retire 5.1.0 → 5.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,8 +1,20 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [5.1.2]
|
|
4
|
+
|
|
5
|
+
### Bugfix
|
|
6
|
+
|
|
7
|
+
- JSON format should not include results without vulnerabilities unless `--verbose` is specified.
|
|
8
|
+
|
|
9
|
+
## [5.1.1]
|
|
10
|
+
|
|
11
|
+
### Bugfix
|
|
12
|
+
|
|
13
|
+
- Remove duplicates in filename output in CycloneDX JSON formats
|
|
14
|
+
|
|
3
15
|
## [5.1.0]
|
|
4
16
|
|
|
5
|
-
|
|
17
|
+
### Add
|
|
6
18
|
|
|
7
19
|
- Support for CycloneDX 1.6 JSON as output format
|
|
8
20
|
- Adding file location as property in CycloneDX 1.4 JSON output
|
|
@@ -76,8 +76,10 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
|
|
|
76
76
|
];
|
|
77
77
|
}
|
|
78
78
|
const purl = (0, utils_1.generatePURL)(dep);
|
|
79
|
-
|
|
80
|
-
|
|
79
|
+
const existing = seen.get(purl);
|
|
80
|
+
if (existing) {
|
|
81
|
+
const missing = evidence.occurrences.filter((x) => !existing.evidence.occurrences.some((y) => y.location == x.location));
|
|
82
|
+
existing.evidence.occurrences.push(...missing);
|
|
81
83
|
return undefined;
|
|
82
84
|
}
|
|
83
85
|
const result = {
|
|
@@ -55,7 +55,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
|
|
|
55
55
|
};
|
|
56
56
|
logger.close = function (callback) {
|
|
57
57
|
const write = vulnsFound ? writer.err : writer.out;
|
|
58
|
-
const seen = new
|
|
58
|
+
const seen = new Map();
|
|
59
59
|
const components = finalResults.data
|
|
60
60
|
.filter((d) => d.results)
|
|
61
61
|
.map((r) => r.results
|
|
@@ -76,10 +76,13 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
|
|
|
76
76
|
];
|
|
77
77
|
}
|
|
78
78
|
const purl = (0, utils_1.generatePURL)(dep);
|
|
79
|
-
|
|
79
|
+
const existing = seen.get(purl);
|
|
80
|
+
if (existing) {
|
|
81
|
+
const missing = properties.filter((p) => !existing.properties.some((ep) => ep.value === p.value));
|
|
82
|
+
existing.properties.push(...missing);
|
|
80
83
|
return undefined;
|
|
81
|
-
|
|
82
|
-
|
|
84
|
+
}
|
|
85
|
+
const result = {
|
|
83
86
|
type: 'library',
|
|
84
87
|
name: dep.component,
|
|
85
88
|
version: dep.version,
|
|
@@ -87,6 +90,8 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
|
|
|
87
90
|
hashes: hashes,
|
|
88
91
|
properties,
|
|
89
92
|
};
|
|
93
|
+
seen.set(purl, result);
|
|
94
|
+
return result;
|
|
90
95
|
})
|
|
91
96
|
.filter((x) => x != undefined))
|
|
92
97
|
.reduce((a, b) => a.concat(b), []);
|
package/lib/reporters/json.js
CHANGED
|
@@ -44,6 +44,9 @@ exports.default = {
|
|
|
44
44
|
};
|
|
45
45
|
logger.warn = logger.error = (message) => finalResults.errors.push(message);
|
|
46
46
|
logger.logVulnerableDependency = (finding) => {
|
|
47
|
+
if (!config.verbose) {
|
|
48
|
+
finding.results = finding.results.filter((r) => retire.isVulnerable([r]));
|
|
49
|
+
}
|
|
47
50
|
finalResults.data.push(finding);
|
|
48
51
|
};
|
|
49
52
|
logger.logDependency = function (finding) {
|
package/lib/retire.js
CHANGED
package/package.json
CHANGED