retire 4.2.1 → 4.2.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [4.2.3]
+
+### Bugfix
+
+- Generate correct purl for moment.js
+
+## [4.2.2]
+
+### Bugfix
+
+- Proxy setting did not work
+
 ## [4.2.1]
 
 ### Changes

package/lib/cli.js

@@ -108,6 +108,7 @@ const config = {
     exitwith: (_j = prg.exitwith) !== null && _j !== void 0 ? _j : 13,
     includeOsv: !!prg.includeOsv,
     verbose: !!prg.verbose,
+    proxy: prg.proxy,
 };
 log.info(`retire.js v${retire.version}`);
 function exitWithError(msg) {

package/lib/repo.js

@@ -31,9 +31,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadrepositoryFromFile = exports.loadrepository = exports.asbowerrepo = void 0;
 const fs = __importStar(require("fs"));
@@ -42,7 +39,7 @@ const http = __importStar(require("http"));
 const https = __importStar(require("https"));
 const retire = __importStar(require("./retire"));
 const URL = __importStar(require("url"));
-const proxy_agent_1 = __importDefault(require("proxy-agent"));
+const proxy_agent_1 = require("proxy-agent");
 function loadJson(url, options) {
     return __awaiter(this, void 0, void 0, function* () {
         return new Promise((resolve, reject) => {
@@ -50,7 +47,9 @@ function loadJson(url, options) {
             const reqOptions = Object.assign(Object.assign({}, URL.parse(url)), { method: 'GET' });
             const proxyUri = options.proxy || process.env.http_proxy;
             if (proxyUri) {
-                reqOptions.agent = new proxy_agent_1.default(proxyUri);
+                reqOptions.agent = new proxy_agent_1.ProxyAgent({
+                    getProxyForUrl: () => proxyUri,
+                });
             }
             if (options.insecure) {
                 reqOptions.rejectUnauthorized = false;
@@ -126,7 +125,7 @@ function loadFromCache(url, cachedir, options) {
 function asbowerrepo(jsRepo) {
     const result = {};
     Object.keys(jsRepo).map((k) => {
-        [jsRepo[k].bowername || k].map((b) => {
+        (jsRepo[k].bowername || [k]).map((b) => {
             result[b] = result[b] || { vulnerabilities: [] };
             result[b].vulnerabilities = result[b].vulnerabilities.concat(jsRepo[k].vulnerabilities);
         });

package/lib/reporters/cyclonedx-json.js

@@ -27,6 +27,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const retire = __importStar(require("../retire"));
 const fs = __importStar(require("fs"));
 const uuid_1 = require("uuid");
+const utils_1 = require("./utils");
 function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     let vulnsFound = false;
     const finalResults = {
@@ -71,7 +72,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                     { alg: 'SHA-512', content: hash.sha512(file) },
                 ];
             }
-            const purl = `pkg:npm/${dep.component}@${dep.version}`;
+            const purl = (0, utils_1.generatePURL)(dep);
             if (seen.has(purl))
                 return undefined;
             seen.add(purl);
@@ -84,7 +85,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
             };
         })
             .filter((x) => x != undefined))
-            .reduce((a, b) => a.concat(b));
+            .reduce((a, b) => a.concat(b), []);
         write(JSON.stringify({
             bomFormat: 'CycloneDX',
             specVersion: '1.4',

package/lib/reporters/cyclonedx.js

@@ -27,6 +27,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const retire = __importStar(require("../retire"));
 const fs = __importStar(require("fs"));
 const uuid_1 = require("uuid");
+const utils_1 = require("./utils");
 function configureCycloneDXLogger(logger, writer, config, hash) {
     let vulnsFound = false;
     const finalResults = {
@@ -72,7 +73,7 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
             <hash alg="SHA-512">${hash.sha512(file)}</hash>
           </hashes>`;
             }
-            const purl = `pkg:npm/${dep.component}@${dep.version}`;
+            const purl = (0, utils_1.generatePURL)(dep);
             if (seen.has(purl))
                 return '';
             seen.add(purl);

package/lib/reporters/utils.d.ts

@@ -0,0 +1,2 @@
+import { Component } from '../types';
+export declare function generatePURL(component: Component): string;

package/lib/reporters/utils.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePURL = void 0;
+function generatePURL(component) {
+    const compName = component.npmname || component.component;
+    return `pkg:npm/${compName}@${component.version}`;
+}
+exports.generatePURL = generatePURL;

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '4.2.1';
+exports.version = '4.2.3';
 
 function isDefined(o) {
   return typeof o !== 'undefined';
@@ -29,7 +29,7 @@ function scan(data, extractor, repo, matcher) {
       var match = matcher(extractors[i], data);
       if (match) {
         match = match.replace(/(\.|-)min$/, '');
-        detected.push({ version: match, component: component, detection: extractor });
+        detected.push({ version: match, component: component, npmname: repo[component].npmname, detection: extractor });
       }
     }
   }
@@ -65,7 +65,7 @@ function scanhash(hash, repo) {
     var hashes = repo[component].extractors.hashes;
     if (!isDefined(hashes)) continue;
     if (hashes.hasOwnProperty(hash)) {
-      return [{ version: hashes[hash], component: component, detection: 'hash' }];
+      return [{ version: hashes[hash], component: component, npmname: repo[component].npmname, detection: 'hash' }];
     }
   }
   return [];
@@ -76,6 +76,7 @@ function check(results, repo) {
     var result = results[r];
     if (!isDefined(repo[result.component])) continue;
     var vulns = repo[result.component].vulnerabilities;
+    result.npmname = repo[result.component].npmname;
     for (var i in vulns) {
       if (!isDefined(vulns[i].below) || !isAtOrAbove(result.version, vulns[i].below)) {
         if (isDefined(vulns[i].atOrAbove) && !isAtOrAbove(result.version, vulns[i].atOrAbove)) {

package/lib/types.d.ts

@@ -1,7 +1,8 @@
 /// <reference types="node" />
 import { Logger } from './reporting';
 export type Repository = Record<string, {
-    bowername?: string;
+    bowername?: string[];
+    npmname?: string;
     vulnerabilities: Vulnerability[];
     extractors: {
         func?: string[];
@@ -28,6 +29,7 @@ export type Vulnerability = {
 };
 export type Component = {
     component: string;
+    npmname?: string;
     version: string;
     vulnerabilities?: Vulnerability[];
 };

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "4.2.1",
+  "version": "4.2.3",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -15,7 +15,7 @@
   "dependencies": {
     "ansi-colors": "^4.1.1",
     "commander": "^10.0.0",
-    "proxy-agent": "^5.0.0",
+    "proxy-agent": "^6.2.0",
     "uuid": "^9.0.0",
     "walkdir": "0.4.1",
     "zod": "^3.20.6"