retire 4.1.0 → 4.2.0

package/lib/scanner.js

@@ -32,17 +32,15 @@ const path = __importStar(require("path"));
 const depsdev_1 = require("./depsdev");
 const events = new events_1.EventEmitter();
 const hash = {
-    'sha1': (data) => {
+    sha1: (data) => {
         const shasum = crypto.createHash('sha1');
         shasum.update(data);
         return shasum.digest('hex');
-    }
+    },
 };
 function emitResults(finding, options) {
     if (options.includeOsv === true) {
-        Promise
-            .all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.component, r.version, options).then(v => { var _a; return r.vulnerabilities = ((_a = r.vulnerabilities) !== null && _a !== void 0 ? _a : []).concat(v); })))
-            .then(() => filterAndEmitResults(finding, options));
+        Promise.all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.component, r.version, options).then((v) => { var _a; return (r.vulnerabilities = ((_a = r.vulnerabilities) !== null && _a !== void 0 ? _a : []).concat(v)); }))).then(() => filterAndEmitResults(finding, options));
     }
     else {
         filterAndEmitResults(finding, options);
@@ -60,18 +58,18 @@ function uniqueVulnerabilities(vulnerabilities) {
         return undefined;
     const unique = [];
     for (const v of vulnerabilities) {
-        if (!unique.some(u => getIdentifiers(u).some(i => getIdentifiers(v).includes(i)))) {
+        if (!unique.some((u) => getIdentifiers(u).some((i) => getIdentifiers(v).includes(i)))) {
             unique.push(v);
         }
     }
     return unique;
 }
 function filterAndEmitResults(finding, options) {
-    finding.results.forEach(r => r.vulnerabilities = uniqueVulnerabilities(r.vulnerabilities));
+    finding.results.forEach((r) => (r.vulnerabilities = uniqueVulnerabilities(r.vulnerabilities)));
     if (options.ignore)
         removeIgnored(finding.results, options.ignore);
     if (!options.verbose)
-        finding.results = finding.results.filter(f => retire.isVulnerable([f]));
+        finding.results = finding.results.filter((f) => retire.isVulnerable([f]));
     if (finding.results.length == 0)
         return;
     if (retire.isVulnerable(finding.results)) {
@@ -83,25 +81,26 @@ function filterAndEmitResults(finding, options) {
 }
 function shouldIgnorePath(fileSpecs, ignores) {
     var _a, _b;
-    return (_b = (_a = ignores.paths) === null || _a === void 0 ? void 0 : _a.some((i) => {
+    return ((_b = (_a = ignores.paths) === null || _a === void 0 ? void 0 : _a.some((i) => {
         return fileSpecs.some((j) => i.test(j) || i.test(path.resolve(j)));
-    })) !== null && _b !== void 0 ? _b : false;
+    })) !== null && _b !== void 0 ? _b : false);
 }
 function removeIgnored(results, ignores) {
-    if (!("descriptors" in ignores))
+    if (!('descriptors' in ignores))
         return;
     results.forEach((r) => {
         var _a, _b;
-        if (!("vulnerabilities" in r))
+        if (!('vulnerabilities' in r))
             return;
-        (_a = ignores.descriptors) === null || _a === void 0 ? void 0 : _a.filter((d) => "component" in d).forEach((i) => {
+        (_a = ignores.descriptors) === null || _a === void 0 ? void 0 : _a.filter((d) => 'component' in d).forEach((i) => {
             var _a;
             if (r.component !== i.component)
                 return;
             if (i.version && r.version !== i.version)
                 return;
-            if (i.severity) { //Remove vulnerabilities with the severity we want to drop
-                r.vulnerabilities = (_a = r.vulnerabilities) === null || _a === void 0 ? void 0 : _a.filter(v => v.severity != i.severity);
+            if (i.severity) {
+                //Remove vulnerabilities with the severity we want to drop
+                r.vulnerabilities = (_a = r.vulnerabilities) === null || _a === void 0 ? void 0 : _a.filter((v) => v.severity != i.severity);
                 return;
             }
             if (i.identifiers) {
@@ -117,7 +116,7 @@ function removeIgnored(results, ignores) {
 function removeIgnoredVulnerabilitiesByIdentifier(identifiers, result) {
     var _a;
     result.vulnerabilities = (_a = result.vulnerabilities) === null || _a === void 0 ? void 0 : _a.filter((v) => {
-        if (!("identifiers" in v))
+        if (!('identifiers' in v))
             return true;
         return !Object.entries(identifiers || {}).every(([key, value]) => hasIdentifier(Object.assign({}, v.identifiers), key, value));
     });
@@ -134,7 +133,7 @@ function scanJsFile(file, repo, options) {
     }
     let results = retire.scanFileName(file, repo);
     if (!results || results.length === 0) {
-        results = retire.scanFileContent(fs.readFileSync(file, "utf-8"), repo, hash);
+        results = retire.scanFileContent(fs.readFileSync(file, 'utf-8'), repo, hash);
     }
     emitResults({ file: file, results: results }, options);
 }
@@ -144,7 +143,7 @@ function scanBowerFile(file, repo, options) {
         return;
     }
     try {
-        const bower = JSON.parse(fs.readFileSync(file, "utf-8"));
+        const bower = JSON.parse(fs.readFileSync(file, 'utf-8'));
         if (bower.version) {
             const results = retire.check(bower.name, bower.version, repo);
             emitResults({ file: file, results: results }, options);
@@ -159,4 +158,3 @@ function on(event, handler) {
     events.on(event, handler);
 }
 exports.on = on;
-;

package/lib/types.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="node" />
-import { Logger } from "./reporting";
+import { Logger } from './reporting';
 export type Repository = Record<string, {
     bowername?: string;
     vulnerabilities: Vulnerability[];
@@ -16,6 +16,7 @@ export type Vulnerability = {
     below: string;
     atOrAbove?: string;
     severity: SeverityLevel;
+    cwe: string[];
     identifiers?: {
         CVE?: string[];
         bug?: string;
@@ -53,10 +54,10 @@ export type ComponentDescriptor = {
     component: string;
     version?: string;
     severity?: string;
-    identifiers?: Vulnerability["identifiers"];
+    identifiers?: Vulnerability['identifiers'];
     justification?: string;
 };
-type Descriptor = (PathDescriptor | ComponentDescriptor);
+type Descriptor = PathDescriptor | ComponentDescriptor;
 export type Options = {
     log: Logger;
     proxy?: string;

package/lib/types.js

@@ -6,5 +6,5 @@ exports.severityLevels = {
     low: 1,
     medium: 2,
     high: 3,
-    critical: 4
+    critical: 4,
 };

package/lib/utils.d.ts

@@ -6,6 +6,6 @@ export declare function warn(options: {
     warnlogger?: LogMethod;
     logger?: LogMethod;
 }): (...message: unknown[]) => void;
-export declare function pick(p: Record<string, unknown>, keys: string[]): Record<typeof keys[number], unknown>;
+export declare function pick(p: Record<string, unknown>, keys: string[]): Record<(typeof keys)[number], unknown>;
 export declare function flatten<T>(e: T[][]): T[];
 export {};

package/lib/utils.js

@@ -23,9 +23,7 @@ function pick(p, keys) {
     return result;
 }
 exports.pick = pick;
-;
 function flatten(e) {
     return e.reduce((x, y) => x.concat(y), []);
 }
 exports.flatten = flatten;
-;

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -16,7 +16,7 @@
     "ansi-colors": "^4.1.1",
     "commander": "^10.0.0",
     "proxy-agent": "^5.0.0",
-    "uuid": "^8.3.2",
+    "uuid": "^9.0.0",
     "walkdir": "0.4.1",
     "zod": "^3.20.6"
   },
@@ -30,14 +30,15 @@
     "eslint-config-prettier": "^8.6.0",
     "jsonschema": "^1.4.1",
     "libxmljs": "^1.0.8",
-    "mocha": "^9.2.0",
+    "mocha": "^10.2.0",
     "prettier": "^2.8.4",
-    "typescript": "^4.9.5"
+    "typescript": "^5.0.4"
   },
   "scripts": {
     "test": "./test",
     "build": "tsc && chmod ugo+x lib/cli.js",
     "watch": "tsc --watch ",
+    "typecheck": "tsc --noEmit",
     "lint": "eslint . --ext .ts --fix --ignore-path ../.gitignore",
     "check": "npm run lint && npm run typecheck"
   },
@@ -53,7 +54,7 @@
     "software-composition-analysis",
     "sca"
   ],
-  "files" : [
+  "files": [
     "lib/**/*",
     "CHANGELOG.md"
   ]