retire 4.1.0 → 4.1.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [4.1.1]
+
+### Bugfixes
+- Handle error if OSV does not have library or version
 
 ## [4.1.0]
 

package/lib/depsdev.js

@@ -19,6 +19,11 @@ function loadJson(url, options) {
     options.log.debug("Downloading " + url + " ...");
     return new Promise((resolve, reject) => {
         const req = https_1.default.request(url, res => {
+            if (res.statusCode == 404)
+                return resolve(undefined);
+            if (res.statusCode != 200) {
+                return reject("HTTP " + res.statusCode + " " + res.statusMessage + " for " + url);
+            }
             const data = [];
             res.on('data', c => data.push(c));
             res.on('end', () => {
@@ -46,6 +51,8 @@ function loadAdvisory(packageName, version, id, options) {
     return __awaiter(this, void 0, void 0, function* () {
         const osvAdvisory = yield loadJson(`https://api.osv.dev/v1/vulns/${id}`, options);
         const advisory = yield loadJson(`https://api.deps.dev/v3alpha/advisories/${id}`, options);
+        if (!advisory || !osvAdvisory)
+            return [];
         const simplifiedRepo = {
             [packageName]: {
                 vulnerabilities: osvAdvisory.affected.map(({ ranges }) => ranges.map(({ events }) => ({
@@ -67,12 +74,20 @@ function loadAdvisory(packageName, version, id, options) {
 }
 function checkOSV(packageName, version, options) {
     return __awaiter(this, void 0, void 0, function* () {
-        const versionInfo = yield getVulnerabilities(packageName, version, options);
-        if (versionInfo.advisoryKeys.length == 0)
+        try {
+            const versionInfo = yield getVulnerabilities(packageName, version, options);
+            if (!versionInfo)
+                return [];
+            if (versionInfo.advisoryKeys.length == 0)
+                return [];
+            const comps = yield Promise.all(versionInfo.advisoryKeys.map(({ id }) => loadAdvisory(packageName, version, id, options)));
+            const flattened = comps.reduce((a, b) => a.concat(b), []);
+            return flattened.map(x => { var _a; return (_a = x.vulnerabilities) !== null && _a !== void 0 ? _a : []; }).reduce((a, b) => a.concat(b), []);
+        }
+        catch (e) {
+            options.log.warn("Error checking OSV: " + e);
             return [];
-        const comps = yield Promise.all(versionInfo.advisoryKeys.map(({ id }) => loadAdvisory(packageName, version, id, options)));
-        const flattened = comps.reduce((a, b) => a.concat(b), []);
-        return flattened.map(x => { var _a; return (_a = x.vulnerabilities) !== null && _a !== void 0 ? _a : []; }).reduce((a, b) => a.concat(b), []);
+        }
     });
 }
 exports.checkOSV = checkOSV;

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '4.1.0';
+exports.version = '4.1.1';
 
 function isDefined(o) {
 	return typeof o !== 'undefined';

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "4.1.0",
+  "version": "4.1.1",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",