retire 4.2.3 → 4.3.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [4.3.1]
+
+### Bugfix
+
+- Should always include detected libraries in SBOM reports regardless of if they are vulnerable or not
+
+## [4.3.0]
+
+### Changes
+
+- Support basePurl in repository to generate purls in SBOM
+
 ## [4.2.3]
 
 ### Bugfix

package/lib/reporters/utils.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generatePURL = void 0;
 function generatePURL(component) {
+    if (component.basePurl) {
+        return component.basePurl + '@' + component.version;
+    }
     const compName = component.npmname || component.component;
     return `pkg:npm/${compName}@${component.version}`;
 }

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '4.2.3';
+exports.version = '4.3.1';
 
 function isDefined(o) {
   return typeof o !== 'undefined';
@@ -29,7 +29,13 @@ function scan(data, extractor, repo, matcher) {
       var match = matcher(extractors[i], data);
       if (match) {
         match = match.replace(/(\.|-)min$/, '');
-        detected.push({ version: match, component: component, npmname: repo[component].npmname, detection: extractor });
+        detected.push({
+          version: match,
+          component: component,
+          npmname: repo[component].npmname,
+          basePurl: repo[component].basePurl,
+          detection: extractor,
+        });
       }
     }
   }
@@ -65,7 +71,15 @@ function scanhash(hash, repo) {
     var hashes = repo[component].extractors.hashes;
     if (!isDefined(hashes)) continue;
     if (hashes.hasOwnProperty(hash)) {
-      return [{ version: hashes[hash], component: component, npmname: repo[component].npmname, detection: 'hash' }];
+      return [
+        {
+          version: hashes[hash],
+          component: component,
+          npmname: repo[component].npmname,
+          basePurl: repo[component].basePurl,
+          detection: 'hash',
+        },
+      ];
     }
   }
   return [];
@@ -76,6 +90,7 @@ function check(results, repo) {
     var result = results[r];
     if (!isDefined(repo[result.component])) continue;
     var vulns = repo[result.component].vulnerabilities;
+    result.basePurl = repo[result.component].basePurl;
     result.npmname = repo[result.component].npmname;
     for (var i in vulns) {
       if (!isDefined(vulns[i].below) || !isAtOrAbove(result.version, vulns[i].below)) {

package/lib/scanner.js

@@ -68,8 +68,6 @@ function filterAndEmitResults(finding, options) {
     finding.results.forEach((r) => (r.vulnerabilities = uniqueVulnerabilities(r.vulnerabilities)));
     if (options.ignore)
         removeIgnored(finding.results, options.ignore);
-    if (!options.verbose)
-        finding.results = finding.results.filter((f) => retire.isVulnerable([f]));
     if (finding.results.length == 0)
         return;
     if (retire.isVulnerable(finding.results)) {

package/lib/types.d.ts

@@ -2,6 +2,7 @@
 import { Logger } from './reporting';
 export type Repository = Record<string, {
     bowername?: string[];
+    basePurl?: string;
     npmname?: string;
     vulnerabilities: Vulnerability[];
     extractors: {
@@ -29,6 +30,7 @@ export type Vulnerability = {
 };
 export type Component = {
     component: string;
+    basePurl?: string;
     npmname?: string;
     version: string;
     vulnerabilities?: Vulnerability[];

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "4.2.3",
+  "version": "4.3.1",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",