retire 5.6.0 → 6.0.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## [6.0.0]
+
+### Breaking changes
+
+- Requires Node.js 20.19+ or 22.12+ (previously 18+).
+- `--proxy` (and the `http_proxy` environment variable) now only supports `http://` and `https://` proxy URLs. SOCKS (`socks://`, `socks5://`, ...) and PAC (`pac+http://`, ...) proxies are no longer supported and fail with an `Unsupported proxy protocol` error.
+
+### Improvements
+
+- Replaced the `proxy-agent` dependency (and its 27 transitive packages) with a small built-in proxy client. Proxy credentials in the URL (`http://user:pass@host:port`) are still supported.
+- Removed the `ansi-colors` dependency.
+
+### Bugfixes
+
+- `--includeOsv` lookups ignored `--proxy`, `--insecure` and `--cacert`. They now use the same settings as the repository download.
+- `--includeOsv` looked up advisories under the repository's display name instead of the npm package name, so most components that declare an `npmname` silently got no OSV results (#626).
+- `--includeOsv` findings could be missing from the report, because the report was closed before the OSV lookups finished (#623).
+- Invalid CLI input (an unknown `--severity`, an unreadable `--cacert` or ignore file) now stops before scanning with an error message instead of a stack trace (#623).
+- Malformed repository files and malformed OSV responses are reported with their source, instead of crashing the scan (#623).
+- Errors while scanning files or `bower.json` are now reported, and the scan exits with code 1 (#623).
+- `bower.json` files were not detected on Windows paths (#623).
+- Distinct CVEs that share an issue were merged into one finding, while repeated advisories for the same vulnerability were not deduplicated (#623).
+- The upper bound of a license version range was treated as inclusive (#623).
+- CycloneDX output could change the scan results used by other reporters, and duplicate components are now merged together with their vulnerabilities and evidence (#625).
+
+## [5.7.0]
+
+### Improvements
+
+- Added CycloneDX 1.7 output: `--outputformat cyclonedxJSON1_7` and `cyclonedxJSON1_7_VEX`.
+- CycloneDX 1.7 reports every resolved license, each as its own SPDX expression. Earlier spec versions only allow a single expression per component, so 1.4/1.6 output still reports the first license only.
+- The CycloneDX 1.6 and 1.7 reports now include:
+  - `$schema`, pointing at the schema for the emitted spec version.
+  - `metadata.tools` in the object form introduced in 1.5, replacing the deprecated legacy array.
+  - `metadata.component`, describing the scanned path as the subject of the BOM.
+  - `dependencies`, linking the scan target to every detected component.
+  - `evidence.identity`, reporting how the version was detected (`filecontent`, `filename`, `hash`, `ast`, ...) as a CycloneDX identity technique and confidence.
+  - `vulnerabilities[].detail`, when the repository supplies `details` (VEX variants only).
+
+### Bugfixes
+
+- CycloneDX 1.6 output threw when a vulnerability in a custom `--jsrepo` had no `cwe`, and could throw on a vulnerability with no `identifiers`.
+
 ## [5.6.0]
 
 ### Improvements

package/README.md

@@ -18,7 +18,8 @@ Options:
   --jsrepo <path|url>      Local or internal version of repo. Can be multiple comma separated. Default: 'central')
   --cachedir <path>        Path to use for local cache instead of /tmp/.retire-cache
   --proxy <url>            Proxy url (http://some.host:8080)
-  --outputformat <format>  Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx and cyclonedxJSON
+  --outputformat <format>  Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6,
+                           cyclonedxJSON1_6_VEX, cyclonedxJSON1_7 and cyclonedxJSON1_7_VEX
   --outputpath <path>      File to which output should be written
   --ignore <paths>         Comma delimited list of paths to ignore
   --ignorefile <path>      Custom ignore file, defaults to .retireignore / .retireignore.json
@@ -35,7 +36,9 @@ Options:
 ```
 
 The `depcheck` output format mimics the output of OWASP Dependency Check, but lacks some information compared to OWASP Dependency Check, because that information is not in the repo.
-The `cyclonedx` output format is based on based on the https://github.com/CycloneDX spec.
+The `cyclonedx` output format is based on the https://github.com/CycloneDX spec. `cyclonedx` and `cyclonedxJSON` emit CycloneDX 1.4
+(XML and JSON respectively). `cyclonedxJSON1_6` and `cyclonedxJSON1_7` emit JSON for the corresponding spec versions, and the
+`_VEX` variants of those additionally include a `vulnerabilities` section.
 
 ## .retireignore
 

package/lib/cli.js

@@ -47,11 +47,8 @@ const reporting = __importStar(require("./reporting"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
-const ansi_colors_1 = __importDefault(require("ansi-colors"));
-const events_1 = require("events");
 const types_1 = require("./types");
-const z = __importStar(require("zod"));
-const events = new events_1.EventEmitter();
+const parseIgnoreFile_1 = require("./parseIgnoreFile");
 let failProcess = false;
 const defaultIgnoreFiles = ['.retireignore', '.retireignore.json'];
 if (process.argv.includes('--node') || process.argv.includes('-n')) {
@@ -70,7 +67,7 @@ const prg = commander_1.program
     .option('--jsrepo <path|url>', "Local or internal version of repo. Can be multiple comma separated. Default: 'central')")
     .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
     .option('--proxy <url>', 'Proxy url (http://some.host:8080)')
-    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6, cyclonedxJSON1_6_VEX')
+    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6, cyclonedxJSON1_6_VEX, cyclonedxJSON1_7, cyclonedxJSON1_7_VEX')
     .option('--outputpath <path>', 'File to which output should be written')
     .option('--ignore <paths>', 'Comma delimited list of paths to ignore')
     .option('--ignorefile <path>', 'Custom ignore file, defaults to .retireignore / .retireignore.json')
@@ -84,7 +81,8 @@ const prg = commander_1.program
     .option('--deep', 'Deep scan (slower and experimental)')
     .parse()
     .opts();
-const colorwarn = prg.colors ? ansi_colors_1.default.red : (x) => x;
+const red = (x) => `\u001b[31m${x}\u001b[39m`;
+const colorwarn = prg.colors ? red : (x) => x;
 const jsrepolocation = (prg.jsrepo ?? "'central'")
     .split(',')
     .map((x) => x === "'central'"
@@ -103,9 +101,6 @@ const log = reporting.open({
     verbose: !!prg.verbose,
 });
 const severity = prg.severity ?? 'none';
-if (!(severity in types_1.severityLevels)) {
-    exitWithError(`Error: Invalid severity level (${severity}). Valid levels are: ${Object.keys(types_1.severityLevels).join(', ')}`);
-}
 const config = {
     path: scanpath,
     ignore: {
@@ -122,109 +117,84 @@ const config = {
     includeOsv: !!prg.includeOsv,
     verbose: !!prg.verbose,
     proxy: prg.proxy,
+    insecure: !!prg.insecure,
     deep: !!prg.deep,
     ext: prg.ext ?? 'js',
 };
-log.info(`retire.js v${retire.version}`);
-function exitWithError(msg) {
-    log.error(config.colorwarn(msg));
+function exitWithError(error) {
+    log.error(colorwarn(String(error)));
     process.exitCode = 1;
     log.close();
 }
-if (prg.cacert) {
-    if (!fs_1.default.existsSync(prg.cacert)) {
-        exitWithError(`Error: Could not read cacert file: ${prg.cacert}`);
-    }
-    config.cacertbuf = fs_1.default.readFileSync(prg.cacert);
+function scan() {
+    scanner.on('vulnerable-dependency-found', (result) => {
+        const levels = result.results.map((r) => {
+            return r.vulnerabilities
+                ? r.vulnerabilities.map((v) => {
+                    return types_1.severityLevels[v.severity ?? 'critical'];
+                })
+                : [];
+        });
+        const severity = utils.flatten(levels).reduce((x, y) => (x > y ? x : y));
+        if (severity >= types_1.severityLevels[config.severity]) {
+            failProcess = true;
+        }
+    });
+    scanner.on('vulnerable-dependency-found', log.logVulnerableDependency);
+    scanner.on('dependency-found', log.logDependency);
+    Promise.all(jsrepolocation.map((jsr) => jsr.match(/^https?:\/\//) ? repo.loadrepository(jsr, config) : repo.loadrepositoryFromFile(jsr, config)))
+        .then(async (jsRepos) => {
+        const scans = [];
+        let scanError;
+        const failed = (error) => {
+            scanError = error;
+        };
+        await new Promise((done) => {
+            resolve
+                .scanJsFiles(config.path, config)
+                .on('jsfile', (file) => {
+                jsRepos.forEach((jsRepo) => {
+                    scans.push(scanner.scanJsFile(file, jsRepo, config).catch(failed));
+                });
+            })
+                .on('bowerfile', (bowerfile) => {
+                jsRepos.forEach((jsRepo) => {
+                    const bowerRepo = repo.asbowerrepo(jsRepo);
+                    scans.push(scanner.scanBowerFile(bowerfile, bowerRepo, config).catch(failed));
+                });
+            })
+                .on('fail', (file, err) => failed(`Could not scan ${file}: ${err ?? 'Unknown error'}`))
+                .on('error', failed)
+                .on('end', done);
+        });
+        await Promise.all(scans);
+        if (scanError !== undefined)
+            throw scanError;
+        process.exitCode = failProcess ? config.exitwith : 0;
+        log.close();
+    })
+        .catch(exitWithError);
 }
-const ignoreFileParser = z.array(z
-    .object({
-    justification: z.string(),
-})
-    .and(z
-    .object({
-    path: z.string(),
-})
-    .or(z.object({
-    component: z.string(),
-    version: z.string().optional(),
-    identifiers: z.record(z.string(), z.string()).optional(),
-}))));
-if (ignorefile) {
-    if (!fs_1.default.existsSync(ignorefile)) {
-        exitWithError(`Error: Could not read ignore file: ${ignorefile}`);
+try {
+    if (!types_1.severityParser.safeParse(severity).success) {
+        throw new Error(`Invalid severity level (${severity}). Valid levels are: ${Object.keys(types_1.severityLevels).join(', ')}`);
     }
-    if (ignorefile.substr(-5) === '.json') {
-        try {
-            config.ignore.descriptors = ignoreFileParser.parse(JSON.parse(fs_1.default.readFileSync(ignorefile, 'utf-8')));
-        }
-        catch (e) {
-            exitWithError(`Error: Invalid ignore file: ${ignorefile}`);
+    log.info(`retire.js v${retire.version}`);
+    if (prg.cacert) {
+        if (!fs_1.default.existsSync(prg.cacert)) {
+            throw new Error(`Could not read cacert file: ${prg.cacert}`);
         }
-        const ignoredPaths = config.ignore.descriptors
-            ?.map((x) => ('path' in x ? x.path : undefined))
-            ?.filter((x) => x != undefined) ?? [];
-        config.ignore.pathsAsString = config.ignore.pathsAsString.concat(ignoredPaths);
+        config.cacertbuf = fs_1.default.readFileSync(prg.cacert);
     }
-    else {
-        const lines = fs_1.default
-            .readFileSync(ignorefile, 'utf-8')
-            .split(/\r\n|\n/g)
-            .filter((e) => e !== '');
-        const ignored = lines.map((e) => {
-            return e[0] === '@' ? e.slice(1) : path_1.default.resolve(e);
-        });
-        config.ignore.pathsAsString = config.ignore.pathsAsString.concat(ignored);
+    if (ignorefile) {
+        config.ignore.pathsAsString = (0, parseIgnoreFile_1.parseIgnoreFile)(ignorefile, config);
     }
+    config.ignore.paths = config.ignore.pathsAsString
+        .map((p) => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
+        .map((p) => p.replace(/[*]{1,2}/g, (a) => (a.length == 2 ? '.*' : '[^/]*')))
+        .map((s) => new RegExp(s));
+    scan();
+}
+catch (error) {
+    exitWithError(error);
 }
-config.ignore.paths = config.ignore.pathsAsString
-    .map((p) => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
-    .map((p) => p.replace(/[*]{1,2}/g, (a) => (a.length == 2 ? '.*' : '[^/]*')))
-    .map((s) => new RegExp(s));
-scanner.on('vulnerable-dependency-found', (result) => {
-    const levels = result.results.map((r) => {
-        return r.vulnerabilities
-            ? r.vulnerabilities.map((v) => {
-                return types_1.severityLevels[v.severity ?? 'critical'];
-            })
-            : [];
-    });
-    const severity = utils.flatten(levels).reduce((x, y) => (x > y ? x : y));
-    if (severity >= types_1.severityLevels[config.severity]) {
-        failProcess = true;
-    }
-});
-scanner.on('vulnerable-dependency-found', log.logVulnerableDependency);
-scanner.on('dependency-found', log.logDependency);
-events.on('scan-done', () => {
-    process.exitCode = failProcess ? config.exitwith : 0;
-    log.close();
-});
-process.on('uncaughtException', (err, ...rest) => {
-    console.warn('Exception caught: ', err, rest);
-    console.warn(err.stack);
-    process.exit(1);
-});
-events.on('stop', (err) => {
-    exitWithError(err);
-});
-Promise.all(jsrepolocation.map((jsr) => jsr.match(/^https?:\/\//) ? repo.loadrepository(jsr, config) : repo.loadrepositoryFromFile(jsr, config)))
-    .then((jsRepos) => {
-    resolve
-        .scanJsFiles(config.path, config)
-        .on('jsfile', (file) => {
-        jsRepos.forEach((jsRepo) => {
-            scanner.scanJsFile(file, jsRepo, config);
-        });
-    })
-        .on('bowerfile', (bowerfile) => {
-        jsRepos.forEach((jsRepo) => {
-            const bowerRepo = repo.asbowerrepo(jsRepo);
-            scanner.scanBowerFile(bowerfile, bowerRepo, config);
-        });
-    })
-        .on('end', () => {
-        events.emit('scan-done');
-    });
-})
-    .catch((e) => events.emit('stop', e));

package/lib/depsdev.js

@@ -1,31 +1,31 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkOSV = checkOSV;
-const https_1 = __importDefault(require("https"));
+const http_1 = require("./http");
 const retire_1 = require("./retire");
-function loadJson(url, options) {
+async function loadJson(url, options) {
     options.log.debug('Downloading ' + url + ' ...');
+    const res = await (0, http_1.get)(url, (0, http_1.requestSettings)(options));
     return new Promise((resolve, reject) => {
-        const req = https_1.default.request(url, (res) => {
-            if (res.statusCode == 404)
-                return resolve(undefined);
-            if (res.statusCode != 200) {
-                return reject('HTTP ' + res.statusCode + ' ' + res.statusMessage + ' for ' + url);
-            }
-            const data = [];
-            res.on('data', (c) => data.push(c));
-            res.on('end', () => {
-                const result = Buffer.concat(data).toString();
+        if (res.statusCode != 200)
+            res.resume();
+        if (res.statusCode == 404)
+            return resolve(undefined);
+        if (res.statusCode != 200) {
+            return reject('HTTP ' + res.statusCode + ' ' + res.statusMessage + ' for ' + url);
+        }
+        const data = [];
+        res.on('data', (c) => data.push(c));
+        res.on('error', reject);
+        res.on('end', () => {
+            const result = Buffer.concat(data).toString();
+            try {
                 resolve(JSON.parse(result));
-            });
-        });
-        req.on('error', (err) => {
-            reject(err);
+            }
+            catch (error) {
+                reject(`Invalid JSON from ${url}: ${error}`);
+            }
         });
-        req.end();
     });
 }
 function getVulnerabilities(packageName, version, options) {

package/lib/http.d.ts

@@ -0,0 +1,14 @@
+import * as http from 'http';
+import { Options } from './types';
+export type RequestSettings = {
+    proxy?: string;
+    insecure?: boolean;
+    ca?: Buffer;
+};
+export declare function requestSettings(options: Options): RequestSettings;
+/**
+ * GET a URL, optionally through an http:// or https:// proxy.
+ * Plain http targets are sent to the proxy as absolute-form requests,
+ * https targets are tunnelled through the proxy with CONNECT.
+ */
+export declare function get(url: string, settings?: RequestSettings): Promise<http.IncomingMessage>;

package/lib/http.js

@@ -0,0 +1,122 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestSettings = requestSettings;
+exports.get = get;
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const net = __importStar(require("net"));
+const tls = __importStar(require("tls"));
+function requestSettings(options) {
+    return {
+        proxy: options.proxy || process.env.http_proxy,
+        insecure: options.insecure,
+        ca: options.cacertbuf,
+    };
+}
+/**
+ * GET a URL, optionally through an http:// or https:// proxy.
+ * Plain http targets are sent to the proxy as absolute-form requests,
+ * https targets are tunnelled through the proxy with CONNECT.
+ */
+async function get(url, settings = {}) {
+    const target = new URL(url);
+    const tlsSettings = {
+        rejectUnauthorized: !settings.insecure,
+        ...(settings.ca ? { ca: [settings.ca] } : {}),
+    };
+    if (!settings.proxy) {
+        return send(target.protocol === 'http:' ? http : https, url, tlsSettings);
+    }
+    const proxy = new URL(settings.proxy);
+    if (proxy.protocol !== 'http:' && proxy.protocol !== 'https:') {
+        throw new Error(`Unsupported proxy protocol: ${proxy.protocol} (only http: and https: are supported)`);
+    }
+    const proxyModule = proxy.protocol === 'https:' ? https : http;
+    const proxyConnection = {
+        host: unbracket(proxy.hostname),
+        port: proxy.port || (proxy.protocol === 'https:' ? 443 : 80),
+        ...(proxy.protocol === 'https:' ? tlsSettings : {}),
+    };
+    if (target.protocol === 'http:') {
+        return send(proxyModule, {
+            ...proxyConnection,
+            path: url,
+            headers: { host: target.host, ...proxyAuthorization(proxy) },
+        });
+    }
+    const socket = await tunnel(proxyModule, proxyConnection, proxy, target);
+    const servername = net.isIP(unbracket(target.hostname)) ? undefined : target.hostname;
+    // No agent: Node only honours createConnection when the request has no agent.
+    return send(https, url, {
+        createConnection: () => tls.connect({ ...tlsSettings, socket, servername }),
+    });
+}
+function tunnel(proxyModule, proxyConnection, proxy, target) {
+    const authority = `${target.hostname}:${target.port || 443}`;
+    return new Promise((resolve, reject) => {
+        const req = proxyModule.request({
+            ...proxyConnection,
+            method: 'CONNECT',
+            path: authority,
+            agent: false,
+            headers: { host: authority, ...proxyAuthorization(proxy) },
+        });
+        req.on('connect', (res, socket) => {
+            if (res.statusCode !== 200) {
+                socket.destroy();
+                return reject(new Error(`Proxy refused tunnel to ${authority}: HTTP ${res.statusCode} ${res.statusMessage}`));
+            }
+            resolve(socket);
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+function send(module, url, options = {}) {
+    return new Promise((resolve, reject) => {
+        const req = typeof url === 'string' ? module.get(url, options, resolve) : module.get(url, resolve);
+        req.on('error', reject);
+    });
+}
+function proxyAuthorization(proxy) {
+    if (!proxy.username)
+        return {};
+    const credentials = `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`;
+    return { 'proxy-authorization': `Basic ${Buffer.from(credentials).toString('base64')}` };
+}
+function unbracket(hostname) {
+    return hostname.replace(/^\[(.*)\]$/, '$1');
+}

package/lib/license.js

@@ -32,7 +32,7 @@ function evaluateLicense(licenses, version) {
         .filter((parsedLicense) => {
         return parsedLicense.ranges.some((range) => {
             if (range.from && range.to) {
-                return (0, retire_1.isAtOrAbove)(version, range.from) && (0, retire_1.isAtOrAbove)(range.to, version);
+                return (0, retire_1.isAtOrAbove)(version, range.from) && !(0, retire_1.isAtOrAbove)(version, range.to);
             }
             if (range.from) {
                 return (0, retire_1.isAtOrAbove)(version, range.from);

package/lib/parseIgnoreFile.d.ts

@@ -0,0 +1,2 @@
+import { Options } from './types';
+export declare function parseIgnoreFile(ignorefile: string, config: Options): string[];

package/lib/parseIgnoreFile.js

@@ -0,0 +1,36 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseIgnoreFile = parseIgnoreFile;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const types_1 = require("./types");
+function parseIgnoreFile(ignorefile, config) {
+    if (!fs_1.default.existsSync(ignorefile)) {
+        throw new Error(`Could not read ignore file: ${ignorefile}`);
+    }
+    if (ignorefile.endsWith('.json')) {
+        try {
+            config.ignore.descriptors = types_1.ignoreFileParser.parse(JSON.parse(fs_1.default.readFileSync(ignorefile, 'utf-8')));
+        }
+        catch (e) {
+            throw new Error(`Invalid ignore file: ${ignorefile}`, { cause: e });
+        }
+        const ignoredPaths = config.ignore.descriptors
+            ?.map((x) => ('path' in x ? x.path : undefined))
+            ?.filter((x) => x != undefined) ?? [];
+        return config.ignore.pathsAsString.concat(ignoredPaths);
+    }
+    else {
+        const lines = fs_1.default
+            .readFileSync(ignorefile, 'utf-8')
+            .split(/\r\n|\n/g)
+            .filter((e) => e !== '');
+        const ignored = lines.map((e) => {
+            return e[0] === '@' ? e.slice(1) : path_1.default.resolve(e);
+        });
+        return config.ignore.pathsAsString.concat(ignored);
+    }
+}

package/lib/repo.js

@@ -39,11 +39,8 @@ exports.loadrepository = loadrepository;
 exports.loadrepositoryFromFile = loadrepositoryFromFile;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const http = __importStar(require("http"));
-const https = __importStar(require("https"));
 const retire = __importStar(require("./retire"));
-const URL = __importStar(require("url"));
-const proxy_agent_1 = require("proxy-agent");
+const http_1 = require("./http");
 const z = __importStar(require("zod"));
 const types_1 = require("./types");
 function validateRepository(repo, replacer) {
@@ -108,7 +105,7 @@ function validateRepository(repo, replacer) {
         try {
             new RegExp(s);
         }
-        catch (error) {
+        catch {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
                 message: 'Invalid regex: ' + s,
@@ -175,27 +172,24 @@ function formatValidationError(error) {
     return JSON.stringify(error.format(), (key, value) => (Array.isArray(value) && value.length === 0 ? undefined : value), 2);
 }
 async function loadJson(url, options) {
+    options.log.info('Downloading ' + url + ' ...');
+    let res;
+    try {
+        res = await (0, http_1.get)(url, (0, http_1.requestSettings)(options));
+    }
+    catch (e) {
+        throw `Error downloading: ${url}: ${e}`;
+    }
     return new Promise((resolve, reject) => {
-        options.log.info('Downloading ' + url + ' ...');
-        const reqOptions = { ...URL.parse(url), method: 'GET' };
-        const proxyUri = options.proxy || process.env.http_proxy;
-        if (proxyUri) {
-            reqOptions.agent = new proxy_agent_1.ProxyAgent({
-                getProxyForUrl: () => proxyUri,
-            });
-        }
-        if (options.insecure) {
-            reqOptions.rejectUnauthorized = false;
+        if (res.statusCode != 200) {
+            res.resume();
+            return reject(`Error downloading: ${url}: HTTP ${res.statusCode} ${res.statusMessage}`);
         }
-        if (options.cacertbuf) {
-            reqOptions.ca = [options.cacertbuf];
-        }
-        const req = (url.startsWith('http:') ? http : https).get(reqOptions, (res) => {
-            if (res.statusCode != 200)
-                return reject(`Error downloading: ${url}: HTTP ${res.statusCode} ${res.statusMessage}`);
-            const data = [];
-            res.on('data', (c) => data.push(c));
-            res.on('end', () => {
+        const data = [];
+        res.on('data', (c) => data.push(c));
+        res.on('error', (e) => reject(`Error downloading: ${url}: ${e}`));
+        res.on('end', () => {
+            try {
                 let d = Buffer.concat(data).toString();
                 d = options.process ? options.process(d) : d;
                 const json = JSON.parse(d);
@@ -206,10 +200,11 @@ async function loadJson(url, options) {
                 else {
                     reject(`Invalid repository from ${url}: ${formatValidationError(vresult.error)}`);
                 }
-            });
+            }
+            catch (error) {
+                reject(`Invalid repository from ${url}: ${error}`);
+            }
         });
-        req.on('error', (e) => reject(`Error downloading: ${url}: ${e}`));
-        req.end();
     });
 }
 async function loadJsonFromFile(file, options) {
@@ -219,14 +214,19 @@ async function loadJsonFromFile(file, options) {
             if (err) {
                 return reject(err.toString());
             }
-            data = options.process ? options.process(data) : data;
-            const json = JSON.parse(data);
-            const vresult = validateRepository(json, options.process);
-            if (vresult.success) {
-                resolve(json);
+            try {
+                data = options.process ? options.process(data) : data;
+                const json = JSON.parse(data);
+                const vresult = validateRepository(json, options.process);
+                if (vresult.success) {
+                    resolve(json);
+                }
+                else {
+                    reject(`Invalid repository from ${file}: ${formatValidationError(vresult.error)}`);
+                }
             }
-            else {
-                reject(`Invalid repository from ${file}: ${formatValidationError(vresult.error)}`);
+            catch (error) {
+                reject(`Invalid repository from ${file}: ${error}`);
             }
         });
     });

package/lib/reporters/cyclonedx-1_6-json.d.ts

@@ -1,3 +1,2 @@
-import { ConfigurableLogger } from '../reporting';
-declare const _default: ConfigurableLogger;
+declare const _default: import("../reporting").ConfigurableLogger;
 export default _default;