retire 4.4.2 → 4.4.4

package/CHANGELOG.md

@@ -1,12 +1,23 @@
 # Changelog
 
+## [4.4.4]
+
+### Bugfix
+
+- CLI argument `--ext` was not working
+
+## [4.4.3]
+
+### Bugfix
+
+- JSON format should not include results without vulnerabilities unless `--verbose` is specified.
+
 ## [4.4.2]
 
 ### Fix
 
 - Fix matching to include all matches
 
-
 ## [4.4.1]
 
 ### Chore

package/lib/cli.js

@@ -108,6 +108,7 @@ const config = {
     includeOsv: !!prg.includeOsv,
     verbose: !!prg.verbose,
     proxy: prg.proxy,
+    ext: prg.ext ?? 'js',
 };
 log.info(`retire.js v${retire.version}`);
 function exitWithError(msg) {

package/lib/depsdev.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkOSV = void 0;
+exports.checkOSV = checkOSV;
 const https_1 = __importDefault(require("https"));
 const retire_1 = require("./retire");
 function loadJson(url, options) {
@@ -80,4 +80,3 @@ async function checkOSV(packageName, version, options) {
         return [];
     }
 }
-exports.checkOSV = checkOSV;

package/lib/repo.js

@@ -23,7 +23,10 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadrepositoryFromFile = exports.loadrepository = exports.asbowerrepo = exports.validateRepository = void 0;
+exports.validateRepository = validateRepository;
+exports.asbowerrepo = asbowerrepo;
+exports.loadrepository = loadrepository;
+exports.loadrepositoryFromFile = loadrepositoryFromFile;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const http = __importStar(require("http"));
@@ -150,7 +153,6 @@ function validateRepository(repo, replacer) {
         .strict());
     return validator.safeParse(repo);
 }
-exports.validateRepository = validateRepository;
 function formatValidationError(error) {
     return JSON.stringify(error.format(), (key, value) => (Array.isArray(value) && value.length === 0 ? undefined : value), 2);
 }
@@ -254,7 +256,6 @@ function asbowerrepo(jsRepo) {
     });
     return result;
 }
-exports.asbowerrepo = asbowerrepo;
 async function loadrepository(repoUrl, options) {
     options = { ...options, process: retire.replaceVersion };
     if (options.nocache) {
@@ -262,9 +263,7 @@ async function loadrepository(repoUrl, options) {
     }
     return await loadFromCache(repoUrl, options.cachedir, options);
 }
-exports.loadrepository = loadrepository;
 async function loadrepositoryFromFile(filepath, options) {
     options = { ...options, process: retire.replaceVersion };
     return await loadJsonFromFile(filepath, options);
 }
-exports.loadrepositoryFromFile = loadrepositoryFromFile;

package/lib/reporters/json.js

@@ -44,6 +44,9 @@ exports.default = {
             };
         logger.warn = logger.error = (message) => finalResults.errors.push(message);
         logger.logVulnerableDependency = (finding) => {
+            if (!config.verbose) {
+                finding.results = finding.results.filter((r) => retire.isVulnerable([r]));
+            }
             finalResults.data.push(finding);
         };
         logger.logDependency = function (finding) {

package/lib/reporters/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generatePURL = void 0;
+exports.generatePURL = generatePURL;
 function generatePURL(component) {
     if (component.basePurl) {
         return component.basePurl + '@' + component.version;
@@ -8,4 +8,3 @@ function generatePURL(component) {
     const compName = component.npmname || component.component;
     return `pkg:npm/${compName}@${component.version}`;
 }
-exports.generatePURL = generatePURL;

package/lib/reporting.d.ts

@@ -1,6 +1,3 @@
-/// <reference types="node" />
-/// <reference types="node" />
-/// <reference types="node" />
 import { Finding } from './types';
 export type LoggerOptions = {
     outputpath: string;

package/lib/reporting.js

@@ -26,7 +26,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.open = exports.hash = void 0;
+exports.hash = void 0;
+exports.open = open;
 const fs = __importStar(require("fs"));
 const crypto = __importStar(require("crypto"));
 const console_1 = __importDefault(require("./reporters/console"));
@@ -127,4 +128,3 @@ function open(config) {
     configureFileWriter(config);
     return logger;
 }
-exports.open = open;

package/lib/resolve.d.ts

@@ -1,4 +1,3 @@
-/// <reference types="node" />
 import { EventEmitter as Emitter } from 'events';
 import { Options } from './types';
 export declare function scanJsFiles(path: string, options: Options): Emitter;

package/lib/resolve.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.scanJsFiles = void 0;
+exports.scanJsFiles = scanJsFiles;
 const fs = __importStar(require("fs"));
 const walkdir = __importStar(require("walkdir"));
 function scanJsFiles(path, options) {
@@ -51,4 +51,3 @@ function scanJsFiles(path, options) {
     });
     return finder;
 }
-exports.scanJsFiles = scanJsFiles;

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '4.4.2';
+exports.version = '4.4.4';
 
 function isDefined(o) {
   return typeof o !== 'undefined';
@@ -26,7 +26,7 @@ function scan(data, extractor, repo, matcher = simpleMatch) {
     if (!isDefined(extractors)) continue;
     for (var i in extractors) {
       var matches = matcher(extractors[i], data);
-      matches.forEach(match => {
+      matches.forEach((match) => {
         match = match.replace(/(\.|-)min$/, '');
         detected.push({
           version: match,
@@ -42,20 +42,20 @@ function scan(data, extractor, repo, matcher = simpleMatch) {
 }
 
 function simpleMatch(regex, data) {
-  var re = new RegExp(regex, "g");
+  var re = new RegExp(regex, 'g');
   const result = [];
   let match;
-  while (match = re.exec(data)) {
+  while ((match = re.exec(data))) {
     result.push(match[1]);
   }
   return result;
 }
 function replacementMatch(regex, data) {
   var ar = /^\/(.*[^\\])\/([^\/]+)\/$/.exec(regex);
-  var re = new RegExp(ar[1], "g");
+  var re = new RegExp(ar[1], 'g');
   const result = [];
   let match;
-  while(match = re.exec(data)) {
+  while ((match = re.exec(data))) {
     var ver = null;
     if (match) {
       ver = match[0].replace(new RegExp(ar[1]), ar[2]);

package/lib/scanner.js

@@ -23,7 +23,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.on = exports.scanBowerFile = exports.scanJsFile = void 0;
+exports.scanJsFile = scanJsFile;
+exports.scanBowerFile = scanBowerFile;
+exports.on = on;
 const events_1 = require("events");
 const retire = __importStar(require("./retire"));
 const fs = __importStar(require("fs"));
@@ -132,7 +134,6 @@ function scanJsFile(file, repo, options) {
     }
     emitResults({ file: file, results: results }, options);
 }
-exports.scanJsFile = scanJsFile;
 function scanBowerFile(file, repo, options) {
     if (options.ignore && shouldIgnorePath([file], options.ignore)) {
         return;
@@ -148,8 +149,6 @@ function scanBowerFile(file, repo, options) {
         options.log.warn(`Could not parse file: ${file}`);
     }
 }
-exports.scanBowerFile = scanBowerFile;
 function on(event, handler) {
     events.on(event, handler);
 }
-exports.on = on;

package/lib/types.d.ts

@@ -1,4 +1,3 @@
-/// <reference types="node" />
 import { Logger } from './reporting';
 export type Repository = Record<string, {
     bowername?: string[];

package/lib/utils.js

@@ -1,18 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.flatten = exports.pick = exports.warn = exports.info = void 0;
+exports.info = info;
+exports.warn = warn;
+exports.pick = pick;
+exports.flatten = flatten;
 function info(options) {
     return function (...message) {
         (options.logger || console.log)(message);
     };
 }
-exports.info = info;
 function warn(options) {
     return function (...message) {
         (options.warnlogger || options.logger || console.warn)(message);
     };
 }
-exports.warn = warn;
 function pick(p, keys) {
     const result = {};
     keys.forEach((k) => {
@@ -22,8 +23,6 @@ function pick(p, keys) {
     });
     return result;
 }
-exports.pick = pick;
 function flatten(e) {
     return e.reduce((x, y) => x.concat(y), []);
 }
-exports.flatten = flatten;

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "4.4.2",
+  "version": "4.4.4",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -29,10 +29,10 @@
     "eslint": "^8.34.0",
     "eslint-config-prettier": "^9.0.0",
     "jsonschema": "^1.4.1",
-    "libxmljs": "^1.0.8",
     "mocha": "^10.2.0",
     "prettier": "^3.1.0",
-    "typescript": "^5.0.4"
+    "typescript": "^5.0.4",
+    "xsd-schema-validator": "^0.9.0"
   },
   "scripts": {
     "test": "./test",