retire 5.2.3 → 5.2.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/CHANGELOG.md +12 -0
  2. package/lib/cli.js +1 -0
  3. package/lib/reporters/cyclonedx-1_6-json.js +3 -1
  4. package/lib/reporters/cyclonedx-json.js +3 -1
  5. package/lib/reporters/cyclonedx.js +2 -1
  6. package/lib/retire.js +1 -1
  7. package/package.json +4 -3
package/CHANGELOG.md CHANGED
@@ -1,5 +1,17 @@
1
1
  # Changelog
2
2
 
3
+ ## [5.2.5]
4
+
5
+ ### Bugfix
6
+
7
+ - CLI argument `--ext` was not working
8
+
9
+ ## [5.2.4]
10
+
11
+ ### Bugfix
12
+
13
+ - Fix name vs group for scoped components in CycloneDX output
14
+
3
15
  ## [5.2.3]
4
16
 
5
17
  ### Bugfix
package/lib/cli.js CHANGED
@@ -112,6 +112,7 @@ const config = {
112
112
  verbose: !!prg.verbose,
113
113
  proxy: prg.proxy,
114
114
  deep: !!prg.deep,
115
+ ext: prg.ext ?? 'js',
115
116
  };
116
117
  log.info(`retire.js v${retire.version}`);
117
118
  function exitWithError(msg) {
package/lib/reporters/cyclonedx-1_6-json.js CHANGED
@@ -82,9 +82,11 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
82
82
  existing.evidence.occurrences.push(...missing);
83
83
  return undefined;
84
84
  }
85
+ const nameParts = dep.component.split('/').reverse();
85
86
  const result = {
86
87
  type: 'library',
87
- name: dep.component,
88
+ name: nameParts[0],
89
+ group: nameParts[1],
88
90
  version: dep.version,
89
91
  purl: purl,
90
92
  hashes: hashes,
package/lib/reporters/cyclonedx-json.js CHANGED
@@ -82,9 +82,11 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
82
82
  existing.properties.push(...missing);
83
83
  return undefined;
84
84
  }
85
+ const nameParts = dep.component.split('/').reverse();
85
86
  const result = {
86
87
  type: 'library',
87
- name: dep.component,
88
+ name: nameParts[0],
89
+ group: nameParts[1],
88
90
  version: dep.version,
89
91
  purl: purl,
90
92
  hashes: hashes,
package/lib/reporters/cyclonedx.js CHANGED
@@ -77,9 +77,10 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
77
77
  if (seen.has(purl))
78
78
  return '';
79
79
  seen.add(purl);
80
+ const nameParts = dep.component.split('/').reverse();
80
81
  return `
81
82
  <component type="library">
82
- <name>${dep.component}</name>
83
+ <name>${nameParts[0]}</name>${nameParts.length > 1 ? `\n <group>${nameParts[1]}</group>` : ''}
83
84
  <version>${dep.version}</version>${hashes}
84
85
  <licenses>${mapLicenses(dep.licenses)}</licenses>
85
86
  <purl>${purl}</purl>
package/lib/retire.js CHANGED
@@ -4,7 +4,7 @@
4
4
  */
5
5
 
6
6
  var exports = exports || {};
7
- exports.version = '5.2.3';
7
+ exports.version = '5.2.5';
8
8
 
9
9
  function isDefined(o) {
10
10
  return typeof o !== 'undefined';
package/package.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "author": "Erlend Oftedal <erlend@oftedal.no>",
3
3
  "name": "retire",
4
4
  "description": "Retire is a tool for detecting use of vulnerable libraries",
5
- "version": "5.2.3",
5
+ "version": "5.2.5",
6
6
  "license": "Apache-2.0",
7
7
  "repository": {
8
8
  "type": "git",
@@ -23,6 +23,7 @@
23
23
  },
24
24
  "devDependencies": {
25
25
  "@types/chai": "^4.3.17",
26
+ "@types/libxmljs": "^0.18.13",
26
27
  "@types/mocha": "^10.0.7",
27
28
  "@types/node": "^18.13.0",
28
29
  "@types/uuid": "^9.0.0",
@@ -32,11 +33,11 @@
32
33
  "eslint": "^8.34.0",
33
34
  "eslint-config-prettier": "^9.0.0",
34
35
  "jsonschema": "^1.4.1",
36
+ "libxmljs": "^1.0.11",
35
37
  "mocha": "^10.2.0",
36
38
  "prettier": "^3.1.0",
37
39
  "ts-node": "^10.9.2",
38
- "typescript": "^5.0.4",
39
- "xsd-schema-validator": "^0.9.0"
40
+ "typescript": "^5.0.4"
40
41
  },
41
42
  "scripts": {
42
43
  "test": "./test",