retire 3.0.1 → 3.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +30 -7
- package/lib/reporters/json.js +1 -2
- package/lib/retire.js +1 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,62 +1,85 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [3.0.4] / [3.0.5]
|
|
4
|
+
|
|
5
|
+
### Security
|
|
6
|
+
|
|
7
|
+
- Pin colors dependency to avoid DOS from colors author
|
|
8
|
+
|
|
9
|
+
## [3.0.3]
|
|
10
|
+
|
|
11
|
+
### Bug
|
|
12
|
+
|
|
13
|
+
- Fix version number
|
|
14
|
+
|
|
15
|
+
## [3.0.2]
|
|
16
|
+
|
|
17
|
+
### Dependency update
|
|
18
|
+
|
|
19
|
+
- always output JSON to stdout, to avoid conflict with deprecation warning
|
|
20
|
+
|
|
3
21
|
## [3.0.1]
|
|
4
22
|
|
|
5
23
|
### Dependency update
|
|
24
|
+
|
|
6
25
|
- glob-parent, lodash and hosted-git-info had vulnerabilities and was updated
|
|
7
26
|
|
|
8
27
|
## [3.0.0]
|
|
9
28
|
|
|
10
29
|
### Deprecation notice
|
|
30
|
+
|
|
11
31
|
- The node scanner is deprecated: https://github.com/RetireJS/retire.js/wiki/Deprecating-the-node.js-scanner
|
|
12
32
|
|
|
13
33
|
## [2.2.5]
|
|
14
34
|
|
|
15
35
|
### Dependency update
|
|
36
|
+
|
|
16
37
|
- y18n had a vulnerability and was updated
|
|
17
38
|
|
|
18
39
|
## [2.2.4]
|
|
19
40
|
|
|
20
41
|
### Bugfix
|
|
42
|
+
|
|
21
43
|
- Fixes [#343](https://github.com/RetireJS/retire.js/pull/343) where symlink to nonexistent file causes it to crash with exception. Now it will log it as warn instead.
|
|
22
44
|
|
|
23
45
|
## [2.2.3]
|
|
24
46
|
|
|
25
47
|
### Bugfix
|
|
26
|
-
- Fixes [#337](https://github.com/RetireJS/retire.js/issues/337) where symlinks are not read
|
|
27
48
|
|
|
49
|
+
- Fixes [#337](https://github.com/RetireJS/retire.js/issues/337) where symlinks are not read
|
|
28
50
|
|
|
29
51
|
## [2.2.2]
|
|
30
52
|
|
|
31
53
|
### Bugfix
|
|
32
|
-
- Fixes [#334](https://github.com/RetireJS/retire.js/issues/334) where detected libraries without vulnerabilities show in output even when verbose is not specified
|
|
33
54
|
|
|
55
|
+
- Fixes [#334](https://github.com/RetireJS/retire.js/issues/334) where detected libraries without vulnerabilities show in output even when verbose is not specified
|
|
34
56
|
|
|
35
57
|
## [2.2.1]
|
|
36
58
|
|
|
37
59
|
### Bugfix
|
|
60
|
+
|
|
38
61
|
- Fixes [#321](https://github.com/RetireJS/retire.js/issues/321) where write output to file did not always work as expected
|
|
39
62
|
|
|
40
|
-
## [2.2.0]
|
|
63
|
+
## [2.2.0]
|
|
41
64
|
|
|
42
65
|
### Added
|
|
43
|
-
- Support `--cacert <path>` or `--insecure` when loading the repos (thanks to [adamcohen](https://github.com/adamcohen)) [PR#322](https://github.com/RetireJS/retire.js/pull/322)
|
|
44
66
|
|
|
67
|
+
- Support `--cacert <path>` or `--insecure` when loading the repos (thanks to [adamcohen](https://github.com/adamcohen)) [PR#322](https://github.com/RetireJS/retire.js/pull/322)
|
|
45
68
|
|
|
46
69
|
## [2.1.1] - 2020-03-20
|
|
47
70
|
|
|
48
71
|
### Bugfix
|
|
49
|
-
- Fix compatibility with node 6
|
|
50
72
|
|
|
73
|
+
- Fix compatibility with node 6
|
|
51
74
|
|
|
52
75
|
## [2.1.1] - 2020-03-16
|
|
53
76
|
|
|
54
77
|
### Modified
|
|
55
|
-
- Remove `request` as it is deprecated
|
|
56
78
|
|
|
79
|
+
- Remove `request` as it is deprecated
|
|
57
80
|
|
|
58
81
|
## [2.1.0] - 2020-03-16
|
|
59
82
|
|
|
60
83
|
### Modified
|
|
61
|
-
- Support ** and * in ignore paths (** = any number of folders)
|
|
62
84
|
|
|
85
|
+
- Support ** and \* in ignore paths (** = any number of folders)
|
package/lib/reporters/json.js
CHANGED
|
@@ -20,9 +20,8 @@ function configureJsonLogger(logger, writer, config) {
|
|
|
20
20
|
};
|
|
21
21
|
logger.close = function(callback) {
|
|
22
22
|
finalResults.time = (Date.now() - scanStart)/1000;
|
|
23
|
-
var write = vulnsFound ? writer.err : writer.out;
|
|
24
23
|
var res = (config.outputformat === "jsonsimple") ? finalResults.data : finalResults;
|
|
25
|
-
|
|
24
|
+
writer.out(JSON.stringify(res));
|
|
26
25
|
writer.close(callback);
|
|
27
26
|
};
|
|
28
27
|
}
|
package/lib/retire.js
CHANGED
package/package.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"author": "Erlend Oftedal <erlend@oftedal.no>",
|
|
3
3
|
"name": "retire",
|
|
4
4
|
"description": "Retire is a tool for detecting use of vulnerable libraries",
|
|
5
|
-
"version": "3.0.
|
|
5
|
+
"version": "3.0.5",
|
|
6
6
|
"license": "Apache-2.0",
|
|
7
7
|
"repository": {
|
|
8
8
|
"type": "git",
|
|
@@ -13,7 +13,7 @@
|
|
|
13
13
|
},
|
|
14
14
|
"main": "./lib/retire.js",
|
|
15
15
|
"dependencies": {
|
|
16
|
-
"colors": "
|
|
16
|
+
"colors": "1.4.0",
|
|
17
17
|
"commander": "2.5.x",
|
|
18
18
|
"https-proxy-agent": "^5.0.0",
|
|
19
19
|
"read-installed": "^4.0.3",
|