retire 5.4.2 → 5.4.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +4 -0
  2. package/lib/repo.js +1 -0
  3. package/lib/reporters/cyclonedx-1_6-json.js +2 -2
  4. package/lib/reporters/cyclonedx-json.js +2 -2
  5. package/lib/reporters/cyclonedx.js +2 -2
  6. package/lib/retire.js +4 -1
  7. package/lib/types.d.ts +1 -0
  8. package/package.json +1 -2
package/CHANGELOG.md CHANGED
@@ -1,5 +1,9 @@
1
1
  # Changelog
2
2
 
3
+ ## [5.4.3]
4
+
5
+ * Remove dependencies that are not needed anymore
6
+
3
7
  ## [5.4.2]
4
8
 
5
9
  * Fix build scripts
package/lib/repo.js CHANGED
@@ -98,6 +98,7 @@ function validateRepository(repo, replacer) {
98
98
  if (ids == 0)
99
99
  ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Must have at least one identifier' });
100
100
  }),
101
+ details: z.string().optional(),
101
102
  info: z.array(z.string().regex(/^https?:\/\/.+/)),
102
103
  })
103
104
  .strict();
package/lib/reporters/cyclonedx-1_6-json.js CHANGED
@@ -35,9 +35,9 @@ var __importStar = (this && this.__importStar) || (function () {
35
35
  Object.defineProperty(exports, "__esModule", { value: true });
36
36
  const retire = __importStar(require("../retire"));
37
37
  const fs = __importStar(require("fs"));
38
- const uuid_1 = require("uuid");
39
38
  const utils_1 = require("./utils");
40
39
  const path = __importStar(require("path"));
40
+ const crypto = __importStar(require("crypto"));
41
41
  function configureCycloneDXJSONLogger(logger, writer, config, hash) {
42
42
  let vulnsFound = false;
43
43
  const finalResults = {
@@ -145,7 +145,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
145
145
  write(JSON.stringify({
146
146
  bomFormat: 'CycloneDX',
147
147
  specVersion: '1.6',
148
- serialNumber: `urn:uuid:${(0, uuid_1.v4)()}`,
148
+ serialNumber: `urn:uuid:${crypto.randomUUID()}`,
149
149
  version: 1,
150
150
  metadata: {
151
151
  timestamp: finalResults.start,
package/lib/reporters/cyclonedx-json.js CHANGED
@@ -35,9 +35,9 @@ var __importStar = (this && this.__importStar) || (function () {
35
35
  Object.defineProperty(exports, "__esModule", { value: true });
36
36
  const retire = __importStar(require("../retire"));
37
37
  const fs = __importStar(require("fs"));
38
- const uuid_1 = require("uuid");
39
38
  const utils_1 = require("./utils");
40
39
  const path = __importStar(require("path"));
40
+ const crypto = __importStar(require("crypto"));
41
41
  function configureCycloneDXJSONLogger(logger, writer, config, hash) {
42
42
  let vulnsFound = false;
43
43
  const finalResults = {
@@ -111,7 +111,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
111
111
  write(JSON.stringify({
112
112
  bomFormat: 'CycloneDX',
113
113
  specVersion: '1.4',
114
- serialNumber: `urn:uuid:${(0, uuid_1.v4)()}`,
114
+ serialNumber: `urn:uuid:${crypto.randomUUID()}`,
115
115
  version: 1,
116
116
  metadata: {
117
117
  timestamp: finalResults.start,
package/lib/reporters/cyclonedx.js CHANGED
@@ -36,8 +36,8 @@ var __importStar = (this && this.__importStar) || (function () {
36
36
  Object.defineProperty(exports, "__esModule", { value: true });
37
37
  const retire = __importStar(require("../retire"));
38
38
  const fs = __importStar(require("fs"));
39
- const uuid_1 = require("uuid");
40
39
  const utils_1 = require("./utils");
40
+ const crypto = __importStar(require("crypto"));
41
41
  function configureCycloneDXLogger(logger, writer, config, hash) {
42
42
  let vulnsFound = false;
43
43
  const finalResults = {
@@ -100,7 +100,7 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
100
100
  .join(''))
101
101
  .join('');
102
102
  write(`<?xml version="1.0"?>
103
- <bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:${(0, uuid_1.v4)()}" version="1">
103
+ <bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:${crypto.randomUUID()}" version="1">
104
104
  <metadata>
105
105
  <timestamp>${finalResults.start.toISOString()}</timestamp>
106
106
  <tools>
package/lib/retire.js CHANGED
@@ -4,7 +4,7 @@
4
4
  */
5
5
 
6
6
  var exports = exports || {};
7
- exports.version = '5.4.2';
7
+ exports.version = '5.4.3';
8
8
 
9
9
  function isDefined(o) {
10
10
  return typeof o !== 'undefined';
@@ -116,6 +116,9 @@ function check(results, repo) {
116
116
  if (vulns[i].cwe) {
117
117
  vulnerability.cwe = vulns[i].cwe;
118
118
  }
119
+ if (vulns[i].details) {
120
+ vulnerability.details = vulns[i].details;
121
+ }
119
122
  result.vulnerabilities = result.vulnerabilities || [];
120
123
  result.vulnerabilities.push(vulnerability);
121
124
  }
package/lib/types.d.ts CHANGED
@@ -28,6 +28,7 @@ export type Vulnerability = {
28
28
  summary?: string;
29
29
  githubID?: string;
30
30
  };
31
+ details?: string;
31
32
  info: string[];
32
33
  };
33
34
  export type Component = {
package/package.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "author": "Erlend Oftedal <erlend@oftedal.no>",
3
3
  "name": "retire",
4
4
  "description": "Retire is a tool for detecting use of vulnerable libraries",
5
- "version": "5.4.2",
5
+ "version": "5.4.3",
6
6
  "license": "Apache-2.0",
7
7
  "repository": {
8
8
  "type": "git",
@@ -17,7 +17,6 @@
17
17
  "astronomical": "^3.0.0",
18
18
  "commander": "^10.0.1",
19
19
  "proxy-agent": "^6.4.0",
20
- "uuid": "^9.0.1",
21
20
  "walkdir": "0.4.1",
22
21
  "zod": "^3.22.4"
23
22
  },