retire 5.1.2 → 5.1.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [5.1.4]
+
+### Bugfix
+
+- Fix bug where deepScan would sometimes not report vulnerabilities
+
+## [5.1.3]
+
+### Bugfix
+
+- Use URI detector on file paths as well
+
 ## [5.1.2]
 
 ### Bugfix

package/lib/deepscan.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deepScan = deepScan;
 const astronomical_1 = require("astronomical");
+const retire_1 = require("./retire");
 function deepScan(content, repo) {
     const astQueries = {};
     const backMap = {};
@@ -30,7 +31,6 @@ function deepScan(content, repo) {
     return detected.reduce((acc, cur) => {
         if (acc.some((c) => c.component === cur.component && c.version === cur.version))
             return acc;
-        acc.push(cur);
-        return acc;
+        return acc.concat((0, retire_1.check)(cur.component, cur.version, repo));
     }, []);
 }

package/lib/retire.d.ts

@@ -8,7 +8,7 @@ export declare function isVulnerable(results: Component[]): boolean;
 
 export declare function scanUri(uri: string, repo: Repository): Component[];
 
-export declare function scanFileName(fileName: string, repo: Repository): Component[];
+export declare function scanFileName(fileName: string, repo: Repository, includeUri: boolean): Component[];
 
 export declare function scanFileContent(content: string, repo: Repository, hasher: Hasher): Component[];
 

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.1.2';
+exports.version = '5.1.4';
 
 function isDefined(o) {
   return typeof o !== 'undefined';
@@ -167,8 +167,11 @@ exports.scanUri = function (uri, repo) {
   return check(result, repo);
 };
 
-exports.scanFileName = function (fileName, repo) {
+exports.scanFileName = function (fileName, repo, includeUri = false) {
   var result = scan(fileName, 'filename', repo, splitAndMatchAll(/[\/\\]/));
+  if (includeUri) {
+    result = result.concat(scan(fileName.replace(/\\/g, '/'), 'uri', repo));
+  }
   return check(result, repo);
 };
 

package/lib/scanner.js

@@ -129,7 +129,7 @@ function scanJsFile(file, repo, options) {
     if (options.ignore && shouldIgnorePath([file], options.ignore)) {
         return;
     }
-    let results = retire.scanFileName(file, repo);
+    let results = retire.scanFileName(file, repo, true);
     if (!results || results.length === 0) {
         const content = fs.readFileSync(file, 'utf-8');
         results = retire.scanFileContent(content, repo, hash);

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.1.2",
+  "version": "5.1.4",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",