retire 5.3.0 → 5.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +14 -0
- package/lib/cli.js +1 -1
- package/lib/repo.js +1 -0
- package/lib/retire.js +4 -1
- package/lib/types.d.ts +1 -0
- package/package.json +3 -3
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,19 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [5.4.2]
|
|
4
|
+
|
|
5
|
+
* Fix build scripts
|
|
6
|
+
|
|
7
|
+
## [5.4.1]
|
|
8
|
+
|
|
9
|
+
* Upgrade dependencies
|
|
10
|
+
|
|
11
|
+
## [5.4.0]
|
|
12
|
+
|
|
13
|
+
### Improvements
|
|
14
|
+
|
|
15
|
+
- Add possibility to exclude specific versions for a vulnerability (example: jquery-1.12.4-aem which has some extra patches).
|
|
16
|
+
|
|
3
17
|
## [5.3.0]
|
|
4
18
|
|
|
5
19
|
### Improvement
|
package/lib/cli.js
CHANGED
|
@@ -88,7 +88,7 @@ const colorwarn = prg.colors ? ansi_colors_1.default.red : (x) => x;
|
|
|
88
88
|
const jsrepolocation = (prg.jsrepo ?? "'central'")
|
|
89
89
|
.split(',')
|
|
90
90
|
.map((x) => x === "'central'"
|
|
91
|
-
? 'https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository-
|
|
91
|
+
? 'https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository-v5.json'
|
|
92
92
|
: x);
|
|
93
93
|
const ignorefile = prg.ignorefile ?? defaultIgnoreFiles.filter((x) => fs_1.default.existsSync(x))[0];
|
|
94
94
|
const scanpath = prg.path ?? prg.jspath ?? '.';
|
package/lib/repo.js
CHANGED
|
@@ -54,6 +54,7 @@ function validateRepository(repo, replacer) {
|
|
|
54
54
|
.object({
|
|
55
55
|
below: versionValidator,
|
|
56
56
|
atOrAbove: versionValidator.optional(),
|
|
57
|
+
excludes: z.array(versionValidator).optional(),
|
|
57
58
|
severity: z.enum(keys),
|
|
58
59
|
cwe: z.array(z.string().regex(/^CWE-[0-9]+$/)).min(1),
|
|
59
60
|
identifiers: z
|
package/lib/retire.js
CHANGED
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
*/
|
|
5
5
|
|
|
6
6
|
var exports = exports || {};
|
|
7
|
-
exports.version = '5.
|
|
7
|
+
exports.version = '5.4.2';
|
|
8
8
|
|
|
9
9
|
function isDefined(o) {
|
|
10
10
|
return typeof o !== 'undefined';
|
|
@@ -103,6 +103,9 @@ function check(results, repo) {
|
|
|
103
103
|
if (isDefined(vulns[i].atOrAbove) && !isAtOrAbove(result.version, vulns[i].atOrAbove)) {
|
|
104
104
|
continue;
|
|
105
105
|
}
|
|
106
|
+
if (isDefined(vulns[i].excludes) && vulns[i].excludes.includes(result.version)) {
|
|
107
|
+
continue;
|
|
108
|
+
}
|
|
106
109
|
var vulnerability = { info: vulns[i].info, below: vulns[i].below, atOrAbove: vulns[i].atOrAbove };
|
|
107
110
|
if (vulns[i].severity) {
|
|
108
111
|
vulnerability.severity = vulns[i].severity;
|
package/lib/types.d.ts
CHANGED
package/package.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"author": "Erlend Oftedal <erlend@oftedal.no>",
|
|
3
3
|
"name": "retire",
|
|
4
4
|
"description": "Retire is a tool for detecting use of vulnerable libraries",
|
|
5
|
-
"version": "5.
|
|
5
|
+
"version": "5.4.2",
|
|
6
6
|
"license": "Apache-2.0",
|
|
7
7
|
"repository": {
|
|
8
8
|
"type": "git",
|
|
@@ -14,7 +14,7 @@
|
|
|
14
14
|
"main": "./lib/retire.js",
|
|
15
15
|
"dependencies": {
|
|
16
16
|
"ansi-colors": "^4.1.1",
|
|
17
|
-
"astronomical": "^
|
|
17
|
+
"astronomical": "^3.0.0",
|
|
18
18
|
"commander": "^10.0.1",
|
|
19
19
|
"proxy-agent": "^6.4.0",
|
|
20
20
|
"uuid": "^9.0.1",
|
|
@@ -22,8 +22,8 @@
|
|
|
22
22
|
"zod": "^3.22.4"
|
|
23
23
|
},
|
|
24
24
|
"devDependencies": {
|
|
25
|
-
"@types/jest": "^29.5.14",
|
|
26
25
|
"@types/chai": "^4.3.17",
|
|
26
|
+
"@types/jest": "^29.5.14",
|
|
27
27
|
"@types/node": "^18.13.0",
|
|
28
28
|
"@types/uuid": "^9.0.0",
|
|
29
29
|
"@typescript-eslint/eslint-plugin": "^7.1.1",
|