retire 4.3.3 → 4.4.1

package/CHANGELOG.md

@@ -1,6 +1,24 @@
 # Changelog
 
-## [4.3.2]
+## [4.4.1]
+
+### Chore
+
+- Dependency upgrades
+
+## [4.4.0]
+
+### Added
+
+- Adding proper repository validation to ensure it's on the expected format
+
+## [4.3.4]
+
+### Bugfix
+
+- Bug: `--jspath` is not being honoured
+
+## [4.3.3]
 
 ### Bugfix
 

package/lib/cli.js

@@ -26,7 +26,6 @@ var __importStar = (this && this.__importStar) || function (mod) {
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
 Object.defineProperty(exports, "__esModule", { value: true });
 const utils = __importStar(require("./utils"));
 const commander_1 = require("commander");
@@ -56,8 +55,8 @@ const prg = commander_1.program
     .version(retire.version)
     .option('-v, --verbose', 'Show identified files (by default only vulnerable files are shown)')
     .option('-c, --nocache', "Don't use local cache")
-    .option('--jspath <path>', 'Folder to scan for javascript files')
-    .option('--path <path>', 'Folder to scan for both')
+    .option('--jspath <path>', 'Folder to scan for javascript files (deprecated)')
+    .option('--path <path>', 'Folder to scan for javascript files')
     .option('--jsrepo <path|url>', "Local or internal version of repo. Can be multiple comma separated. Default: 'central')")
     .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
     .option('--proxy <url>', 'Proxy url (http://some.host:8080)')
@@ -75,11 +74,11 @@ const prg = commander_1.program
     .parse()
     .opts();
 const colorwarn = prg.colors ? ansi_colors_1.default.red : (x) => x;
-const jsrepolocation = ((_a = prg.jsrepo) !== null && _a !== void 0 ? _a : "'central'")
+const jsrepolocation = (prg.jsrepo ?? "'central'")
     .split(',')
     .map((x) => x === "'central'" ? 'https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json' : x);
-const ignorefile = (_b = prg.ignoreFile) !== null && _b !== void 0 ? _b : defaultIgnoreFiles.filter((x) => fs_1.default.existsSync(x))[0];
-const scanpath = (_c = prg.path) !== null && _c !== void 0 ? _c : '.';
+const ignorefile = prg.ignoreFile ?? defaultIgnoreFiles.filter((x) => fs_1.default.existsSync(x))[0];
+const scanpath = prg.path ?? prg.jspath ?? '.';
 const log = reporting.open({
     colors: !!prg.colors,
     colorwarn,
@@ -89,7 +88,7 @@ const log = reporting.open({
     path: scanpath,
     verbose: !!prg.verbose,
 });
-const severity = (_d = prg.severity) !== null && _d !== void 0 ? _d : 'none';
+const severity = prg.severity ?? 'none';
 if (!(severity in types_1.severityLevels)) {
     exitWithError(`Error: Invalid severity level (${severity}). Valid levels are: ${Object.keys(types_1.severityLevels).join(', ')}`);
 }
@@ -97,15 +96,15 @@ const config = {
     path: scanpath,
     ignore: {
         paths: [],
-        pathsAsString: (_g = (_f = (_e = prg.ignore) === null || _e === void 0 ? void 0 : _e.split(',')) === null || _f === void 0 ? void 0 : _f.map((x) => path_1.default.resolve(x))) !== null && _g !== void 0 ? _g : [],
+        pathsAsString: prg.ignore?.split(',')?.map((x) => path_1.default.resolve(x)) ?? [],
         descriptors: [],
     },
     colorwarn,
     nocache: prg.nocache ? true : false,
-    cachedir: (_h = prg.cachedir) !== null && _h !== void 0 ? _h : path_1.default.resolve(os_1.default.tmpdir(), '.retire-cache/'),
+    cachedir: prg.cachedir ?? path_1.default.resolve(os_1.default.tmpdir(), '.retire-cache/'),
     log: log,
     severity: severity,
-    exitwith: (_j = prg.exitwith) !== null && _j !== void 0 ? _j : 13,
+    exitwith: prg.exitwith ?? 13,
     includeOsv: !!prg.includeOsv,
     verbose: !!prg.verbose,
     proxy: prg.proxy,
@@ -146,7 +145,9 @@ if (ignorefile) {
         catch (e) {
             exitWithError(`Error: Invalid ignore file: ${ignorefile}`);
         }
-        const ignoredPaths = (_m = (_l = (_k = config.ignore.descriptors) === null || _k === void 0 ? void 0 : _k.map((x) => ('path' in x ? x.path : undefined))) === null || _l === void 0 ? void 0 : _l.filter((x) => x != undefined)) !== null && _m !== void 0 ? _m : [];
+        const ignoredPaths = config.ignore.descriptors
+            ?.map((x) => ('path' in x ? x.path : undefined))
+            ?.filter((x) => x != undefined) ?? [];
         config.ignore.pathsAsString = config.ignore.pathsAsString.concat(ignoredPaths);
     }
     else {
@@ -168,8 +169,7 @@ scanner.on('vulnerable-dependency-found', (result) => {
     const levels = result.results.map((r) => {
         return r.vulnerabilities
             ? r.vulnerabilities.map((v) => {
-                var _a;
-                return types_1.severityLevels[(_a = v.severity) !== null && _a !== void 0 ? _a : 'critical'];
+                return types_1.severityLevels[v.severity ?? 'critical'];
             })
             : [];
     });

package/lib/depsdev.js

@@ -1,13 +1,4 @@
 "use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -47,53 +38,46 @@ function scoreToSeverity(score) {
         return 'medium';
     return 'low';
 }
-function loadAdvisory(packageName, version, id, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const osvAdvisory = yield loadJson(`https://api.osv.dev/v1/vulns/${id}`, options);
-        const advisory = yield loadJson(`https://api.deps.dev/v3alpha/advisories/${id}`, options);
-        if (!advisory || !osvAdvisory)
-            return [];
-        const simplifiedRepo = {
-            [packageName]: {
-                vulnerabilities: osvAdvisory.affected
-                    .map(({ ranges }) => ranges.map(({ events }) => {
-                    var _a, _b;
-                    return ({
-                        atOrAbove: events[0].introduced,
-                        below: events[0].fixed,
-                        severity: scoreToSeverity(advisory.cvss3Score),
-                        cwe: (_b = (_a = osvAdvisory.database_specific) === null || _a === void 0 ? void 0 : _a.cwe_ids) !== null && _b !== void 0 ? _b : [],
-                        identifiers: {
-                            githubID: id,
-                            CVE: osvAdvisory.aliases.filter((x) => x.startsWith('CVE-')),
-                            summary: advisory.title,
-                        },
-                        info: osvAdvisory.references.map(({ url }) => url),
-                    });
-                }))
-                    .reduce((a, b) => a.concat(b), []),
-                extractors: {},
-            },
-        };
-        return (0, retire_1.check)(packageName, version, simplifiedRepo);
-    });
+async function loadAdvisory(packageName, version, id, options) {
+    const osvAdvisory = await loadJson(`https://api.osv.dev/v1/vulns/${id}`, options);
+    const advisory = await loadJson(`https://api.deps.dev/v3alpha/advisories/${id}`, options);
+    if (!advisory || !osvAdvisory)
+        return [];
+    const simplifiedRepo = {
+        [packageName]: {
+            vulnerabilities: osvAdvisory.affected
+                .map(({ ranges }) => ranges.map(({ events }) => ({
+                atOrAbove: events[0].introduced,
+                below: events[0].fixed,
+                severity: scoreToSeverity(advisory.cvss3Score),
+                cwe: osvAdvisory.database_specific?.cwe_ids ?? [],
+                identifiers: {
+                    githubID: id,
+                    CVE: osvAdvisory.aliases.filter((x) => x.startsWith('CVE-')),
+                    summary: advisory.title,
+                },
+                info: osvAdvisory.references.map(({ url }) => url),
+            })))
+                .reduce((a, b) => a.concat(b), []),
+            extractors: {},
+        },
+    };
+    return (0, retire_1.check)(packageName, version, simplifiedRepo);
 }
-function checkOSV(packageName, version, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        try {
-            const versionInfo = yield getVulnerabilities(packageName, version, options);
-            if (!versionInfo)
-                return [];
-            if (versionInfo.advisoryKeys.length == 0)
-                return [];
-            const comps = yield Promise.all(versionInfo.advisoryKeys.map(({ id }) => loadAdvisory(packageName, version, id, options)));
-            const flattened = comps.reduce((a, b) => a.concat(b), []);
-            return flattened.map((x) => { var _a; return (_a = x.vulnerabilities) !== null && _a !== void 0 ? _a : []; }).reduce((a, b) => a.concat(b), []);
-        }
-        catch (e) {
-            options.log.warn('Error checking OSV: ' + e);
+async function checkOSV(packageName, version, options) {
+    try {
+        const versionInfo = await getVulnerabilities(packageName, version, options);
+        if (!versionInfo)
             return [];
-        }
-    });
+        if (versionInfo.advisoryKeys.length == 0)
+            return [];
+        const comps = await Promise.all(versionInfo.advisoryKeys.map(({ id }) => loadAdvisory(packageName, version, id, options)));
+        const flattened = comps.reduce((a, b) => a.concat(b), []);
+        return flattened.map((x) => x.vulnerabilities ?? []).reduce((a, b) => a.concat(b), []);
+    }
+    catch (e) {
+        options.log.warn('Error checking OSV: ' + e);
+        return [];
+    }
 }
 exports.checkOSV = checkOSV;

package/lib/repo.d.ts

@@ -1,4 +1,6 @@
 import { Options, Repository } from './types';
+import * as z from 'zod';
+export declare function validateRepository(repo: Repository, replacer?: Options['process']): z.SafeParseReturnType<unknown, Repository>;
 export declare function asbowerrepo(jsRepo: Repository): Repository;
 export declare function loadrepository(repoUrl: string, options: Options): Promise<Repository>;
 export declare function loadrepositoryFromFile(filepath: string, options: Options): Promise<Repository>;

package/lib/repo.js

@@ -22,17 +22,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
     __setModuleDefault(result, mod);
     return result;
 };
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadrepositoryFromFile = exports.loadrepository = exports.asbowerrepo = void 0;
+exports.loadrepositoryFromFile = exports.loadrepository = exports.asbowerrepo = exports.validateRepository = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const http = __importStar(require("http"));
@@ -40,87 +31,218 @@ const https = __importStar(require("https"));
 const retire = __importStar(require("./retire"));
 const URL = __importStar(require("url"));
 const proxy_agent_1 = require("proxy-agent");
-function loadJson(url, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        return new Promise((resolve, reject) => {
-            options.log.info('Downloading ' + url + ' ...');
-            const reqOptions = Object.assign(Object.assign({}, URL.parse(url)), { method: 'GET' });
-            const proxyUri = options.proxy || process.env.http_proxy;
-            if (proxyUri) {
-                reqOptions.agent = new proxy_agent_1.ProxyAgent({
-                    getProxyForUrl: () => proxyUri,
-                });
-            }
-            if (options.insecure) {
-                reqOptions.rejectUnauthorized = false;
-            }
-            if (options.cacertbuf) {
-                reqOptions.ca = [options.cacertbuf];
-            }
-            const req = (url.startsWith('http:') ? http : https).get(reqOptions, (res) => {
-                if (res.statusCode != 200)
-                    return reject(`Error downloading: ${url}: HTTP ${res.statusCode} ${res.statusMessage}`);
-                const data = [];
-                res.on('data', (c) => data.push(c));
-                res.on('end', () => {
-                    let d = Buffer.concat(data).toString();
-                    d = options.process ? options.process(d) : d;
-                    resolve(JSON.parse(d));
-                });
+const z = __importStar(require("zod"));
+const types_1 = require("./types");
+function validateRepository(repo, replacer) {
+    const keys = Object.keys(types_1.severityLevels);
+    const versionValidator = z.string().regex(/^[\d.]+([a-zA-Z\d.-]+)?$/);
+    const numericString = z.string().regex(/^[\d]+$/);
+    const vulnValidator = z
+        .object({
+        below: versionValidator,
+        atOrAbove: versionValidator.optional(),
+        severity: z.enum(keys),
+        cwe: z.array(z.string().regex(/^CWE-[0-9]+$/)).min(1),
+        identifiers: z
+            .object({
+            CVE: z.array(z.string().regex(/^CVE-[0-9X-]+$/)).optional(),
+            bug: z
+                .string()
+                .regex(/^[a-z0-9-]+$/i)
+                .optional(),
+            issue: numericString.optional(),
+            summary: z.string().min(3).optional(),
+            githubID: z
+                .string()
+                .regex(/^GHSA[A-Z0-9-]+$/i)
+                .optional(),
+            osvdb: z.array(numericString).optional(),
+            gist: z
+                .string()
+                .regex(/^[a-z0-9-]+\/[a-f0-9]+$/i)
+                .optional(),
+            tenable: numericString.optional(),
+            blog: z
+                .string()
+                .min(10)
+                .regex(/^[:a-z0-9/-]+$/)
+                .optional(),
+            release: z.string().min(5).optional(),
+            PR: numericString.optional(),
+            retid: z
+                .string()
+                .regex(/^[\d]+$/)
+                .optional(),
+        })
+            .strict()
+            .superRefine((o, ctx) => {
+            if (Object.keys(o).filter((k) => k != 'summary').length == 0)
+                ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Must have at least one identifier' });
+            const ids = Object.values(o)
+                .map((x) => (Array.isArray(x) ? x : [x]))
+                .reduce((a, b) => a.concat(b), []).length;
+            if (ids == 0)
+                ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Must have at least one identifier' });
+        }),
+        info: z.array(z.string().regex(/^https?:\/\/.+/)),
+    })
+        .strict();
+    const regexValidator = z.string().superRefine((s, ctx) => {
+        if (ctx.path[0] == 'dont check')
+            return;
+        try {
+            new RegExp(s);
+        }
+        catch (error) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'Invalid regex: ' + s,
             });
-            req.on('error', (e) => reject(`Error downloading: ${url}: ${e}`));
-            req.end();
+        }
+        if (s.includes('[]'))
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Regex must not contain []: ' + s });
+        if (s.includes('{}'))
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Regex must not contain {}: ' + s });
+        [/.*[^\\]\{[^0-9,\\]\}.*/, /[^,0-9\\]\}/, /[^\\]\{[^,0-9]/].forEach((r) => {
+            if (r.test(s))
+                ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'There is something odd with this regex: ' + s });
         });
+        let versionMatcher = '§§version§§';
+        if (replacer)
+            versionMatcher = JSON.parse(`"${replacer(versionMatcher)}"`);
+        const versionIndex = s.indexOf(versionMatcher);
+        if (versionIndex == -1 || (versionIndex > 0 && s.substring(versionIndex - 1, versionIndex) == '\\')) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Regex must contain (§§version§§): ' + s });
+        }
+        else if (s.replace(/\(\?:/g, '').replace(/\\\(/g, '').split(/\(/)[1].indexOf(versionMatcher) != 0) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'Regex must contain (§§version§§) as first capture group: ' + s.replace(/\(\?:/g, '').replace(/\\\(/g, ''),
+            });
+        }
     });
+    const replaceValidator = z
+        .string()
+        .regex(/^\/(.*[^\\])\/([^/]+)\/$/, 'RegExp error - should be on format "/search/replacement/"');
+    const validator = z.record(z
+        .object({
+        bowername: z.array(z.string().regex(/^[a-z0-9.-]+$/i)).optional(),
+        basePurl: z
+            .string()
+            .regex(/^pkg:[a-z0-9/]+$/i)
+            .optional(),
+        npmname: z
+            .string()
+            .regex(/^[a-z0-9.-]+$/i)
+            .optional(),
+        vulnerabilities: z.array(vulnValidator),
+        extractors: z
+            .object({
+            func: z.array(z.string().min(5)).optional(),
+            uri: z.array(regexValidator).optional(),
+            filename: z.array(regexValidator).optional(),
+            filecontent: z.array(regexValidator).optional(),
+            filecontentreplace: z.array(replaceValidator).optional(),
+            hashes: z.record(z.string().regex(/^[a-f0-9]+$/i), versionValidator).optional(),
+        })
+            .strict(),
+    })
+        .strict());
+    return validator.safeParse(repo);
 }
-function loadJsonFromFile(file, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        options.log.debug('Reading ' + file + ' ...');
-        return new Promise((resolve, reject) => {
-            fs.readFile(file, { encoding: 'utf8' }, (err, data) => {
-                if (err) {
-                    return reject(err.toString());
+exports.validateRepository = validateRepository;
+function formatValidationError(error) {
+    return JSON.stringify(error.format(), (key, value) => (Array.isArray(value) && value.length === 0 ? undefined : value), 2);
+}
+async function loadJson(url, options) {
+    return new Promise((resolve, reject) => {
+        options.log.info('Downloading ' + url + ' ...');
+        const reqOptions = { ...URL.parse(url), method: 'GET' };
+        const proxyUri = options.proxy || process.env.http_proxy;
+        if (proxyUri) {
+            reqOptions.agent = new proxy_agent_1.ProxyAgent({
+                getProxyForUrl: () => proxyUri,
+            });
+        }
+        if (options.insecure) {
+            reqOptions.rejectUnauthorized = false;
+        }
+        if (options.cacertbuf) {
+            reqOptions.ca = [options.cacertbuf];
+        }
+        const req = (url.startsWith('http:') ? http : https).get(reqOptions, (res) => {
+            if (res.statusCode != 200)
+                return reject(`Error downloading: ${url}: HTTP ${res.statusCode} ${res.statusMessage}`);
+            const data = [];
+            res.on('data', (c) => data.push(c));
+            res.on('end', () => {
+                let d = Buffer.concat(data).toString();
+                d = options.process ? options.process(d) : d;
+                const json = JSON.parse(d);
+                const vresult = validateRepository(json, options.process);
+                if (vresult.success) {
+                    resolve(json);
+                }
+                else {
+                    reject(`Invalid repository from ${url}: ${formatValidationError(vresult.error)}`);
                 }
-                data = options.process ? options.process(data) : data;
-                resolve(JSON.parse(data));
             });
         });
+        req.on('error', (e) => reject(`Error downloading: ${url}: ${e}`));
+        req.end();
     });
 }
-function loadFromCache(url, cachedir, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const cacheIndex = path.resolve(cachedir, 'index.json');
-        if (!fs.existsSync(cachedir))
-            fs.mkdirSync(cachedir);
-        const cache = fs.existsSync(cacheIndex) ? JSON.parse(fs.readFileSync(cacheIndex, 'utf-8')) : {};
-        const now = new Date().getTime();
-        if (cache[url]) {
-            if (now - cache[url].date < 60 * 60 * 1000) {
-                options.log.info('Loading from cache: ' + url);
-                return loadJsonFromFile(path.resolve(cachedir, cache[url].file), options);
+async function loadJsonFromFile(file, options) {
+    options.log.debug('Reading ' + file + ' ...');
+    return new Promise((resolve, reject) => {
+        fs.readFile(file, { encoding: 'utf8' }, (err, data) => {
+            if (err) {
+                return reject(err.toString());
+            }
+            data = options.process ? options.process(data) : data;
+            const json = JSON.parse(data);
+            const vresult = validateRepository(json, options.process);
+            if (vresult.success) {
+                resolve(json);
             }
             else {
-                if (fs.existsSync(path.resolve(cachedir, cache[url].date + '.json'))) {
-                    try {
-                        fs.unlinkSync(path.resolve(cachedir, cache[url].date + '.json'));
+                reject(`Invalid repository from ${file}: ${formatValidationError(vresult.error)}`);
+            }
+        });
+    });
+}
+async function loadFromCache(url, cachedir, options) {
+    const cacheIndex = path.resolve(cachedir, 'index.json');
+    if (!fs.existsSync(cachedir))
+        fs.mkdirSync(cachedir);
+    const cache = fs.existsSync(cacheIndex) ? JSON.parse(fs.readFileSync(cacheIndex, 'utf-8')) : {};
+    const now = new Date().getTime();
+    if (cache[url]) {
+        if (now - cache[url].date < 60 * 60 * 1000) {
+            options.log.info('Loading from cache: ' + url);
+            return loadJsonFromFile(path.resolve(cachedir, cache[url].file), options);
+        }
+        else {
+            if (fs.existsSync(path.resolve(cachedir, cache[url].date + '.json'))) {
+                try {
+                    fs.unlinkSync(path.resolve(cachedir, cache[url].date + '.json'));
+                }
+                catch (error) {
+                    if (error != null && typeof error == 'object' && 'code' in error && error.code !== 'ENOENT') {
+                        throw error;
                     }
-                    catch (error) {
-                        if (error != null && typeof error == 'object' && 'code' in error && error.code !== 'ENOENT') {
-                            throw error;
-                        }
-                        else {
-                            console.warn('Could not delete cache. Ignore this error if you are running multiple retire.js in parallel');
-                        }
+                    else {
+                        console.warn('Could not delete cache. Ignore this error if you are running multiple retire.js in parallel');
                     }
                 }
             }
         }
-        const data = yield loadJson(url, options);
-        cache[url] = { date: now, file: now + '.json' };
-        fs.writeFileSync(path.resolve(cachedir, cache[url].file), JSON.stringify(data), { encoding: 'utf8' });
-        fs.writeFileSync(cacheIndex, JSON.stringify(cache), { encoding: 'utf8' });
-        return data;
-    });
+    }
+    const data = await loadJson(url, options);
+    cache[url] = { date: now, file: now + '.json' };
+    fs.writeFileSync(path.resolve(cachedir, cache[url].file), JSON.stringify(data), { encoding: 'utf8' });
+    fs.writeFileSync(cacheIndex, JSON.stringify(cache), { encoding: 'utf8' });
+    return data;
 }
 function asbowerrepo(jsRepo) {
     const result = {};
@@ -133,21 +255,16 @@ function asbowerrepo(jsRepo) {
     return result;
 }
 exports.asbowerrepo = asbowerrepo;
-function loadrepository(repoUrl, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        //options = utils.extend(options, { process : retire.replaceVersion });
-        options = Object.assign(Object.assign({}, options), { process: retire.replaceVersion });
-        if (options.nocache) {
-            return yield loadJson(repoUrl, options);
-        }
-        return yield loadFromCache(repoUrl, options.cachedir, options);
-    });
+async function loadrepository(repoUrl, options) {
+    options = { ...options, process: retire.replaceVersion };
+    if (options.nocache) {
+        return await loadJson(repoUrl, options);
+    }
+    return await loadFromCache(repoUrl, options.cachedir, options);
 }
 exports.loadrepository = loadrepository;
-function loadrepositoryFromFile(filepath, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        options = Object.assign(Object.assign({}, options), { process: retire.replaceVersion });
-        return yield loadJsonFromFile(filepath, options);
-    });
+async function loadrepositoryFromFile(filepath, options) {
+    options = { ...options, process: retire.replaceVersion };
+    return await loadJsonFromFile(filepath, options);
 }
 exports.loadrepositoryFromFile = loadrepositoryFromFile;

package/lib/reporters/console.js

@@ -45,9 +45,8 @@ function printResults(logger, finding, config) {
     }
 }
 function printVulnerability(component, config) {
-    var _a;
     let string = '';
-    (_a = component.vulnerabilities) === null || _a === void 0 ? void 0 : _a.forEach((vulnerability) => {
+    component.vulnerabilities?.forEach((vulnerability) => {
         string += config.outputformat === 'clean' ? '\n   ' : ' ';
         if (vulnerability.severity) {
             string += `severity: ${vulnerability.severity}; `;

package/lib/reporting.d.ts

@@ -1,4 +1,6 @@
 /// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
 import { Finding } from './types';
 export type LoggerOptions = {
     outputpath: string;

package/lib/reporting.js

@@ -115,8 +115,7 @@ function configureFileWriter(config) {
     };
 }
 function open(config) {
-    var _a;
-    verbose = (_a = config.verbose) !== null && _a !== void 0 ? _a : false;
+    verbose = config.verbose ?? false;
     if (config.colors)
         colorwarn = config.colorwarn;
     const format = config.outputformat || 'console';

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '4.3.3';
+exports.version = '4.4.1';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

package/lib/scanner.js

@@ -40,18 +40,17 @@ const hash = {
 };
 function emitResults(finding, options) {
     if (options.includeOsv === true) {
-        Promise.all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.component, r.version, options).then((v) => { var _a; return (r.vulnerabilities = ((_a = r.vulnerabilities) !== null && _a !== void 0 ? _a : []).concat(v)); }))).then(() => filterAndEmitResults(finding, options));
+        Promise.all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.component, r.version, options).then((v) => (r.vulnerabilities = (r.vulnerabilities ?? []).concat(v))))).then(() => filterAndEmitResults(finding, options));
     }
     else {
         filterAndEmitResults(finding, options);
     }
 }
 function getIdentifiers(v) {
-    var _a, _b, _c, _d, _e, _f, _g, _h;
-    return ((_b = (_a = v.identifiers) === null || _a === void 0 ? void 0 : _a.CVE) !== null && _b !== void 0 ? _b : [])
-        .concat((_d = (_c = v.identifiers) === null || _c === void 0 ? void 0 : _c.bug) !== null && _d !== void 0 ? _d : [])
-        .concat((_f = (_e = v.identifiers) === null || _e === void 0 ? void 0 : _e.issue) !== null && _f !== void 0 ? _f : [])
-        .concat((_h = (_g = v.identifiers) === null || _g === void 0 ? void 0 : _g.githubID) !== null && _h !== void 0 ? _h : []);
+    return (v.identifiers?.CVE ?? [])
+        .concat(v.identifiers?.bug ?? [])
+        .concat(v.identifiers?.issue ?? [])
+        .concat(v.identifiers?.githubID ?? []);
 }
 function uniqueVulnerabilities(vulnerabilities) {
     if (!vulnerabilities)
@@ -78,45 +77,43 @@ function filterAndEmitResults(finding, options) {
     }
 }
 function shouldIgnorePath(fileSpecs, ignores) {
-    var _a, _b;
-    return ((_b = (_a = ignores.paths) === null || _a === void 0 ? void 0 : _a.some((i) => {
+    return (ignores.paths?.some((i) => {
         return fileSpecs.some((j) => i.test(j) || i.test(path.resolve(j)));
-    })) !== null && _b !== void 0 ? _b : false);
+    }) ?? false);
 }
 function removeIgnored(results, ignores) {
     if (!('descriptors' in ignores))
         return;
     results.forEach((r) => {
-        var _a, _b;
         if (!('vulnerabilities' in r))
             return;
-        (_a = ignores.descriptors) === null || _a === void 0 ? void 0 : _a.filter((d) => 'component' in d).forEach((i) => {
-            var _a;
+        ignores.descriptors
+            ?.filter((d) => 'component' in d)
+            .forEach((i) => {
             if (r.component !== i.component)
                 return;
             if (i.version && r.version !== i.version)
                 return;
             if (i.severity) {
                 //Remove vulnerabilities with the severity we want to drop
-                r.vulnerabilities = (_a = r.vulnerabilities) === null || _a === void 0 ? void 0 : _a.filter((v) => v.severity != i.severity);
+                r.vulnerabilities = r.vulnerabilities?.filter((v) => v.severity != i.severity);
                 return;
             }
             if (i.identifiers) {
-                removeIgnoredVulnerabilitiesByIdentifier(Object.assign({}, i.identifiers), r);
+                removeIgnoredVulnerabilitiesByIdentifier({ ...i.identifiers }, r);
                 return;
             }
             r.vulnerabilities = [];
         });
-        if (((_b = r.vulnerabilities) === null || _b === void 0 ? void 0 : _b.length) === 0)
+        if (r.vulnerabilities?.length === 0)
             delete r.vulnerabilities;
     });
 }
 function removeIgnoredVulnerabilitiesByIdentifier(identifiers, result) {
-    var _a;
-    result.vulnerabilities = (_a = result.vulnerabilities) === null || _a === void 0 ? void 0 : _a.filter((v) => {
+    result.vulnerabilities = result.vulnerabilities?.filter((v) => {
         if (!('identifiers' in v))
             return true;
-        return !Object.entries(identifiers || {}).every(([key, value]) => hasIdentifier(Object.assign({}, v.identifiers), key, value));
+        return !Object.entries(identifiers || {}).every(([key, value]) => hasIdentifier({ ...v.identifiers }, key, value));
     });
 }
 function hasIdentifier(identifiers, key, value) {

package/lib/types.d.ts

@@ -19,7 +19,7 @@ export type Vulnerability = {
     atOrAbove?: string;
     severity: SeverityLevel;
     cwe: string[];
-    identifiers?: {
+    identifiers: {
         CVE?: string[];
         bug?: string;
         issue?: string;

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "4.3.3",
+  "version": "4.4.1",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -14,24 +14,24 @@
   "main": "./lib/retire.js",
   "dependencies": {
     "ansi-colors": "^4.1.1",
-    "commander": "^10.0.0",
-    "proxy-agent": "^6.2.0",
-    "uuid": "^9.0.0",
+    "commander": "^10.0.1",
+    "proxy-agent": "^6.4.0",
+    "uuid": "^9.0.1",
     "walkdir": "0.4.1",
-    "zod": "^3.20.6"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@types/node": "^18.13.0",
     "@types/uuid": "^9.0.0",
-    "@typescript-eslint/eslint-plugin": "^5.51.0",
-    "@typescript-eslint/parser": "^5.51.0",
+    "@typescript-eslint/eslint-plugin": "^6.11.0",
+    "@typescript-eslint/parser": "^6.11.0",
     "chai": "^4.3.4",
     "eslint": "^8.34.0",
-    "eslint-config-prettier": "^8.6.0",
+    "eslint-config-prettier": "^9.0.0",
     "jsonschema": "^1.4.1",
     "libxmljs": "^1.0.8",
     "mocha": "^10.2.0",
-    "prettier": "^2.8.4",
+    "prettier": "^3.1.0",
     "typescript": "^5.0.4"
   },
   "scripts": {
@@ -43,7 +43,7 @@
     "check": "npm run lint && npm run typecheck"
   },
   "engines": {
-    "node": ">= 14.0.0"
+    "node": ">= 18.0.0"
   },
   "keywords": [
     "sbom",