retire 3.2.0 → 3.2.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [3.2.2]
+
+- Fix bug in CycloneDX JSON output (wrapped components array)
+
+## [3.2.1]
+
+- Remove unintended use of arrow functions
+
 ## [3.2.0]
 
 - Add `--ext` to allow specifying other file extensions

package/lib/reporters/cyclonedx-json.js

@@ -26,8 +26,17 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
         var seen = {};
         var components = finalResults.data.filter(d => d.results).map(r => r.results.map(dep => {
             dep.version = (dep.version.split(".").length >= 3 ? dep.version : dep.version + ".0").replace(/-/g, ".");
+            var hashes;
             var filepath = r.file || dep.file;
-            var file = fs.readFileSync(filepath);
+            if (filepath) {
+                var file = fs.readFileSync(filepath);
+                hashes = [
+                    { "alg" : "MD5", "content" : hash.md5(file) },
+                    { "alg" : "SHA-1", "content" : hash.sha1(file) },
+                    { "alg" : "SHA-256", "content" : hash.sha256(file) },
+                    { "alg" : "SHA-512", "content" : hash.sha512(file) },
+                ];
+            }
             var purl = `pkg:npm/${dep.component}@${dep.version}`;
             if (seen[purl]) return '';
             seen[purl] = true;
@@ -36,14 +45,9 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 name: dep.component,
                 version: dep.version,
                 purl: purl,
-                hashes: [
-                    { "alg" : "MD5", "content" : hash.md5(file) },
-                    { "alg" : "SHA-1", "content" : hash.sha1(file) },
-                    { "alg" : "SHA-256", "content" : hash.sha256(file) },
-                    { "alg" : "SHA-512", "content" : hash.sha512(file) },
-                ]
+                hashes: hashes
             };
-        }));
+        })).reduce((a,b) => a.concat(b));
         write(JSON.stringify({
             bomFormat    : "CycloneDX",
             specVersion  : "1.4",

package/lib/reporters/cyclonedx.js

@@ -27,21 +27,25 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
       var components = finalResults.data.filter(d => d.results).map(r => r.results.map(dep => {
           dep.version = (dep.version.split(".").length >= 3 ? dep.version : dep.version + ".0").replace(/-/g, ".");
           var filepath = r.file || dep.file;
-          var filename = filepath.split("/").slice(-1);
-          var file = fs.readFileSync(filepath);
+          if (filepath) {
+            var filename = filepath.split("/").slice(-1);
+            var file = fs.readFileSync(filepath);
+              hashes = `
+          <hashes>
+            <hash alg="MD5">${hash.md5(file)}</hash>
+            <hash alg="SHA-1">${hash.sha1(file)}</hash>
+            <hash alg="SHA-256">${hash.sha256(file)}</hash>
+            <hash alg="SHA-512">${hash.sha512(file)}</hash>
+          </hashes>`;
+          }
           var purl = `pkg:npm/${dep.component}@${dep.version}`;
+          var hashes = "";
           if (seen[purl]) return '';
           seen[purl] = true;
           return `
     <component type="library">
       <name>${dep.component}</name>
-      <version>${dep.version}</version>
-      <hashes>
-        <hash alg="MD5">${hash.md5(file)}</hash>
-        <hash alg="SHA-1">${hash.sha1(file)}</hash>
-        <hash alg="SHA-256">${hash.sha256(file)}</hash>
-        <hash alg="SHA-512">${hash.sha512(file)}</hash>
-      </hashes>
+      <version>${dep.version}</version>${hashes}
       <purl>${purl}</purl>
       <modified>false</modified>
     </component>`;

package/lib/resolve.js

@@ -69,9 +69,9 @@ function getNodeDependencies(path, limit) {
 
 function scanJsFiles(path, options) {
 	var finder = walkdir.find(path, { "follow_symlinks" : false, "no_return": true });
-	var ext = (options.ext || "js").split(",").map(e => "." + e);
+	var ext = (options.ext || "js").split(",").map(function(e) { return  "." + e; });
 	function onFile(file){
-		if (ext.some(e => file.endsWith(e))) {
+		if (ext.some(function(e) { return file.endsWith(e); })) {
 			finder.emit('jsfile', file);
 		}
 		if (file.match(/\/bower.json$/)) {

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '3.2.0';
+exports.version = '3.2.2';
 
 function isDefined(o) {
 	return typeof o !== 'undefined';

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "3.2.0",
+  "version": "3.2.2",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",