retire 5.2.2 → 5.2.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [5.2.4]
+
+### Bugfix
+
+- Fix name vs group for scoped components in CycloneDX output
+
+## [5.2.3]
+
+### Bugfix
+
+- Fix license handling for complex licenses
+
 ## [5.2.2]
 
 ### Bugfix

package/lib/license.js

@@ -15,10 +15,11 @@ function evaluateLicense(licenses, version) {
             .slice(splitIndex + 1)
             .trim()
             .split(';')
+            .map((x) => x.trim())
             .map((range) => {
             const [from, to] = range.split(' ').map((v) => v.trim());
             if (!from.startsWith('>='))
-                throw new Error("Invalid license range: 'from' must start with '>=': " + range);
+                throw new Error("Invalid license range: 'from' must start with '>=': " + range + '[' + from + ']' + '[' + to + ']');
             if (to && !to.startsWith('<'))
                 throw new Error("Invalid license range: 'to' must start with '<': " + range);
             if (to && to.startsWith('<='))

package/lib/reporters/cyclonedx-1_6-json.js

@@ -82,9 +82,11 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 existing.evidence.occurrences.push(...missing);
                 return undefined;
             }
+            const nameParts = dep.component.split('/').reverse();
             const result = {
                 type: 'library',
-                name: dep.component,
+                name: nameParts[0],
+                group: nameParts[1],
                 version: dep.version,
                 purl: purl,
                 hashes: hashes,

package/lib/reporters/cyclonedx-json.js

@@ -82,9 +82,11 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                 existing.properties.push(...missing);
                 return undefined;
             }
+            const nameParts = dep.component.split('/').reverse();
             const result = {
                 type: 'library',
-                name: dep.component,
+                name: nameParts[0],
+                group: nameParts[1],
                 version: dep.version,
                 purl: purl,
                 hashes: hashes,

package/lib/reporters/cyclonedx.js

@@ -77,9 +77,10 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
             if (seen.has(purl))
                 return '';
             seen.add(purl);
+            const nameParts = dep.component.split('/').reverse();
             return `
     <component type="library">
-      <name>${dep.component}</name>
+      <name>${nameParts[0]}</name>${nameParts.length > 1 ? `\n      <group>${nameParts[1]}</group>` : ''}
       <version>${dep.version}</version>${hashes}
       <licenses>${mapLicenses(dep.licenses)}</licenses>
       <purl>${purl}</purl>

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.2.2';
+exports.version = '5.2.4';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.2.2",
+  "version": "5.2.4",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",