf": "^2.6.3",
-    "ts-node": "^8.3.0",
-    "ts-node-test-register": "^8.0.1",
-    "typescript": "^3.5.2"
+    "@types/mocha": "^8.0.1",
+    "@types/nock": "^11.1.0",
+    "@types/node": "^14.18.12",
+    "cross-env": "^7.0.2",
+    "husky": "^4.2.5",
+    "mocha": "^9.2.2",
+    "nock": "^13.0.3",
+    "rimraf": "^3.0.2",
+    "ts-node": "^10.7.0",
+    "ts-node-test-register": "^10.0.0",
+    "typescript": "^4.6.3"
   },
   "dependencies": {
     "@npm/types": "^1.0.1",
-    "@octokit/graphql": "^2.1.2",
-    "@octokit/rest": "^16.28.2",
-    "meow": "^5.0.0"
+    "@octokit/graphql": "^4.5.3",
+    "@octokit/rest": "^18.0.3",
+    "@octokit/types": "^6.34.0",
+    "@yarnpkg/lockfile": "^1.0.0",
+    "meow": "^7.0.1"
   },
-  "gitHead": "0534d414d1a2e5919bc67002bc6a44c384bccbf1",
+  "gitHead": "6788f5c379dc9daa8cfeb6556d1cce93401df21e",
   "publishConfig": {
     "access": "public"
   }

package/src/VulnerabilityAlerts.ts

@@ -1,14 +1,14 @@
-const graphql = require("@octokit/graphql");
+import { graphql } from "@octokit/graphql";
 
 export type fetchVulnerabilityAlertsOptions = {
     token: string;
     owner: string;
     repo: string;
-}
+};
 
 export type VulnerabilityAlertNode = {
     id: string;
-    vulnerableManifestFilename: string
+    vulnerableManifestFilename: string;
     vulnerableManifestPath: string;
     vulnerableRequirements: string;
     dismissReason: string | null;
@@ -20,10 +20,10 @@ export type VulnerabilityAlertNode = {
         description: string;
         ghsaId: string;
         severity: string;
-        summary: string
-        identifiers: { id: string; value: string; }[]
-        references: { url: string }[]
-    }
+        summary: string;
+        identifiers: { id: string; value: string }[];
+        references: { url: string }[];
+    };
     securityVulnerability: {
         firstPatchedVersion?: {
             identifier: string;
@@ -32,64 +32,70 @@ export type VulnerabilityAlertNode = {
         severity: string;
         package: {
             name: string;
-            ecosystem: string
-        }
-    }
-}
+            ecosystem: string;
+        };
+    };
+};
 
-export async function fetchVulnerabilityAlerts(options: fetchVulnerabilityAlertsOptions): Promise<VulnerabilityAlertNode[]> {
+export async function fetchVulnerabilityAlerts(
+    options: fetchVulnerabilityAlertsOptions
+): Promise<VulnerabilityAlertNode[]> {
     // https://developer.github.com/v4/object/repository/#connections
-    const { repository } = await graphql(`
-query vulnerabilityAlerts($owner: String!, $repo: String!) {
-  repository(owner:$owner, name:$repo) {
-    vulnerabilityAlerts(first:100) {
-      edges {
-        node {
-          id
-          vulnerableManifestFilename
-          vulnerableManifestPath
-          vulnerableRequirements
-          dismissReason
-          dismissedAt
-          dismisser {
-            login
-          }
-          securityAdvisory {
-            ghsaId
-            description
-            severity
-            summary
-            identifiers {
-              type
-              value
+    const { repository } = await graphql(
+        `
+            query vulnerabilityAlerts($owner: String!, $repo: String!) {
+                repository(owner: $owner, name: $repo) {
+                    vulnerabilityAlerts(first: 100) {
+                        edges {
+                            node {
+                                id
+                                vulnerableManifestFilename
+                                vulnerableManifestPath
+                                vulnerableRequirements
+                                dismissReason
+                                dismissedAt
+                                dismisser {
+                                    login
+                                }
+                                securityAdvisory {
+                                    ghsaId
+                                    description
+                                    severity
+                                    summary
+                                    identifiers {
+                                        type
+                                        value
+                                    }
+                                    references {
+                                        url
+                                    }
+                                }
+                                securityVulnerability {
+                                    firstPatchedVersion {
+                                        identifier
+                                    }
+                                    vulnerableVersionRange
+                                    severity
+                                    package {
+                                        name
+                                        ecosystem
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
             }
-            references {
-              url
+        `,
+        {
+            owner: options.owner,
+            repo: options.repo,
+            headers: {
+                authorization: `token ${options.token}`,
+                accept: "application/vnd.github.vixen-preview+json"
             }
-          }
-          securityVulnerability {
-            firstPatchedVersion {
-              identifier
-            }
-            vulnerableVersionRange
-            severity
-            package {
-              name
-              ecosystem
-            }
-          }
         }
-      }
-    }
-  }
-}`, {
-        owner: options.owner,
-        repo: options.repo,
-        headers: {
-            authorization: `token ${options.token}`,
-            accept: "application/vnd.github.vixen-preview+json"
-        }
-    });
+    );
     return repository.vulnerabilityAlerts.edges.map((edge: any) => {
         return edge.node;
     });

package/src/fetchPackageDetails.ts

@@ -1,7 +1,10 @@
-import Octokit from "@octokit/rest";
-import { lookupPackageDetails } from "./parser/package.json";
+import { Octokit } from "@octokit/rest";
+import { isPackage, lookupPackageDetails } from "./parser/package.json";
 import { isPackageLock, lookupPackageLockDetails } from "./parser/package-lock.json";
 import { PackageDetails } from "./parser/Details";
+import { isYarnLock, lookupYarnLockDetails } from "./parser/yarn-lock";
+
+const lockfile = require("@yarnpkg/lockfile");
 
 export type fetchPackageOptions = {
     token: string;
@@ -11,14 +14,17 @@ export type fetchPackageOptions = {
     packageFilePath: string;
 };
 
-const cacheMap = new Map<string, {
-    html_url: string,
-    content: object,
-}>();
+const cacheMap = new Map<
+    string,
+    {
+        html_url: string;
+        content: string;
+    }
+>();
 
 export type fetchPackageDetails = PackageDetails & {
     packageManifestUrl: string;
-}
+};
 
 export async function fetchPackageDetails(options: fetchPackageOptions): Promise<fetchPackageDetails> {
     const { token } = options;
@@ -30,45 +36,62 @@ export async function fetchPackageDetails(options: fetchPackageOptions): Promise
     const pkg = cachedValue
         ? cachedValue
         : await octokit.repos
-            .getContents({
-                repo: options.repo,
-                owner: options.owner,
-                path: options.packageFilePath
-            })
-            .then(res => {
-                if (res.data.type !== "file") {
-                    throw new Error("This is not file:" + options.packageFilePath);
-                }
-                if (res.data.encoding === "base64") {
-                    const content = JSON.parse(Buffer.from(res.data.content, "base64").toString());
-                    cacheMap.set(cacheKey, {
-                        html_url: res.data.html_url,
-                        content
-                    });
-                    return {
-                        html_url: res.data.html_url,
-                        content
-                    };
-                }
-                throw new Error("Unknown file type" + res.data.type + ":" + res.data.encoding);
-            });
+              .getContent({
+                  repo: options.repo,
+                  owner: options.owner,
+                  path: options.packageFilePath
+              })
+              .then((res: any): any => {
+                  if (res.data.type !== "file") {
+                      throw new Error("This is not file:" + options.packageFilePath);
+                  }
+                  if (res.data.encoding === "base64") {
+                      const content = Buffer.from(res.data.content, "base64").toString();
+                      cacheMap.set(cacheKey, {
+                          html_url: res.data.html_url,
+                          content: content
+                      });
+                      return {
+                          html_url: res.data.html_url,
+                          content: content
+                      };
+                  }
+                  throw new Error("Unknown file type" + res.data.type + ":" + res.data.encoding);
+              });
     if (isPackageLock(options.packageFilePath)) {
         return {
             ...lookupPackageLockDetails({
                 packageName: options.packageName,
                 packageFilePath: options.packageFilePath,
-                pkg: pkg.content
+                pkg: JSON.parse(pkg.content)
             }),
             packageManifestUrl: pkg.html_url
         };
-    } else {
+    } else if (isPackage(options.packageFilePath)) {
         return {
             ...lookupPackageDetails({
                 packageName: options.packageName,
                 packageFilePath: options.packageFilePath,
-                pkg: pkg.content
+                pkg: JSON.parse(pkg.content)
+            }),
+            packageManifestUrl: pkg.html_url
+        };
+    } else if (isYarnLock(options.packageFilePath)) {
+        return {
+            ...lookupYarnLockDetails({
+                packageName: options.packageName,
+                packageFilePath: options.packageFilePath,
+                pkg: lockfile.parse(pkg.content)
             }),
             packageManifestUrl: pkg.html_url
         };
     }
+    // unknown
+    return Promise.resolve({
+        name: options.packageName,
+        version: "0.0.0",
+        packageFilePath: options.packageFilePath,
+        dependenciesType: "unknown",
+        packageManifestUrl: pkg.html_url
+    });
 }

package/src/index.ts

@@ -1,3 +1,7 @@
-export {fetchPackageOptions, fetchPackageDetails} from "./fetchPackageDetails";
-export {fetchVulnerabilityAlertsOptions, fetchVulnerabilityAlerts, VulnerabilityAlertNode} from "./VulnerabilityAlerts";
-export {PackageDetails} from "./parser/Details";
+export { fetchPackageOptions, fetchPackageDetails } from "./fetchPackageDetails";
+export {
+    fetchVulnerabilityAlertsOptions,
+    fetchVulnerabilityAlerts,
+    VulnerabilityAlertNode
+} from "./VulnerabilityAlerts";
+export { PackageDetails } from "./parser/Details";

package/src/parser/Details.ts

@@ -4,4 +4,4 @@ export type PackageDetails = {
     version: string;
     packageFilePath: string;
     dependenciesType: DependenciesType;
-}
+};

package/src/parser/package-lock.json.ts

@@ -5,10 +5,14 @@ export function isPackageLock(packageFilePath: string) {
     return /package-lock.json$/.test(packageFilePath);
 }
 
-export function lookupPackageLockDetails({ packageName, packageFilePath, pkg }: {
-    packageName: string,
-    packageFilePath: string,
-    pkg: PackageLock
+export function lookupPackageLockDetails({
+    packageName,
+    packageFilePath,
+    pkg
+}: {
+    packageName: string;
+    packageFilePath: string;
+    pkg: PackageLock;
 }): PackageDetails {
     if (!pkg.dependencies) {
         return {

package/src/parser/package.json.ts

@@ -5,15 +5,19 @@ export function isPackage(packageFilePath: string) {
     return /pacakge.json$/.test(packageFilePath);
 }
 
-export function lookupPackageDetails({ packageName, packageFilePath, pkg }: {
-    packageName: string,
-    packageFilePath: string,
-    pkg: PackageJson
+export function lookupPackageDetails({
+    packageName,
+    packageFilePath,
+    pkg
+}: {
+    packageName: string;
+    packageFilePath: string;
+    pkg: PackageJson;
 }): PackageDetails {
     // TODO: https://github.com/npm/types/pull/2
     const dependencies = (pkg as any)["dependencies"] || {};
     const devDependencies = pkg["devDependencies"] || {};
-    const target = ((): { dependenciesType: DependenciesType, version: string } => {
+    const target = ((): { dependenciesType: DependenciesType; version: string } => {
         if (dependencies.hasOwnProperty(packageName)) {
             return {
                 dependenciesType: "dependencies",

package/src/parser/yarn-lock.ts

@@ -0,0 +1,46 @@
+import { PackageDetails } from "./Details";
+
+export function isYarnLock(packageFilePath: string) {
+    return /yarn.lock$/.test(packageFilePath);
+}
+
+export function lookupYarnLockDetails({
+    packageName,
+    packageFilePath,
+    pkg
+}: {
+    packageName: string;
+    packageFilePath: string;
+    pkg: {
+        type: string;
+        object: { [index: string]: { version: string; resolve: string; integrity: string; dependencies: object } };
+    };
+}): PackageDetails {
+    if (pkg.type !== "success") {
+        return {
+            name: packageName,
+            packageFilePath,
+            version: "0.0.0",
+            dependenciesType: "unknown"
+        };
+    }
+    const matchKey = Object.keys(pkg.object).find((key) => {
+        const keyName = key.slice(0, key.lastIndexOf("@"));
+        return keyName === packageName;
+    });
+    if (!matchKey) {
+        return {
+            name: packageName,
+            packageFilePath,
+            version: "0.0.0",
+            dependenciesType: "unknown"
+        };
+    }
+    const dep = pkg.object[matchKey];
+    return {
+        name: packageName,
+        packageFilePath,
+        version: dep.version,
+        dependenciesType: "unknown"
+    };
+}

package/CHANGELOG.md

@@ -1,8 +0,0 @@
-# Change Log
-
-All notable changes to this project will be documented in this file.
-See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
-
-## 1.1.1 (2019-07-05)
-
-**Note:** Version bump only for package @security-alert/share