renovate 44.21.0 → 44.22.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -192,7 +192,9 @@ var Vulnerabilities = class Vulnerabilities {
|
|
|
192
192
|
return sortedCopy;
|
|
193
193
|
}
|
|
194
194
|
isPackageAffected(ecosystem, osvPackageName, affected) {
|
|
195
|
-
|
|
195
|
+
const pkg = affected.package;
|
|
196
|
+
if (pkg?.name !== osvPackageName) return false;
|
|
197
|
+
return pkg.ecosystem === ecosystem || pkg.ecosystem.startsWith(`${ecosystem}:`);
|
|
196
198
|
}
|
|
197
199
|
includedInVersions(depVersion, affected) {
|
|
198
200
|
return !!affected.versions?.includes(depVersion);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vulnerabilities.js","names":["p.all","getVersioning"],"sources":["../../../../lib/workers/repository/process/vulnerabilities.ts"],"sourcesContent":["// TODO #22198\nimport type { Ecosystem, Osv } from '@renovatebot/osv-offline';\nimport { OsvOffline } from '@renovatebot/osv-offline';\nimport {\n isEmptyArray,\n isNonEmptyString,\n isNullOrUndefined,\n isTruthy,\n} from '@sindresorhus/is';\nimport type { CvssVector } from 'ae-cvss-calculator';\nimport * as _aeCvss from 'ae-cvss-calculator';\nimport { z } from 'zod/v4';\nimport { getManagerConfig, mergeChildConfig } from '../../../config/index.ts';\nimport type { PackageRule, RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { getDefaultVersioning } from '../../../modules/datasource/common.ts';\nimport type {\n PackageDependency,\n PackageFile,\n} from '../../../modules/manager/types.ts';\nimport type { VersioningApi } from '../../../modules/versioning/index.ts';\nimport { get as getVersioning } from '../../../modules/versioning/index.ts';\nimport { sanitizeMarkdown } from '../../../util/markdown.ts';\nimport * as p from '../../../util/promises.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { titleCase } from '../../../util/string.ts';\nimport { datasourceToOsvEcosystem } from '../../../util/vulnerability/ecosystem.ts';\nimport {\n getFixedVersionConstraint,\n getLastAffectedVersionConstraint,\n} from '../../../util/vulnerability/utils.ts';\nimport type {\n DependencyVulnerabilities,\n SeverityDetails,\n Vulnerability,\n} from './types.ts';\n\nconst { fromVector } = (_aeCvss as unknown as { default: typeof _aeCvss })\n .default;\n\nexport class Vulnerabilities {\n private static osvOffline: Promise<OsvOffline> | undefined;\n\n private osvOffline: OsvOffline;\n\n private static readonly datasourceEcosystemMap = datasourceToOsvEcosystem;\n\n private constructor(osvOffline: OsvOffline) {\n this.osvOffline = osvOffline;\n }\n\n private static initialize(): Promise<OsvOffline> {\n // no async here, so osv promise will only be created once\n Vulnerabilities.osvOffline ??= OsvOffline.create();\n return Vulnerabilities.osvOffline;\n }\n\n static async create(): Promise<Vulnerabilities> {\n // intialize osv only once\n const osvOffline = await Vulnerabilities.initialize();\n\n const instance = new Vulnerabilities(osvOffline);\n return instance;\n }\n\n async appendVulnerabilityPackageRules(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<void> {\n const dependencyVulnerabilities = await this.fetchDependencyVulnerabilities(\n config,\n packageFiles,\n );\n\n config.packageRules ??= [];\n for (const {\n vulnerabilities,\n versioningApi,\n } of dependencyVulnerabilities) {\n const groupPackageRules: PackageRule[] = [];\n for (const vulnerability of vulnerabilities) {\n const rule = this.vulnerabilityToPackageRules(vulnerability);\n if (isNullOrUndefined(rule)) {\n continue;\n }\n groupPackageRules.push(rule);\n }\n this.sortByFixedVersion(groupPackageRules, versioningApi);\n\n config.packageRules.push(...groupPackageRules);\n }\n }\n\n async fetchVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<Vulnerability[]> {\n const groups = await this.fetchDependencyVulnerabilities(\n config,\n packageFiles,\n );\n return groups.flatMap((group) => group.vulnerabilities);\n }\n\n private async fetchDependencyVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<DependencyVulnerabilities[]> {\n const managers = Object.keys(packageFiles);\n const allManagerJobs = managers.map((manager) =>\n this.fetchManagerVulnerabilities(config, packageFiles, manager),\n );\n return (await Promise.all(allManagerJobs)).flat();\n }\n\n private async fetchManagerVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n manager: string,\n ): Promise<DependencyVulnerabilities[]> {\n const managerConfig = getManagerConfig(config, manager);\n const queue = packageFiles[manager].map(\n (pFile) => (): Promise<DependencyVulnerabilities[]> =>\n this.fetchManagerPackageFileVulnerabilities(managerConfig, pFile),\n );\n logger.trace(\n { manager, queueLength: queue.length },\n 'fetchManagerVulnerabilities starting',\n );\n const result = (await p.all(queue)).flat();\n logger.trace({ manager }, 'fetchManagerVulnerabilities finished');\n return result;\n }\n\n private async fetchManagerPackageFileVulnerabilities(\n managerConfig: RenovateConfig,\n pFile: PackageFile,\n ): Promise<DependencyVulnerabilities[]> {\n const { packageFile } = pFile;\n const packageFileConfig = mergeChildConfig(managerConfig, pFile);\n const { manager } = packageFileConfig;\n const queue = pFile.deps.map(\n (dep) => (): Promise<DependencyVulnerabilities | null> =>\n this.fetchDependencyVulnerability(packageFileConfig, dep),\n );\n logger.trace(\n { manager, packageFile, queueLength: queue.length },\n 'fetchManagerPackageFileVulnerabilities starting with concurrency',\n );\n\n const result = await p.all(queue);\n logger.trace(\n { packageFile },\n 'fetchManagerPackageFileVulnerabilities finished',\n );\n\n return result.filter(isTruthy);\n }\n\n private async fetchDependencyVulnerability(\n packageFileConfig: RenovateConfig & PackageFile,\n dep: PackageDependency,\n ): Promise<DependencyVulnerabilities | null> {\n const ecosystem = Vulnerabilities.datasourceEcosystemMap[dep.datasource!];\n if (!ecosystem) {\n logger.trace(`Cannot map datasource ${dep.datasource!} to OSV ecosystem`);\n return null;\n }\n\n const packageName = dep.packageName ?? dep.depName!;\n let osvPackageName = packageName;\n if (ecosystem === 'PyPI') {\n // https://peps.python.org/pep-0503/#normalized-names\n osvPackageName = osvPackageName\n .toLowerCase()\n .replace(regEx(/[_.-]+/g), '-');\n } else if (ecosystem === 'Go' && packageName === 'go') {\n if (dep.depType !== 'toolchain') {\n // The `go` directive is source compatibility, not the build toolchain, so we skip it\n return null;\n }\n osvPackageName = 'stdlib';\n }\n\n try {\n const osvVulnerabilities = await instrument(\n 'get OSV vulnerabilities',\n () => this.osvOffline.getVulnerabilities(ecosystem, osvPackageName),\n {\n attributes: {\n osvPackageName,\n ecosystem,\n },\n },\n );\n if (\n isNullOrUndefined(osvVulnerabilities) ||\n isEmptyArray(osvVulnerabilities)\n ) {\n logger.trace(\n `No vulnerabilities found in OSV database for ${packageName}`,\n );\n return null;\n }\n\n const depVersion =\n dep.lockedVersion ?? dep.currentVersion ?? dep.currentValue!;\n\n const versioning = dep.versioning ?? getDefaultVersioning(dep.datasource);\n const versioningApi = getVersioning(versioning);\n\n if (!versioningApi.isVersion(depVersion)) {\n logger.debug(\n `Skipping vulnerability lookup for package ${packageName} due to unsupported version ${depVersion}`,\n );\n return null;\n }\n\n const vulnerabilities: Vulnerability[] = [];\n for (const osvVulnerability of osvVulnerabilities) {\n if (osvVulnerability.withdrawn) {\n logger.trace(\n `Skipping withdrawn vulnerability ${osvVulnerability.id}`,\n );\n continue;\n }\n\n this.skipMaliciousPackages(\n ecosystem,\n osvPackageName,\n depVersion,\n versioningApi,\n dep,\n packageFileConfig.manager,\n packageFileConfig.packageFile,\n osvVulnerability,\n );\n\n for (const affected of osvVulnerability.affected ?? []) {\n const isVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n depVersion,\n affected,\n versioningApi,\n );\n if (!isVulnerable) {\n continue;\n }\n\n logger.debug(\n `Vulnerability ${osvVulnerability.id} affects ${packageName} ${depVersion}`,\n );\n const fixedVersion = this.getFixedVersion(\n ecosystem,\n depVersion,\n affected,\n versioningApi,\n );\n\n vulnerabilities.push({\n packageName,\n osvPackageName,\n vulnerability: osvVulnerability,\n affected,\n depVersion,\n fixedVersion,\n datasource: dep.datasource!,\n packageFileConfig,\n });\n }\n }\n\n return { vulnerabilities, versioningApi };\n } catch (err) {\n logger.warn(\n { err, packageName },\n 'Error fetching vulnerability information for package',\n );\n return null;\n }\n }\n\n private skipMaliciousPackages(\n ecosystem: Ecosystem,\n osvPackageName: string,\n depVersion: string,\n versioningApi: VersioningApi,\n dep: PackageDependency,\n manager: string | undefined,\n packageFile: string,\n osvVulnerability: Osv.Vulnerability,\n ): void {\n // the OpenSSF's Malicious Packages (https://github.com/ossf/malicious-packages) is a source of advisories through osv.dev, which takes various sources of advisories, and will re-publish them with more specific information about their malicious usage\n if (osvVulnerability.id.startsWith('MAL-')) {\n // is the current dependency vulnerable?\n for (const affected of osvVulnerability.affected ?? []) {\n // is the current dependency vulnerable?\n const isVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n depVersion,\n affected,\n versioningApi,\n );\n\n if (isVulnerable) {\n logger.debug(\n {\n packageFile: packageFile,\n depName: dep.depName,\n packageName: dep.packageName,\n manager: manager,\n datasource: dep.datasource,\n currentVersion: depVersion,\n },\n `Marking ${dep.depName} as skipReason=malicious-version-in-use, as it is affected by ${osvVulnerability.id}`,\n );\n dep.skipReason = 'malicious-version-in-use';\n dep.skipStage = 'lookup';\n }\n\n // or are any of the updates vulnerable?\n for (const update of dep.updates ?? []) {\n const newVersion = update.newVersion ?? update.newValue!;\n\n const isUpdateVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n newVersion,\n affected,\n versioningApi,\n );\n\n if (isUpdateVulnerable) {\n logger.debug(\n {\n packageFile: packageFile,\n depName: dep.depName,\n packageName: dep.packageName,\n manager: manager,\n datasource: dep.datasource,\n currentVersion: depVersion,\n newVersion,\n },\n `Marking ${dep.depName}'s update to ${newVersion} as skipReason=malicious-update-proposed, as it is affected by ${osvVulnerability.id}`,\n );\n dep.skipReason = 'malicious-update-proposed';\n dep.skipStage = 'lookup';\n }\n }\n }\n }\n }\n\n private sortByFixedVersion(\n packageRules: PackageRule[],\n versioningApi: VersioningApi,\n ): void {\n const versionsCleaned: Record<string, string> = {};\n for (const rule of packageRules) {\n const version = rule.allowedVersions!;\n versionsCleaned[version] = version.replace(regEx(/[(),=> ]+/g), '');\n }\n packageRules.sort((a, b) =>\n versioningApi.sortVersions(\n versionsCleaned[a.allowedVersions!],\n versionsCleaned[b.allowedVersions!],\n ),\n );\n }\n\n // https://ossf.github.io/osv-schema/#affectedrangesevents-fields\n private sortEvents(\n events: Osv.Event[],\n versioningApi: VersioningApi,\n ): Osv.Event[] {\n const sortedCopy: Osv.Event[] = [];\n let zeroEvent: Osv.Event | null = null;\n\n for (const event of events) {\n if (event.introduced === '0') {\n zeroEvent = event;\n } else if (versioningApi.isVersion(Object.values(event)[0])) {\n sortedCopy.push(event);\n } else {\n logger.debug({ event }, 'Skipping OSV event with invalid version');\n }\n }\n\n sortedCopy.sort((a, b) =>\n // no pre-processing, as there are only very few values to sort\n versioningApi.sortVersions(Object.values(a)[0], Object.values(b)[0]),\n );\n\n if (zeroEvent) {\n sortedCopy.unshift(zeroEvent);\n }\n\n return sortedCopy;\n }\n\n private isPackageAffected(\n ecosystem: Ecosystem,\n osvPackageName: string,\n affected: Osv.Affected,\n ): boolean {\n return (\n affected.package?.name === osvPackageName &&\n affected.package?.ecosystem === ecosystem\n );\n }\n\n private includedInVersions(\n depVersion: string,\n affected: Osv.Affected,\n ): boolean {\n return !!affected.versions?.includes(depVersion);\n }\n\n private includedInRanges(\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): boolean {\n for (const range of affected.ranges ?? []) {\n if (range.type === 'GIT') {\n continue;\n }\n\n let vulnerable = false;\n for (const event of this.sortEvents(range.events, versioningApi)) {\n if (\n isNonEmptyString(event.introduced) &&\n (event.introduced === '0' ||\n this.isVersionGtOrEq(depVersion, event.introduced, versioningApi))\n ) {\n vulnerable = true;\n } else if (\n isNonEmptyString(event.fixed) &&\n this.isVersionGtOrEq(depVersion, event.fixed, versioningApi)\n ) {\n vulnerable = false;\n } else if (\n isNonEmptyString(event.last_affected) &&\n this.isVersionGt(depVersion, event.last_affected, versioningApi)\n ) {\n vulnerable = false;\n }\n }\n\n if (vulnerable) {\n return true;\n }\n }\n\n return false;\n }\n\n // https://ossf.github.io/osv-schema/#evaluation\n private isPackageVulnerable(\n ecosystem: Ecosystem,\n osvPackageName: string,\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n this.isPackageAffected(ecosystem, osvPackageName, affected) &&\n (this.includedInVersions(depVersion, affected) ||\n this.includedInRanges(depVersion, affected, versioningApi))\n );\n }\n\n private getFixedVersion(\n ecosystem: Ecosystem,\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): string | null {\n const fixedVersions: string[] = [];\n const lastAffectedVersions: string[] = [];\n\n for (const range of affected.ranges ?? []) {\n if (range.type === 'GIT') {\n continue;\n }\n\n for (const event of range.events) {\n if (\n isNonEmptyString(event.fixed) &&\n versioningApi.isVersion(event.fixed)\n ) {\n fixedVersions.push(event.fixed);\n } else if (\n isNonEmptyString(event.last_affected) &&\n versioningApi.isVersion(event.last_affected)\n ) {\n lastAffectedVersions.push(event.last_affected);\n }\n }\n }\n\n fixedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n const fixedVersion = fixedVersions.find((version) =>\n this.isVersionGt(version, depVersion, versioningApi),\n );\n if (fixedVersion) {\n return this.getFixedVersionByEcosystem(fixedVersion, ecosystem);\n }\n\n lastAffectedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n const lastAffected = lastAffectedVersions.find((version) =>\n this.isVersionGtOrEq(version, depVersion, versioningApi),\n );\n if (lastAffected) {\n return this.getLastAffectedByEcosystem(lastAffected, ecosystem);\n }\n\n return null;\n }\n\n private getFixedVersionByEcosystem(\n fixedVersion: string,\n ecosystem: Ecosystem,\n ): string {\n return getFixedVersionConstraint(fixedVersion, ecosystem);\n }\n\n private getLastAffectedByEcosystem(\n lastAffected: string,\n ecosystem: Ecosystem,\n ): string {\n return getLastAffectedVersionConstraint(lastAffected, ecosystem);\n }\n\n private isVersionGt(\n version: string,\n other: string,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n versioningApi.isVersion(version) &&\n versioningApi.isVersion(other) &&\n versioningApi.isGreaterThan(version, other)\n );\n }\n\n private isVersionGtOrEq(\n version: string,\n other: string,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n versioningApi.isVersion(version) &&\n versioningApi.isVersion(other) &&\n (versioningApi.equals(version, other) ||\n versioningApi.isGreaterThan(version, other))\n );\n }\n\n private vulnerabilityToPackageRules(vul: Vulnerability): PackageRule | null {\n const {\n vulnerability,\n affected,\n packageName,\n depVersion,\n fixedVersion,\n datasource,\n packageFileConfig,\n } = vul;\n if (isNullOrUndefined(fixedVersion)) {\n logger.debug(\n `No fixed version available for vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n );\n return null;\n }\n\n // we don't know if the dependency has a `versioning` applied to it already, so we have to use the default for the datasource\n const versioning = getDefaultVersioning(datasource);\n\n logger.debug(\n {\n datasource,\n versioning,\n },\n\n `Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n );\n\n const severityDetails = this.extractSeverityDetails(\n vulnerability,\n affected,\n );\n\n return {\n matchDatasources: [datasource],\n matchPackageNames: [packageName],\n matchCurrentVersion: depVersion,\n versioning,\n allowedVersions: fixedVersion,\n isVulnerabilityAlert: true,\n vulnerabilitySeverity: severityDetails.severityLevel,\n prBodyNotes: this.generatePrBodyNotes(vulnerability, affected),\n force: {\n ...packageFileConfig.vulnerabilityAlerts,\n },\n };\n }\n\n static evaluateCvssVector(vector: string): [string, string] {\n const CvssJson = z.object({\n baseScore: z.number().default(0.0),\n baseSeverity: z.string().toUpperCase().default('UNKNOWN'),\n });\n\n try {\n const parsedCvssScore: CvssVector<any> | null = fromVector(vector);\n const res = CvssJson.parse(parsedCvssScore?.createJsonSchema());\n\n return [res.baseScore.toFixed(1), res.baseSeverity];\n } catch {\n logger.debug(`Error processing CVSS vector ${vector}`);\n }\n\n return ['', ''];\n }\n\n private generatePrBodyNotes(\n vulnerability: Osv.Vulnerability,\n affected: Osv.Affected,\n ): string[] {\n let aliases = [vulnerability.id].concat(vulnerability.aliases ?? []).sort();\n aliases = aliases.map((id) => {\n if (id.startsWith('CVE-')) {\n return `[${id}](https://nvd.nist.gov/vuln/detail/${id})`;\n }\n if (id.startsWith('GHSA-')) {\n return `[${id}](https://github.com/advisories/${id})`;\n }\n if (id.startsWith('GO-')) {\n return `[${id}](https://pkg.go.dev/vuln/${id})`;\n }\n if (id.startsWith('RUSTSEC-')) {\n return `[${id}](https://rustsec.org/advisories/${id}.html)`;\n }\n\n return id;\n });\n\n let content = '\\n\\n---\\n\\n### ';\n content += vulnerability.summary ? `${vulnerability.summary}\\n` : '';\n content += `${aliases.join(' / ')}\\n`;\n content += `\\n<details>\\n<summary>More information</summary>\\n`;\n\n const details = vulnerability.details?.replace(\n regEx(/^#{1,4} /gm),\n '##### ',\n );\n content += `#### Details\\n${details ?? 'No details.'}\\n`;\n\n content += '#### Severity\\n';\n const severityDetails = this.extractSeverityDetails(\n vulnerability,\n affected,\n );\n\n if (severityDetails.cvssVector) {\n content += `- CVSS Score: ${severityDetails.score}\\n`;\n content += `- Vector String: \\`${severityDetails.cvssVector}\\`\\n`;\n } else {\n content += `${titleCase(severityDetails.severityLevel)}\\n`;\n }\n\n content += `\\n#### References\\n${\n vulnerability.references\n ?.map((ref) => {\n return `- [${ref.url}](${ref.url})`;\n })\n .join('\\n') ?? 'No references.'\n }`;\n\n let attribution = '';\n if (vulnerability.id.startsWith('GHSA-')) {\n attribution = ` and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))`;\n } else if (vulnerability.id.startsWith('GO-')) {\n attribution = ` and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))`;\n } else if (vulnerability.id.startsWith('PYSEC-')) {\n attribution = ` and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))`;\n } else if (vulnerability.id.startsWith('RUSTSEC-')) {\n attribution = ` and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))`;\n }\n content += `\\n\\nThis data is provided by [OSV](https://osv.dev/vulnerability/${vulnerability.id})${attribution}.\\n`;\n content += `</details>`;\n\n return [sanitizeMarkdown(content)];\n }\n\n private extractSeverityDetails(\n vulnerability: Osv.Vulnerability,\n affected: Osv.Affected,\n ): SeverityDetails {\n let severityLevel = 'UNKNOWN';\n let score = 'Unknown';\n\n const cvssVector =\n vulnerability.severity?.find((e) => e.type === 'CVSS_V4')?.score ??\n vulnerability.severity?.find((e) => e.type === 'CVSS_V3')?.score ??\n (affected.database_specific?.cvss as string); // RUSTSEC\n\n if (cvssVector) {\n const [baseScore, severity] =\n Vulnerabilities.evaluateCvssVector(cvssVector);\n severityLevel = severity ? severity.toUpperCase() : 'UNKNOWN';\n score = baseScore\n ? `${baseScore} / 10 (${titleCase(severityLevel)})`\n : 'Unknown';\n } else if (\n vulnerability.id.startsWith('GHSA-') &&\n vulnerability.database_specific?.severity\n ) {\n const severity = vulnerability.database_specific.severity as string;\n severityLevel = severity.toUpperCase();\n }\n\n return {\n cvssVector,\n score,\n severityLevel,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAM,EAAE,eAAgB,QACrB;AAEH,IAAa,kBAAb,MAAa,gBAAgB;CAC3B,OAAe;CAEf;CAEA,OAAwB,yBAAyB;CAEjD,YAAoB,YAAwB;EAC1C,KAAK,aAAa;CACpB;CAEA,OAAe,aAAkC;EAE/C,gBAAgB,eAAe,WAAW,OAAO;EACjD,OAAO,gBAAgB;CACzB;CAEA,aAAa,SAAmC;EAE9C,MAAM,aAAa,MAAM,gBAAgB,WAAW;EAGpD,OAAO,IADc,gBAAgB,UACvB;CAChB;CAEA,MAAM,gCACJ,QACA,cACe;EACf,MAAM,4BAA4B,MAAM,KAAK,+BAC3C,QACA,YACF;EAEA,OAAO,iBAAiB,CAAC;EACzB,KAAK,MAAM,EACT,iBACA,mBACG,2BAA2B;GAC9B,MAAM,oBAAmC,CAAC;GAC1C,KAAK,MAAM,iBAAiB,iBAAiB;IAC3C,MAAM,OAAO,KAAK,4BAA4B,aAAa;IAC3D,IAAI,kBAAkB,IAAI,GACxB;IAEF,kBAAkB,KAAK,IAAI;GAC7B;GACA,KAAK,mBAAmB,mBAAmB,aAAa;GAExD,OAAO,aAAa,KAAK,GAAG,iBAAiB;EAC/C;CACF;CAEA,MAAM,qBACJ,QACA,cAC0B;EAK1B,QAAO,MAJc,KAAK,+BACxB,QACA,YACF,EAAA,CACc,SAAS,UAAU,MAAM,eAAe;CACxD;CAEA,MAAc,+BACZ,QACA,cACsC;EAEtC,MAAM,iBADW,OAAO,KAAK,YACC,CAAC,CAAC,KAAK,YACnC,KAAK,4BAA4B,QAAQ,cAAc,OAAO,CAChE;EACA,QAAQ,MAAM,QAAQ,IAAI,cAAc,EAAA,CAAG,KAAK;CAClD;CAEA,MAAc,4BACZ,QACA,cACA,SACsC;EACtC,MAAM,gBAAgB,iBAAiB,QAAQ,OAAO;EACtD,MAAM,QAAQ,aAAa,QAAQ,CAAC,KACjC,gBACC,KAAK,uCAAuC,eAAe,KAAK,CACpE;EACA,OAAO,MACL;GAAE;GAAS,aAAa,MAAM;EAAO,GACrC,sCACF;EACA,MAAM,UAAU,MAAMA,IAAM,KAAK,EAAA,CAAG,KAAK;EACzC,OAAO,MAAM,EAAE,QAAQ,GAAG,sCAAsC;EAChE,OAAO;CACT;CAEA,MAAc,uCACZ,eACA,OACsC;EACtC,MAAM,EAAE,gBAAgB;EACxB,MAAM,oBAAoB,iBAAiB,eAAe,KAAK;EAC/D,MAAM,EAAE,YAAY;EACpB,MAAM,QAAQ,MAAM,KAAK,KACtB,cACC,KAAK,6BAA6B,mBAAmB,GAAG,CAC5D;EACA,OAAO,MACL;GAAE;GAAS;GAAa,aAAa,MAAM;EAAO,GAClD,kEACF;EAEA,MAAM,SAAS,MAAMA,IAAM,KAAK;EAChC,OAAO,MACL,EAAE,YAAY,GACd,iDACF;EAEA,OAAO,OAAO,OAAO,QAAQ;CAC/B;CAEA,MAAc,6BACZ,mBACA,KAC2C;EAC3C,MAAM,YAAY,gBAAgB,uBAAuB,IAAI;EAC7D,IAAI,CAAC,WAAW;GACd,OAAO,MAAM,yBAAyB,IAAI,WAAY,kBAAkB;GACxE,OAAO;EACT;EAEA,MAAM,cAAc,IAAI,eAAe,IAAI;EAC3C,IAAI,iBAAiB;EACrB,IAAI,cAAc,QAEhB,iBAAiB,eACd,YAAY,CAAC,CACb,QAAQ,MAAM,SAAS,GAAG,GAAG;OAC3B,IAAI,cAAc,QAAQ,gBAAgB,MAAM;GACrD,IAAI,IAAI,YAAY,aAElB,OAAO;GAET,iBAAiB;EACnB;EAEA,IAAI;GACF,MAAM,qBAAqB,MAAM,WAC/B,iCACM,KAAK,WAAW,mBAAmB,WAAW,cAAc,GAClE,EACE,YAAY;IACV;IACA;GACF,EACF,CACF;GACA,IACE,kBAAkB,kBAAkB,KACpC,aAAa,kBAAkB,GAC/B;IACA,OAAO,MACL,gDAAgD,aAClD;IACA,OAAO;GACT;GAEA,MAAM,aACJ,IAAI,iBAAiB,IAAI,kBAAkB,IAAI;GAEjD,MAAM,aAAa,IAAI,cAAc,qBAAqB,IAAI,UAAU;GACxE,MAAM,gBAAgBC,IAAc,UAAU;GAE9C,IAAI,CAAC,cAAc,UAAU,UAAU,GAAG;IACxC,OAAO,MACL,6CAA6C,YAAY,8BAA8B,YACzF;IACA,OAAO;GACT;GAEA,MAAM,kBAAmC,CAAC;GAC1C,KAAK,MAAM,oBAAoB,oBAAoB;IACjD,IAAI,iBAAiB,WAAW;KAC9B,OAAO,MACL,oCAAoC,iBAAiB,IACvD;KACA;IACF;IAEA,KAAK,sBACH,WACA,gBACA,YACA,eACA,KACA,kBAAkB,SAClB,kBAAkB,aAClB,gBACF;IAEA,KAAK,MAAM,YAAY,iBAAiB,YAAY,CAAC,GAAG;KAQtD,IAAI,CAPiB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAEc,GACd;KAGF,OAAO,MACL,iBAAiB,iBAAiB,GAAG,WAAW,YAAY,GAAG,YACjE;KACA,MAAM,eAAe,KAAK,gBACxB,WACA,YACA,UACA,aACF;KAEA,gBAAgB,KAAK;MACnB;MACA;MACA,eAAe;MACf;MACA;MACA;MACA,YAAY,IAAI;MAChB;KACF,CAAC;IACH;GACF;GAEA,OAAO;IAAE;IAAiB;GAAc;EAC1C,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK;GAAY,GACnB,sDACF;GACA,OAAO;EACT;CACF;CAEA,sBACE,WACA,gBACA,YACA,eACA,KACA,SACA,aACA,kBACM;EAEN,IAAI,iBAAiB,GAAG,WAAW,MAAM,GAEvC,KAAK,MAAM,YAAY,iBAAiB,YAAY,CAAC,GAAG;GAUtD,IARqB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAGa,GAAG;IAChB,OAAO,MACL;KACe;KACb,SAAS,IAAI;KACb,aAAa,IAAI;KACR;KACT,YAAY,IAAI;KAChB,gBAAgB;IAClB,GACA,WAAW,IAAI,QAAQ,gEAAgE,iBAAiB,IAC1G;IACA,IAAI,aAAa;IACjB,IAAI,YAAY;GAClB;GAGA,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,GAAG;IACtC,MAAM,aAAa,OAAO,cAAc,OAAO;IAU/C,IAR2B,KAAK,oBAC9B,WACA,gBACA,YACA,UACA,aAGmB,GAAG;KACtB,OAAO,MACL;MACe;MACb,SAAS,IAAI;MACb,aAAa,IAAI;MACR;MACT,YAAY,IAAI;MAChB,gBAAgB;MAChB;KACF,GACA,WAAW,IAAI,QAAQ,eAAe,WAAW,iEAAiE,iBAAiB,IACrI;KACA,IAAI,aAAa;KACjB,IAAI,YAAY;IAClB;GACF;EACF;CAEJ;CAEA,mBACE,cACA,eACM;EACN,MAAM,kBAA0C,CAAC;EACjD,KAAK,MAAM,QAAQ,cAAc;GAC/B,MAAM,UAAU,KAAK;GACrB,gBAAgB,WAAW,QAAQ,QAAQ,MAAM,YAAY,GAAG,EAAE;EACpE;EACA,aAAa,MAAM,GAAG,MACpB,cAAc,aACZ,gBAAgB,EAAE,kBAClB,gBAAgB,EAAE,gBACpB,CACF;CACF;CAGA,WACE,QACA,eACa;EACb,MAAM,aAA0B,CAAC;EACjC,IAAI,YAA8B;EAElC,KAAK,MAAM,SAAS,QAClB,IAAI,MAAM,eAAe,KACvB,YAAY;OACP,IAAI,cAAc,UAAU,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE,GACxD,WAAW,KAAK,KAAK;OAErB,OAAO,MAAM,EAAE,MAAM,GAAG,yCAAyC;EAIrE,WAAW,MAAM,GAAG,MAElB,cAAc,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CACrE;EAEA,IAAI,WACF,WAAW,QAAQ,SAAS;EAG9B,OAAO;CACT;CAEA,kBACE,WACA,gBACA,UACS;EACT,OACE,SAAS,SAAS,SAAS,kBAC3B,SAAS,SAAS,cAAc;CAEpC;CAEA,mBACE,YACA,UACS;EACT,OAAO,CAAC,CAAC,SAAS,UAAU,SAAS,UAAU;CACjD;CAEA,iBACE,YACA,UACA,eACS;EACT,KAAK,MAAM,SAAS,SAAS,UAAU,CAAC,GAAG;GACzC,IAAI,MAAM,SAAS,OACjB;GAGF,IAAI,aAAa;GACjB,KAAK,MAAM,SAAS,KAAK,WAAW,MAAM,QAAQ,aAAa,GAC7D,IACE,iBAAiB,MAAM,UAAU,MAChC,MAAM,eAAe,OACpB,KAAK,gBAAgB,YAAY,MAAM,YAAY,aAAa,IAElE,aAAa;QACR,IACL,iBAAiB,MAAM,KAAK,KAC5B,KAAK,gBAAgB,YAAY,MAAM,OAAO,aAAa,GAE3D,aAAa;QACR,IACL,iBAAiB,MAAM,aAAa,KACpC,KAAK,YAAY,YAAY,MAAM,eAAe,aAAa,GAE/D,aAAa;GAIjB,IAAI,YACF,OAAO;EAEX;EAEA,OAAO;CACT;CAGA,oBACE,WACA,gBACA,YACA,UACA,eACS;EACT,OACE,KAAK,kBAAkB,WAAW,gBAAgB,QAAQ,MACzD,KAAK,mBAAmB,YAAY,QAAQ,KAC3C,KAAK,iBAAiB,YAAY,UAAU,aAAa;CAE/D;CAEA,gBACE,WACA,YACA,UACA,eACe;EACf,MAAM,gBAA0B,CAAC;EACjC,MAAM,uBAAiC,CAAC;EAExC,KAAK,MAAM,SAAS,SAAS,UAAU,CAAC,GAAG;GACzC,IAAI,MAAM,SAAS,OACjB;GAGF,KAAK,MAAM,SAAS,MAAM,QACxB,IACE,iBAAiB,MAAM,KAAK,KAC5B,cAAc,UAAU,MAAM,KAAK,GAEnC,cAAc,KAAK,MAAM,KAAK;QACzB,IACL,iBAAiB,MAAM,aAAa,KACpC,cAAc,UAAU,MAAM,aAAa,GAE3C,qBAAqB,KAAK,MAAM,aAAa;EAGnD;EAEA,cAAc,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EAC7D,MAAM,eAAe,cAAc,MAAM,YACvC,KAAK,YAAY,SAAS,YAAY,aAAa,CACrD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,qBAAqB,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EACpE,MAAM,eAAe,qBAAqB,MAAM,YAC9C,KAAK,gBAAgB,SAAS,YAAY,aAAa,CACzD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,OAAO;CACT;CAEA,2BACE,cACA,WACQ;EACR,OAAO,0BAA0B,cAAc,SAAS;CAC1D;CAEA,2BACE,cACA,WACQ;EACR,OAAO,iCAAiC,cAAc,SAAS;CACjE;CAEA,YACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,KAC7B,cAAc,cAAc,SAAS,KAAK;CAE9C;CAEA,gBACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,MAC5B,cAAc,OAAO,SAAS,KAAK,KAClC,cAAc,cAAc,SAAS,KAAK;CAEhD;CAEA,4BAAoC,KAAwC;EAC1E,MAAM,EACJ,eACA,UACA,aACA,YACA,cACA,YACA,sBACE;EACJ,IAAI,kBAAkB,YAAY,GAAG;GACnC,OAAO,MACL,gDAAgD,cAAc,GAAG,MAAM,YAAY,GAAG,YACxF;GACA,OAAO;EACT;EAGA,MAAM,aAAa,qBAAqB,UAAU;EAElD,OAAO,MACL;GACE;GACA;EACF,GAEA,2BAA2B,aAAa,wBAAwB,cAAc,GAAG,MAAM,YAAY,GAAG,YACxG;EAEA,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,OAAO;GACL,kBAAkB,CAAC,UAAU;GAC7B,mBAAmB,CAAC,WAAW;GAC/B,qBAAqB;GACrB;GACA,iBAAiB;GACjB,sBAAsB;GACtB,uBAAuB,gBAAgB;GACvC,aAAa,KAAK,oBAAoB,eAAe,QAAQ;GAC7D,OAAO,EACL,GAAG,kBAAkB,oBACvB;EACF;CACF;CAEA,OAAO,mBAAmB,QAAkC;EAC1D,MAAM,WAAW,EAAE,OAAO;GACxB,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAG;GACjC,cAAc,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,SAAS;EAC1D,CAAC;EAED,IAAI;GACF,MAAM,kBAA0C,WAAW,MAAM;GACjE,MAAM,MAAM,SAAS,MAAM,iBAAiB,iBAAiB,CAAC;GAE9D,OAAO,CAAC,IAAI,UAAU,QAAQ,CAAC,GAAG,IAAI,YAAY;EACpD,QAAQ;GACN,OAAO,MAAM,gCAAgC,QAAQ;EACvD;EAEA,OAAO,CAAC,IAAI,EAAE;CAChB;CAEA,oBACE,eACA,UACU;EACV,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;EAC1E,UAAU,QAAQ,KAAK,OAAO;GAC5B,IAAI,GAAG,WAAW,MAAM,GACtB,OAAO,IAAI,GAAG,qCAAqC,GAAG;GAExD,IAAI,GAAG,WAAW,OAAO,GACvB,OAAO,IAAI,GAAG,kCAAkC,GAAG;GAErD,IAAI,GAAG,WAAW,KAAK,GACrB,OAAO,IAAI,GAAG,4BAA4B,GAAG;GAE/C,IAAI,GAAG,WAAW,UAAU,GAC1B,OAAO,IAAI,GAAG,mCAAmC,GAAG;GAGtD,OAAO;EACT,CAAC;EAED,IAAI,UAAU;EACd,WAAW,cAAc,UAAU,GAAG,cAAc,QAAQ,MAAM;EAClE,WAAW,GAAG,QAAQ,KAAK,KAAK,EAAE;EAClC,WAAW;EAEX,MAAM,UAAU,cAAc,SAAS,QACrC,MAAM,YAAY,GAClB,QACF;EACA,WAAW,iBAAiB,WAAW,cAAc;EAErD,WAAW;EACX,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,IAAI,gBAAgB,YAAY;GAC9B,WAAW,iBAAiB,gBAAgB,MAAM;GAClD,WAAW,sBAAsB,gBAAgB,WAAW;EAC9D,OACE,WAAW,GAAG,UAAU,gBAAgB,aAAa,EAAE;EAGzD,WAAW,sBACT,cAAc,YACV,KAAK,QAAQ;GACb,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI;EACnC,CAAC,CAAC,CACD,KAAK,IAAI,KAAK;EAGnB,IAAI,cAAc;EAClB,IAAI,cAAc,GAAG,WAAW,OAAO,GACrC,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,KAAK,GAC1C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,QAAQ,GAC7C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,UAAU,GAC/C,cAAc;EAEhB,WAAW,oEAAoE,cAAc,GAAG,GAAG,YAAY;EAC/G,WAAW;EAEX,OAAO,CAAC,iBAAiB,OAAO,CAAC;CACnC;CAEA,uBACE,eACA,UACiB;EACjB,IAAI,gBAAgB;EACpB,IAAI,QAAQ;EAEZ,MAAM,aACJ,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC3D,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC1D,SAAS,mBAAmB;EAE/B,IAAI,YAAY;GACd,MAAM,CAAC,WAAW,YAChB,gBAAgB,mBAAmB,UAAU;GAC/C,gBAAgB,WAAW,SAAS,YAAY,IAAI;GACpD,QAAQ,YACJ,GAAG,UAAU,SAAS,UAAU,aAAa,EAAE,KAC/C;EACN,OAAO,IACL,cAAc,GAAG,WAAW,OAAO,KACnC,cAAc,mBAAmB,UAGjC,gBADiB,cAAc,kBAAkB,SACxB,YAAY;EAGvC,OAAO;GACL;GACA;GACA;EACF;CACF;AACF"}
|
|
1
|
+
{"version":3,"file":"vulnerabilities.js","names":["p.all","getVersioning"],"sources":["../../../../lib/workers/repository/process/vulnerabilities.ts"],"sourcesContent":["// TODO #22198\nimport type { Ecosystem, Osv } from '@renovatebot/osv-offline';\nimport { OsvOffline } from '@renovatebot/osv-offline';\nimport {\n isEmptyArray,\n isNonEmptyString,\n isNullOrUndefined,\n isTruthy,\n} from '@sindresorhus/is';\nimport type { CvssVector } from 'ae-cvss-calculator';\nimport * as _aeCvss from 'ae-cvss-calculator';\nimport { z } from 'zod/v4';\nimport { getManagerConfig, mergeChildConfig } from '../../../config/index.ts';\nimport type { PackageRule, RenovateConfig } from '../../../config/types.ts';\nimport { instrument } from '../../../instrumentation/index.ts';\nimport { logger } from '../../../logger/index.ts';\nimport { getDefaultVersioning } from '../../../modules/datasource/common.ts';\nimport type {\n PackageDependency,\n PackageFile,\n} from '../../../modules/manager/types.ts';\nimport type { VersioningApi } from '../../../modules/versioning/index.ts';\nimport { get as getVersioning } from '../../../modules/versioning/index.ts';\nimport { sanitizeMarkdown } from '../../../util/markdown.ts';\nimport * as p from '../../../util/promises.ts';\nimport { regEx } from '../../../util/regex.ts';\nimport { titleCase } from '../../../util/string.ts';\nimport { datasourceToOsvEcosystem } from '../../../util/vulnerability/ecosystem.ts';\nimport {\n getFixedVersionConstraint,\n getLastAffectedVersionConstraint,\n} from '../../../util/vulnerability/utils.ts';\nimport type {\n DependencyVulnerabilities,\n SeverityDetails,\n Vulnerability,\n} from './types.ts';\n\nconst { fromVector } = (_aeCvss as unknown as { default: typeof _aeCvss })\n .default;\n\nexport class Vulnerabilities {\n private static osvOffline: Promise<OsvOffline> | undefined;\n\n private osvOffline: OsvOffline;\n\n private static readonly datasourceEcosystemMap = datasourceToOsvEcosystem;\n\n private constructor(osvOffline: OsvOffline) {\n this.osvOffline = osvOffline;\n }\n\n private static initialize(): Promise<OsvOffline> {\n // no async here, so osv promise will only be created once\n Vulnerabilities.osvOffline ??= OsvOffline.create();\n return Vulnerabilities.osvOffline;\n }\n\n static async create(): Promise<Vulnerabilities> {\n // intialize osv only once\n const osvOffline = await Vulnerabilities.initialize();\n\n const instance = new Vulnerabilities(osvOffline);\n return instance;\n }\n\n async appendVulnerabilityPackageRules(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<void> {\n const dependencyVulnerabilities = await this.fetchDependencyVulnerabilities(\n config,\n packageFiles,\n );\n\n config.packageRules ??= [];\n for (const {\n vulnerabilities,\n versioningApi,\n } of dependencyVulnerabilities) {\n const groupPackageRules: PackageRule[] = [];\n for (const vulnerability of vulnerabilities) {\n const rule = this.vulnerabilityToPackageRules(vulnerability);\n if (isNullOrUndefined(rule)) {\n continue;\n }\n groupPackageRules.push(rule);\n }\n this.sortByFixedVersion(groupPackageRules, versioningApi);\n\n config.packageRules.push(...groupPackageRules);\n }\n }\n\n async fetchVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<Vulnerability[]> {\n const groups = await this.fetchDependencyVulnerabilities(\n config,\n packageFiles,\n );\n return groups.flatMap((group) => group.vulnerabilities);\n }\n\n private async fetchDependencyVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n ): Promise<DependencyVulnerabilities[]> {\n const managers = Object.keys(packageFiles);\n const allManagerJobs = managers.map((manager) =>\n this.fetchManagerVulnerabilities(config, packageFiles, manager),\n );\n return (await Promise.all(allManagerJobs)).flat();\n }\n\n private async fetchManagerVulnerabilities(\n config: RenovateConfig,\n packageFiles: Record<string, PackageFile[]>,\n manager: string,\n ): Promise<DependencyVulnerabilities[]> {\n const managerConfig = getManagerConfig(config, manager);\n const queue = packageFiles[manager].map(\n (pFile) => (): Promise<DependencyVulnerabilities[]> =>\n this.fetchManagerPackageFileVulnerabilities(managerConfig, pFile),\n );\n logger.trace(\n { manager, queueLength: queue.length },\n 'fetchManagerVulnerabilities starting',\n );\n const result = (await p.all(queue)).flat();\n logger.trace({ manager }, 'fetchManagerVulnerabilities finished');\n return result;\n }\n\n private async fetchManagerPackageFileVulnerabilities(\n managerConfig: RenovateConfig,\n pFile: PackageFile,\n ): Promise<DependencyVulnerabilities[]> {\n const { packageFile } = pFile;\n const packageFileConfig = mergeChildConfig(managerConfig, pFile);\n const { manager } = packageFileConfig;\n const queue = pFile.deps.map(\n (dep) => (): Promise<DependencyVulnerabilities | null> =>\n this.fetchDependencyVulnerability(packageFileConfig, dep),\n );\n logger.trace(\n { manager, packageFile, queueLength: queue.length },\n 'fetchManagerPackageFileVulnerabilities starting with concurrency',\n );\n\n const result = await p.all(queue);\n logger.trace(\n { packageFile },\n 'fetchManagerPackageFileVulnerabilities finished',\n );\n\n return result.filter(isTruthy);\n }\n\n private async fetchDependencyVulnerability(\n packageFileConfig: RenovateConfig & PackageFile,\n dep: PackageDependency,\n ): Promise<DependencyVulnerabilities | null> {\n const ecosystem = Vulnerabilities.datasourceEcosystemMap[dep.datasource!];\n if (!ecosystem) {\n logger.trace(`Cannot map datasource ${dep.datasource!} to OSV ecosystem`);\n return null;\n }\n\n const packageName = dep.packageName ?? dep.depName!;\n let osvPackageName = packageName;\n if (ecosystem === 'PyPI') {\n // https://peps.python.org/pep-0503/#normalized-names\n osvPackageName = osvPackageName\n .toLowerCase()\n .replace(regEx(/[_.-]+/g), '-');\n } else if (ecosystem === 'Go' && packageName === 'go') {\n if (dep.depType !== 'toolchain') {\n // The `go` directive is source compatibility, not the build toolchain, so we skip it\n return null;\n }\n osvPackageName = 'stdlib';\n }\n\n try {\n const osvVulnerabilities = await instrument(\n 'get OSV vulnerabilities',\n () => this.osvOffline.getVulnerabilities(ecosystem, osvPackageName),\n {\n attributes: {\n osvPackageName,\n ecosystem,\n },\n },\n );\n if (\n isNullOrUndefined(osvVulnerabilities) ||\n isEmptyArray(osvVulnerabilities)\n ) {\n logger.trace(\n `No vulnerabilities found in OSV database for ${packageName}`,\n );\n return null;\n }\n\n const depVersion =\n dep.lockedVersion ?? dep.currentVersion ?? dep.currentValue!;\n\n const versioning = dep.versioning ?? getDefaultVersioning(dep.datasource);\n const versioningApi = getVersioning(versioning);\n\n if (!versioningApi.isVersion(depVersion)) {\n logger.debug(\n `Skipping vulnerability lookup for package ${packageName} due to unsupported version ${depVersion}`,\n );\n return null;\n }\n\n const vulnerabilities: Vulnerability[] = [];\n for (const osvVulnerability of osvVulnerabilities) {\n if (osvVulnerability.withdrawn) {\n logger.trace(\n `Skipping withdrawn vulnerability ${osvVulnerability.id}`,\n );\n continue;\n }\n\n this.skipMaliciousPackages(\n ecosystem,\n osvPackageName,\n depVersion,\n versioningApi,\n dep,\n packageFileConfig.manager,\n packageFileConfig.packageFile,\n osvVulnerability,\n );\n\n for (const affected of osvVulnerability.affected ?? []) {\n const isVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n depVersion,\n affected,\n versioningApi,\n );\n if (!isVulnerable) {\n continue;\n }\n\n logger.debug(\n `Vulnerability ${osvVulnerability.id} affects ${packageName} ${depVersion}`,\n );\n const fixedVersion = this.getFixedVersion(\n ecosystem,\n depVersion,\n affected,\n versioningApi,\n );\n\n vulnerabilities.push({\n packageName,\n osvPackageName,\n vulnerability: osvVulnerability,\n affected,\n depVersion,\n fixedVersion,\n datasource: dep.datasource!,\n packageFileConfig,\n });\n }\n }\n\n return { vulnerabilities, versioningApi };\n } catch (err) {\n logger.warn(\n { err, packageName },\n 'Error fetching vulnerability information for package',\n );\n return null;\n }\n }\n\n private skipMaliciousPackages(\n ecosystem: Ecosystem,\n osvPackageName: string,\n depVersion: string,\n versioningApi: VersioningApi,\n dep: PackageDependency,\n manager: string | undefined,\n packageFile: string,\n osvVulnerability: Osv.Vulnerability,\n ): void {\n // the OpenSSF's Malicious Packages (https://github.com/ossf/malicious-packages) is a source of advisories through osv.dev, which takes various sources of advisories, and will re-publish them with more specific information about their malicious usage\n if (osvVulnerability.id.startsWith('MAL-')) {\n // is the current dependency vulnerable?\n for (const affected of osvVulnerability.affected ?? []) {\n // is the current dependency vulnerable?\n const isVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n depVersion,\n affected,\n versioningApi,\n );\n\n if (isVulnerable) {\n logger.debug(\n {\n packageFile: packageFile,\n depName: dep.depName,\n packageName: dep.packageName,\n manager: manager,\n datasource: dep.datasource,\n currentVersion: depVersion,\n },\n `Marking ${dep.depName} as skipReason=malicious-version-in-use, as it is affected by ${osvVulnerability.id}`,\n );\n dep.skipReason = 'malicious-version-in-use';\n dep.skipStage = 'lookup';\n }\n\n // or are any of the updates vulnerable?\n for (const update of dep.updates ?? []) {\n const newVersion = update.newVersion ?? update.newValue!;\n\n const isUpdateVulnerable = this.isPackageVulnerable(\n ecosystem,\n osvPackageName,\n newVersion,\n affected,\n versioningApi,\n );\n\n if (isUpdateVulnerable) {\n logger.debug(\n {\n packageFile: packageFile,\n depName: dep.depName,\n packageName: dep.packageName,\n manager: manager,\n datasource: dep.datasource,\n currentVersion: depVersion,\n newVersion,\n },\n `Marking ${dep.depName}'s update to ${newVersion} as skipReason=malicious-update-proposed, as it is affected by ${osvVulnerability.id}`,\n );\n dep.skipReason = 'malicious-update-proposed';\n dep.skipStage = 'lookup';\n }\n }\n }\n }\n }\n\n private sortByFixedVersion(\n packageRules: PackageRule[],\n versioningApi: VersioningApi,\n ): void {\n const versionsCleaned: Record<string, string> = {};\n for (const rule of packageRules) {\n const version = rule.allowedVersions!;\n versionsCleaned[version] = version.replace(regEx(/[(),=> ]+/g), '');\n }\n packageRules.sort((a, b) =>\n versioningApi.sortVersions(\n versionsCleaned[a.allowedVersions!],\n versionsCleaned[b.allowedVersions!],\n ),\n );\n }\n\n // https://ossf.github.io/osv-schema/#affectedrangesevents-fields\n private sortEvents(\n events: Osv.Event[],\n versioningApi: VersioningApi,\n ): Osv.Event[] {\n const sortedCopy: Osv.Event[] = [];\n let zeroEvent: Osv.Event | null = null;\n\n for (const event of events) {\n if (event.introduced === '0') {\n zeroEvent = event;\n } else if (versioningApi.isVersion(Object.values(event)[0])) {\n sortedCopy.push(event);\n } else {\n logger.debug({ event }, 'Skipping OSV event with invalid version');\n }\n }\n\n sortedCopy.sort((a, b) =>\n // no pre-processing, as there are only very few values to sort\n versioningApi.sortVersions(Object.values(a)[0], Object.values(b)[0]),\n );\n\n if (zeroEvent) {\n sortedCopy.unshift(zeroEvent);\n }\n\n return sortedCopy;\n }\n\n private isPackageAffected(\n ecosystem: Ecosystem,\n osvPackageName: string,\n affected: Osv.Affected,\n ): boolean {\n const pkg = affected.package;\n if (pkg?.name !== osvPackageName) {\n return false;\n }\n\n // Match exact ecosystems and OSV sub-ecosystems (e.g. Packagist:https://packages.drupal.org/8).\n return (\n pkg.ecosystem === ecosystem || pkg.ecosystem.startsWith(`${ecosystem}:`)\n );\n }\n\n private includedInVersions(\n depVersion: string,\n affected: Osv.Affected,\n ): boolean {\n return !!affected.versions?.includes(depVersion);\n }\n\n private includedInRanges(\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): boolean {\n for (const range of affected.ranges ?? []) {\n if (range.type === 'GIT') {\n continue;\n }\n\n let vulnerable = false;\n for (const event of this.sortEvents(range.events, versioningApi)) {\n if (\n isNonEmptyString(event.introduced) &&\n (event.introduced === '0' ||\n this.isVersionGtOrEq(depVersion, event.introduced, versioningApi))\n ) {\n vulnerable = true;\n } else if (\n isNonEmptyString(event.fixed) &&\n this.isVersionGtOrEq(depVersion, event.fixed, versioningApi)\n ) {\n vulnerable = false;\n } else if (\n isNonEmptyString(event.last_affected) &&\n this.isVersionGt(depVersion, event.last_affected, versioningApi)\n ) {\n vulnerable = false;\n }\n }\n\n if (vulnerable) {\n return true;\n }\n }\n\n return false;\n }\n\n // https://ossf.github.io/osv-schema/#evaluation\n private isPackageVulnerable(\n ecosystem: Ecosystem,\n osvPackageName: string,\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n this.isPackageAffected(ecosystem, osvPackageName, affected) &&\n (this.includedInVersions(depVersion, affected) ||\n this.includedInRanges(depVersion, affected, versioningApi))\n );\n }\n\n private getFixedVersion(\n ecosystem: Ecosystem,\n depVersion: string,\n affected: Osv.Affected,\n versioningApi: VersioningApi,\n ): string | null {\n const fixedVersions: string[] = [];\n const lastAffectedVersions: string[] = [];\n\n for (const range of affected.ranges ?? []) {\n if (range.type === 'GIT') {\n continue;\n }\n\n for (const event of range.events) {\n if (\n isNonEmptyString(event.fixed) &&\n versioningApi.isVersion(event.fixed)\n ) {\n fixedVersions.push(event.fixed);\n } else if (\n isNonEmptyString(event.last_affected) &&\n versioningApi.isVersion(event.last_affected)\n ) {\n lastAffectedVersions.push(event.last_affected);\n }\n }\n }\n\n fixedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n const fixedVersion = fixedVersions.find((version) =>\n this.isVersionGt(version, depVersion, versioningApi),\n );\n if (fixedVersion) {\n return this.getFixedVersionByEcosystem(fixedVersion, ecosystem);\n }\n\n lastAffectedVersions.sort((a, b) => versioningApi.sortVersions(a, b));\n const lastAffected = lastAffectedVersions.find((version) =>\n this.isVersionGtOrEq(version, depVersion, versioningApi),\n );\n if (lastAffected) {\n return this.getLastAffectedByEcosystem(lastAffected, ecosystem);\n }\n\n return null;\n }\n\n private getFixedVersionByEcosystem(\n fixedVersion: string,\n ecosystem: Ecosystem,\n ): string {\n return getFixedVersionConstraint(fixedVersion, ecosystem);\n }\n\n private getLastAffectedByEcosystem(\n lastAffected: string,\n ecosystem: Ecosystem,\n ): string {\n return getLastAffectedVersionConstraint(lastAffected, ecosystem);\n }\n\n private isVersionGt(\n version: string,\n other: string,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n versioningApi.isVersion(version) &&\n versioningApi.isVersion(other) &&\n versioningApi.isGreaterThan(version, other)\n );\n }\n\n private isVersionGtOrEq(\n version: string,\n other: string,\n versioningApi: VersioningApi,\n ): boolean {\n return (\n versioningApi.isVersion(version) &&\n versioningApi.isVersion(other) &&\n (versioningApi.equals(version, other) ||\n versioningApi.isGreaterThan(version, other))\n );\n }\n\n private vulnerabilityToPackageRules(vul: Vulnerability): PackageRule | null {\n const {\n vulnerability,\n affected,\n packageName,\n depVersion,\n fixedVersion,\n datasource,\n packageFileConfig,\n } = vul;\n if (isNullOrUndefined(fixedVersion)) {\n logger.debug(\n `No fixed version available for vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n );\n return null;\n }\n\n // we don't know if the dependency has a `versioning` applied to it already, so we have to use the default for the datasource\n const versioning = getDefaultVersioning(datasource);\n\n logger.debug(\n {\n datasource,\n versioning,\n },\n\n `Setting allowed version ${fixedVersion} to fix vulnerability ${vulnerability.id} in ${packageName} ${depVersion}`,\n );\n\n const severityDetails = this.extractSeverityDetails(\n vulnerability,\n affected,\n );\n\n return {\n matchDatasources: [datasource],\n matchPackageNames: [packageName],\n matchCurrentVersion: depVersion,\n versioning,\n allowedVersions: fixedVersion,\n isVulnerabilityAlert: true,\n vulnerabilitySeverity: severityDetails.severityLevel,\n prBodyNotes: this.generatePrBodyNotes(vulnerability, affected),\n force: {\n ...packageFileConfig.vulnerabilityAlerts,\n },\n };\n }\n\n static evaluateCvssVector(vector: string): [string, string] {\n const CvssJson = z.object({\n baseScore: z.number().default(0.0),\n baseSeverity: z.string().toUpperCase().default('UNKNOWN'),\n });\n\n try {\n const parsedCvssScore: CvssVector<any> | null = fromVector(vector);\n const res = CvssJson.parse(parsedCvssScore?.createJsonSchema());\n\n return [res.baseScore.toFixed(1), res.baseSeverity];\n } catch {\n logger.debug(`Error processing CVSS vector ${vector}`);\n }\n\n return ['', ''];\n }\n\n private generatePrBodyNotes(\n vulnerability: Osv.Vulnerability,\n affected: Osv.Affected,\n ): string[] {\n let aliases = [vulnerability.id].concat(vulnerability.aliases ?? []).sort();\n aliases = aliases.map((id) => {\n if (id.startsWith('CVE-')) {\n return `[${id}](https://nvd.nist.gov/vuln/detail/${id})`;\n }\n if (id.startsWith('GHSA-')) {\n return `[${id}](https://github.com/advisories/${id})`;\n }\n if (id.startsWith('GO-')) {\n return `[${id}](https://pkg.go.dev/vuln/${id})`;\n }\n if (id.startsWith('RUSTSEC-')) {\n return `[${id}](https://rustsec.org/advisories/${id}.html)`;\n }\n\n return id;\n });\n\n let content = '\\n\\n---\\n\\n### ';\n content += vulnerability.summary ? `${vulnerability.summary}\\n` : '';\n content += `${aliases.join(' / ')}\\n`;\n content += `\\n<details>\\n<summary>More information</summary>\\n`;\n\n const details = vulnerability.details?.replace(\n regEx(/^#{1,4} /gm),\n '##### ',\n );\n content += `#### Details\\n${details ?? 'No details.'}\\n`;\n\n content += '#### Severity\\n';\n const severityDetails = this.extractSeverityDetails(\n vulnerability,\n affected,\n );\n\n if (severityDetails.cvssVector) {\n content += `- CVSS Score: ${severityDetails.score}\\n`;\n content += `- Vector String: \\`${severityDetails.cvssVector}\\`\\n`;\n } else {\n content += `${titleCase(severityDetails.severityLevel)}\\n`;\n }\n\n content += `\\n#### References\\n${\n vulnerability.references\n ?.map((ref) => {\n return `- [${ref.url}](${ref.url})`;\n })\n .join('\\n') ?? 'No references.'\n }`;\n\n let attribution = '';\n if (vulnerability.id.startsWith('GHSA-')) {\n attribution = ` and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))`;\n } else if (vulnerability.id.startsWith('GO-')) {\n attribution = ` and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))`;\n } else if (vulnerability.id.startsWith('PYSEC-')) {\n attribution = ` and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))`;\n } else if (vulnerability.id.startsWith('RUSTSEC-')) {\n attribution = ` and the [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))`;\n }\n content += `\\n\\nThis data is provided by [OSV](https://osv.dev/vulnerability/${vulnerability.id})${attribution}.\\n`;\n content += `</details>`;\n\n return [sanitizeMarkdown(content)];\n }\n\n private extractSeverityDetails(\n vulnerability: Osv.Vulnerability,\n affected: Osv.Affected,\n ): SeverityDetails {\n let severityLevel = 'UNKNOWN';\n let score = 'Unknown';\n\n const cvssVector =\n vulnerability.severity?.find((e) => e.type === 'CVSS_V4')?.score ??\n vulnerability.severity?.find((e) => e.type === 'CVSS_V3')?.score ??\n (affected.database_specific?.cvss as string); // RUSTSEC\n\n if (cvssVector) {\n const [baseScore, severity] =\n Vulnerabilities.evaluateCvssVector(cvssVector);\n severityLevel = severity ? severity.toUpperCase() : 'UNKNOWN';\n score = baseScore\n ? `${baseScore} / 10 (${titleCase(severityLevel)})`\n : 'Unknown';\n } else if (\n vulnerability.id.startsWith('GHSA-') &&\n vulnerability.database_specific?.severity\n ) {\n const severity = vulnerability.database_specific.severity as string;\n severityLevel = severity.toUpperCase();\n }\n\n return {\n cvssVector,\n score,\n severityLevel,\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAM,EAAE,eAAgB,QACrB;AAEH,IAAa,kBAAb,MAAa,gBAAgB;CAC3B,OAAe;CAEf;CAEA,OAAwB,yBAAyB;CAEjD,YAAoB,YAAwB;EAC1C,KAAK,aAAa;CACpB;CAEA,OAAe,aAAkC;EAE/C,gBAAgB,eAAe,WAAW,OAAO;EACjD,OAAO,gBAAgB;CACzB;CAEA,aAAa,SAAmC;EAE9C,MAAM,aAAa,MAAM,gBAAgB,WAAW;EAGpD,OAAO,IADc,gBAAgB,UACvB;CAChB;CAEA,MAAM,gCACJ,QACA,cACe;EACf,MAAM,4BAA4B,MAAM,KAAK,+BAC3C,QACA,YACF;EAEA,OAAO,iBAAiB,CAAC;EACzB,KAAK,MAAM,EACT,iBACA,mBACG,2BAA2B;GAC9B,MAAM,oBAAmC,CAAC;GAC1C,KAAK,MAAM,iBAAiB,iBAAiB;IAC3C,MAAM,OAAO,KAAK,4BAA4B,aAAa;IAC3D,IAAI,kBAAkB,IAAI,GACxB;IAEF,kBAAkB,KAAK,IAAI;GAC7B;GACA,KAAK,mBAAmB,mBAAmB,aAAa;GAExD,OAAO,aAAa,KAAK,GAAG,iBAAiB;EAC/C;CACF;CAEA,MAAM,qBACJ,QACA,cAC0B;EAK1B,QAAO,MAJc,KAAK,+BACxB,QACA,YACF,EAAA,CACc,SAAS,UAAU,MAAM,eAAe;CACxD;CAEA,MAAc,+BACZ,QACA,cACsC;EAEtC,MAAM,iBADW,OAAO,KAAK,YACC,CAAC,CAAC,KAAK,YACnC,KAAK,4BAA4B,QAAQ,cAAc,OAAO,CAChE;EACA,QAAQ,MAAM,QAAQ,IAAI,cAAc,EAAA,CAAG,KAAK;CAClD;CAEA,MAAc,4BACZ,QACA,cACA,SACsC;EACtC,MAAM,gBAAgB,iBAAiB,QAAQ,OAAO;EACtD,MAAM,QAAQ,aAAa,QAAQ,CAAC,KACjC,gBACC,KAAK,uCAAuC,eAAe,KAAK,CACpE;EACA,OAAO,MACL;GAAE;GAAS,aAAa,MAAM;EAAO,GACrC,sCACF;EACA,MAAM,UAAU,MAAMA,IAAM,KAAK,EAAA,CAAG,KAAK;EACzC,OAAO,MAAM,EAAE,QAAQ,GAAG,sCAAsC;EAChE,OAAO;CACT;CAEA,MAAc,uCACZ,eACA,OACsC;EACtC,MAAM,EAAE,gBAAgB;EACxB,MAAM,oBAAoB,iBAAiB,eAAe,KAAK;EAC/D,MAAM,EAAE,YAAY;EACpB,MAAM,QAAQ,MAAM,KAAK,KACtB,cACC,KAAK,6BAA6B,mBAAmB,GAAG,CAC5D;EACA,OAAO,MACL;GAAE;GAAS;GAAa,aAAa,MAAM;EAAO,GAClD,kEACF;EAEA,MAAM,SAAS,MAAMA,IAAM,KAAK;EAChC,OAAO,MACL,EAAE,YAAY,GACd,iDACF;EAEA,OAAO,OAAO,OAAO,QAAQ;CAC/B;CAEA,MAAc,6BACZ,mBACA,KAC2C;EAC3C,MAAM,YAAY,gBAAgB,uBAAuB,IAAI;EAC7D,IAAI,CAAC,WAAW;GACd,OAAO,MAAM,yBAAyB,IAAI,WAAY,kBAAkB;GACxE,OAAO;EACT;EAEA,MAAM,cAAc,IAAI,eAAe,IAAI;EAC3C,IAAI,iBAAiB;EACrB,IAAI,cAAc,QAEhB,iBAAiB,eACd,YAAY,CAAC,CACb,QAAQ,MAAM,SAAS,GAAG,GAAG;OAC3B,IAAI,cAAc,QAAQ,gBAAgB,MAAM;GACrD,IAAI,IAAI,YAAY,aAElB,OAAO;GAET,iBAAiB;EACnB;EAEA,IAAI;GACF,MAAM,qBAAqB,MAAM,WAC/B,iCACM,KAAK,WAAW,mBAAmB,WAAW,cAAc,GAClE,EACE,YAAY;IACV;IACA;GACF,EACF,CACF;GACA,IACE,kBAAkB,kBAAkB,KACpC,aAAa,kBAAkB,GAC/B;IACA,OAAO,MACL,gDAAgD,aAClD;IACA,OAAO;GACT;GAEA,MAAM,aACJ,IAAI,iBAAiB,IAAI,kBAAkB,IAAI;GAEjD,MAAM,aAAa,IAAI,cAAc,qBAAqB,IAAI,UAAU;GACxE,MAAM,gBAAgBC,IAAc,UAAU;GAE9C,IAAI,CAAC,cAAc,UAAU,UAAU,GAAG;IACxC,OAAO,MACL,6CAA6C,YAAY,8BAA8B,YACzF;IACA,OAAO;GACT;GAEA,MAAM,kBAAmC,CAAC;GAC1C,KAAK,MAAM,oBAAoB,oBAAoB;IACjD,IAAI,iBAAiB,WAAW;KAC9B,OAAO,MACL,oCAAoC,iBAAiB,IACvD;KACA;IACF;IAEA,KAAK,sBACH,WACA,gBACA,YACA,eACA,KACA,kBAAkB,SAClB,kBAAkB,aAClB,gBACF;IAEA,KAAK,MAAM,YAAY,iBAAiB,YAAY,CAAC,GAAG;KAQtD,IAAI,CAPiB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAEc,GACd;KAGF,OAAO,MACL,iBAAiB,iBAAiB,GAAG,WAAW,YAAY,GAAG,YACjE;KACA,MAAM,eAAe,KAAK,gBACxB,WACA,YACA,UACA,aACF;KAEA,gBAAgB,KAAK;MACnB;MACA;MACA,eAAe;MACf;MACA;MACA;MACA,YAAY,IAAI;MAChB;KACF,CAAC;IACH;GACF;GAEA,OAAO;IAAE;IAAiB;GAAc;EAC1C,SAAS,KAAK;GACZ,OAAO,KACL;IAAE;IAAK;GAAY,GACnB,sDACF;GACA,OAAO;EACT;CACF;CAEA,sBACE,WACA,gBACA,YACA,eACA,KACA,SACA,aACA,kBACM;EAEN,IAAI,iBAAiB,GAAG,WAAW,MAAM,GAEvC,KAAK,MAAM,YAAY,iBAAiB,YAAY,CAAC,GAAG;GAUtD,IARqB,KAAK,oBACxB,WACA,gBACA,YACA,UACA,aAGa,GAAG;IAChB,OAAO,MACL;KACe;KACb,SAAS,IAAI;KACb,aAAa,IAAI;KACR;KACT,YAAY,IAAI;KAChB,gBAAgB;IAClB,GACA,WAAW,IAAI,QAAQ,gEAAgE,iBAAiB,IAC1G;IACA,IAAI,aAAa;IACjB,IAAI,YAAY;GAClB;GAGA,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,GAAG;IACtC,MAAM,aAAa,OAAO,cAAc,OAAO;IAU/C,IAR2B,KAAK,oBAC9B,WACA,gBACA,YACA,UACA,aAGmB,GAAG;KACtB,OAAO,MACL;MACe;MACb,SAAS,IAAI;MACb,aAAa,IAAI;MACR;MACT,YAAY,IAAI;MAChB,gBAAgB;MAChB;KACF,GACA,WAAW,IAAI,QAAQ,eAAe,WAAW,iEAAiE,iBAAiB,IACrI;KACA,IAAI,aAAa;KACjB,IAAI,YAAY;IAClB;GACF;EACF;CAEJ;CAEA,mBACE,cACA,eACM;EACN,MAAM,kBAA0C,CAAC;EACjD,KAAK,MAAM,QAAQ,cAAc;GAC/B,MAAM,UAAU,KAAK;GACrB,gBAAgB,WAAW,QAAQ,QAAQ,MAAM,YAAY,GAAG,EAAE;EACpE;EACA,aAAa,MAAM,GAAG,MACpB,cAAc,aACZ,gBAAgB,EAAE,kBAClB,gBAAgB,EAAE,gBACpB,CACF;CACF;CAGA,WACE,QACA,eACa;EACb,MAAM,aAA0B,CAAC;EACjC,IAAI,YAA8B;EAElC,KAAK,MAAM,SAAS,QAClB,IAAI,MAAM,eAAe,KACvB,YAAY;OACP,IAAI,cAAc,UAAU,OAAO,OAAO,KAAK,CAAC,CAAC,EAAE,GACxD,WAAW,KAAK,KAAK;OAErB,OAAO,MAAM,EAAE,MAAM,GAAG,yCAAyC;EAIrE,WAAW,MAAM,GAAG,MAElB,cAAc,aAAa,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CACrE;EAEA,IAAI,WACF,WAAW,QAAQ,SAAS;EAG9B,OAAO;CACT;CAEA,kBACE,WACA,gBACA,UACS;EACT,MAAM,MAAM,SAAS;EACrB,IAAI,KAAK,SAAS,gBAChB,OAAO;EAIT,OACE,IAAI,cAAc,aAAa,IAAI,UAAU,WAAW,GAAG,UAAU,EAAE;CAE3E;CAEA,mBACE,YACA,UACS;EACT,OAAO,CAAC,CAAC,SAAS,UAAU,SAAS,UAAU;CACjD;CAEA,iBACE,YACA,UACA,eACS;EACT,KAAK,MAAM,SAAS,SAAS,UAAU,CAAC,GAAG;GACzC,IAAI,MAAM,SAAS,OACjB;GAGF,IAAI,aAAa;GACjB,KAAK,MAAM,SAAS,KAAK,WAAW,MAAM,QAAQ,aAAa,GAC7D,IACE,iBAAiB,MAAM,UAAU,MAChC,MAAM,eAAe,OACpB,KAAK,gBAAgB,YAAY,MAAM,YAAY,aAAa,IAElE,aAAa;QACR,IACL,iBAAiB,MAAM,KAAK,KAC5B,KAAK,gBAAgB,YAAY,MAAM,OAAO,aAAa,GAE3D,aAAa;QACR,IACL,iBAAiB,MAAM,aAAa,KACpC,KAAK,YAAY,YAAY,MAAM,eAAe,aAAa,GAE/D,aAAa;GAIjB,IAAI,YACF,OAAO;EAEX;EAEA,OAAO;CACT;CAGA,oBACE,WACA,gBACA,YACA,UACA,eACS;EACT,OACE,KAAK,kBAAkB,WAAW,gBAAgB,QAAQ,MACzD,KAAK,mBAAmB,YAAY,QAAQ,KAC3C,KAAK,iBAAiB,YAAY,UAAU,aAAa;CAE/D;CAEA,gBACE,WACA,YACA,UACA,eACe;EACf,MAAM,gBAA0B,CAAC;EACjC,MAAM,uBAAiC,CAAC;EAExC,KAAK,MAAM,SAAS,SAAS,UAAU,CAAC,GAAG;GACzC,IAAI,MAAM,SAAS,OACjB;GAGF,KAAK,MAAM,SAAS,MAAM,QACxB,IACE,iBAAiB,MAAM,KAAK,KAC5B,cAAc,UAAU,MAAM,KAAK,GAEnC,cAAc,KAAK,MAAM,KAAK;QACzB,IACL,iBAAiB,MAAM,aAAa,KACpC,cAAc,UAAU,MAAM,aAAa,GAE3C,qBAAqB,KAAK,MAAM,aAAa;EAGnD;EAEA,cAAc,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EAC7D,MAAM,eAAe,cAAc,MAAM,YACvC,KAAK,YAAY,SAAS,YAAY,aAAa,CACrD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,qBAAqB,MAAM,GAAG,MAAM,cAAc,aAAa,GAAG,CAAC,CAAC;EACpE,MAAM,eAAe,qBAAqB,MAAM,YAC9C,KAAK,gBAAgB,SAAS,YAAY,aAAa,CACzD;EACA,IAAI,cACF,OAAO,KAAK,2BAA2B,cAAc,SAAS;EAGhE,OAAO;CACT;CAEA,2BACE,cACA,WACQ;EACR,OAAO,0BAA0B,cAAc,SAAS;CAC1D;CAEA,2BACE,cACA,WACQ;EACR,OAAO,iCAAiC,cAAc,SAAS;CACjE;CAEA,YACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,KAC7B,cAAc,cAAc,SAAS,KAAK;CAE9C;CAEA,gBACE,SACA,OACA,eACS;EACT,OACE,cAAc,UAAU,OAAO,KAC/B,cAAc,UAAU,KAAK,MAC5B,cAAc,OAAO,SAAS,KAAK,KAClC,cAAc,cAAc,SAAS,KAAK;CAEhD;CAEA,4BAAoC,KAAwC;EAC1E,MAAM,EACJ,eACA,UACA,aACA,YACA,cACA,YACA,sBACE;EACJ,IAAI,kBAAkB,YAAY,GAAG;GACnC,OAAO,MACL,gDAAgD,cAAc,GAAG,MAAM,YAAY,GAAG,YACxF;GACA,OAAO;EACT;EAGA,MAAM,aAAa,qBAAqB,UAAU;EAElD,OAAO,MACL;GACE;GACA;EACF,GAEA,2BAA2B,aAAa,wBAAwB,cAAc,GAAG,MAAM,YAAY,GAAG,YACxG;EAEA,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,OAAO;GACL,kBAAkB,CAAC,UAAU;GAC7B,mBAAmB,CAAC,WAAW;GAC/B,qBAAqB;GACrB;GACA,iBAAiB;GACjB,sBAAsB;GACtB,uBAAuB,gBAAgB;GACvC,aAAa,KAAK,oBAAoB,eAAe,QAAQ;GAC7D,OAAO,EACL,GAAG,kBAAkB,oBACvB;EACF;CACF;CAEA,OAAO,mBAAmB,QAAkC;EAC1D,MAAM,WAAW,EAAE,OAAO;GACxB,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAG;GACjC,cAAc,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,SAAS;EAC1D,CAAC;EAED,IAAI;GACF,MAAM,kBAA0C,WAAW,MAAM;GACjE,MAAM,MAAM,SAAS,MAAM,iBAAiB,iBAAiB,CAAC;GAE9D,OAAO,CAAC,IAAI,UAAU,QAAQ,CAAC,GAAG,IAAI,YAAY;EACpD,QAAQ;GACN,OAAO,MAAM,gCAAgC,QAAQ;EACvD;EAEA,OAAO,CAAC,IAAI,EAAE;CAChB;CAEA,oBACE,eACA,UACU;EACV,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;EAC1E,UAAU,QAAQ,KAAK,OAAO;GAC5B,IAAI,GAAG,WAAW,MAAM,GACtB,OAAO,IAAI,GAAG,qCAAqC,GAAG;GAExD,IAAI,GAAG,WAAW,OAAO,GACvB,OAAO,IAAI,GAAG,kCAAkC,GAAG;GAErD,IAAI,GAAG,WAAW,KAAK,GACrB,OAAO,IAAI,GAAG,4BAA4B,GAAG;GAE/C,IAAI,GAAG,WAAW,UAAU,GAC1B,OAAO,IAAI,GAAG,mCAAmC,GAAG;GAGtD,OAAO;EACT,CAAC;EAED,IAAI,UAAU;EACd,WAAW,cAAc,UAAU,GAAG,cAAc,QAAQ,MAAM;EAClE,WAAW,GAAG,QAAQ,KAAK,KAAK,EAAE;EAClC,WAAW;EAEX,MAAM,UAAU,cAAc,SAAS,QACrC,MAAM,YAAY,GAClB,QACF;EACA,WAAW,iBAAiB,WAAW,cAAc;EAErD,WAAW;EACX,MAAM,kBAAkB,KAAK,uBAC3B,eACA,QACF;EAEA,IAAI,gBAAgB,YAAY;GAC9B,WAAW,iBAAiB,gBAAgB,MAAM;GAClD,WAAW,sBAAsB,gBAAgB,WAAW;EAC9D,OACE,WAAW,GAAG,UAAU,gBAAgB,aAAa,EAAE;EAGzD,WAAW,sBACT,cAAc,YACV,KAAK,QAAQ;GACb,OAAO,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI;EACnC,CAAC,CAAC,CACD,KAAK,IAAI,KAAK;EAGnB,IAAI,cAAc;EAClB,IAAI,cAAc,GAAG,WAAW,OAAO,GACrC,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,KAAK,GAC1C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,QAAQ,GAC7C,cAAc;OACT,IAAI,cAAc,GAAG,WAAW,UAAU,GAC/C,cAAc;EAEhB,WAAW,oEAAoE,cAAc,GAAG,GAAG,YAAY;EAC/G,WAAW;EAEX,OAAO,CAAC,iBAAiB,OAAO,CAAC;CACnC;CAEA,uBACE,eACA,UACiB;EACjB,IAAI,gBAAgB;EACpB,IAAI,QAAQ;EAEZ,MAAM,aACJ,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC3D,cAAc,UAAU,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,SAC1D,SAAS,mBAAmB;EAE/B,IAAI,YAAY;GACd,MAAM,CAAC,WAAW,YAChB,gBAAgB,mBAAmB,UAAU;GAC/C,gBAAgB,WAAW,SAAS,YAAY,IAAI;GACpD,QAAQ,YACJ,GAAG,UAAU,SAAS,UAAU,aAAa,EAAE,KAC/C;EACN,OAAO,IACL,cAAc,GAAG,WAAW,OAAO,KACnC,cAAc,mBAAmB,UAGjC,gBADiB,cAAc,kBAAkB,SACxB,YAAY;EAGvC,OAAO;GACL;GACA;GACA;EACF;CACF;AACF"}
|
package/package.json
CHANGED
package/renovate-schema.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$id": "https://docs.renovatebot.com/renovate-schema.json",
|
|
3
|
-
"title": "JSON schema for Renovate 44.
|
|
3
|
+
"title": "JSON schema for Renovate 44.22.0 config files (https://renovatebot.com/)",
|
|
4
4
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
5
|
-
"x-renovate-version": "44.
|
|
5
|
+
"x-renovate-version": "44.22.0",
|
|
6
6
|
"allowComments": true,
|
|
7
7
|
"type": "object",
|
|
8
8
|
"definitions": {
|