retire 3.2.4 → 4.0.1

package/CHANGELOG.md

@@ -1,8 +1,18 @@
 # Changelog
 
-## [3.2.4]
+## [4.0.1]
+
+### Breaking changes
+- Not really a breaking change as the change was introduced in 4.0.0, but node.js >= 14.0.0 is required to run retire.js >= 4.0.0 going forward
+
+## [4.0.0]
+
+### Breaking changes
+- npm scanning no longer supported
+
+### Changes
+- Complete rewrite to typescript
 
-- Bump vulnerable deps
 
 ## [3.2.3]
 

package/README.md

@@ -13,22 +13,13 @@ Usage
 Usage: retire [options]
 
 Options:
-
-  -h, --help               output usage information
   -V, --version            output the version number
-
-  -p, --package            limit node scan to packages where parent is mentioned in package.json (ignore node_modules)
-  -n, --node               Run node dependency scan only
-  -j, --js                 Run scan of JavaScript files only
   -v, --verbose            Show identified files (by default only vulnerable files are shown)
   -x, --dropexternal       Don't include project provided vulnerability repository
   -c, --nocache            Don't use local cache
-
   --jspath <path>          Folder to scan for javascript files
-  --nodepath <path>        Folder to scan for node files
   --path <path>            Folder to scan for both
   --jsrepo <path|url>      Local or internal version of repo
-  --noderepo <path|url>    Local or internal version of repo
   --cachedir <path>        Path to use for local cache instead of /tmp/.retire-cache
   --proxy <url>            Proxy url (http://some.host:8080)
   --outputformat <format>  Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx and cyclonedxJSON
@@ -41,6 +32,7 @@ Options:
   --insecure               Enable fetching remote jsrepo/noderepo files from hosts using an insecure or self-signed SSL (TLS) certificate
   --ext <extensions>       Comman separated list of file extensions for javascript files. The default is "js"
   --cacert <path>          Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files
+  -h, --help               display help for command
 ````
 
 The `depcheck` output format mimics the output of OWASP Dependency Check, but lacks some information compared to OWASP Dependency Check, because that information is not in the repo.

package/lib/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/lib/cli.js

@@ -0,0 +1,195 @@
+#!/usr/bin/env node
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils = __importStar(require("./utils"));
+const commander_1 = require("commander");
+const retire = __importStar(require("./retire"));
+const repo = __importStar(require("./repo"));
+const resolve = __importStar(require("./resolve"));
+const scanner = __importStar(require("./scanner"));
+const reporting = __importStar(require("./reporting"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const ansi_colors_1 = __importDefault(require("ansi-colors"));
+const events_1 = require("events");
+const types_1 = require("./types");
+const z = __importStar(require("zod"));
+const events = new events_1.EventEmitter();
+let failProcess = false;
+const defaultIgnoreFiles = ['.retireignore', '.retireignore.json'];
+if (process.argv.includes("--node") || process.argv.includes("-n")) {
+    console.log("Error: retire.js no longer supports scanning node packages. Use npm audit instead.");
+    process.exit(1);
+}
+/*
+ * Parse command line flags.
+ */
+const prg = commander_1.program
+    .version(retire.version)
+    .option('-v, --verbose', 'Show identified files (by default only vulnerable files are shown)')
+    .option('-x, --dropexternal', "Don't include project provided vulnerability repository")
+    .option('-c, --nocache', "Don't use local cache")
+    .option('--jspath <path>', 'Folder to scan for javascript files')
+    .option('--path <path>', 'Folder to scan for both')
+    .option('--jsrepo <path|url>', 'Local or internal version of repo')
+    .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
+    .option('--proxy <url>', 'Proxy url (http://some.host:8080)')
+    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx and cyclonedxJSON')
+    .option('--outputpath <path>', 'File to which output should be written')
+    .option('--ignore <paths>', 'Comma delimited list of paths to ignore')
+    .option('--ignorefile <path>', 'Custom ignore file, defaults to .retireignore / .retireignore.json')
+    .option('--severity <level>', 'Specify the bug severity level from which the process fails. Allowed levels none, low, medium, high, critical. Default: none')
+    .option('--exitwith <code>', 'Custom exit code (default: 13) when vulnerabilities are found')
+    .option('--colors', 'Enable color output (console output only)')
+    .option('--insecure', 'Enable fetching remote jsrepo/noderepo files from hosts using an insecure or self-signed SSL (TLS) certificate')
+    .option('--ext <extensions>', 'Comman separated list of file extensions for javascript files. The default is "js"')
+    .option('--cacert <path>', 'Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files')
+    .parse()
+    .opts();
+const colorwarn = prg.colors ? ansi_colors_1.default.red : (x) => x;
+const jsrepolocation = (_a = prg.jsrepo) !== null && _a !== void 0 ? _a : "https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json";
+const ignorefile = (_b = prg.ignoreFile) !== null && _b !== void 0 ? _b : defaultIgnoreFiles.filter((x) => fs_1.default.existsSync(x))[0];
+const scanpath = (_c = prg.path) !== null && _c !== void 0 ? _c : ".";
+const log = reporting.open({
+    colors: !!prg.colors,
+    colorwarn,
+    jsRepo: jsrepolocation,
+    outputformat: prg.outputformat,
+    outputpath: prg.outputpath,
+    path: scanpath,
+    verbose: !!prg.verbose
+});
+const severity = (_d = prg.severity) !== null && _d !== void 0 ? _d : "none";
+if (!(severity in types_1.severityLevels)) {
+    exitWithError(`Error: Invalid severity level (${severity}). Valid levels are: ${Object.keys(types_1.severityLevels).join(', ')}`);
+}
+const config = {
+    path: scanpath,
+    ignore: {
+        paths: (_g = (_f = (_e = prg.ignore) === null || _e === void 0 ? void 0 : _e.split(",")) === null || _f === void 0 ? void 0 : _f.map((x) => path_1.default.resolve(x))) !== null && _g !== void 0 ? _g : [],
+        pathsAsString: [],
+        descriptors: []
+    },
+    colorwarn,
+    nocache: prg.nocache ? true : false,
+    cachedir: (_h = prg.cachedir) !== null && _h !== void 0 ? _h : path_1.default.resolve(os_1.default.tmpdir(), '.retire-cache/'),
+    log: log,
+    severity: severity,
+    exitwith: (_j = prg.exitwith) !== null && _j !== void 0 ? _j : 13
+};
+log.info(`retire.js v${retire.version}`);
+function exitWithError(msg) {
+    log.error(config.colorwarn(msg));
+    process.exitCode = 1;
+    log.close();
+}
+if (prg.cacert) {
+    if (!fs_1.default.existsSync(prg.cacert)) {
+        exitWithError(`Error: Could not read cacert file: ${prg.cacert}`);
+    }
+    config.cacertbuf = fs_1.default.readFileSync(prg.cacert);
+}
+const ignoreFileParser = z.array(z.object({
+    justification: z.string()
+}).and(z.object({
+    path: z.string(),
+}).or(z.object({
+    component: z.string(),
+    version: z.string().optional(),
+    identifiers: z.record(z.string(), z.string()).optional(),
+}))));
+if (ignorefile) {
+    if (!fs_1.default.existsSync(ignorefile)) {
+        exitWithError(`Error: Could not read ignore file: ${ignorefile}`);
+    }
+    if (ignorefile.substr(-5) === ".json") {
+        try {
+            config.ignore.descriptors = ignoreFileParser.parse(JSON.parse(fs_1.default.readFileSync(ignorefile, "utf-8")));
+        }
+        catch (e) {
+            exitWithError(`Error: Invalid ignore file: ${ignorefile}`);
+        }
+        const ignoredPaths = (_m = (_l = (_k = config.ignore.descriptors) === null || _k === void 0 ? void 0 : _k.map((x) => "path" in x ? x.path : undefined)) === null || _l === void 0 ? void 0 : _l.filter((x) => x != undefined)) !== null && _m !== void 0 ? _m : [];
+        config.ignore.pathsAsString = config.ignore.pathsAsString.concat(ignoredPaths);
+    }
+    else {
+        const lines = fs_1.default.readFileSync(ignorefile, "utf-8").split(/\r\n|\n/g).filter((e) => e !== '');
+        const ignored = lines.map(e => { return e[0] === '@' ? e.slice(1) : path_1.default.resolve(e); });
+        config.ignore.pathsAsString = config.ignore.pathsAsString.concat(ignored);
+    }
+}
+config.ignore.paths = config.ignore.pathsAsString
+    .map(p => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
+    .map(p => p.replace(/[*]{1,2}/g, (a) => a.length == 2 ? ".*" : "[^/]*"))
+    .map(s => new RegExp(s));
+scanner.on('vulnerable-dependency-found', (result) => {
+    const levels = result.results
+        .map((r) => {
+        return r.vulnerabilities ? r.vulnerabilities.map((v) => {
+            var _a;
+            return types_1.severityLevels[(_a = v.severity) !== null && _a !== void 0 ? _a : 'critical'];
+        }) : [];
+    });
+    const severity = utils.flatten(levels).reduce((x, y) => x > y ? x : y);
+    if (severity >= types_1.severityLevels[config.severity]) {
+        failProcess = true;
+    }
+});
+scanner.on('vulnerable-dependency-found', log.logVulnerableDependency);
+scanner.on('dependency-found', log.logDependency);
+events.on('scan-done', () => {
+    process.exitCode = failProcess ? config.exitwith : 0;
+    log.close();
+});
+process.on('uncaughtException', (err, ...rest) => {
+    console.warn('Exception caught: ', err, rest);
+    console.warn(err.stack);
+    process.exit(1);
+});
+events.on('stop', (err) => {
+    exitWithError(err);
+});
+(jsrepolocation.match(/^https?:\/\//)
+    ? repo.loadrepository(jsrepolocation, config)
+    : repo.loadrepositoryFromFile(jsrepolocation, config))
+    .then((jsRepo) => {
+    resolve.scanJsFiles(config.path, config)
+        .on('jsfile', (file) => {
+        scanner.scanJsFile(file, jsRepo, config);
+    })
+        .on('bowerfile', (bowerfile) => {
+        const bowerRepo = repo.asbowerrepo(jsRepo);
+        scanner.scanBowerFile(bowerfile, bowerRepo, config);
+    })
+        .on('end', () => {
+        events.emit('scan-done');
+    });
+}).catch((e) => events.emit('stop', e));

package/lib/repo.d.ts

@@ -0,0 +1,4 @@
+import { Options, Repository } from "./types";
+export declare function asbowerrepo(jsRepo: Repository): Repository;
+export declare function loadrepository(repoUrl: string, options: Options): Promise<Repository>;
+export declare function loadrepositoryFromFile(filepath: string, options: Options): Promise<Repository>;

package/lib/repo.js

@@ -1,112 +1,157 @@
-/* global require, exports */
-/*jshint esversion: 6 */
-var utils   = require('./utils'),
-    fs      = require('fs'),
-    path    = require('path'),
-    forward = require('../lib/utils').forwardEvent,
-    http    = require('http'),
-    https   = require('https'),
-    retire  = require('./retire'),
-    URL     = require('url'),
-    ProxyAgent = require('proxy-agent');
-
-var emitter = require('events').EventEmitter;
-
-
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadrepositoryFromFile = exports.loadrepository = exports.asbowerrepo = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const retire = __importStar(require("./retire"));
+const URL = __importStar(require("url"));
+const proxy_agent_1 = __importDefault(require("proxy-agent"));
 function loadJson(url, options) {
-  var events = new emitter();
-  options.log.info('Downloading ' + url + ' ...');
-  var reqOptions = Object.assign({}, URL.parse(url), { method: 'GET' });
-  var proxyUri = options.proxy || process.env.http_proxy;
-  if (proxyUri) {
-    reqOptions.agent = new ProxyAgent(proxyUri);
-  }
-  if (options.insecure) {
-    reqOptions.rejectUnauthorized = false;
-  }
-  if (options.cacertbuf) {
-    reqOptions.ca = [ options.cacertbuf ];
-  }
-  var req = (url.startsWith("http:") ? http : https).get(reqOptions, function (res) {
-    if (res.statusCode != 200) return events.emit('stop', 'Error downloading: ' + url + ": HTTP " + res.statusCode + " " + res.statusText);
-    var data = [];
-    res.on('data', c => data.push(c));
-    res.on('end', () => {
-        var d = Buffer.concat(data).toString();
-        d = options.process ? options.process(d) : d;
-        events.emit('done', JSON.parse(d));
+    return __awaiter(this, void 0, void 0, function* () {
+        return new Promise((resolve, reject) => {
+            options.log.info('Downloading ' + url + ' ...');
+            const reqOptions = Object.assign(Object.assign({}, URL.parse(url)), { method: 'GET' });
+            const proxyUri = options.proxy || process.env.http_proxy;
+            if (proxyUri) {
+                reqOptions.agent = new proxy_agent_1.default(proxyUri);
+            }
+            if (options.insecure) {
+                reqOptions.rejectUnauthorized = false;
+            }
+            if (options.cacertbuf) {
+                reqOptions.ca = [options.cacertbuf];
+            }
+            const req = (url.startsWith("http:") ? http : https).get(reqOptions, (res) => {
+                if (res.statusCode != 200)
+                    return reject(`Error downloading: ${url}: HTTP ${res.statusCode} ${res.statusMessage}`);
+                const data = [];
+                res.on('data', c => data.push(c));
+                res.on('end', () => {
+                    let d = Buffer.concat(data).toString();
+                    d = options.process ? options.process(d) : d;
+                    resolve(JSON.parse(d));
+                });
+            });
+            req.on('error', e => reject(`Error downloading: ${url}: ${e}`));
+            req.end();
+        });
     });
-  });
-  req.on('error', e => events.emit('stop', 'Error downloading: ' + url + ": " + e.toString()));
-  req.end();
-  return events;
 }
-
 function loadJsonFromFile(file, options) {
-  options.log.debug('Reading ' + file + ' ...');
-  var events = new emitter();
-  fs.readFile(file, { encoding : 'utf8'}, function(err, data) {
-    if (err) { return events.emit('stop', err.toString()); }
-    data = options.process ? options.process(data) : data;
-    var obj = JSON.parse(data);
-    events.emit('done', obj);
-  });
-  return events;
+    return __awaiter(this, void 0, void 0, function* () {
+        options.log.debug('Reading ' + file + ' ...');
+        return new Promise((resolve, reject) => {
+            fs.readFile(file, { encoding: 'utf8' }, (err, data) => {
+                if (err) {
+                    return reject(err.toString());
+                }
+                data = options.process ? options.process(data) : data;
+                resolve(JSON.parse(data));
+            });
+        });
+    });
 }
-
 function loadFromCache(url, cachedir, options) {
-  var cacheIndex = path.resolve(cachedir, 'index.json');
-  if (!fs.existsSync(cachedir)) fs.mkdirSync(cachedir);
-  var cache = fs.existsSync(cacheIndex) ? JSON.parse(fs.readFileSync(cacheIndex)) : {};
-  var now = new Date().getTime();
-  if (cache[url]) {
-    if (now - cache[url].date < 60*60*1000) {
-      options.log.info('Loading from cache: ' + url);
-      return loadJsonFromFile(path.resolve(cachedir, cache[url].file), options);
-    } else {
-      if (fs.existsSync(path.resolve(cachedir, cache[url].date + '.json'))) {
-        try {
-          fs.unlinkSync(path.resolve(cachedir, cache[url].date + '.json'));
-        } catch (error) {
-          if (error.code !== 'ENOENT') {
-            throw error;
-          } else {
-            console.warn("Could not delete cache. Ignore this error if you are running multiple retire.js in parallel");
-          }
+    return __awaiter(this, void 0, void 0, function* () {
+        const cacheIndex = path.resolve(cachedir, 'index.json');
+        if (!fs.existsSync(cachedir))
+            fs.mkdirSync(cachedir);
+        const cache = fs.existsSync(cacheIndex) ? JSON.parse(fs.readFileSync(cacheIndex, "utf-8")) : {};
+        const now = new Date().getTime();
+        if (cache[url]) {
+            if (now - cache[url].date < 60 * 60 * 1000) {
+                options.log.info('Loading from cache: ' + url);
+                return loadJsonFromFile(path.resolve(cachedir, cache[url].file), options);
+            }
+            else {
+                if (fs.existsSync(path.resolve(cachedir, cache[url].date + '.json'))) {
+                    try {
+                        fs.unlinkSync(path.resolve(cachedir, cache[url].date + '.json'));
+                    }
+                    catch (error) {
+                        if (error != null && typeof error == "object" && "code" in error && error.code !== 'ENOENT') {
+                            throw error;
+                        }
+                        else {
+                            console.warn("Could not delete cache. Ignore this error if you are running multiple retire.js in parallel");
+                        }
+                    }
+                }
+            }
         }
-      }
-    }
-  }
-  var events = new emitter();
-  loadJson(url, options).on('done', function(data) {
-    cache[url] = { date : now, file : now + '.json' };
-    fs.writeFileSync(path.resolve(cachedir, cache[url].file), JSON.stringify(data), { encoding : 'utf8' });
-    fs.writeFileSync(cacheIndex, JSON.stringify(cache), { encoding : 'utf8' });
-    events.emit('done', data);
-  }).on('stop', forward(events, 'stop'));
-  return events;
+        const data = yield loadJson(url, options);
+        cache[url] = { date: now, file: now + '.json' };
+        fs.writeFileSync(path.resolve(cachedir, cache[url].file), JSON.stringify(data), { encoding: 'utf8' });
+        fs.writeFileSync(cacheIndex, JSON.stringify(cache), { encoding: 'utf8' });
+        return data;
+    });
 }
-
-exports.asbowerrepo = function(jsRepo) {
-  var result = {};
-  Object.keys(jsRepo).map(function(k) {
-    (jsRepo[k].bowername || [k]).map(function(b) {
-      result[b] = result[b] || { vulnerabilities: [] };
-      result[b].vulnerabilities = result[b].vulnerabilities.concat(jsRepo[k].vulnerabilities);
+function asbowerrepo(jsRepo) {
+    const result = {};
+    Object.keys(jsRepo).map((k) => {
+        ([jsRepo[k].bowername || k]).map((b) => {
+            result[b] = result[b] || { vulnerabilities: [] };
+            result[b].vulnerabilities = result[b].vulnerabilities.concat(jsRepo[k].vulnerabilities);
+        });
     });
-  });
-  return result;
-};
-
-exports.loadrepository = function(repoUrl, options) {
-  options = utils.extend(options, { process : retire.replaceVersion });
-  if (options.nocache) {
-    return loadJson(repoUrl, options);
-  }
-  return loadFromCache(repoUrl, options.cachedir, options);
-};
-
-exports.loadrepositoryFromFile = function(filepath, options) {
-  options = utils.extend(options, { process : retire.replaceVersion });
-  return loadJsonFromFile(filepath, options);
-};
+    return result;
+}
+exports.asbowerrepo = asbowerrepo;
+;
+function loadrepository(repoUrl, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        //options = utils.extend(options, { process : retire.replaceVersion });
+        options = Object.assign(Object.assign({}, options), { process: retire.replaceVersion });
+        if (options.nocache) {
+            return yield loadJson(repoUrl, options);
+        }
+        return yield loadFromCache(repoUrl, options.cachedir, options);
+    });
+}
+exports.loadrepository = loadrepository;
+;
+function loadrepositoryFromFile(filepath, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        options = Object.assign(Object.assign({}, options), { process: retire.replaceVersion });
+        return yield loadJsonFromFile(filepath, options);
+    });
+}
+exports.loadrepositoryFromFile = loadrepositoryFromFile;
+;

package/lib/reporters/console.d.ts

@@ -0,0 +1,3 @@
+import { type ConfigurableLogger } from "../reporting";
+declare const _default: ConfigurableLogger;
+export default _default;

package/lib/reporters/console.js

@@ -1,43 +1,70 @@
-var retire = require('../retire');
-var utils = require('../utils');
-
-
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const retire = __importStar(require("../retire"));
+const utils = __importStar(require("../utils"));
 function printResults(logger, finding, config) {
-  if (finding.results && finding.results.length > 0) {
-    var logFunc = retire.isVulnerable(finding.results) ? logger.warn : logger.info;
-    var printed = {};
-    finding.results.forEach(function(elm) {
-      if (!config.verbose && !retire.isVulnerable([elm])) return;
-      var key = elm.component + ' ' + elm.version;
-      logFunc(finding.file);
-      logFunc(' ' + String.fromCharCode(8627) + ' ' + key);
-      if (printed[key]) return;
-      if (retire.isVulnerable([elm])) {
-        logFunc(key + ' has known vulnerabilities:' + printVulnerability(logger, elm, config));
-      }
-      printed[key] = true;
+    if (finding.results && finding.results.length > 0) {
+        const logFunc = retire.isVulnerable(finding.results) ? logger.warn : logger.info;
+        const printed = new Set();
+        finding.results.forEach((elm) => {
+            if (!config.verbose && !retire.isVulnerable([elm]))
+                return;
+            const key = `${elm.component} ${elm.version}`;
+            logFunc(finding.file);
+            logFunc(` ${String.fromCharCode(8627)} ${key}`);
+            if (printed.has(key))
+                return;
+            if (retire.isVulnerable([elm])) {
+                logFunc(`${key} has known vulnerabilities:${printVulnerability(elm, config)}`);
+            }
+            printed.add(key);
+        });
+    }
+}
+function printVulnerability(component, config) {
+    var _a;
+    let string = '';
+    (_a = component.vulnerabilities) === null || _a === void 0 ? void 0 : _a.forEach((vulnerability) => {
+        string += config.outputformat === 'clean' ? '\n   ' : ' ';
+        if (vulnerability.severity) {
+            string += `severity: ${vulnerability.severity}; `;
+        }
+        if (vulnerability.identifiers) {
+            string += Object.entries(vulnerability.identifiers).map(([id, name]) => {
+                return `${name}: ${utils.flatten([[id]]).join(' ')}`;
+            }).join(', ') + '; ';
+        }
+        string += vulnerability.info.join(config.outputformat === 'clean' ? '\n' : ' ');
     });
-  }
+    return string;
 }
-
-function printVulnerability(logger, component, config) {
-  var string = '';
-  component.vulnerabilities.forEach(function(vulnerability){
-    string += config.outputformat === 'clean' ? '\n   ' : ' ';
-    if (vulnerability.severity) {
-      string += 'severity: ' + vulnerability.severity + '; ';
+exports.default = {
+    configure: (logger, _, config) => {
+        logger.logDependency = (finding) => { if (config.verbose)
+            printResults(logger, finding, config); };
+        logger.logVulnerableDependency = (component) => { printResults(logger, component, config); };
     }
-    if (vulnerability.identifiers) {
-      string += utils.map(vulnerability.identifiers, function(id, name) {
-        return name + ': ' + utils.flatten([id]).join(' ');
-      }).join(', ') + '; ';
-    }
-    string += vulnerability.info.join(config.outputformat === 'clean' ? '\n' : ' ');
-  });
-  return string;
-}
-
-exports.configure = function(logger, writer, config, hash) {
-    logger.logDependency = function(finding) { if (config.verbose) printResults(logger, finding, config); };
-    logger.logVulnerableDependency = function(component) { printResults(logger, component, config); };
-};
+};

package/lib/reporters/cyclonedx-json.d.ts

@@ -0,0 +1,3 @@
+import { ConfigurableLogger } from "../reporting";
+declare const _default: ConfigurableLogger;
+export default _default;