autoremediator 0.16.0 → 0.17.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api/delta-scan/delta-scan.test.d.ts +2 -0
- package/dist/api/delta-scan/delta-scan.test.d.ts.map +1 -0
- package/dist/api/delta-scan/index.d.ts +5 -0
- package/dist/api/delta-scan/index.d.ts.map +1 -0
- package/dist/api/evaluate/evaluate.test.d.ts +2 -0
- package/dist/api/evaluate/evaluate.test.d.ts.map +1 -0
- package/dist/api/evaluate/index.d.ts +5 -0
- package/dist/api/evaluate/index.d.ts.map +1 -0
- package/dist/api/index.d.ts +4 -1
- package/dist/api/index.d.ts.map +1 -1
- package/dist/api/reachability/index.d.ts +3 -0
- package/dist/api/reachability/index.d.ts.map +1 -0
- package/dist/api/reachability/reachability.test.d.ts +2 -0
- package/dist/api/reachability/reachability.test.d.ts.map +1 -0
- package/dist/api/reporting.d.ts.map +1 -1
- package/dist/api/vex/index.d.ts +1 -1
- package/dist/api/vex/index.d.ts.map +1 -1
- package/dist/{chunk-CQXNIRHT.js → chunk-U4LIJIGD.js} +411 -20
- package/dist/cli/program.d.ts.map +1 -1
- package/dist/cli/runners.d.ts +17 -0
- package/dist/cli/runners.d.ts.map +1 -1
- package/dist/cli.js +146 -1
- package/dist/index.js +409 -18
- package/dist/index.js.map +1 -1
- package/dist/intelligence/index.d.ts +1 -1
- package/dist/intelligence/index.d.ts.map +1 -1
- package/dist/intelligence/sources/github-advisory.d.ts +8 -0
- package/dist/intelligence/sources/github-advisory.d.ts.map +1 -1
- package/dist/intelligence/sources/osv.d.ts +4 -0
- package/dist/intelligence/sources/osv.d.ts.map +1 -1
- package/dist/mcp/server.d.ts +106 -1
- package/dist/mcp/server.d.ts.map +1 -1
- package/dist/mcp/server.js +100 -1
- package/dist/openapi/rbac.d.ts +2 -2
- package/dist/openapi/rbac.d.ts.map +1 -1
- package/dist/openapi/server.d.ts.map +1 -1
- package/dist/openapi/server.js +13 -6
- package/dist/platform/types.d.ts +84 -1
- package/dist/platform/types.d.ts.map +1 -1
- package/dist/remediation/evaluate-package.d.ts +3 -0
- package/dist/remediation/evaluate-package.d.ts.map +1 -0
- package/dist/remediation/runtime-tools.d.ts +1 -1
- package/dist/remediation/runtime-tools.d.ts.map +1 -1
- package/dist/remediation/tools/apply-patch-file/helpers.d.ts.map +1 -1
- package/dist/scanner/delta-scan.d.ts +3 -0
- package/dist/scanner/delta-scan.d.ts.map +1 -0
- package/package.json +7 -9
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"delta-scan.test.d.ts","sourceRoot":"","sources":["../../../src/api/delta-scan/delta-scan.test.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/delta-scan/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"evaluate.test.d.ts","sourceRoot":"","sources":["../../../src/api/evaluate/evaluate.test.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/evaluate/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC"}
|
package/dist/api/index.d.ts
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
* import { remediate } from 'autoremediator';
|
|
6
6
|
* const report = await remediate('CVE-2021-23337', { cwd: '/my/project' });
|
|
7
7
|
*/
|
|
8
|
-
export type { CorrelationContext, CveSeverity, LlmUsageMetrics, ModelPersonality, RemediationConstraints, ProvenanceContext, ProgressEvent, ProviderSafetyProfile, RemediateOptions, RemediationReport, ResultSimulation, CveDetails, AffectedPackage, InventoryPackage, VulnerablePackage, PatchResult, PatchStrategy, PatchStrategyCounts, DependencyScope, DependencyScopeCounts, PatchArtifact, PatchArtifactInspection, PatchArtifactQueryOptions, PatchArtifactSummary, PatchArtifactValidationReport, PatchMode, PatchRiskLevel, PatchConfidenceThresholds, UnresolvedReason, UnresolvedReasonCounts, EscalationAction, EscalationGraph, EscalationCounts, Disposition, DispositionPolicy, DispositionSignals, DispositionCounts, PatchValidationPhase, PatchValidationPhaseName, PortfolioReport, PortfolioTarget, PortfolioTargetResult, OutdatedPackage, UpdateOutdatedOptions, UpdateOutdatedReport, ExploitSignalOverridePolicy, VexJustification, VexSuppression, SlaPolicy, SlaBreach, SlaBreachEntry, SlaBreachSummary, ReachabilityAssessment, ReachabilityEvidence, SbomEntry, SbomStatus, SimulationMutation, SimulationMutationTarget, SimulationRebuttalCode, SimulationRebuttalFinding, SimulationSummary, } from "../platform/types.js";
|
|
8
|
+
export type { CorrelationContext, CveSeverity, LlmUsageMetrics, ModelPersonality, RemediationConstraints, ProvenanceContext, ProgressEvent, ProviderSafetyProfile, RemediateOptions, RemediationReport, ResultSimulation, CveDetails, AffectedPackage, InventoryPackage, VulnerablePackage, PatchResult, PatchStrategy, PatchStrategyCounts, DependencyScope, DependencyScopeCounts, PatchArtifact, PatchArtifactInspection, PatchArtifactQueryOptions, PatchArtifactSummary, PatchArtifactValidationReport, PatchMode, PatchRiskLevel, PatchConfidenceThresholds, UnresolvedReason, UnresolvedReasonCounts, EscalationAction, EscalationGraph, EscalationCounts, Disposition, DispositionPolicy, DispositionSignals, DispositionCounts, PatchValidationPhase, PatchValidationPhaseName, PortfolioReport, PortfolioTarget, PortfolioTargetResult, OutdatedPackage, UpdateOutdatedOptions, UpdateOutdatedReport, ExploitSignalOverridePolicy, VexJustification, VexSuppression, SlaPolicy, SlaBreach, SlaBreachEntry, SlaBreachSummary, ReachabilityAssessment, ReachabilityEvidence, SbomEntry, SbomStatus, SimulationMutation, SimulationMutationTarget, SimulationRebuttalCode, SimulationRebuttalFinding, SimulationSummary, CheckReachabilityOptions, EvaluatePackageOptions, PackageEvaluationReport, VulnerabilityEvaluationEntry, DeltaDependencyChange, DeltaFinding, DeltaScanOptions, DeltaScanReport, } from "../platform/types.js";
|
|
9
9
|
export type { ScanInputFormat } from "../scanner/index.js";
|
|
10
10
|
export type { ScanOptions, ScanReport, CiSummary } from "./contracts.js";
|
|
11
11
|
export { PACKAGE_MANAGER_VALUES, LLM_PROVIDER_VALUES, PROVENANCE_SOURCE_VALUES, OPTION_DESCRIPTIONS, createConstraintSchemaProperties, createRemediateOptionSchemaProperties, createScanOptionSchemaProperties, createScanReportSchemaProperties, createUpdateOutdatedOptionSchemaProperties, } from "./options-schema.js";
|
|
@@ -17,5 +17,8 @@ export { remediatePortfolio } from "./portfolio/index.js";
|
|
|
17
17
|
export { remediate, planRemediation } from "./remediate/index.js";
|
|
18
18
|
export { remediateFromScan } from "./remediate-from-scan/index.js";
|
|
19
19
|
export { updateOutdated } from "./update-outdated/index.js";
|
|
20
|
+
export { checkReachability } from "./reachability/index.js";
|
|
21
|
+
export { evaluatePackage } from "./evaluate/index.js";
|
|
22
|
+
export { scanDelta } from "./delta-scan/index.js";
|
|
20
23
|
export { submitRemediateJob, submitScanJob, submitPortfolioJob, pollJob, type JobHandle, type AsyncRemediationJob, type TypedAsyncRemediationJob, } from "./jobs/index.js";
|
|
21
24
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/api/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,6BAA6B,EAC7B,SAAS,EACT,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,6BAA6B,EAC7B,SAAS,EACT,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gCAAgC,EAChC,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,EACtC,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,OAAO,EACP,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/reachability/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEhG,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,sBAAsB,CAAC,CAGjC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"reachability.test.d.ts","sourceRoot":"","sources":["../../../src/api/reachability/reachability.test.ts"],"names":[],"mappings":""}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"reporting.d.ts","sourceRoot":"","sources":["../../src/api/reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,qBAAqB,EACrB,iBAAiB,EAEjB,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAKhB,iBAAiB,EAEjB,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA4C5D,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC,GACvE,IAAI,CAQN;AAyJD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,gBAAgB,GAAG,SAAS,
|
|
1
|
+
{"version":3,"file":"reporting.d.ts","sourceRoot":"","sources":["../../src/api/reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,qBAAqB,EACrB,iBAAiB,EAEjB,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAKhB,iBAAiB,EAEjB,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA4C5D,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC,GACvE,IAAI,CAQN;AAyJD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,gBAAgB,GAAG,SAAS,CAiC9B;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,iBAAiB,GAAG,SAAS,CA+C/B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,iBAAiB,CAkBnB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,mBAAmB,GAAG,SAAS,CAUjG;AAMD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,qBAAqB,GAAG,SAAS,CAsBnC;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,sBAAsB,GAAG,SAAS,CAWpC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,iBAAiB,GAAG,SAAS,CAW/B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAS1F;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAuBhG;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAuCzD;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAErD"}
|
package/dist/api/vex/index.d.ts
CHANGED
|
@@ -2,7 +2,7 @@ import type { RemediationReport } from "../../platform/types.js";
|
|
|
2
2
|
import type { ScanReport } from "../contracts.js";
|
|
3
3
|
export interface CycloneDxVexVulnerabilityAnalysis {
|
|
4
4
|
state: "resolved" | "not_affected" | "in_triage";
|
|
5
|
-
justification?: "code_not_in_execute_path" | "code_not_reachable" | string;
|
|
5
|
+
justification?: "code_not_in_execute_path" | "code_not_reachable" | (string & {});
|
|
6
6
|
detail?: string;
|
|
7
7
|
response?: ("update" | "workaround_available")[];
|
|
8
8
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/vex/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;IACjD,aAAa,CAAC,EAAE,0BAA0B,GAAG,oBAAoB,GAAG,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/vex/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;IACjD,aAAa,CAAC,EAAE,0BAA0B,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,QAAQ,GAAG,sBAAsB,CAAC,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,iCAAiC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;IACF,eAAe,EAAE,yBAAyB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA4DD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,GAAG,iBAAiB,EACtC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CA2BtB"}
|
|
@@ -1458,6 +1458,37 @@ async function fetchOsvVuln(cveId) {
|
|
|
1458
1458
|
throw err;
|
|
1459
1459
|
}
|
|
1460
1460
|
}
|
|
1461
|
+
async function queryOsvPackage(packageName, version) {
|
|
1462
|
+
const url = `${OSV_BASE}/query`;
|
|
1463
|
+
const body = {
|
|
1464
|
+
package: {
|
|
1465
|
+
name: packageName,
|
|
1466
|
+
ecosystem: "npm"
|
|
1467
|
+
}
|
|
1468
|
+
};
|
|
1469
|
+
if (version) {
|
|
1470
|
+
body.version = version;
|
|
1471
|
+
}
|
|
1472
|
+
try {
|
|
1473
|
+
const res = await httpClient({
|
|
1474
|
+
url,
|
|
1475
|
+
method: "POST",
|
|
1476
|
+
body,
|
|
1477
|
+
headers: { "Content-Type": "application/json" }
|
|
1478
|
+
});
|
|
1479
|
+
if (res.status === 404) return [];
|
|
1480
|
+
if (!res.ok) {
|
|
1481
|
+
throw new Error(`OSV API error ${res.status} for query "${packageName}": ${res.text}`);
|
|
1482
|
+
}
|
|
1483
|
+
const data = res.data;
|
|
1484
|
+
return data.vulns ?? [];
|
|
1485
|
+
} catch (err) {
|
|
1486
|
+
if (err instanceof Error) {
|
|
1487
|
+
throw new Error(`OSV API error for query "${packageName}": ${err.message}`);
|
|
1488
|
+
}
|
|
1489
|
+
throw err;
|
|
1490
|
+
}
|
|
1491
|
+
}
|
|
1461
1492
|
function osvEventsToSemverRange(events) {
|
|
1462
1493
|
const parts = [];
|
|
1463
1494
|
for (const event of events) {
|
|
@@ -1522,24 +1553,31 @@ async function lookupCveOsv(cveId) {
|
|
|
1522
1553
|
}
|
|
1523
1554
|
|
|
1524
1555
|
// src/intelligence/sources/github-advisory.ts
|
|
1525
|
-
|
|
1526
|
-
function createOctokitClient() {
|
|
1527
|
-
const token = getGitHubToken();
|
|
1528
|
-
return new Octokit(token ? { auth: `token ${token}` } : {});
|
|
1529
|
-
}
|
|
1556
|
+
var GITHUB_API_BASE = "https://api.github.com/advisories";
|
|
1530
1557
|
async function fetchGhAdvisories(cveId) {
|
|
1531
|
-
const
|
|
1558
|
+
const token = getGitHubToken();
|
|
1559
|
+
const headers = {
|
|
1560
|
+
"X-GitHub-Api-Version": "2022-11-28",
|
|
1561
|
+
"User-Agent": "autoremediator"
|
|
1562
|
+
};
|
|
1563
|
+
if (token) {
|
|
1564
|
+
headers["Authorization"] = `token ${token}`;
|
|
1565
|
+
}
|
|
1566
|
+
const url = new URL(GITHUB_API_BASE);
|
|
1567
|
+
url.searchParams.set("cve_id", cveId);
|
|
1568
|
+
url.searchParams.set("ecosystem", "npm");
|
|
1569
|
+
url.searchParams.set("type", "reviewed");
|
|
1570
|
+
url.searchParams.set("per_page", "10");
|
|
1532
1571
|
try {
|
|
1533
|
-
const
|
|
1534
|
-
|
|
1535
|
-
|
|
1536
|
-
type: "reviewed",
|
|
1537
|
-
per_page: 10,
|
|
1538
|
-
headers: {
|
|
1539
|
-
"X-GitHub-Api-Version": "2022-11-28"
|
|
1540
|
-
}
|
|
1572
|
+
const res = await httpClient({
|
|
1573
|
+
url: url.toString(),
|
|
1574
|
+
headers
|
|
1541
1575
|
});
|
|
1542
|
-
|
|
1576
|
+
if (!res.ok) {
|
|
1577
|
+
if (res.status === 404) return [];
|
|
1578
|
+
throw new Error(`HTTP ${res.status}: ${res.text}`);
|
|
1579
|
+
}
|
|
1580
|
+
return Array.isArray(res.data) ? res.data : [];
|
|
1543
1581
|
} catch (err) {
|
|
1544
1582
|
const errorMsg = err instanceof Error ? err.message : String(err);
|
|
1545
1583
|
console.warn(
|
|
@@ -2148,6 +2186,15 @@ async function fetchPackageVersions(packageName) {
|
|
|
2148
2186
|
return [];
|
|
2149
2187
|
}
|
|
2150
2188
|
}
|
|
2189
|
+
async function findSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
|
|
2190
|
+
const resolution = await resolveSafeUpgradeVersion(
|
|
2191
|
+
packageName,
|
|
2192
|
+
installedVersion,
|
|
2193
|
+
firstPatchedVersion,
|
|
2194
|
+
vulnerableRange
|
|
2195
|
+
);
|
|
2196
|
+
return resolution.safeVersion;
|
|
2197
|
+
}
|
|
2151
2198
|
async function resolveSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
|
|
2152
2199
|
const versions = await fetchPackageVersions(packageName);
|
|
2153
2200
|
if (!versions.length) {
|
|
@@ -3830,7 +3877,8 @@ async function validatePatchWithTests(cwd, testCommand) {
|
|
|
3830
3877
|
output: result.stdout
|
|
3831
3878
|
};
|
|
3832
3879
|
} catch (err) {
|
|
3833
|
-
const
|
|
3880
|
+
const stdoutVal = typeof err === "object" && err !== null && "stdout" in err ? err.stdout : "";
|
|
3881
|
+
const errorOutput = typeof stdoutVal === "string" ? stdoutVal : Buffer.isBuffer(stdoutVal) ? stdoutVal.toString("utf8") : "";
|
|
3834
3882
|
const failedTests = extractFailedTests(errorOutput);
|
|
3835
3883
|
return {
|
|
3836
3884
|
passed: false,
|
|
@@ -6268,6 +6316,24 @@ function buildResultSimulation(report, result, options) {
|
|
|
6268
6316
|
const dependencyScope = result.dependencyScope ?? dependencyScopeLookup.get(result.packageName);
|
|
6269
6317
|
const plannedMutations = buildPlannedMutations(result, options.runTests === true);
|
|
6270
6318
|
const wouldMutate = plannedMutations.length > 0;
|
|
6319
|
+
let unifiedDiff;
|
|
6320
|
+
if (result.patchArtifact?.patchFilePath) {
|
|
6321
|
+
unifiedDiff = `--- ${result.patchArtifact.patchFilePath}
|
|
6322
|
+
+++ ${result.patchArtifact.patchFilePath}`;
|
|
6323
|
+
} else if (result.strategy === "version-bump" && result.toVersion) {
|
|
6324
|
+
unifiedDiff = `--- package.json
|
|
6325
|
+
+++ package.json
|
|
6326
|
+
@@ -1,3 +1,3 @@
|
|
6327
|
+
- "${result.packageName}": "${result.fromVersion}"
|
|
6328
|
+
+ "${result.packageName}": "^${result.toVersion}"`;
|
|
6329
|
+
} else if (result.strategy === "override" && result.toVersion) {
|
|
6330
|
+
unifiedDiff = `--- package.json
|
|
6331
|
+
+++ package.json
|
|
6332
|
+
@@ -1,3 +1,3 @@
|
|
6333
|
+
+ "overrides": {
|
|
6334
|
+
+ "${result.packageName}": "${result.toVersion}"
|
|
6335
|
+
+ }`;
|
|
6336
|
+
}
|
|
6271
6337
|
return {
|
|
6272
6338
|
mode,
|
|
6273
6339
|
wouldMutate,
|
|
@@ -6278,7 +6344,8 @@ function buildResultSimulation(report, result, options) {
|
|
|
6278
6344
|
dependencyScope,
|
|
6279
6345
|
wouldMutate,
|
|
6280
6346
|
runTests: options.runTests === true
|
|
6281
|
-
})
|
|
6347
|
+
}),
|
|
6348
|
+
unifiedDiff
|
|
6282
6349
|
};
|
|
6283
6350
|
}
|
|
6284
6351
|
function buildSimulationSummary(reports) {
|
|
@@ -6706,7 +6773,7 @@ function parseScanInput(filePath, format) {
|
|
|
6706
6773
|
if (resolved === "sarif") {
|
|
6707
6774
|
return parseSarifFile(resolvedPath);
|
|
6708
6775
|
}
|
|
6709
|
-
throw new Error(`Unsupported input format: ${resolved}`);
|
|
6776
|
+
throw new Error(`Unsupported input format: ${String(resolved)}`);
|
|
6710
6777
|
}
|
|
6711
6778
|
async function parseScanInputFromAudit(params) {
|
|
6712
6779
|
const pm = params.packageManager ?? detectPackageManager(params.cwd);
|
|
@@ -7428,6 +7495,327 @@ async function updateOutdated(options = {}) {
|
|
|
7428
7495
|
};
|
|
7429
7496
|
}
|
|
7430
7497
|
|
|
7498
|
+
// src/api/reachability/index.ts
|
|
7499
|
+
async function checkReachability(options) {
|
|
7500
|
+
const cwd = options.cwd ?? process.cwd();
|
|
7501
|
+
return assessPackageReachability(cwd, options.packageName, options.symbol);
|
|
7502
|
+
}
|
|
7503
|
+
|
|
7504
|
+
// src/remediation/evaluate-package.ts
|
|
7505
|
+
import semver7 from "semver";
|
|
7506
|
+
async function evaluatePackage(packageName, options = {}) {
|
|
7507
|
+
const version = options.version?.trim();
|
|
7508
|
+
const enrich = options.enrichIntelligence !== false;
|
|
7509
|
+
let versions = [];
|
|
7510
|
+
let latestVersion;
|
|
7511
|
+
try {
|
|
7512
|
+
versions = await fetchPackageVersions(packageName);
|
|
7513
|
+
if (versions.length > 0) {
|
|
7514
|
+
const valid = versions.filter((v) => semver7.valid(v)).sort((a, b) => semver7.compare(a, b));
|
|
7515
|
+
latestVersion = valid[valid.length - 1];
|
|
7516
|
+
}
|
|
7517
|
+
} catch {
|
|
7518
|
+
}
|
|
7519
|
+
let rawVulns = [];
|
|
7520
|
+
try {
|
|
7521
|
+
rawVulns = await queryOsvPackage(packageName, version);
|
|
7522
|
+
} catch {
|
|
7523
|
+
rawVulns = [];
|
|
7524
|
+
}
|
|
7525
|
+
let kevFeed = null;
|
|
7526
|
+
if (enrich) {
|
|
7527
|
+
try {
|
|
7528
|
+
kevFeed = await fetchCisaKevFeed();
|
|
7529
|
+
} catch {
|
|
7530
|
+
kevFeed = null;
|
|
7531
|
+
}
|
|
7532
|
+
}
|
|
7533
|
+
const entries = [];
|
|
7534
|
+
for (const raw of rawVulns) {
|
|
7535
|
+
const cveDetails = parseOsvVuln(raw);
|
|
7536
|
+
const affected = cveDetails.affectedPackages.find(
|
|
7537
|
+
(p) => p.name.toLowerCase() === packageName.toLowerCase()
|
|
7538
|
+
);
|
|
7539
|
+
if (version && affected?.vulnerableRange) {
|
|
7540
|
+
const cleanVer = semver7.clean(version) || version;
|
|
7541
|
+
if (semver7.valid(cleanVer) && !semver7.satisfies(cleanVer, affected.vulnerableRange)) {
|
|
7542
|
+
continue;
|
|
7543
|
+
}
|
|
7544
|
+
}
|
|
7545
|
+
let inCisaKev = false;
|
|
7546
|
+
let epssScore;
|
|
7547
|
+
let epssPercentile;
|
|
7548
|
+
if (enrich && cveDetails.id.startsWith("CVE-")) {
|
|
7549
|
+
if (kevFeed) {
|
|
7550
|
+
inCisaKev = Boolean(findKevEntry(kevFeed, cveDetails.id));
|
|
7551
|
+
}
|
|
7552
|
+
try {
|
|
7553
|
+
const epss = await fetchEpss(cveDetails.id);
|
|
7554
|
+
if (epss) {
|
|
7555
|
+
epssScore = Number.parseFloat(epss.epss);
|
|
7556
|
+
epssPercentile = Number.parseFloat(epss.percentile);
|
|
7557
|
+
}
|
|
7558
|
+
} catch {
|
|
7559
|
+
}
|
|
7560
|
+
}
|
|
7561
|
+
let safeUpgradeVersion;
|
|
7562
|
+
if (affected?.firstPatchedVersion) {
|
|
7563
|
+
try {
|
|
7564
|
+
const safe = await findSafeUpgradeVersion(
|
|
7565
|
+
packageName,
|
|
7566
|
+
version || "0.0.0",
|
|
7567
|
+
affected.firstPatchedVersion
|
|
7568
|
+
);
|
|
7569
|
+
safeUpgradeVersion = safe ?? affected.firstPatchedVersion;
|
|
7570
|
+
} catch {
|
|
7571
|
+
safeUpgradeVersion = affected.firstPatchedVersion;
|
|
7572
|
+
}
|
|
7573
|
+
}
|
|
7574
|
+
entries.push({
|
|
7575
|
+
cveId: cveDetails.id,
|
|
7576
|
+
severity: cveDetails.severity,
|
|
7577
|
+
summary: cveDetails.summary,
|
|
7578
|
+
vulnerableRange: affected?.vulnerableRange,
|
|
7579
|
+
firstPatchedVersion: affected?.firstPatchedVersion,
|
|
7580
|
+
safeUpgradeVersion,
|
|
7581
|
+
epssScore,
|
|
7582
|
+
epssPercentile,
|
|
7583
|
+
inCisaKev,
|
|
7584
|
+
references: cveDetails.references
|
|
7585
|
+
});
|
|
7586
|
+
}
|
|
7587
|
+
const isVulnerable = entries.length > 0;
|
|
7588
|
+
let verdict = "safe";
|
|
7589
|
+
if (isVulnerable) {
|
|
7590
|
+
const hasKevOrHighEpss = entries.some((e) => e.inCisaKev || e.epssScore && e.epssScore > 0.5);
|
|
7591
|
+
const hasHighOrCritical = entries.some(
|
|
7592
|
+
(e) => e.severity === "CRITICAL" || e.severity === "HIGH"
|
|
7593
|
+
);
|
|
7594
|
+
if (hasKevOrHighEpss) {
|
|
7595
|
+
verdict = "actively-exploited";
|
|
7596
|
+
} else if (hasHighOrCritical) {
|
|
7597
|
+
verdict = "vulnerable";
|
|
7598
|
+
} else {
|
|
7599
|
+
verdict = "caution";
|
|
7600
|
+
}
|
|
7601
|
+
}
|
|
7602
|
+
let recommendedVersion;
|
|
7603
|
+
if (isVulnerable) {
|
|
7604
|
+
const upgradeCandidates = entries.map((e) => e.safeUpgradeVersion).filter((v) => Boolean(v && semver7.valid(v))).sort((a, b) => semver7.compare(a, b));
|
|
7605
|
+
recommendedVersion = upgradeCandidates[upgradeCandidates.length - 1] || latestVersion;
|
|
7606
|
+
} else {
|
|
7607
|
+
recommendedVersion = version || latestVersion;
|
|
7608
|
+
}
|
|
7609
|
+
const summary = isVulnerable ? `Package "${packageName}${version ? `@${version}` : ""}" has ${entries.length} known vulnerability(ies) (verdict: ${verdict}). Recommended safe version: ${recommendedVersion || "none"}.` : `Package "${packageName}${version ? `@${version}` : ""}" has no known vulnerabilities. Safe to install.`;
|
|
7610
|
+
return {
|
|
7611
|
+
schemaVersion: "1.0",
|
|
7612
|
+
packageName,
|
|
7613
|
+
evaluatedVersion: version,
|
|
7614
|
+
isVulnerable,
|
|
7615
|
+
verdict,
|
|
7616
|
+
summary,
|
|
7617
|
+
vulnerabilities: entries,
|
|
7618
|
+
recommendedVersion,
|
|
7619
|
+
latestVersion,
|
|
7620
|
+
generatedAt: (/* @__PURE__ */ new Date()).toISOString()
|
|
7621
|
+
};
|
|
7622
|
+
}
|
|
7623
|
+
|
|
7624
|
+
// src/scanner/delta-scan.ts
|
|
7625
|
+
import { existsSync as existsSync12, readFileSync as readFileSync17 } from "fs";
|
|
7626
|
+
import { join as join20 } from "path";
|
|
7627
|
+
import { execa as execa12 } from "execa";
|
|
7628
|
+
import semver8 from "semver";
|
|
7629
|
+
var DEP_SECTIONS = [
|
|
7630
|
+
"dependencies",
|
|
7631
|
+
"devDependencies",
|
|
7632
|
+
"peerDependencies",
|
|
7633
|
+
"optionalDependencies"
|
|
7634
|
+
];
|
|
7635
|
+
async function getChangedManifestPaths(cwd, baseRef) {
|
|
7636
|
+
const manifests = /* @__PURE__ */ new Set();
|
|
7637
|
+
try {
|
|
7638
|
+
const { stdout: diffFiles } = await execa12(
|
|
7639
|
+
"git",
|
|
7640
|
+
["diff", "--name-only", baseRef, "--", "package.json", "**/package.json"],
|
|
7641
|
+
{ cwd, reject: false }
|
|
7642
|
+
);
|
|
7643
|
+
for (const f of diffFiles.split("\n")) {
|
|
7644
|
+
const trimmed = f.trim();
|
|
7645
|
+
if (trimmed && trimmed.endsWith("package.json") && !trimmed.includes("node_modules")) {
|
|
7646
|
+
manifests.add(trimmed);
|
|
7647
|
+
}
|
|
7648
|
+
}
|
|
7649
|
+
const { stdout: untrackedFiles } = await execa12(
|
|
7650
|
+
"git",
|
|
7651
|
+
["ls-files", "--others", "--exclude-standard", "--", "package.json", "**/package.json"],
|
|
7652
|
+
{ cwd, reject: false }
|
|
7653
|
+
);
|
|
7654
|
+
for (const f of untrackedFiles.split("\n")) {
|
|
7655
|
+
const trimmed = f.trim();
|
|
7656
|
+
if (trimmed && trimmed.endsWith("package.json") && !trimmed.includes("node_modules")) {
|
|
7657
|
+
manifests.add(trimmed);
|
|
7658
|
+
}
|
|
7659
|
+
}
|
|
7660
|
+
} catch {
|
|
7661
|
+
if (existsSync12(join20(cwd, "package.json"))) {
|
|
7662
|
+
manifests.add("package.json");
|
|
7663
|
+
}
|
|
7664
|
+
}
|
|
7665
|
+
return Array.from(manifests);
|
|
7666
|
+
}
|
|
7667
|
+
async function getOldManifestContent(cwd, baseRef, relPath) {
|
|
7668
|
+
try {
|
|
7669
|
+
const { stdout } = await execa12("git", ["show", `${baseRef}:${relPath}`], {
|
|
7670
|
+
cwd,
|
|
7671
|
+
reject: false
|
|
7672
|
+
});
|
|
7673
|
+
if (!stdout || !stdout.trim()) return null;
|
|
7674
|
+
return JSON.parse(stdout);
|
|
7675
|
+
} catch {
|
|
7676
|
+
return null;
|
|
7677
|
+
}
|
|
7678
|
+
}
|
|
7679
|
+
function getNewManifestContent(cwd, relPath) {
|
|
7680
|
+
const fullPath = join20(cwd, relPath);
|
|
7681
|
+
if (!existsSync12(fullPath)) return null;
|
|
7682
|
+
try {
|
|
7683
|
+
return JSON.parse(readFileSync17(fullPath, "utf8"));
|
|
7684
|
+
} catch {
|
|
7685
|
+
return null;
|
|
7686
|
+
}
|
|
7687
|
+
}
|
|
7688
|
+
function computeDependencyDiff(relPath, oldPkg, newPkg) {
|
|
7689
|
+
const changes = [];
|
|
7690
|
+
for (const section of DEP_SECTIONS) {
|
|
7691
|
+
const oldDeps = oldPkg?.[section] ?? {};
|
|
7692
|
+
const newDeps = newPkg?.[section] ?? {};
|
|
7693
|
+
for (const [pkgName, newVer] of Object.entries(newDeps)) {
|
|
7694
|
+
const oldVer = oldDeps[pkgName];
|
|
7695
|
+
if (!oldVer) {
|
|
7696
|
+
changes.push({
|
|
7697
|
+
packageName: pkgName,
|
|
7698
|
+
changeType: "added",
|
|
7699
|
+
newVersion: newVer,
|
|
7700
|
+
dependencyType: section,
|
|
7701
|
+
manifestPath: relPath
|
|
7702
|
+
});
|
|
7703
|
+
} else if (oldVer !== newVer) {
|
|
7704
|
+
const cleanOld = semver8.clean(oldVer) || semver8.coerce(oldVer)?.version;
|
|
7705
|
+
const cleanNew = semver8.clean(newVer) || semver8.coerce(newVer)?.version;
|
|
7706
|
+
const isUpgrade = cleanOld && cleanNew && semver8.valid(cleanOld) && semver8.valid(cleanNew) ? semver8.gt(cleanNew, cleanOld) : true;
|
|
7707
|
+
changes.push({
|
|
7708
|
+
packageName: pkgName,
|
|
7709
|
+
changeType: isUpgrade ? "upgraded" : "downgraded",
|
|
7710
|
+
oldVersion: oldVer,
|
|
7711
|
+
newVersion: newVer,
|
|
7712
|
+
dependencyType: section,
|
|
7713
|
+
manifestPath: relPath
|
|
7714
|
+
});
|
|
7715
|
+
}
|
|
7716
|
+
}
|
|
7717
|
+
for (const [pkgName, oldVer] of Object.entries(oldDeps)) {
|
|
7718
|
+
if (!(pkgName in newDeps)) {
|
|
7719
|
+
changes.push({
|
|
7720
|
+
packageName: pkgName,
|
|
7721
|
+
changeType: "removed",
|
|
7722
|
+
oldVersion: oldVer,
|
|
7723
|
+
dependencyType: section,
|
|
7724
|
+
manifestPath: relPath
|
|
7725
|
+
});
|
|
7726
|
+
}
|
|
7727
|
+
}
|
|
7728
|
+
}
|
|
7729
|
+
return changes;
|
|
7730
|
+
}
|
|
7731
|
+
async function scanDelta(options = {}) {
|
|
7732
|
+
const cwd = options.cwd ?? process.cwd();
|
|
7733
|
+
const baseRef = options.baseRef ?? "HEAD";
|
|
7734
|
+
const changedManifests = await getChangedManifestPaths(cwd, baseRef);
|
|
7735
|
+
const dependencyChanges = [];
|
|
7736
|
+
for (const manifestRel of changedManifests) {
|
|
7737
|
+
const oldPkg = await getOldManifestContent(cwd, baseRef, manifestRel);
|
|
7738
|
+
const newPkg = getNewManifestContent(cwd, manifestRel);
|
|
7739
|
+
const diffs = computeDependencyDiff(manifestRel, oldPkg, newPkg);
|
|
7740
|
+
dependencyChanges.push(...diffs);
|
|
7741
|
+
}
|
|
7742
|
+
const introducedFindings = [];
|
|
7743
|
+
const resolvedFindings = [];
|
|
7744
|
+
for (const change of dependencyChanges) {
|
|
7745
|
+
if (change.changeType === "added" || change.changeType === "upgraded" || change.changeType === "downgraded") {
|
|
7746
|
+
const cleanVer = semver8.coerce(change.newVersion)?.version ?? change.newVersion;
|
|
7747
|
+
const evaluation = await evaluatePackage(change.packageName, {
|
|
7748
|
+
version: cleanVer,
|
|
7749
|
+
enrichIntelligence: true
|
|
7750
|
+
});
|
|
7751
|
+
for (const vuln of evaluation.vulnerabilities) {
|
|
7752
|
+
introducedFindings.push({
|
|
7753
|
+
packageName: change.packageName,
|
|
7754
|
+
cveId: vuln.cveId,
|
|
7755
|
+
severity: vuln.severity,
|
|
7756
|
+
summary: vuln.summary,
|
|
7757
|
+
deltaType: "introduced",
|
|
7758
|
+
installedVersion: change.newVersion,
|
|
7759
|
+
safeUpgradeVersion: vuln.safeUpgradeVersion,
|
|
7760
|
+
inCisaKev: vuln.inCisaKev,
|
|
7761
|
+
epssScore: vuln.epssScore
|
|
7762
|
+
});
|
|
7763
|
+
}
|
|
7764
|
+
}
|
|
7765
|
+
if (change.oldVersion && (change.changeType === "upgraded" || change.changeType === "removed")) {
|
|
7766
|
+
const cleanOldVer = semver8.coerce(change.oldVersion)?.version ?? change.oldVersion;
|
|
7767
|
+
const oldEval = await evaluatePackage(change.packageName, {
|
|
7768
|
+
version: cleanOldVer,
|
|
7769
|
+
enrichIntelligence: true
|
|
7770
|
+
});
|
|
7771
|
+
const cleanNewVer = change.newVersion ? semver8.coerce(change.newVersion)?.version ?? change.newVersion : void 0;
|
|
7772
|
+
const newEval = cleanNewVer ? await evaluatePackage(change.packageName, {
|
|
7773
|
+
version: cleanNewVer,
|
|
7774
|
+
enrichIntelligence: false
|
|
7775
|
+
}) : { vulnerabilities: [] };
|
|
7776
|
+
const newCveSet = new Set(newEval.vulnerabilities.map((v) => v.cveId));
|
|
7777
|
+
for (const oldVuln of oldEval.vulnerabilities) {
|
|
7778
|
+
if (!newCveSet.has(oldVuln.cveId)) {
|
|
7779
|
+
resolvedFindings.push({
|
|
7780
|
+
packageName: change.packageName,
|
|
7781
|
+
cveId: oldVuln.cveId,
|
|
7782
|
+
severity: oldVuln.severity,
|
|
7783
|
+
summary: oldVuln.summary,
|
|
7784
|
+
deltaType: "resolved",
|
|
7785
|
+
installedVersion: change.oldVersion,
|
|
7786
|
+
safeUpgradeVersion: oldVuln.safeUpgradeVersion,
|
|
7787
|
+
inCisaKev: oldVuln.inCisaKev,
|
|
7788
|
+
epssScore: oldVuln.epssScore
|
|
7789
|
+
});
|
|
7790
|
+
}
|
|
7791
|
+
}
|
|
7792
|
+
}
|
|
7793
|
+
}
|
|
7794
|
+
let netRiskVerdict = "neutral";
|
|
7795
|
+
let status = "ok";
|
|
7796
|
+
if (introducedFindings.length > 0) {
|
|
7797
|
+
netRiskVerdict = "degraded";
|
|
7798
|
+
status = "degraded";
|
|
7799
|
+
} else if (resolvedFindings.length > 0) {
|
|
7800
|
+
netRiskVerdict = "improved";
|
|
7801
|
+
status = "improved";
|
|
7802
|
+
}
|
|
7803
|
+
const summary = introducedFindings.length > 0 ? `Delta scan against ${baseRef} found ${introducedFindings.length} newly introduced vulnerability(ies) across ${dependencyChanges.length} dependency change(s) (net risk: degraded).` : resolvedFindings.length > 0 ? `Delta scan against ${baseRef} resolved ${resolvedFindings.length} vulnerability(ies) across ${dependencyChanges.length} dependency change(s) (net risk: improved).` : `Delta scan against ${baseRef} found 0 new vulnerabilities across ${dependencyChanges.length} dependency change(s) (net risk: neutral).`;
|
|
7804
|
+
return {
|
|
7805
|
+
schemaVersion: "1.0",
|
|
7806
|
+
status,
|
|
7807
|
+
baseRef,
|
|
7808
|
+
targetRef: "working-tree",
|
|
7809
|
+
changedManifests,
|
|
7810
|
+
dependencyChanges,
|
|
7811
|
+
introducedFindings,
|
|
7812
|
+
resolvedFindings,
|
|
7813
|
+
netRiskVerdict,
|
|
7814
|
+
summary,
|
|
7815
|
+
generatedAt: (/* @__PURE__ */ new Date()).toISOString()
|
|
7816
|
+
};
|
|
7817
|
+
}
|
|
7818
|
+
|
|
7431
7819
|
// src/api/jobs/index.ts
|
|
7432
7820
|
import { randomUUID as randomUUID2 } from "crypto";
|
|
7433
7821
|
|
|
@@ -7543,9 +7931,9 @@ function toSarifOutput(report) {
|
|
|
7543
7931
|
}
|
|
7544
7932
|
|
|
7545
7933
|
// src/version.ts
|
|
7546
|
-
import { readFileSync as
|
|
7934
|
+
import { readFileSync as readFileSync18 } from "fs";
|
|
7547
7935
|
function readPackageVersion() {
|
|
7548
|
-
const raw =
|
|
7936
|
+
const raw = readFileSync18(new URL("../package.json", import.meta.url), "utf8");
|
|
7549
7937
|
const metadata = JSON.parse(raw);
|
|
7550
7938
|
if (!metadata.version) {
|
|
7551
7939
|
throw new Error("packages/core/package.json is missing a version field.");
|
|
@@ -7575,6 +7963,9 @@ export {
|
|
|
7575
7963
|
remediateFromScan,
|
|
7576
7964
|
remediatePortfolio,
|
|
7577
7965
|
updateOutdated,
|
|
7966
|
+
checkReachability,
|
|
7967
|
+
evaluatePackage,
|
|
7968
|
+
scanDelta,
|
|
7578
7969
|
submitRemediateJob,
|
|
7579
7970
|
submitScanJob,
|
|
7580
7971
|
submitPortfolioJob,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsIpC,wBAAgB,aAAa,IAAI,OAAO,CAyQvC"}
|
package/dist/cli/runners.d.ts
CHANGED
|
@@ -6,4 +6,21 @@ export declare function runInspectPatch(patchPath: string, opts: Pick<CommandOpt
|
|
|
6
6
|
export declare function runValidatePatch(patchPath: string, opts: Pick<CommandOptions, "cwd" | "patchesDir" | "packageManager" | "outputFormat">): Promise<void>;
|
|
7
7
|
export declare function runUpdateOutdated(opts: CommandOptions): Promise<void>;
|
|
8
8
|
export declare function runPortfolio(targetsFilePath: string, opts: CommandOptions): Promise<void>;
|
|
9
|
+
export declare function runReachability(opts: {
|
|
10
|
+
cwd?: string;
|
|
11
|
+
package: string;
|
|
12
|
+
symbol?: string;
|
|
13
|
+
outputFormat?: string;
|
|
14
|
+
}): Promise<void>;
|
|
15
|
+
export declare function runEvaluate(packageName: string, opts: {
|
|
16
|
+
cwd?: string;
|
|
17
|
+
version?: string;
|
|
18
|
+
outputFormat?: string;
|
|
19
|
+
}): Promise<void>;
|
|
20
|
+
export declare function runDiffAudit(opts: {
|
|
21
|
+
cwd?: string;
|
|
22
|
+
base?: string;
|
|
23
|
+
outputFormat?: string;
|
|
24
|
+
ci?: boolean;
|
|
25
|
+
}): Promise<void>;
|
|
9
26
|
//# sourceMappingURL=runners.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/cli/runners.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/cli/runners.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkFjD,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IrF;AAED,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqKzF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,gBAAgB,GAAG,cAAc,CAAC,GACnF,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C3E;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6F/F;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,EAAE,CAAC,EAAE,OAAO,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAiChB"}
|