@sudoplatform/sudo-common 10.0.3 → 10.0.5

package/bin/yarn-audit-with-suppression.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env bash
 
 # Run yarn audit reading any suppressions from the auditSuppressions element
 # of package.json.
@@ -13,34 +13,70 @@
 #   }
 # }
 #
-# Previously, the value of the audit suppression was jsut the expiry timestamp
-# this old format is still recognized by this script.
-#
-yarn audit --json --groups "dependencies devDependencies" | \
-  jq -M -s -c 'map(select(.type == "auditAdvisory").data.advisory) | unique_by(.id) | .[] | {id, title, module_name, vulnerable_versions, patched_versions, severity, findings}' | \
-  (new=""; while read -r advisory ; do
-  id=$(echo "${advisory}" | jq '.id')
-  suppression=$(jq ".auditSuppressions[\"$id\"] | select (. != null)" package.json)
-  if [ -z "$suppression" ]; then
-    echo "New advisory ${id}:"
-    echo "${advisory}" | jq .
-    new=1
-  else
-    if expr "$suppression" : '[0-9][0-9]*$' >/dev/null ; then
-      # Old style suppression that was just the expiry timestamp
-      expiry="$suppression"
-    else
-      # New style suppression is a JSON object
-      expiry=$(echo "$suppression" | jq -M -c ".until // 0")
-    fi
-    if [ "$(date '+%s')" -gt "$expiry" ]; then
-      echo "Suppression for advisory ${id} has expired. Please revisit:"
-      echo "${advisory}" | jq .
-      new=1
+# Previously, the value of the audit suppression was just the expiry timestamp
+# this old format is still recognized by this script for Yarn v1 projects, but
+# ignored for Yarn 4+ projects.
+
+YARNVER=$(yarn -v)
+if [[ "${YARNVER}" == 1* ]]; then
+  yarn npm audit --json --groups "dependencies devDependencies" | \
+    jq -M -s -c 'map(select(.type == "auditAdvisory").data.advisory) | unique_by(.id) | .[] | {id, title, module_name, vulnerable_versions, patched_versions, severity, findings}' | \
+    (new=""; while read -r advisory ; do
+      id=$(echo "${advisory}" | jq '.id')
+      suppression=$(jq ".auditSuppressions[\"$id\"] | select (. != null)" package.json)
+      if [ -z "$suppression" ]; then
+        echo "New advisory ${id}:"
+        echo "${advisory}" | jq .
+        new=1
+      else
+        if expr "$suppression" : '[0-9][0-9]*$' >/dev/null ; then
+          # Old style suppression that was just the expiry timestamp
+          expiry="$suppression"
+        else
+          # New style suppression is a JSON object
+          expiry=$(echo "$suppression" | jq -M -c ".until // 0")
+        fi
+        if [ "$(date '+%s')" -gt "$expiry" ]; then
+          echo "Suppression for advisory ${id} has expired. Please revisit:"
+          echo "${advisory}" | jq .
+          new=1
+        fi
+      fi
+    done
+    if [ -n "${new}" ]; then
+      exit 1
     fi
-  fi
-done
-if [ -n "${new}" ]; then
-  exit 1
+  )
+else
+  now=$(date '+%s')
+
+  echo "Checking for npm audit advisories"
+  echo
+  ignores=$(
+    # shellcheck disable=SC2002
+    cat package.json | \
+      jq -j -r ".auditSuppressions | select(. != null) | to_entries[] | select(.value.untilISO | fromdate > $now) | (\" --ignore \" + .key)"
+  )
+  # shellcheck disable=SC2086
+  yarn npm audit --all --environment all --recursive --no-deprecations $ignores
+  foundaudits=$?
+  
+  echo
+  echo "Checking for expired audit suppressions"
+  # shellcheck disable=SC2002
+  cat package.json | \
+    jq -e ".auditSuppressions | select(. != null) | to_entries[] | select(.value.untilISO | fromdate <= $now)"
+  # "jq -e" returns 4 if no valid result was found - so 4 means success, 0 (or anything else) is failure
+  # so determine status by testing result for 4
+  [ $? == 4 ]
+  foundexpired=$?
+
+  echo
+  echo "done"
+
+  [ $foundaudits != 0 ] && exit 1
+  [ $foundexpired != 0 ] && exit 1
+
+  # No audit failures or expired suppressions that need examination. Success
+  exit 0
 fi
-)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sudoplatform/sudo-common",
-  "version": "10.0.3",
+  "version": "10.0.5",
   "author": "Anonyome Labs, Inc.",
   "repository": {
     "type": "git",
@@ -48,31 +48,31 @@
     "types"
   ],
   "dependencies": {
-    "@aws-sdk/client-s3": "<3.633.0",
+    "@aws-sdk/client-s3": "^3.758.0",
     "apollo-client": "^2.6.10",
     "asn1js": "^3.0.5",
     "browser-bunyan": "^1.8.0",
     "fflate": "^0.8.2",
     "graphql": "^15.9.0",
-    "pkijs": "^3.2.4",
+    "pkijs": "^3.2.5",
     "tslib": "^2.8.1"
   },
   "peerDependencies": {
-    "io-ts": "^2.2.21"
+    "io-ts": "^2.2.22"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",
     "@types/node": "^20.17.9",
-    "@typescript-eslint/eslint-plugin": "^8.18.0",
-    "@typescript-eslint/parser": "^8.18.0",
-    "concurrently": "^9.1.0",
+    "@typescript-eslint/eslint-plugin": "^8.26.1",
+    "@typescript-eslint/parser": "^8.26.1",
+    "concurrently": "^9.1.2",
     "eslint": "8.57.1",
     "eslint-config-prettier": "^9.1.0",
     "eslint-plugin-import": "^2.31.0",
-    "eslint-plugin-prettier": "^5.2.1",
+    "eslint-plugin-prettier": "^5.2.3",
     "eslint-plugin-tree-shaking": "^1.12.2",
     "fp-ts": "^2.16.9",
-    "io-ts": "^2.2.21",
+    "io-ts": "^2.2.22",
     "io-ts-types": "^0.5.19",
     "isomorphic-fetch": "^3.0.0",
     "isomorphic-webcrypto": "^2.3.8",
@@ -80,12 +80,12 @@
     "jest-environment-jsdom": "^29.7.0",
     "monocle-ts": "^2.3.13",
     "newtype-ts": "^0.3.5",
-    "prettier": "^3.4.2",
+    "prettier": "^3.5.3",
     "rimraf": "^6.0.1",
-    "ts-jest": "^29.2.5",
+    "ts-jest": "^29.2.6",
     "ts-mockito": "^2.6.1",
     "ts-node": "^10.9.2",
-    "typedoc": "^0.27.4",
+    "typedoc": "^0.28.0",
     "typescript": "~5.7.2"
   },
   "engines": {