retire 3.0.2 → 3.0.6

package/CHANGELOG.md

@@ -1,67 +1,91 @@
 # Changelog
 
-## [3.0.1]
+## [3.0.6]
+
+### Security
+
+- Switch the `colors` package with `ansi-colors`
+
+## [3.0.4] / [3.0.5]
+
+### Security
+
+- Pin colors dependency to avoid DOS from colors author
+
+## [3.0.3]
+
+### Bug
+
+- Fix version number
+
+## [3.0.2]
 
 ### Dependency update
+
 - always output JSON to stdout, to avoid conflict with deprecation warning
 
 ## [3.0.1]
 
 ### Dependency update
+
 - glob-parent, lodash and hosted-git-info had vulnerabilities and was updated
 
 ## [3.0.0]
 
 ### Deprecation notice
+
 - The node scanner is deprecated: https://github.com/RetireJS/retire.js/wiki/Deprecating-the-node.js-scanner
 
 ## [2.2.5]
 
 ### Dependency update
+
 - y18n had a vulnerability and was updated
 
 ## [2.2.4]
 
 ### Bugfix
+
 - Fixes [#343](https://github.com/RetireJS/retire.js/pull/343) where symlink to nonexistent file causes it to crash with exception. Now it will log it as warn instead.
 
 ## [2.2.3]
 
 ### Bugfix
-- Fixes [#337](https://github.com/RetireJS/retire.js/issues/337) where symlinks are not read
 
+- Fixes [#337](https://github.com/RetireJS/retire.js/issues/337) where symlinks are not read
 
 ## [2.2.2]
 
 ### Bugfix
-- Fixes [#334](https://github.com/RetireJS/retire.js/issues/334) where detected libraries without vulnerabilities show in output even when verbose is not specified
 
+- Fixes [#334](https://github.com/RetireJS/retire.js/issues/334) where detected libraries without vulnerabilities show in output even when verbose is not specified
 
 ## [2.2.1]
 
 ### Bugfix
+
 - Fixes [#321](https://github.com/RetireJS/retire.js/issues/321) where write output to file did not always work as expected
 
-## [2.2.0] 
+## [2.2.0]
 
 ### Added
-- Support `--cacert <path>` or `--insecure` when loading the repos (thanks to [adamcohen](https://github.com/adamcohen)) [PR#322](https://github.com/RetireJS/retire.js/pull/322)
 
+- Support `--cacert <path>` or `--insecure` when loading the repos (thanks to [adamcohen](https://github.com/adamcohen)) [PR#322](https://github.com/RetireJS/retire.js/pull/322)
 
 ## [2.1.1] - 2020-03-20
 
 ### Bugfix
-- Fix compatibility with node 6
 
+- Fix compatibility with node 6
 
 ## [2.1.1] - 2020-03-16
 
 ### Modified
-- Remove `request` as it is deprecated
 
+- Remove `request` as it is deprecated
 
 ## [2.1.0] - 2020-03-16
 
 ### Modified
-- Support ** and * in ignore paths (** = any number of folders)
 
+- Support ** and \* in ignore paths (** = any number of folders)

package/bin/retire

@@ -12,7 +12,7 @@ var utils     = require('../lib/utils'),
     os        = require('os'),
     path      = require('path'),
     fs        = require('fs'),
-    colors    = require('colors/safe'),
+    colors    = require('ansi-colors'),
     emitter   = new require('events').EventEmitter;
 
 var events = new emitter();
@@ -32,9 +32,6 @@ var severityLevels = {
   critical: 4
 };
 
-colors.setTheme({
-  warn: 'red'
-});
 
 
 /*
@@ -80,7 +77,7 @@ if (!config.nocache && !config.cachedir) {
 
 config.ignore = config.ignore ? utils.map(config.ignore.split(','), function(e) { return path.resolve(e); }) : [];
 config.ignore = { paths : config.ignore, descriptors: [] };
-config.colorwarn = config.colors ? colors.warn : x => x;
+config.colorwarn = config.colors ? colors.red : x => x;
 
 if (!config.ignorefile) {
   config.ignorefile = defaultIgnoreFiles.filter(function(x){ return fs.existsSync(x); })[0];
@@ -203,7 +200,7 @@ events.on('scan-js', function() {
 });
 
 events.on('scan-node', function() {
-  console.warn('DEPRECATION NOTICE: The node scanning is deprecated and will be removed soon. See https://github.com/RetireJS/retire.js/wiki/Deprecating-the-node.js-scanner ')
+  console.warn('DEPRECATION NOTICE: The node scanning is deprecated and will be removed soon. See https://github.com/RetireJS/retire.js/wiki/Deprecating-the-node.js-scanner ');
   resolve.getNodeDependencies(config.nodepath || config.path, config.package).on('done', function(dependencies) {
     scanner.scanDependencies(dependencies, nodeRepo, config);
     events.emit('scan-done');

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '3.0.0';
+exports.version = '3.0.6';
 
 function isDefined(o) {
 	return typeof o !== 'undefined';

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "3.0.2",
+  "version": "3.0.6",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -13,16 +13,16 @@
   },
   "main": "./lib/retire.js",
   "dependencies": {
-    "colors": "^1.1.2",
+    "ansi-colors": "^4.1.1",
     "commander": "2.5.x",
     "https-proxy-agent": "^5.0.0",
     "read-installed": "^4.0.3",
     "walkdir": "0.4.1"
   },
   "devDependencies": {
-    "chai": "^4.2.0",
+    "chai": "^4.3.4",
     "jshint": "^2.12.0",
-    "mocha": "^8.1.3"
+    "mocha": "^9.1.3"
   },
   "scripts": {
     "test": "./test"