retire 4.1.0 → 4.2.0

package/CHANGELOG.md

@@ -1,28 +1,48 @@
 # Changelog
 
+## [4.2.0]
+
+### Changes
+
+- Use prettier to get formatting of code
+- Add provenance
+
+## Security fixes
+
+- Upgrade dependencies
+
+## [4.1.1]
+
+### Bugfixes
+
+- Handle error if OSV does not have library or version
 
 ## [4.1.0]
 
 ### Additions
+
 - Option to check results for the component from OSV
 - Option to use more than one JS repository
 
 ### Bugfixes
+
 - Remove dropexternal as it never worked
 
 ## [4.0.1]
 
 ### Breaking changes
+
 - Not really a breaking change as the change was introduced in 4.0.0, but node.js >= 14.0.0 is required to run retire.js >= 4.0.0 going forward
 
 ## [4.0.0]
 
 ### Breaking changes
+
 - npm scanning no longer supported
 
 ### Changes
-- Complete rewrite to typescript
 
+- Complete rewrite to typescript
 
 ## [3.2.3]
 
@@ -64,7 +84,6 @@
 
 - Updating proxy library to fix proxy issues
 
-
 ## [3.0.6]
 
 ### Security

package/lib/cli.js

@@ -45,8 +45,8 @@ const z = __importStar(require("zod"));
 const events = new events_1.EventEmitter();
 let failProcess = false;
 const defaultIgnoreFiles = ['.retireignore', '.retireignore.json'];
-if (process.argv.includes("--node") || process.argv.includes("-n")) {
-    console.log("Error: retire.js no longer supports scanning node packages. Use npm audit instead.");
+if (process.argv.includes('--node') || process.argv.includes('-n')) {
+    console.log('Error: retire.js no longer supports scanning node packages. Use npm audit instead.');
     process.exit(1);
 }
 /*
@@ -58,7 +58,7 @@ const prg = commander_1.program
     .option('-c, --nocache', "Don't use local cache")
     .option('--jspath <path>', 'Folder to scan for javascript files')
     .option('--path <path>', 'Folder to scan for both')
-    .option('--jsrepo <path|url>', 'Local or internal version of repo. Can be multiple comma separated. Default: \'central\')')
+    .option('--jsrepo <path|url>', "Local or internal version of repo. Can be multiple comma separated. Default: 'central')")
     .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
     .option('--proxy <url>', 'Proxy url (http://some.host:8080)')
     .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx and cyclonedxJSON')
@@ -75,29 +75,30 @@ const prg = commander_1.program
     .parse()
     .opts();
 const colorwarn = prg.colors ? ansi_colors_1.default.red : (x) => x;
-const jsrepolocation = ((_a = prg.jsrepo) !== null && _a !== void 0 ? _a : "'central'").split(",")
-    .map((x) => x === "'central'" ? "https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json" : x);
+const jsrepolocation = ((_a = prg.jsrepo) !== null && _a !== void 0 ? _a : "'central'")
+    .split(',')
+    .map((x) => x === "'central'" ? 'https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json' : x);
 const ignorefile = (_b = prg.ignoreFile) !== null && _b !== void 0 ? _b : defaultIgnoreFiles.filter((x) => fs_1.default.existsSync(x))[0];
-const scanpath = (_c = prg.path) !== null && _c !== void 0 ? _c : ".";
+const scanpath = (_c = prg.path) !== null && _c !== void 0 ? _c : '.';
 const log = reporting.open({
     colors: !!prg.colors,
     colorwarn,
-    jsRepo: jsrepolocation.join(", "),
+    jsRepo: jsrepolocation.join(', '),
     outputformat: prg.outputformat,
     outputpath: prg.outputpath,
     path: scanpath,
     verbose: !!prg.verbose,
 });
-const severity = (_d = prg.severity) !== null && _d !== void 0 ? _d : "none";
+const severity = (_d = prg.severity) !== null && _d !== void 0 ? _d : 'none';
 if (!(severity in types_1.severityLevels)) {
     exitWithError(`Error: Invalid severity level (${severity}). Valid levels are: ${Object.keys(types_1.severityLevels).join(', ')}`);
 }
 const config = {
     path: scanpath,
     ignore: {
-        paths: (_g = (_f = (_e = prg.ignore) === null || _e === void 0 ? void 0 : _e.split(",")) === null || _f === void 0 ? void 0 : _f.map((x) => path_1.default.resolve(x))) !== null && _g !== void 0 ? _g : [],
+        paths: (_g = (_f = (_e = prg.ignore) === null || _e === void 0 ? void 0 : _e.split(',')) === null || _f === void 0 ? void 0 : _f.map((x) => path_1.default.resolve(x))) !== null && _g !== void 0 ? _g : [],
         pathsAsString: [],
-        descriptors: []
+        descriptors: [],
     },
     colorwarn,
     nocache: prg.nocache ? true : false,
@@ -120,11 +121,15 @@ if (prg.cacert) {
     }
     config.cacertbuf = fs_1.default.readFileSync(prg.cacert);
 }
-const ignoreFileParser = z.array(z.object({
-    justification: z.string()
-}).and(z.object({
+const ignoreFileParser = z.array(z
+    .object({
+    justification: z.string(),
+})
+    .and(z
+    .object({
     path: z.string(),
-}).or(z.object({
+})
+    .or(z.object({
     component: z.string(),
     version: z.string().optional(),
     identifiers: z.record(z.string(), z.string()).optional(),
@@ -133,35 +138,41 @@ if (ignorefile) {
     if (!fs_1.default.existsSync(ignorefile)) {
         exitWithError(`Error: Could not read ignore file: ${ignorefile}`);
     }
-    if (ignorefile.substr(-5) === ".json") {
+    if (ignorefile.substr(-5) === '.json') {
         try {
-            config.ignore.descriptors = ignoreFileParser.parse(JSON.parse(fs_1.default.readFileSync(ignorefile, "utf-8")));
+            config.ignore.descriptors = ignoreFileParser.parse(JSON.parse(fs_1.default.readFileSync(ignorefile, 'utf-8')));
         }
         catch (e) {
             exitWithError(`Error: Invalid ignore file: ${ignorefile}`);
         }
-        const ignoredPaths = (_m = (_l = (_k = config.ignore.descriptors) === null || _k === void 0 ? void 0 : _k.map((x) => "path" in x ? x.path : undefined)) === null || _l === void 0 ? void 0 : _l.filter((x) => x != undefined)) !== null && _m !== void 0 ? _m : [];
+        const ignoredPaths = (_m = (_l = (_k = config.ignore.descriptors) === null || _k === void 0 ? void 0 : _k.map((x) => ('path' in x ? x.path : undefined))) === null || _l === void 0 ? void 0 : _l.filter((x) => x != undefined)) !== null && _m !== void 0 ? _m : [];
         config.ignore.pathsAsString = config.ignore.pathsAsString.concat(ignoredPaths);
     }
     else {
-        const lines = fs_1.default.readFileSync(ignorefile, "utf-8").split(/\r\n|\n/g).filter((e) => e !== '');
-        const ignored = lines.map(e => { return e[0] === '@' ? e.slice(1) : path_1.default.resolve(e); });
+        const lines = fs_1.default
+            .readFileSync(ignorefile, 'utf-8')
+            .split(/\r\n|\n/g)
+            .filter((e) => e !== '');
+        const ignored = lines.map((e) => {
+            return e[0] === '@' ? e.slice(1) : path_1.default.resolve(e);
+        });
         config.ignore.pathsAsString = config.ignore.pathsAsString.concat(ignored);
     }
 }
 config.ignore.paths = config.ignore.pathsAsString
-    .map(p => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
-    .map(p => p.replace(/[*]{1,2}/g, (a) => a.length == 2 ? ".*" : "[^/]*"))
-    .map(s => new RegExp(s));
+    .map((p) => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
+    .map((p) => p.replace(/[*]{1,2}/g, (a) => (a.length == 2 ? '.*' : '[^/]*')))
+    .map((s) => new RegExp(s));
 scanner.on('vulnerable-dependency-found', (result) => {
-    const levels = result.results
-        .map((r) => {
-        return r.vulnerabilities ? r.vulnerabilities.map((v) => {
-            var _a;
-            return types_1.severityLevels[(_a = v.severity) !== null && _a !== void 0 ? _a : 'critical'];
-        }) : [];
+    const levels = result.results.map((r) => {
+        return r.vulnerabilities
+            ? r.vulnerabilities.map((v) => {
+                var _a;
+                return types_1.severityLevels[(_a = v.severity) !== null && _a !== void 0 ? _a : 'critical'];
+            })
+            : [];
     });
-    const severity = utils.flatten(levels).reduce((x, y) => x > y ? x : y);
+    const severity = utils.flatten(levels).reduce((x, y) => (x > y ? x : y));
     if (severity >= types_1.severityLevels[config.severity]) {
         failProcess = true;
     }
@@ -180,10 +191,10 @@ process.on('uncaughtException', (err, ...rest) => {
 events.on('stop', (err) => {
     exitWithError(err);
 });
-Promise.all(jsrepolocation.map((jsr) => (jsr.match(/^https?:\/\//)
-    ? repo.loadrepository(jsr, config)
-    : repo.loadrepositoryFromFile(jsr, config)))).then((jsRepos) => {
-    resolve.scanJsFiles(config.path, config)
+Promise.all(jsrepolocation.map((jsr) => jsr.match(/^https?:\/\//) ? repo.loadrepository(jsr, config) : repo.loadrepositoryFromFile(jsr, config)))
+    .then((jsRepos) => {
+    resolve
+        .scanJsFiles(config.path, config)
         .on('jsfile', (file) => {
         jsRepos.forEach((jsRepo) => {
             scanner.scanJsFile(file, jsRepo, config);
@@ -198,4 +209,5 @@ Promise.all(jsrepolocation.map((jsr) => (jsr.match(/^https?:\/\//)
         .on('end', () => {
         events.emit('scan-done');
     });
-}).catch((e) => events.emit('stop', e));
+})
+    .catch((e) => events.emit('stop', e));

package/lib/depsdev.d.ts

@@ -1,3 +1,3 @@
-import { Options } from "./types";
-import { Vulnerability } from "./types";
+import { Options } from './types';
+import { Vulnerability } from './types';
 export declare function checkOSV(packageName: string, version: string, options: Options): Promise<Vulnerability[]>;

package/lib/depsdev.js

@@ -16,17 +16,22 @@ exports.checkOSV = void 0;
 const https_1 = __importDefault(require("https"));
 const retire_1 = require("./retire");
 function loadJson(url, options) {
-    options.log.debug("Downloading " + url + " ...");
+    options.log.debug('Downloading ' + url + ' ...');
     return new Promise((resolve, reject) => {
-        const req = https_1.default.request(url, res => {
+        const req = https_1.default.request(url, (res) => {
+            if (res.statusCode == 404)
+                return resolve(undefined);
+            if (res.statusCode != 200) {
+                return reject('HTTP ' + res.statusCode + ' ' + res.statusMessage + ' for ' + url);
+            }
             const data = [];
-            res.on('data', c => data.push(c));
+            res.on('data', (c) => data.push(c));
             res.on('end', () => {
                 const result = Buffer.concat(data).toString();
                 resolve(JSON.parse(result));
             });
         });
-        req.on('error', err => {
+        req.on('error', (err) => {
             reject(err);
         });
         req.end();
@@ -37,42 +42,58 @@ function getVulnerabilities(packageName, version, options) {
 }
 function scoreToSeverity(score) {
     if (score > 7)
-        return "high";
+        return 'high';
     if (score > 4)
-        return "medium";
-    return "low";
+        return 'medium';
+    return 'low';
 }
 function loadAdvisory(packageName, version, id, options) {
     return __awaiter(this, void 0, void 0, function* () {
         const osvAdvisory = yield loadJson(`https://api.osv.dev/v1/vulns/${id}`, options);
         const advisory = yield loadJson(`https://api.deps.dev/v3alpha/advisories/${id}`, options);
+        if (!advisory || !osvAdvisory)
+            return [];
         const simplifiedRepo = {
             [packageName]: {
-                vulnerabilities: osvAdvisory.affected.map(({ ranges }) => ranges.map(({ events }) => ({
-                    atOrAbove: events[0].introduced,
-                    below: events[0].fixed,
-                    severity: scoreToSeverity(advisory.cvss3Score),
-                    identifiers: {
-                        githubID: id,
-                        CVE: osvAdvisory.aliases.filter(x => x.startsWith("CVE-")),
-                        summary: advisory.title
-                    },
-                    info: osvAdvisory.references.map(({ url }) => url)
-                }))).reduce((a, b) => a.concat(b), []),
-                extractors: {}
-            }
+                vulnerabilities: osvAdvisory.affected
+                    .map(({ ranges }) => ranges.map(({ events }) => {
+                    var _a, _b;
+                    return ({
+                        atOrAbove: events[0].introduced,
+                        below: events[0].fixed,
+                        severity: scoreToSeverity(advisory.cvss3Score),
+                        cwe: (_b = (_a = osvAdvisory.database_specific) === null || _a === void 0 ? void 0 : _a.cwe_ids) !== null && _b !== void 0 ? _b : [],
+                        identifiers: {
+                            githubID: id,
+                            CVE: osvAdvisory.aliases.filter((x) => x.startsWith('CVE-')),
+                            summary: advisory.title,
+                        },
+                        info: osvAdvisory.references.map(({ url }) => url),
+                    });
+                }))
+                    .reduce((a, b) => a.concat(b), []),
+                extractors: {},
+            },
         };
         return (0, retire_1.check)(packageName, version, simplifiedRepo);
     });
 }
 function checkOSV(packageName, version, options) {
     return __awaiter(this, void 0, void 0, function* () {
-        const versionInfo = yield getVulnerabilities(packageName, version, options);
-        if (versionInfo.advisoryKeys.length == 0)
+        try {
+            const versionInfo = yield getVulnerabilities(packageName, version, options);
+            if (!versionInfo)
+                return [];
+            if (versionInfo.advisoryKeys.length == 0)
+                return [];
+            const comps = yield Promise.all(versionInfo.advisoryKeys.map(({ id }) => loadAdvisory(packageName, version, id, options)));
+            const flattened = comps.reduce((a, b) => a.concat(b), []);
+            return flattened.map((x) => { var _a; return (_a = x.vulnerabilities) !== null && _a !== void 0 ? _a : []; }).reduce((a, b) => a.concat(b), []);
+        }
+        catch (e) {
+            options.log.warn('Error checking OSV: ' + e);
             return [];
-        const comps = yield Promise.all(versionInfo.advisoryKeys.map(({ id }) => loadAdvisory(packageName, version, id, options)));
-        const flattened = comps.reduce((a, b) => a.concat(b), []);
-        return flattened.map(x => { var _a; return (_a = x.vulnerabilities) !== null && _a !== void 0 ? _a : []; }).reduce((a, b) => a.concat(b), []);
+        }
     });
 }
 exports.checkOSV = checkOSV;

package/lib/repo.d.ts

@@ -1,4 +1,4 @@
-import { Options, Repository } from "./types";
+import { Options, Repository } from './types';
 export declare function asbowerrepo(jsRepo: Repository): Repository;
 export declare function loadrepository(repoUrl: string, options: Options): Promise<Repository>;
 export declare function loadrepositoryFromFile(filepath: string, options: Options): Promise<Repository>;

package/lib/repo.js

@@ -58,18 +58,18 @@ function loadJson(url, options) {
             if (options.cacertbuf) {
                 reqOptions.ca = [options.cacertbuf];
             }
-            const req = (url.startsWith("http:") ? http : https).get(reqOptions, (res) => {
+            const req = (url.startsWith('http:') ? http : https).get(reqOptions, (res) => {
                 if (res.statusCode != 200)
                     return reject(`Error downloading: ${url}: HTTP ${res.statusCode} ${res.statusMessage}`);
                 const data = [];
-                res.on('data', c => data.push(c));
+                res.on('data', (c) => data.push(c));
                 res.on('end', () => {
                     let d = Buffer.concat(data).toString();
                     d = options.process ? options.process(d) : d;
                     resolve(JSON.parse(d));
                 });
             });
-            req.on('error', e => reject(`Error downloading: ${url}: ${e}`));
+            req.on('error', (e) => reject(`Error downloading: ${url}: ${e}`));
             req.end();
         });
     });
@@ -93,7 +93,7 @@ function loadFromCache(url, cachedir, options) {
         const cacheIndex = path.resolve(cachedir, 'index.json');
         if (!fs.existsSync(cachedir))
             fs.mkdirSync(cachedir);
-        const cache = fs.existsSync(cacheIndex) ? JSON.parse(fs.readFileSync(cacheIndex, "utf-8")) : {};
+        const cache = fs.existsSync(cacheIndex) ? JSON.parse(fs.readFileSync(cacheIndex, 'utf-8')) : {};
         const now = new Date().getTime();
         if (cache[url]) {
             if (now - cache[url].date < 60 * 60 * 1000) {
@@ -106,11 +106,11 @@ function loadFromCache(url, cachedir, options) {
                         fs.unlinkSync(path.resolve(cachedir, cache[url].date + '.json'));
                     }
                     catch (error) {
-                        if (error != null && typeof error == "object" && "code" in error && error.code !== 'ENOENT') {
+                        if (error != null && typeof error == 'object' && 'code' in error && error.code !== 'ENOENT') {
                             throw error;
                         }
                         else {
-                            console.warn("Could not delete cache. Ignore this error if you are running multiple retire.js in parallel");
+                            console.warn('Could not delete cache. Ignore this error if you are running multiple retire.js in parallel');
                         }
                     }
                 }
@@ -126,7 +126,7 @@ function loadFromCache(url, cachedir, options) {
 function asbowerrepo(jsRepo) {
     const result = {};
     Object.keys(jsRepo).map((k) => {
-        ([jsRepo[k].bowername || k]).map((b) => {
+        [jsRepo[k].bowername || k].map((b) => {
             result[b] = result[b] || { vulnerabilities: [] };
             result[b].vulnerabilities = result[b].vulnerabilities.concat(jsRepo[k].vulnerabilities);
         });
@@ -134,7 +134,6 @@ function asbowerrepo(jsRepo) {
     return result;
 }
 exports.asbowerrepo = asbowerrepo;
-;
 function loadrepository(repoUrl, options) {
     return __awaiter(this, void 0, void 0, function* () {
         //options = utils.extend(options, { process : retire.replaceVersion });
@@ -146,7 +145,6 @@ function loadrepository(repoUrl, options) {
     });
 }
 exports.loadrepository = loadrepository;
-;
 function loadrepositoryFromFile(filepath, options) {
     return __awaiter(this, void 0, void 0, function* () {
         options = Object.assign(Object.assign({}, options), { process: retire.replaceVersion });
@@ -154,4 +152,3 @@ function loadrepositoryFromFile(filepath, options) {
     });
 }
 exports.loadrepositoryFromFile = loadrepositoryFromFile;
-;

package/lib/reporters/console.d.ts

@@ -1,3 +1,3 @@
-import { type ConfigurableLogger } from "../reporting";
+import { type ConfigurableLogger } from '../reporting';
 declare const _default: ConfigurableLogger;
 export default _default;

package/lib/reporters/console.js

@@ -53,9 +53,12 @@ function printVulnerability(component, config) {
             string += `severity: ${vulnerability.severity}; `;
         }
         if (vulnerability.identifiers) {
-            string += Object.entries(vulnerability.identifiers).map(([name, id]) => {
-                return `${name}: ${utils.flatten([Array.isArray(id) ? id : [id]]).join(' ')}`;
-            }).join(', ') + '; ';
+            string +=
+                Object.entries(vulnerability.identifiers)
+                    .map(([name, id]) => {
+                    return `${name}: ${utils.flatten([Array.isArray(id) ? id : [id]]).join(' ')}`;
+                })
+                    .join(', ') + '; ';
         }
         string += vulnerability.info.join(config.outputformat === 'clean' ? '\n' : ' ');
     });
@@ -63,8 +66,12 @@ function printVulnerability(component, config) {
 }
 exports.default = {
     configure: (logger, _, config) => {
-        logger.logDependency = (finding) => { if (config.verbose)
-            printResults(logger, finding, config); };
-        logger.logVulnerableDependency = (component) => { printResults(logger, component, config); };
-    }
+        logger.logDependency = (finding) => {
+            if (config.verbose)
+                printResults(logger, finding, config);
+        };
+        logger.logVulnerableDependency = (component) => {
+            printResults(logger, component, config);
+        };
+    },
 };

package/lib/reporters/cyclonedx-json.d.ts

@@ -1,3 +1,3 @@
-import { ConfigurableLogger } from "../reporting";
+import { ConfigurableLogger } from '../reporting';
 declare const _default: ConfigurableLogger;
 export default _default;

package/lib/reporters/cyclonedx-json.js

@@ -34,10 +34,14 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
         start: new Date().toISOString(),
         data: [],
         messages: [],
-        errors: []
+        errors: [],
     };
     logger.info = finalResults.messages.push;
-    logger.debug = config.verbose ? finalResults.messages.push : function () { return; };
+    logger.debug = config.verbose
+        ? finalResults.messages.push
+        : function () {
+            return;
+        };
     logger.warn = logger.error = finalResults.errors.push;
     logger.logVulnerableDependency = function (finding) {
         vulnsFound = true;
@@ -51,17 +55,20 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
         const seen = new Set();
-        const components = finalResults.data.filter(d => d.results).map(r => r.results.map(dep => {
-            dep.version = (dep.version.split(".").length >= 3 ? dep.version : dep.version + ".0").replace(/-/g, ".");
+        const components = finalResults.data
+            .filter((d) => d.results)
+            .map((r) => r.results
+            .map((dep) => {
+            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
             let hashes;
             const filepath = r.file;
             if (filepath) {
                 const file = fs.readFileSync(filepath);
                 hashes = [
-                    { "alg": "MD5", "content": hash.md5(file) },
-                    { "alg": "SHA-1", "content": hash.sha1(file) },
-                    { "alg": "SHA-256", "content": hash.sha256(file) },
-                    { "alg": "SHA-512", "content": hash.sha512(file) },
+                    { alg: 'MD5', content: hash.md5(file) },
+                    { alg: 'SHA-1', content: hash.sha1(file) },
+                    { alg: 'SHA-256', content: hash.sha256(file) },
+                    { alg: 'SHA-512', content: hash.sha512(file) },
                 ];
             }
             const purl = `pkg:npm/${dep.component}@${dep.version}`;
@@ -69,33 +76,35 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 return undefined;
             seen.add(purl);
             return {
-                type: "library",
+                type: 'library',
                 name: dep.component,
                 version: dep.version,
                 purl: purl,
-                hashes: hashes
+                hashes: hashes,
             };
-        }).filter(x => x != undefined)).reduce((a, b) => a.concat(b));
+        })
+            .filter((x) => x != undefined))
+            .reduce((a, b) => a.concat(b));
         write(JSON.stringify({
-            bomFormat: "CycloneDX",
-            specVersion: "1.4",
+            bomFormat: 'CycloneDX',
+            specVersion: '1.4',
             serialNumber: `urn:uuid:${(0, uuid_1.v4)()}`,
             version: 1,
             metadata: {
                 timestamp: finalResults.start,
                 tools: [
                     {
-                        vendor: "RetireJS",
-                        name: "retire.js",
-                        version: retire.version
-                    }
-                ]
+                        vendor: 'RetireJS',
+                        name: 'retire.js',
+                        version: retire.version,
+                    },
+                ],
             },
-            components: components
+            components: components,
         }, undefined, 2));
         writer.close(callback);
     };
 }
 exports.default = {
-    configure: configureCycloneDXJSONLogger
+    configure: configureCycloneDXJSONLogger,
 };

package/lib/reporters/cyclonedx.d.ts

@@ -1,3 +1,3 @@
-import { ConfigurableLogger } from "../reporting";
+import { ConfigurableLogger } from '../reporting';
 declare const _default: ConfigurableLogger;
 export default _default;

package/lib/reporters/cyclonedx.js

@@ -34,10 +34,14 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
         start: new Date(),
         data: [],
         messages: [],
-        errors: []
+        errors: [],
     };
     logger.info = finalResults.messages.push;
-    logger.debug = config.verbose ? finalResults.messages.push : () => { return; };
+    logger.debug = config.verbose
+        ? finalResults.messages.push
+        : () => {
+            return;
+        };
     logger.warn = logger.error = finalResults.errors.push;
     logger.logVulnerableDependency = function (finding) {
         vulnsFound = true;
@@ -51,10 +55,13 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
         const seen = new Set();
-        const components = finalResults.data.filter(d => d.results).map(r => r.results.map(dep => {
-            dep.version = (dep.version.split(".").length >= 3 ? dep.version : dep.version + ".0").replace(/-/g, ".");
+        const components = finalResults.data
+            .filter((d) => d.results)
+            .map((r) => r.results
+            .map((dep) => {
+            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
             const filepath = r.file;
-            let hashes = "";
+            let hashes = '';
             if (filepath) {
                 const file = fs.readFileSync(filepath);
                 hashes = `
@@ -76,7 +83,9 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
       <purl>${purl}</purl>
       <modified>false</modified>
     </component>`;
-        }).join("")).join("");
+        })
+            .join(''))
+            .join('');
         write(`<?xml version="1.0"?>
 <bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:${(0, uuid_1.v4)()}" version="1">
   <metadata>
@@ -96,5 +105,5 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
     };
 }
 exports.default = {
-    configure: configureCycloneDXLogger
+    configure: configureCycloneDXLogger,
 };

package/lib/reporters/depcheck.d.ts

@@ -1,3 +1,3 @@
-import { ConfigurableLogger } from "../reporting";
+import { ConfigurableLogger } from '../reporting';
 declare const _default: ConfigurableLogger;
 export default _default;