pnpm-catalog-updates 0.7.18 → 1.0.0

package/src/cli/commands/securityCommand.ts

@@ -5,64 +5,64 @@
  * Integrates with npm audit and snyk for comprehensive security analysis.
  */
 
-import { spawnSync } from 'child_process';
-import * as fs from 'fs-extra';
-import * as path from 'path';
-import { OutputFormat, OutputFormatter } from '../formatters/outputFormatter.js';
-import { ProgressBar } from '../formatters/progressBar.js';
-import { StyledText, ThemeManager } from '../themes/colorTheme.js';
+import { spawnSync } from 'node:child_process'
+import * as path from 'node:path'
+import * as fs from 'fs-extra'
+import type { OutputFormat, OutputFormatter } from '../formatters/outputFormatter.js'
+import { ProgressBar } from '../formatters/progressBar.js'
+import { StyledText, ThemeManager } from '../themes/colorTheme.js'
 
 export interface SecurityCommandOptions {
-  workspace?: string;
-  format?: OutputFormat;
-  audit?: boolean;
-  fixVulns?: boolean;
-  severity?: 'low' | 'moderate' | 'high' | 'critical';
-  includeDev?: boolean;
-  snyk?: boolean;
-  verbose?: boolean;
-  color?: boolean;
+  workspace?: string
+  format?: OutputFormat
+  audit?: boolean
+  fixVulns?: boolean
+  severity?: 'low' | 'moderate' | 'high' | 'critical'
+  includeDev?: boolean
+  snyk?: boolean
+  verbose?: boolean
+  color?: boolean
 }
 
 export interface SecurityReport {
   summary: {
-    totalVulnerabilities: number;
-    critical: number;
-    high: number;
-    moderate: number;
-    low: number;
-    info: number;
-  };
-  vulnerabilities: Vulnerability[];
-  recommendations: SecurityRecommendation[];
+    totalVulnerabilities: number
+    critical: number
+    high: number
+    moderate: number
+    low: number
+    info: number
+  }
+  vulnerabilities: Vulnerability[]
+  recommendations: SecurityRecommendation[]
   metadata: {
-    scanDate: string;
-    scanTools: string[];
-    workspacePath: string;
-  };
+    scanDate: string
+    scanTools: string[]
+    workspacePath: string
+  }
 }
 
 export interface Vulnerability {
-  id: string;
-  package: string;
-  severity: 'low' | 'moderate' | 'high' | 'critical';
-  title: string;
-  url: string;
-  range: string;
-  fixAvailable: boolean | string;
-  fixVersion?: string;
-  paths: string[];
-  cwe?: string[];
-  cve?: string[];
+  id: string
+  package: string
+  severity: 'low' | 'moderate' | 'high' | 'critical'
+  title: string
+  url: string
+  range: string
+  fixAvailable: boolean | string
+  fixVersion?: string
+  paths: string[]
+  cwe?: string[]
+  cve?: string[]
 }
 
 export interface SecurityRecommendation {
-  package: string;
-  currentVersion: string;
-  recommendedVersion: string;
-  type: 'update' | 'remove' | 'replace';
-  reason: string;
-  impact: string;
+  package: string
+  currentVersion: string
+  recommendedVersion: string
+  type: 'update' | 'remove' | 'replace'
+  reason: string
+  impact: string
 }
 
 export class SecurityCommand {
@@ -72,61 +72,61 @@ export class SecurityCommand {
    * Execute the security command
    */
   async execute(options: SecurityCommandOptions = {}): Promise<void> {
-    let progressBar: ProgressBar | undefined;
+    let progressBar: ProgressBar | undefined
 
     try {
       // Initialize theme
-      ThemeManager.setTheme('default');
+      ThemeManager.setTheme('default')
 
       // Show loading with progress bar
       progressBar = new ProgressBar({
         text: 'Performing security analysis...',
-      });
-      progressBar.start();
+      })
+      progressBar.start()
 
       if (options.verbose) {
-        console.log(StyledText.iconAnalysis('Security vulnerability scanning'));
-        console.log(StyledText.muted(`Workspace: ${options.workspace || process.cwd()}`));
-        console.log(StyledText.muted(`Severity filter: ${options.severity || 'all'}`));
-        console.log('');
+        console.log(StyledText.iconAnalysis('Security vulnerability scanning'))
+        console.log(StyledText.muted(`Workspace: ${options.workspace || process.cwd()}`))
+        console.log(StyledText.muted(`Severity filter: ${options.severity || 'all'}`))
+        console.log('')
       }
 
       // Execute security scan
-      const report = await this.performSecurityScan(options);
+      const report = await this.performSecurityScan(options)
 
-      progressBar.succeed('Security analysis completed');
+      progressBar.succeed('Security analysis completed')
 
       // Format and display results
-      const formattedOutput = this.outputFormatter.formatSecurityReport(report);
-      console.log(formattedOutput);
+      const formattedOutput = this.outputFormatter.formatSecurityReport(report)
+      console.log(formattedOutput)
 
       // Show recommendations if available
       if (report.recommendations.length > 0) {
-        this.showRecommendations(report);
+        this.showRecommendations(report)
       }
 
       // Auto-fix vulnerabilities if requested
       if (options.fixVulns) {
-        await this.autoFixVulnerabilities(report, options);
+        await this.autoFixVulnerabilities(report, options)
       }
 
       // Exit with appropriate code based on findings
-      const exitCode = report.summary.critical > 0 ? 1 : 0;
-      process.exit(exitCode);
+      const exitCode = report.summary.critical > 0 ? 1 : 0
+      process.exit(exitCode)
     } catch (error) {
       if (progressBar) {
-        progressBar.fail('Security analysis failed');
+        progressBar.fail('Security analysis failed')
       }
 
-      console.error(StyledText.iconError('Error performing security scan:'));
-      console.error(StyledText.error(String(error)));
+      console.error(StyledText.iconError('Error performing security scan:'))
+      console.error(StyledText.error(String(error)))
 
       if (options.verbose && error instanceof Error) {
-        console.error(StyledText.muted('Stack trace:'));
-        console.error(StyledText.muted(error.stack || 'No stack trace available'));
+        console.error(StyledText.muted('Stack trace:'))
+        console.error(StyledText.muted(error.stack || 'No stack trace available'))
       }
 
-      process.exit(1);
+      process.exit(1)
     }
   }
 
@@ -134,37 +134,37 @@ export class SecurityCommand {
    * Perform comprehensive security scan
    */
   private async performSecurityScan(options: SecurityCommandOptions): Promise<SecurityReport> {
-    const workspacePath = options.workspace || process.cwd();
-    const vulnerabilities: Vulnerability[] = [];
-    const recommendations: SecurityRecommendation[] = [];
+    const workspacePath = options.workspace || process.cwd()
+    const vulnerabilities: Vulnerability[] = []
+    const recommendations: SecurityRecommendation[] = []
 
     // Check if package.json exists
-    const packageJsonPath = path.join(workspacePath, 'package.json');
+    const packageJsonPath = path.join(workspacePath, 'package.json')
     if (!(await fs.pathExists(packageJsonPath))) {
-      throw new Error(`No package.json found in ${workspacePath}`);
+      throw new Error(`No package.json found in ${workspacePath}`)
     }
 
     // Run npm audit
     if (options.audit !== false) {
-      const npmVulns = await this.runNpmAudit(workspacePath, options);
-      vulnerabilities.push(...npmVulns);
+      const npmVulns = await this.runNpmAudit(workspacePath, options)
+      vulnerabilities.push(...npmVulns)
     }
 
     // Run snyk scan if available
     if (options.snyk) {
-      const snykVulns = await this.runSnykScan(workspacePath, options);
-      vulnerabilities.push(...snykVulns);
+      const snykVulns = await this.runSnykScan(workspacePath, options)
+      vulnerabilities.push(...snykVulns)
     }
 
     // Generate recommendations
-    recommendations.push(...this.generateRecommendations(vulnerabilities));
+    recommendations.push(...this.generateRecommendations(vulnerabilities))
 
     // Filter by severity if specified
     const filteredVulnerabilities = options.severity
       ? vulnerabilities.filter(
           (v) => this.severityToNumber(v.severity) >= this.severityToNumber(options.severity!)
         )
-      : vulnerabilities;
+      : vulnerabilities
 
     return {
       summary: this.generateSummary(filteredVulnerabilities),
@@ -175,7 +175,7 @@ export class SecurityCommand {
         scanTools: ['npm-audit', ...(options.snyk ? ['snyk'] : [])],
         workspacePath: workspacePath,
       },
-    };
+    }
   }
 
   /**
@@ -185,39 +185,39 @@ export class SecurityCommand {
     workspacePath: string,
     options: SecurityCommandOptions
   ): Promise<Vulnerability[]> {
-    const auditArgs = ['audit', '--json'];
+    const auditArgs = ['audit', '--json']
 
     if (!options.includeDev) {
-      auditArgs.push('--omit=dev');
+      auditArgs.push('--omit=dev')
     }
 
     const result = spawnSync('npm', auditArgs, {
       cwd: workspacePath,
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe'],
-    });
+    })
 
     if (result.error) {
-      throw new Error(`npm audit failed: ${result.error.message}`);
+      throw new Error(`npm audit failed: ${result.error.message}`)
     }
 
     if (result.status === 1) {
       // npm audit returns 1 when vulnerabilities are found
       try {
-        const auditData = JSON.parse(result.stdout);
-        return this.parseNpmAuditResults(auditData);
+        const auditData = JSON.parse(result.stdout)
+        return this.parseNpmAuditResults(auditData)
       } catch (parseError) {
-        throw new Error(`Failed to parse npm audit output: ${parseError}`);
+        throw new Error(`Failed to parse npm audit output: ${parseError}`)
       }
     } else if (result.status === 0) {
       try {
-        const auditData = JSON.parse(result.stdout);
-        return this.parseNpmAuditResults(auditData);
+        const auditData = JSON.parse(result.stdout)
+        return this.parseNpmAuditResults(auditData)
       } catch (parseError) {
-        throw new Error(`Failed to parse npm audit output: ${parseError}`);
+        throw new Error(`Failed to parse npm audit output: ${parseError}`)
       }
     } else {
-      throw new Error(`npm audit failed with status ${result.status}: ${result.stderr}`);
+      throw new Error(`npm audit failed with status ${result.status}: ${result.stderr}`)
     }
   }
 
@@ -230,39 +230,39 @@ export class SecurityCommand {
   ): Promise<Vulnerability[]> {
     try {
       // Check if snyk is installed
-      const versionResult = spawnSync('snyk', ['--version'], { stdio: 'pipe' });
+      const versionResult = spawnSync('snyk', ['--version'], { stdio: 'pipe' })
       if (versionResult.error) {
-        throw versionResult.error;
+        throw versionResult.error
       }
 
-      const snykArgs = ['test', '--json'];
+      const snykArgs = ['test', '--json']
 
       if (!options.includeDev) {
-        snykArgs.push('--dev');
+        snykArgs.push('--dev')
       }
 
       const result = spawnSync('snyk', snykArgs, {
         cwd: workspacePath,
         encoding: 'utf8',
         stdio: ['pipe', 'pipe', 'pipe'],
-      });
+      })
 
       if (result.error) {
-        throw result.error;
+        throw result.error
       }
 
       if (result.status !== 0 && result.status !== 1) {
-        throw new Error(`Snyk scan failed with status ${result.status}: ${result.stderr}`);
+        throw new Error(`Snyk scan failed with status ${result.status}: ${result.stderr}`)
       }
 
-      const snykData = JSON.parse(result.stdout);
-      return this.parseSnykResults(snykData);
+      const snykData = JSON.parse(result.stdout)
+      return this.parseSnykResults(snykData)
     } catch (error: any) {
       if (error.code === 'ENOENT') {
-        console.warn(StyledText.iconWarning('Snyk not found. Install with: npm install -g snyk'));
-        return [];
+        console.warn(StyledText.iconWarning('Snyk not found. Install with: npm install -g snyk'))
+        return []
       }
-      throw new Error(`Snyk scan failed: ${error.message}`);
+      throw new Error(`Snyk scan failed: ${error.message}`)
     }
   }
 
@@ -270,14 +270,14 @@ export class SecurityCommand {
    * Parse npm audit results
    */
   private parseNpmAuditResults(auditData: any): Vulnerability[] {
-    const vulnerabilities: Vulnerability[] = [];
+    const vulnerabilities: Vulnerability[] = []
 
     if (!auditData.vulnerabilities) {
-      return vulnerabilities;
+      return vulnerabilities
     }
 
     for (const [id, vuln] of Object.entries(auditData.vulnerabilities)) {
-      const vulnerability = vuln as any;
+      const vulnerability = vuln as any
 
       vulnerabilities.push({
         id: id,
@@ -291,20 +291,20 @@ export class SecurityCommand {
         paths: vulnerability.via?.map((v: any) => v.source || v.name) || [vulnerability.name],
         cwe: vulnerability.cwe,
         cve: vulnerability.cve,
-      });
+      })
     }
 
-    return vulnerabilities;
+    return vulnerabilities
   }
 
   /**
    * Parse snyk results
    */
   private parseSnykResults(snykData: any): Vulnerability[] {
-    const vulnerabilities: Vulnerability[] = [];
+    const vulnerabilities: Vulnerability[] = []
 
     if (!snykData.vulnerabilities) {
-      return vulnerabilities;
+      return vulnerabilities
     }
 
     for (const vuln of snykData.vulnerabilities) {
@@ -320,35 +320,35 @@ export class SecurityCommand {
         paths: vuln.from || [vuln.packageName],
         cwe: vuln.identifiers?.CWE || [],
         cve: vuln.identifiers?.CVE || [],
-      });
+      })
     }
 
-    return vulnerabilities;
+    return vulnerabilities
   }
 
   /**
    * Generate security recommendations
    */
   private generateRecommendations(vulnerabilities: Vulnerability[]): SecurityRecommendation[] {
-    const recommendations: SecurityRecommendation[] = [];
-    const packages = new Set(vulnerabilities.map((v) => v.package));
+    const recommendations: SecurityRecommendation[] = []
+    const packages = new Set(vulnerabilities.map((v) => v.package))
 
     for (const pkg of packages) {
-      const pkgVulns = vulnerabilities.filter((v) => v.package === pkg);
+      const pkgVulns = vulnerabilities.filter((v) => v.package === pkg)
       const criticalVulns = pkgVulns.filter(
         (v) => v.severity === 'critical' || v.severity === 'high'
-      );
+      )
 
       if (criticalVulns.length > 0) {
         const fixVersions = [
           ...new Set(
             criticalVulns.map((v) => v.fixVersion).filter((v) => v && typeof v === 'string')
           ),
-        ];
+        ]
 
         if (fixVersions.length > 0) {
-          const currentVersion = pkgVulns[0]?.range?.split(' ')[0] || 'unknown';
-          const recommendedVersion = fixVersions[0] || 'unknown';
+          const currentVersion = pkgVulns[0]?.range?.split(' ')[0] || 'unknown'
+          const recommendedVersion = fixVersions[0] || 'unknown'
 
           recommendations.push({
             package: pkg,
@@ -357,12 +357,12 @@ export class SecurityCommand {
             type: 'update',
             reason: `${criticalVulns.length} critical vulnerabilities found`,
             impact: 'High - Security vulnerability fix',
-          });
+          })
         }
       }
     }
 
-    return recommendations;
+    return recommendations
   }
 
   /**
@@ -376,33 +376,33 @@ export class SecurityCommand {
       moderate: 0,
       low: 0,
       info: 0,
-    };
+    }
 
     for (const vuln of vulnerabilities) {
-      const severity = vuln.severity as string;
+      const severity = vuln.severity as string
       switch (severity) {
         case 'critical':
-          summary.critical++;
-          break;
+          summary.critical++
+          break
         case 'high':
-          summary.high++;
-          break;
+          summary.high++
+          break
         case 'moderate':
-          summary.moderate++;
-          break;
+          summary.moderate++
+          break
         case 'low':
-          summary.low++;
-          break;
+          summary.low++
+          break
         case 'info':
-          summary.info++;
-          break;
+          summary.info++
+          break
         default:
-          summary.info++;
-          break;
+          summary.info++
+          break
       }
     }
 
-    return summary;
+    return summary
   }
 
   /**
@@ -411,17 +411,17 @@ export class SecurityCommand {
   private severityToNumber(severity: string): number {
     switch (severity) {
       case 'critical':
-        return 4;
+        return 4
       case 'high':
-        return 3;
+        return 3
       case 'moderate':
-        return 2;
+        return 2
       case 'low':
-        return 1;
+        return 1
       case 'info':
-        return 0;
+        return 0
       default:
-        return 0;
+        return 0
     }
   }
 
@@ -430,21 +430,21 @@ export class SecurityCommand {
    */
   private showRecommendations(report: SecurityReport): void {
     if (report.recommendations.length === 0) {
-      return;
+      return
     }
 
-    console.log('\n' + StyledText.iconInfo('Security Recommendations:'));
+    console.log(`\n${StyledText.iconInfo('Security Recommendations:')}`)
 
     for (const rec of report.recommendations) {
       console.log(
         `  ${StyledText.iconWarning()} ${rec.package}: ${rec.currentVersion} → ${rec.recommendedVersion}`
-      );
-      console.log(`    ${StyledText.muted(rec.reason)}`);
-      console.log(`    ${StyledText.muted(rec.impact)}`);
+      )
+      console.log(`    ${StyledText.muted(rec.reason)}`)
+      console.log(`    ${StyledText.muted(rec.impact)}`)
     }
 
-    console.log('');
-    console.log(StyledText.iconUpdate('Run with --fix-vulns to apply automatic fixes'));
+    console.log('')
+    console.log(StyledText.iconUpdate('Run with --fix-vulns to apply automatic fixes'))
   }
 
   /**
@@ -455,61 +455,61 @@ export class SecurityCommand {
     options: SecurityCommandOptions
   ): Promise<void> {
     if (report.recommendations.length === 0) {
-      console.log(StyledText.iconSuccess('No security fixes available'));
-      return;
+      console.log(StyledText.iconSuccess('No security fixes available'))
+      return
     }
 
-    console.log('\n' + StyledText.iconUpdate('Applying security fixes...'));
+    console.log(`\n${StyledText.iconUpdate('Applying security fixes...')}`)
 
-    const workspacePath = options.workspace || process.cwd();
-    const fixableVulns = report.recommendations.filter((r) => r.type === 'update');
+    const workspacePath = options.workspace || process.cwd()
+    const fixableVulns = report.recommendations.filter((r) => r.type === 'update')
 
     if (fixableVulns.length === 0) {
-      console.log(StyledText.iconInfo('No automatic fixes available'));
-      return;
+      console.log(StyledText.iconInfo('No automatic fixes available'))
+      return
     }
 
     try {
       // Run npm audit fix
-      const fixArgs = ['audit', 'fix'];
+      const fixArgs = ['audit', 'fix']
       if (!options.includeDev) {
-        fixArgs.push('--omit=dev');
+        fixArgs.push('--omit=dev')
       }
 
       const result = spawnSync('npm', fixArgs, {
         cwd: workspacePath,
         encoding: 'utf8',
         stdio: 'inherit',
-      });
+      })
 
       if (result.error) {
-        throw result.error;
+        throw result.error
       }
 
       if (result.status !== 0) {
-        throw new Error(`npm audit fix failed with status ${result.status}`);
+        throw new Error(`npm audit fix failed with status ${result.status}`)
       }
 
-      console.log(StyledText.iconSuccess('Security fixes applied successfully'));
+      console.log(StyledText.iconSuccess('Security fixes applied successfully'))
 
       // Re-run scan to verify fixes
-      console.log(StyledText.iconInfo('Re-running security scan to verify fixes...'));
-      const newReport = await this.performSecurityScan({ ...options, fixVulns: false });
+      console.log(StyledText.iconInfo('Re-running security scan to verify fixes...'))
+      const newReport = await this.performSecurityScan({ ...options, fixVulns: false })
 
       if (newReport.summary.critical === 0 && newReport.summary.high === 0) {
         console.log(
           StyledText.iconSuccess('All critical and high severity vulnerabilities have been fixed!')
-        );
+        )
       } else {
         console.log(
           StyledText.iconWarning(
             `${newReport.summary.critical} critical and ${newReport.summary.high} high severity vulnerabilities remain`
           )
-        );
+        )
       }
     } catch (error: any) {
-      console.error(StyledText.iconError('Failed to apply security fixes:'));
-      console.error(StyledText.error(error.message));
+      console.error(StyledText.iconError('Failed to apply security fixes:'))
+      console.error(StyledText.error(error.message))
     }
   }
 
@@ -517,19 +517,19 @@ export class SecurityCommand {
    * Validate command options
    */
   static validateOptions(options: SecurityCommandOptions): string[] {
-    const errors: string[] = [];
+    const errors: string[] = []
 
     // Validate format
     if (options.format && !['table', 'json', 'yaml', 'minimal'].includes(options.format)) {
-      errors.push('Invalid format. Must be one of: table, json, yaml, minimal');
+      errors.push('Invalid format. Must be one of: table, json, yaml, minimal')
     }
 
     // Validate severity
     if (options.severity && !['low', 'moderate', 'high', 'critical'].includes(options.severity)) {
-      errors.push('Invalid severity. Must be one of: low, moderate, high, critical');
+      errors.push('Invalid severity. Must be one of: low, moderate, high, critical')
     }
 
-    return errors;
+    return errors
   }
 
   /**
@@ -564,6 +564,6 @@ Exit Codes:
   0  No vulnerabilities found
   1  Vulnerabilities found
   2  Error occurred
-    `;
+    `
   }
 }