dep-oracle 1.1.4 → 1.2.0

package/dist/cli/index.js

@@ -539,7 +539,7 @@ function normalizePyPIName(name) {
   return name.toLowerCase().replace(/[-_.]+/g, "-");
 }
 function parsePep508(spec) {
-  const cleaned = spec.split("#")[0].trim();
+  const cleaned = spec.replace(/\s+#.*$/, "").trim();
   if (!cleaned || cleaned.startsWith("-")) return null;
   const withoutMarkers = cleaned.split(";")[0].trim();
   const match = withoutMarkers.match(
@@ -900,7 +900,11 @@ var CacheManager = class {
         const raw = readFileSync(this.filePath, "utf-8");
         return JSON.parse(raw);
       }
-    } catch {
+    } catch (err) {
+      if (err instanceof SyntaxError) {
+      } else {
+        console.error(`Cache load error: ${err instanceof Error ? err.message : String(err)}`);
+      }
     }
     return {};
   }
@@ -1208,7 +1212,11 @@ var GitHubCollector = class extends BaseCollector {
       /github\.com\/([^/]+)\/([^/]+)/
     );
     if (!match) return null;
-    return { owner: match[1], repo: match[2] };
+    const owner = match[1];
+    const repo = match[2];
+    const GITHUB_NAME = /^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$/;
+    if (!GITHUB_NAME.test(owner) || !GITHUB_NAME.test(repo)) return null;
+    return { owner, repo };
   }
   // ---------------------------------------------------------------------------
   // GitHub API calls
@@ -1645,8 +1653,11 @@ var FundingCollector = class extends BaseCollector {
       const ghMatch = fundingYml.match(/github:\s*(.+)/i);
       if (ghMatch) {
         const sponsors = ghMatch[1].trim().replace(/^\[/, "").replace(/]$/, "").split(",").map((s) => s.trim().replace(/['"]/g, "")).filter(Boolean);
+        const GITHUB_USERNAME = /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/;
         for (const sponsor of sponsors) {
-          urls.push(`https://github.com/sponsors/${sponsor}`);
+          if (GITHUB_USERNAME.test(sponsor)) {
+            urls.push(`https://github.com/sponsors/${sponsor}`);
+          }
         }
       }
       const ocMatch = fundingYml.match(/open_collective:\s*(\S+)/i);
@@ -2046,9 +2057,30 @@ var CollectorOrchestrator = class {
       { key: "license", collector: this.licenseCollector }
     ];
     const results = {};
+    const COLLECTOR_TIMEOUT = 3e4;
     const tasks = entries.map(
       ({ key, collector }) => limit(async () => {
-        const result = this.options.offline ? await this.offlineCollect(collector, packageName, version) : await this.onlineCollect(collector, packageName, version);
+        let result;
+        if (this.options.offline) {
+          result = await this.offlineCollect(collector, packageName, version);
+        } else {
+          try {
+            result = await Promise.race([
+              this.onlineCollect(collector, packageName, version),
+              new Promise(
+                (_, reject) => setTimeout(() => reject(new Error("Collector timeout")), COLLECTOR_TIMEOUT)
+              )
+            ]);
+          } catch {
+            logger.warn(`[${collector.name}] ${packageName}@${version} => timeout (${COLLECTOR_TIMEOUT}ms)`);
+            result = {
+              status: "error",
+              data: null,
+              error: `Timeout after ${COLLECTOR_TIMEOUT / 1e3}s`,
+              collectedAt: (/* @__PURE__ */ new Date()).toISOString()
+            };
+          }
+        }
         logger.info(
           `[${collector.name}] ${packageName}@${version} => ${result.status}`
         );
@@ -2125,6 +2157,10 @@ var TrustScoreEngine = class {
   weights;
   constructor(weights) {
     this.weights = { ...DEFAULT_WEIGHTS, ...weights };
+    const total = Object.values(this.weights).reduce((a, b) => a + b, 0);
+    if (Math.abs(total - 1) > 0.01) {
+      throw new Error(`Trust score weights must sum to 1.0, got ${total.toFixed(4)}`);
+    }
   }
   /**
    * Calculate a full trust score from all collector results.
@@ -2183,10 +2219,10 @@ var TrustScoreEngine = class {
     } else {
       score = Math.max(20, 100 - vulns * 12);
     }
-    if (data.averagePatchDays !== null && data.averagePatchDays > 0) {
+    if (vulns > 0 && data.averagePatchDays !== null && data.averagePatchDays > 0) {
       if (data.averagePatchDays <= 7) {
         score = Math.min(100, score + 10);
-      } else {
+      } else if (data.averagePatchDays <= 30) {
         score = Math.min(100, score + 5);
       }
     }
@@ -4960,13 +4996,13 @@ var TyposquatDetector = class _TyposquatDetector {
         const allowed = substitutions[target[i]];
         if (allowed && allowed.includes(input[i])) {
           subCount++;
-          if (subCount > 1) return false;
+          if (subCount > 2) return false;
         } else {
           return false;
         }
       }
     }
-    return subCount === 1;
+    return subCount >= 1 && subCount <= 2;
   }
 };
 function levenshtein(a, b) {
@@ -7037,7 +7073,7 @@ var pkgVersion = (() => {
     const pkg = JSON.parse(readFileSync3(pkgPath, "utf-8"));
     return pkg.version;
   } catch {
-    return "1.1.1";
+    return "1.2.0";
   }
 })();
 var program = new Command3().name("dep-oracle").description("Predictive dependency security engine").version(pkgVersion).option("--verbose", "Enable verbose logging output").hook("preAction", (_thisCommand, actionCommand) => {