ohdear-npm-audit 1.4.0 → 1.5.0

package/dist/handler.d.ts

@@ -1,9 +1,13 @@
-import type { DepsManifest } from "./types.js";
-export type { DepsManifest, HealthCheckResponse, Vulnerability, } from "./types.js";
+import type { DepsManifest, Severity } from "./types.js";
+export type { DepsManifest, HealthCheckResponse, HealthCheckResult, Severity, Vulnerability, } from "./types.js";
 export interface CreateHealthHandlerOptions {
     /** Environment variable name for the secret. Default: "OHDEAR_HEALTH_SECRET" */
     secretEnvVar?: string;
     /** Header name for the secret. Default: "oh-dear-health-check-secret" */
     secretHeader?: string;
+    /** Severity levels to report. Default: ["critical"] */
+    severity?: Severity[];
+    /** Package names to ignore (e.g. known/accepted vulnerabilities). Default: [] */
+    ignorePackages?: string[];
 }
 export declare function createHealthHandler(manifest: DepsManifest, options?: CreateHealthHandlerOptions): (request: Request) => Promise<Response>;

package/dist/handler.js

@@ -3,6 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createHealthHandler = createHealthHandler;
 const NPM_BULK_ADVISORY_URL = "https://registry.npmjs.org/-/npm/v1/security/advisories/bulk";
 const FETCH_TIMEOUT_MS = 8_000;
+const SEVERITY_OHDEAR_STATUS = {
+    critical: "failed",
+    high: "warning",
+    moderate: "warning",
+    low: "warning",
+};
+function capitalize(s) {
+    return s[0].toUpperCase() + s.slice(1);
+}
 /** BFS from pkg up through reverseMap to find the shortest chain to a root dep. */
 function buildChain(pkg, reverseMap) {
     const queue = [[pkg]];
@@ -22,24 +31,21 @@ function buildChain(pkg, reverseMap) {
     }
     return [pkg];
 }
-function makeWarningResponse(message) {
-    return {
-        finishedAt: Math.floor(Date.now() / 1000),
-        checkResults: [
-            {
-                name: "npm_vulnerabilities",
-                label: "NPM Critical Vulnerabilities",
-                status: "warning",
-                notificationMessage: message,
-                shortSummary: "check error",
-                meta: {},
-            },
-        ],
-    };
+function makeWarningResults(message, severityFilter) {
+    return severityFilter.map((sev) => ({
+        name: `npm_vulnerabilities_${sev}`,
+        label: `NPM ${capitalize(sev)} Vulnerabilities`,
+        status: "warning",
+        notificationMessage: message,
+        shortSummary: "check error",
+        meta: {},
+    }));
 }
 function createHealthHandler(manifest, options) {
     const envVar = options?.secretEnvVar ?? "OHDEAR_HEALTH_SECRET";
     const headerName = options?.secretHeader ?? "oh-dear-health-check-secret";
+    const severityFilter = options?.severity ?? ["critical"];
+    const ignorePackages = options?.ignorePackages ?? [];
     let didWarn = false;
     return async (request) => {
         const secret = request.headers.get(headerName);
@@ -63,53 +69,65 @@ function createHealthHandler(manifest, options) {
             const message = err instanceof DOMException && err.name === "TimeoutError"
                 ? "npm advisory API timed out"
                 : "npm advisory API request failed";
-            return Response.json(makeWarningResponse(message));
+            return Response.json({
+                finishedAt: Math.floor(Date.now() / 1000),
+                checkResults: makeWarningResults(message, severityFilter),
+            });
         }
         if (!res.ok) {
-            return Response.json(makeWarningResponse(`npm advisory API returned HTTP ${res.status}`));
+            const msg = `npm advisory API returned HTTP ${res.status}`;
+            return Response.json({
+                finishedAt: Math.floor(Date.now() / 1000),
+                checkResults: makeWarningResults(msg, severityFilter),
+            });
         }
         let advisories;
         try {
             advisories = await res.json();
         }
         catch {
-            return Response.json(makeWarningResponse("Failed to parse npm advisory response"));
+            return Response.json({
+                finishedAt: Math.floor(Date.now() / 1000),
+                checkResults: makeWarningResults("Failed to parse npm advisory response", severityFilter),
+            });
         }
-        const critical = [];
+        // Group vulnerabilities by severity level
+        const bySeverity = new Map(severityFilter.map((sev) => [sev, []]));
         for (const [pkg, entries] of Object.entries(advisories)) {
+            if (ignorePackages.includes(pkg))
+                continue;
             for (const entry of entries) {
-                if (entry.severity === "critical") {
-                    const versions = manifest.packages[pkg] ?? [];
-                    const vuln = {
-                        package: pkg,
-                        installedVersions: versions,
-                        title: entry.title,
-                        url: entry.url,
-                        vulnerableVersions: entry.vulnerable_versions ?? "",
-                        dependencyChain: buildChain(pkg, manifest.reverseDeps),
-                    };
-                    critical.push(vuln);
-                }
+                const sev = entry.severity;
+                const bucket = bySeverity.get(sev);
+                if (!bucket)
+                    continue;
+                bucket.push({
+                    package: pkg,
+                    installedVersions: manifest.packages[pkg] ?? [],
+                    title: entry.title,
+                    url: entry.url,
+                    vulnerableVersions: entry.vulnerable_versions ?? "",
+                    dependencyChain: buildChain(pkg, manifest.reverseDeps),
+                });
             }
         }
-        const status = critical.length === 0 ? "ok" : "failed";
-        const shortSummary = `${critical.length} critical`;
-        const notificationMessage = critical.length === 0
-            ? "No critical npm vulnerabilities found."
-            : `Critical vulnerabilities in: ${critical.map((v) => v.package).join(", ")}`;
-        const body = {
+        const checkResults = severityFilter.map((sev) => {
+            const vulns = bySeverity.get(sev);
+            const status = vulns.length === 0 ? "ok" : SEVERITY_OHDEAR_STATUS[sev];
+            return {
+                name: `npm_vulnerabilities_${sev}`,
+                label: `NPM ${capitalize(sev)} Vulnerabilities`,
+                status,
+                shortSummary: `${vulns.length} ${sev}`,
+                notificationMessage: vulns.length === 0
+                    ? `No ${sev} npm vulnerabilities found.`
+                    : `${capitalize(sev)} vulnerabilities in: ${vulns.map((v) => v.package).join(", ")}`,
+                meta: vulns.length > 0 ? { vulnerabilities: vulns } : {},
+            };
+        });
+        return Response.json({
             finishedAt: Math.floor(Date.now() / 1000),
-            checkResults: [
-                {
-                    name: "npm_vulnerabilities",
-                    label: "NPM Critical Vulnerabilities",
-                    status,
-                    notificationMessage,
-                    shortSummary,
-                    meta: critical.length > 0 ? { vulnerabilities: critical } : {},
-                },
-            ],
-        };
-        return Response.json(body);
+            checkResults,
+        });
     };
 }

package/dist/next.d.ts

@@ -1,8 +1,13 @@
+import type { Severity } from "./types.js";
 export interface WithOhDearHealthOptions {
     /** Output path for the manifest, relative to project root.
      *  Default: "src/app/api/health/deps-manifest.json" */
     output?: string;
     /** Check for critical vulnerabilities at build time. Default: true */
     checkOnBuild?: boolean;
+    /** Severity levels to check at build time. Default: ["critical"] */
+    severity?: Severity[];
+    /** Package names to ignore. Default: [] */
+    ignorePackages?: string[];
 }
 export declare function withOhDearHealth<T>(nextConfig: T, options?: WithOhDearHealthOptions): T;

package/dist/next.js

@@ -75,13 +75,17 @@ function buildChainScript() {
  * API. Output is inherited so logs appear in the build output. Does not
  * block the build — the subprocess runs in parallel with Next.js compilation.
  */
-function checkVulnerabilities(manifestPath) {
+function checkVulnerabilities(manifestPath, severity, ignorePackages) {
     const safePath = JSON.stringify(manifestPath);
+    const safeSeverity = JSON.stringify(severity);
+    const safeIgnore = JSON.stringify(ignorePackages);
     const script = [
         `const fs = require("fs");`,
         `const data = JSON.parse(fs.readFileSync(${safePath}, "utf-8"));`,
         `const packages = data.packages;`,
         `const reverseMap = data.reverseDeps;`,
+        `const severityFilter = ${safeSeverity};`,
+        `const ignorePackages = ${safeIgnore};`,
         buildChainScript(),
         `fetch("https://registry.npmjs.org/-/npm/v1/security/advisories/bulk", {`,
         `  method: "POST",`,
@@ -91,10 +95,12 @@ function checkVulnerabilities(manifestPath) {
         `})`,
         `.then(r => { if (!r.ok) throw new Error("HTTP " + r.status); return r.json(); })`,
         `.then(data => {`,
-        `  const crits = [];`,
+        `  const bySev = {};`,
+        `  severityFilter.forEach(s => bySev[s] = []);`,
         `  for (const [pkg, entries] of Object.entries(data)) {`,
+        `    if (ignorePackages.includes(pkg)) continue;`,
         `    for (const e of entries) {`,
-        `      if (e.severity !== "critical") continue;`,
+        `      if (!bySev[e.severity]) continue;`,
         `      const versions = packages[pkg] || [];`,
         `      const chain = buildChain(pkg, reverseMap);`,
         `      const versionStr = versions.join(", ");`,
@@ -103,14 +109,20 @@ function checkVulnerabilities(manifestPath) {
         `      if (e.vulnerable_versions) {`,
         `        line += "\\n    vulnerable: " + e.vulnerable_versions + " \\u2014 " + e.url;`,
         `      }`,
-        `      crits.push(line);`,
+        `      bySev[e.severity].push(line);`,
         `    }`,
         `  }`,
-        `  if (crits.length > 0) {`,
-        `    console.warn("ohdear-npm-audit: " + crits.length + " critical vulnerabilities:");`,
-        `    crits.forEach(c => console.warn(c));`,
-        `  } else {`,
-        `    console.log("ohdear-npm-audit: no critical vulnerabilities \\u2713");`,
+        `  let total = 0;`,
+        `  for (const sev of severityFilter) {`,
+        `    const lines = bySev[sev];`,
+        `    total += lines.length;`,
+        `    if (lines.length > 0) {`,
+        `      console.warn("ohdear-npm-audit: " + lines.length + " " + sev + " vulnerabilities:");`,
+        `      lines.forEach(c => console.warn(c));`,
+        `    }`,
+        `  }`,
+        `  if (total === 0) {`,
+        `    console.log("ohdear-npm-audit: no " + severityFilter.join("/") + " vulnerabilities \\u2713");`,
         `  }`,
         `})`,
         `.catch(err => console.warn("ohdear-npm-audit: build-time vulnerability check failed:", err.message || err));`,
@@ -145,7 +157,7 @@ function withOhDearHealth(nextConfig, options) {
             console.warn("ohdear-npm-audit: OHDEAR_HEALTH_SECRET is not set — health check will reject all requests.");
         }
         if (options?.checkOnBuild !== false) {
-            checkVulnerabilities(output);
+            checkVulnerabilities(output, options?.severity ?? ["critical"], options?.ignorePackages ?? []);
         }
     }
     catch (err) {

package/dist/types.d.ts

@@ -1,3 +1,4 @@
+export type Severity = "critical" | "high" | "moderate" | "low";
 export interface DepsManifest {
     packages: Record<string, string[]>;
     reverseDeps: Record<string, string[]>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ohdear-npm-audit",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Oh Dear Application Health check for npm audit critical vulnerabilities",
   "main": "./dist/handler.js",
   "types": "./dist/handler.d.ts",