fg-devkit 1.20.0 → 1.21.0

package/scripts/audit-fix-plan.test.mjs

@@ -0,0 +1,287 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import {
+  activeSuppressedGhsas,
+  buildRefreshCommitMessage,
+  compareVersions,
+  diffLockfileVersions,
+  filterSuppressions,
+  isReleaseAgeExcluded,
+  isSameReleaseLine,
+  lowestPatchedVersion,
+  normalizeAdvisories,
+  planOverrides,
+  upsertWorkspaceOverrides,
+} from './audit-fix-plan.mjs'
+
+function advisory({ name, ghsa, vulnerable, patched, versions }) {
+  return { id: `${ghsa}|${name}|${vulnerable}`, ghsa, name, severity: 'high', title: '', vulnerable, patched, versions }
+}
+
+test('compareVersions orders releases and prereleases', () => {
+  assert.equal(compareVersions('1.2.3', '1.2.3'), 0)
+  assert.equal(compareVersions('1.2.3', '1.10.0'), -1)
+  assert.equal(compareVersions('2.0.0', '1.99.99'), 1)
+  assert.equal(compareVersions('1.0.0-beta.2', '1.0.0'), -1)
+  assert.equal(compareVersions('1.0.0-beta.10', '1.0.0-beta.2'), 1)
+})
+
+test('isSameReleaseLine follows caret semantics', () => {
+  assert.equal(isSameReleaseLine('1.5.6', '1.6.3'), true)
+  assert.equal(isSameReleaseLine('1.5.6', '2.0.0'), false)
+  assert.equal(isSameReleaseLine('0.4.1', '0.4.9'), true)
+  assert.equal(isSameReleaseLine('0.4.1', '0.5.0'), false)
+  assert.equal(isSameReleaseLine('0.0.1', '0.0.2'), false)
+})
+
+test('lowestPatchedVersion handles single, multi-range, and missing patches', () => {
+  assert.deepEqual(lowestPatchedVersion('>=1.2.2', '1.2.1'), { status: 'ok', version: '1.2.2' })
+  assert.deepEqual(lowestPatchedVersion('>=1.1.21 <2.0.0 || >=2.1.7', '2.1.4'), { status: 'ok', version: '2.1.7' })
+  assert.deepEqual(lowestPatchedVersion('>=1.1.21 <2.0.0 || >=2.1.7', '1.1.18'), {
+    status: 'ok',
+    version: '1.1.21',
+  })
+  assert.deepEqual(lowestPatchedVersion(null, '3.0.3'), { status: 'none' })
+  assert.deepEqual(lowestPatchedVersion('<0.0.0', '3.0.3'), { status: 'none' })
+  assert.deepEqual(lowestPatchedVersion('^2.0.0', '1.0.0'), { status: 'unparseable' })
+})
+
+test('normalizeAdvisories keeps one entry per GHSA and range', () => {
+  const report = {
+    advisories: {
+      1: {
+        module_name: 'brace-expansion',
+        github_advisory_id: 'GHSA-a',
+        vulnerable_versions: '<1.1.20',
+        patched_versions: '>=1.1.20',
+        severity: 'high',
+        findings: [{ version: '1.1.18', paths: [] }],
+      },
+      2: {
+        module_name: 'brace-expansion',
+        github_advisory_id: 'GHSA-a',
+        vulnerable_versions: '>=2.0.0 <2.1.6',
+        patched_versions: '>=2.1.6',
+        severity: 'high',
+        findings: [{ version: '2.1.4', paths: [] }],
+      },
+    },
+  }
+  const advisories = normalizeAdvisories(report)
+  assert.equal(advisories.length, 2)
+  assert.deepEqual(
+    advisories.map((item) => item.versions),
+    [['1.1.18'], ['2.1.4']],
+  )
+})
+
+test('planOverrides picks the lowest version that fixes every advisory, per release line', () => {
+  const plan = planOverrides([
+    advisory({
+      name: 'brace-expansion',
+      ghsa: 'GHSA-1',
+      vulnerable: '<1.1.19',
+      patched: '>=1.1.19',
+      versions: ['1.1.18'],
+    }),
+    advisory({
+      name: 'brace-expansion',
+      ghsa: 'GHSA-2',
+      vulnerable: '<1.1.21',
+      patched: '>=1.1.21',
+      versions: ['1.1.18'],
+    }),
+    advisory({
+      name: 'brace-expansion',
+      ghsa: 'GHSA-2',
+      vulnerable: '>=2.0.0 <2.1.7',
+      patched: '>=2.1.7',
+      versions: ['2.1.4'],
+    }),
+  ])
+  assert.deepEqual(
+    plan.overrides.map(({ key, value }) => ({ key, value })),
+    [
+      { key: 'brace-expansion@>=1.1.18 <1.1.21', value: '1.1.21' },
+      { key: 'brace-expansion@>=2.1.4 <2.1.7', value: '2.1.7' },
+    ],
+  )
+  assert.deepEqual(plan.overrides[0].ghsas.sort(), ['GHSA-1', 'GHSA-2'])
+})
+
+test('planOverrides merges overlapping spans of the same package', () => {
+  const plan = planOverrides([
+    advisory({ name: 'x', ghsa: 'GHSA-1', vulnerable: '<1.4.0', patched: '>=1.4.0', versions: ['1.2.0', '1.3.0'] }),
+  ])
+  assert.deepEqual(
+    plan.overrides.map(({ key, value }) => ({ key, value })),
+    [{ key: 'x@>=1.2.0 <1.4.0', value: '1.4.0' }],
+  )
+})
+
+test('planOverrides reports instead of overriding when it would be unsafe or useless', () => {
+  const plan = planOverrides(
+    [
+      advisory({ name: 'braces', ghsa: 'GHSA-none', vulnerable: '<=3.0.3', patched: null, versions: ['3.0.3'] }),
+      advisory({ name: 'old', ghsa: 'GHSA-major', vulnerable: '<3.0.0', patched: '>=3.0.0', versions: ['2.4.0'] }),
+      advisory({
+        name: 'eslint',
+        ghsa: 'GHSA-direct',
+        vulnerable: '<10.0.1',
+        patched: '>=10.0.1',
+        versions: ['10.0.0'],
+      }),
+    ],
+    { directDependencies: new Set(['eslint']) },
+  )
+  assert.equal(plan.overrides.length, 0)
+  assert.deepEqual(
+    plan.noPatch.map((item) => item.name),
+    ['braces'],
+  )
+  assert.deepEqual(
+    plan.crossMajor.map((item) => [item.name, item.from, item.to]),
+    [['old', '2.4.0', '3.0.0']],
+  )
+  assert.deepEqual(
+    plan.direct.map((item) => item.name),
+    ['eslint'],
+  )
+})
+
+test('isReleaseAgeExcluded understands names, patterns and version lists', () => {
+  const list = ['fg-devkit', '@fallow-cli/*', 'lefthook@2.1.15 || 2.1.17']
+  assert.equal(isReleaseAgeExcluded(list, 'fg-devkit', '1.0.0'), true)
+  assert.equal(isReleaseAgeExcluded(list, '@fallow-cli/linux-x64-gnu', '3.31.0'), true)
+  assert.equal(isReleaseAgeExcluded(list, 'lefthook', '2.1.17'), true)
+  assert.equal(isReleaseAgeExcluded(list, 'lefthook', '2.1.16'), false)
+  assert.equal(isReleaseAgeExcluded(list, 'seroval', '1.6.3'), false)
+})
+
+test('upsertWorkspaceOverrides creates the section and keeps other settings', () => {
+  const text = 'allowBuilds:\n  esbuild: true\n'
+  const result = upsertWorkspaceOverrides(text, [{ key: 'seroval@>=1.5.6 <1.6.3', value: '1.6.3' }])
+  assert.equal(result, "allowBuilds:\n  esbuild: true\noverrides:\n  'seroval@>=1.5.6 <1.6.3': '1.6.3'\n")
+})
+
+test('upsertWorkspaceOverrides replaces matching keys and appends new ones in place', () => {
+  const text = [
+    'overrides:',
+    "  'seroval@>=1.5.6 <1.6.3': 1.6.2",
+    '  lodash: 4.18.1',
+    '',
+    'allowBuilds:',
+    '  esbuild: true',
+    '',
+  ].join('\n')
+  const result = upsertWorkspaceOverrides(text, [
+    { key: 'seroval@>=1.5.6 <1.6.3', value: '1.6.3' },
+    { key: 'braces@>=3.0.0 <3.0.4', value: '3.0.4' },
+  ])
+  assert.equal(
+    result,
+    [
+      'overrides:',
+      "  'seroval@>=1.5.6 <1.6.3': '1.6.3'",
+      '  lodash: 4.18.1',
+      "  'braces@>=3.0.0 <3.0.4': '3.0.4'",
+      '',
+      'allowBuilds:',
+      '  esbuild: true',
+      '',
+    ].join('\n'),
+  )
+})
+
+test('diffLockfileVersions reports changed resolutions across lockfile documents', () => {
+  const before = [
+    '---',
+    'packages:',
+    "  '@pnpm/exe@12.9.1':",
+    '---',
+    'packages:',
+    '  brace-expansion@1.1.18:',
+    '  brace-expansion@5.0.9:',
+    '  source-map-js@1.2.1:',
+    'snapshots:',
+    '  brace-expansion@1.1.18:',
+  ].join('\n')
+  const after = before.replace(/1\.1\.18/g, '1.1.21').replace('5.0.9', '5.0.12')
+  assert.deepEqual(diffLockfileVersions(before, after), [
+    { name: 'brace-expansion', from: ['1.1.18', '5.0.9'], to: ['1.1.21', '5.0.12'] },
+  ])
+})
+
+test('buildRefreshCommitMessage follows the vuln() convention', () => {
+  assert.deepEqual(buildRefreshCommitMessage([{ name: 'source-map-js', from: ['1.2.1'], to: ['1.2.2'] }]), {
+    subject: 'vuln(source-map-js): refresh lockfile',
+    body: '- source-map-js: 1.2.1 -> 1.2.2',
+  })
+  assert.equal(
+    buildRefreshCommitMessage([
+      { name: 'a', from: ['1.0.0'], to: ['1.0.1'] },
+      { name: 'b', from: ['2.0.0'], to: ['2.0.1'] },
+    ]).subject,
+    'vuln(): refresh 2 packages in lockfile',
+  )
+})
+
+test('activeSuppressedGhsas reads active entries and ignores notes and expired ones', () => {
+  const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<suppressions>
+  <suppress until="2026-12-01Z">
+    <notes><![CDATA[ braces, see also GHSA-xxxx-yyyy-zzzz in the notes ]]></notes>
+    <filePath regex="true">.*pnpm-lock\\.yaml\\?braces$</filePath>
+    <vulnerabilityName regex="true">.*(GHSA-vfj7-8cjw-p6xm|1240992).*</vulnerabilityName>
+  </suppress>
+  <suppress until="2026-01-01Z">
+    <vulnerabilityName regex="true">.*(GHSA-hp3w-g68c-fv3c).*</vulnerabilityName>
+  </suppress>
+  <suppress>
+    <vulnerabilityName>GHSA-AAAA-bbbb-cccc</vulnerabilityName>
+  </suppress>
+</suppressions>`
+  const now = Date.parse('2026-10-06T12:00:00Z')
+  assert.deepEqual(
+    [...activeSuppressedGhsas(xml, now)],
+    [
+      ['GHSA-vfj7-8cjw-p6xm', '2026-12-01Z'],
+      ['GHSA-aaaa-bbbb-cccc', undefined],
+    ],
+  )
+  assert.equal(activeSuppressedGhsas(xml, Date.parse('2026-12-02T00:00:00Z')).has('GHSA-vfj7-8cjw-p6xm'), false)
+})
+
+test('filterSuppressions keeps only active entries that match the repo findings', () => {
+  const xml = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">',
+    '  <suppress until="2026-12-01Z">',
+    '    <notes><![CDATA[ braces ]]></notes>',
+    '    <vulnerabilityName regex="true">.*(GHSA-vfj7-8cjw-p6xm|1240992).*</vulnerabilityName>',
+    '  </suppress>',
+    '  <suppress until="2026-12-01Z">',
+    '    <notes><![CDATA[ sprintf-js ]]></notes>',
+    '    <vulnerabilityName regex="true">.*(GHSA-hp3w-g68c-fv3c).*</vulnerabilityName>',
+    '  </suppress>',
+    '</suppressions>',
+    '',
+  ].join('\n')
+  const now = Date.parse('2026-10-06T12:00:00Z')
+  assert.equal(
+    filterSuppressions(xml, ['GHSA-vfj7-8cjw-p6xm'], now),
+    [
+      '<?xml version="1.0" encoding="UTF-8"?>',
+      '<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">',
+      '  <suppress until="2026-12-01Z">',
+      '    <notes><![CDATA[ braces ]]></notes>',
+      '    <vulnerabilityName regex="true">.*(GHSA-vfj7-8cjw-p6xm|1240992).*</vulnerabilityName>',
+      '  </suppress>',
+      '</suppressions>',
+      '',
+    ].join('\n'),
+  )
+  // Expired entries are dropped even when they match.
+  assert.doesNotMatch(filterSuppressions(xml, ['GHSA-vfj7-8cjw-p6xm'], Date.parse('2026-12-02T00:00:00Z')), /GHSA-vfj7/)
+})