retire 5.6.0 → 6.0.0

package/lib/reporters/cyclonedx-1_6-json.js

@@ -1,209 +1,4 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
-const retire = __importStar(require("../retire"));
-const fs = __importStar(require("fs"));
-const utils_1 = require("./utils");
-const path = __importStar(require("path"));
-const crypto = __importStar(require("crypto"));
-function configureCycloneDXJSONLogger(logger, writer, config, hash) {
-    let vulnsFound = false;
-    const finalResults = {
-        version: retire.version,
-        start: new Date().toISOString(),
-        data: [],
-        messages: [],
-        errors: [],
-    };
-    logger.info = finalResults.messages.push;
-    logger.debug = config.verbose
-        ? finalResults.messages.push
-        : function () {
-            return;
-        };
-    logger.warn = logger.error = finalResults.errors.push;
-    logger.logVulnerableDependency = function (finding) {
-        vulnsFound = true;
-        finalResults.data.push(finding);
-    };
-    logger.logDependency = function (finding) {
-        if (finding.results.length > 0) {
-            finalResults.data.push(finding);
-        }
-    };
-    logger.close = function (callback) {
-        const write = vulnsFound ? writer.err : writer.out;
-        const seen = new Map();
-        const vulnerabilitiesCyclone = new Map();
-        const includeVEX = config.outputformat === 'cyclonedxJSON1_6_VEX';
-        const vulnerabilityRepositoriesList = (0, utils_1.vulnerabilityRepositories)(config.jsRepo);
-        // Only attributable to a single URL when exactly one repository was used
-        const retireSource = {
-            name: 'Retire.js',
-            url: vulnerabilityRepositoriesList.length === 1 ? vulnerabilityRepositoriesList[0] : undefined,
-        };
-        const properties = vulnerabilityRepositoriesList.map((repo) => ({ name: 'retirejs:vulnerability-repository', value: repo }));
-        if (config.insecure) {
-            properties.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
-        }
-        const components = finalResults.data
-            .filter((d) => d.results)
-            .map((r) => r.results
-            .map((dep) => {
-            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
-            let hashes;
-            const filepath = r.file;
-            const evidence = { occurrences: [] };
-            if (filepath) {
-                const file = fs.readFileSync(filepath);
-                const relativePath = path.relative(process.cwd(), filepath);
-                evidence.occurrences.push({ location: relativePath });
-                hashes = [
-                    { alg: 'MD5', content: hash.md5(file) },
-                    { alg: 'SHA-1', content: hash.sha1(file) },
-                    { alg: 'SHA-256', content: hash.sha256(file) },
-                    { alg: 'SHA-512', content: hash.sha512(file) },
-                ];
-            }
-            const purl = (0, utils_1.generatePURL)(dep);
-            const existing = seen.get(purl);
-            if (existing) {
-                const missing = evidence.occurrences.filter((x) => !existing.evidence.occurrences.some((y) => y.location == x.location));
-                existing.evidence.occurrences.push(...missing);
-                return undefined;
-            }
-            const nameParts = dep.component.split('/').reverse();
-            const bomRef = purl;
-            dep.vulnerabilities?.forEach((vuln) => {
-                // Pick valid identifiers for VEX
-                const ids = vuln.identifiers?.CVE ?? (vuln.identifiers?.githubID ? [vuln.identifiers.githubID] : undefined);
-                if (!ids)
-                    return;
-                ids.forEach((id) => {
-                    if (!vulnerabilitiesCyclone.has(id)) {
-                        const { references, advisories } = mapUrls(vuln);
-                        vulnerabilitiesCyclone.set(id, {
-                            id,
-                            source: retireSource,
-                            cwes: vuln.cwe.map((c) => parseInt(c.split("-")[1])),
-                            description: vuln.identifiers.summary,
-                            advisories: advisories,
-                            references: references,
-                            ratings: [
-                                {
-                                    source: retireSource,
-                                    severity: vuln.severity,
-                                },
-                            ],
-                            affects: [],
-                        });
-                    }
-                    vulnerabilitiesCyclone.get(id).affects.push({
-                        ref: bomRef,
-                        versions: [
-                            {
-                                // "vers:npm/1.2.3|>=2.0.0|<5.0.0"
-                                range: 'vers:npm/' + (vuln.atOrAbove ? '>=' + vuln.atOrAbove + '|' : '') + '<' + vuln.below,
-                                status: 'affected',
-                            },
-                        ],
-                    });
-                });
-            });
-            const result = {
-                "bom-ref": bomRef,
-                type: 'library',
-                name: nameParts[0],
-                group: nameParts[1],
-                version: dep.version,
-                purl: purl,
-                hashes: hashes,
-                evidence,
-                licenses: mapLicenses(dep.licenses),
-            };
-            seen.set(purl, result);
-            return result;
-        })
-            .filter((x) => x != undefined))
-            .reduce((a, b) => a.concat(b), []);
-        write(JSON.stringify({
-            bomFormat: 'CycloneDX',
-            specVersion: '1.6',
-            serialNumber: `urn:uuid:${crypto.randomUUID()}`,
-            version: 1,
-            metadata: {
-                timestamp: finalResults.start,
-                tools: [
-                    {
-                        vendor: 'RetireJS',
-                        name: 'retire',
-                        version: retire.version,
-                    },
-                ],
-                properties: properties.length ? properties : undefined,
-            },
-            components: components,
-            vulnerabilities: includeVEX ? Array.from(vulnerabilitiesCyclone.values()) : undefined,
-        }, undefined, 2));
-        writer.close(callback);
-    };
-}
-function mapLicenses(licenses) {
-    if (!licenses)
-        return [];
-    if (licenses.length == 0)
-        return [];
-    if (licenses[0] == 'commercial')
-        return [{ license: { name: 'Commercial' } }];
-    return [{ expression: licenses[0] }];
-}
-function mapUrls(vulnerability) {
-    const references = [];
-    if (vulnerability.identifiers.CVE) {
-        const nvdlink = `https://nvd.nist.gov/vuln/detail/${vulnerability.identifiers.CVE[0]}`;
-        references.push({ id: vulnerability.identifiers.CVE[0], source: { name: 'NVD', url: nvdlink } });
-    }
-    if (vulnerability.identifiers.githubID) {
-        const ghsa = `https://github.com/advisories/${vulnerability.identifiers.githubID}`;
-        references.push({ id: vulnerability.identifiers.githubID, source: { name: 'GitHub Advisories', url: ghsa } });
-    }
-    const advisories = vulnerability.info
-        .filter((url) => !url.startsWith('https://nvd.nist.gov/vuln/detail/') && !url.startsWith('https://github.com/advisories/'))
-        .map((u) => ({ url: u }));
-    return { references, advisories };
-}
-exports.default = {
-    configure: configureCycloneDXJSONLogger,
-};
+const cyclonedx_json_builder_1 = require("./cyclonedx-json-builder");
+exports.default = (0, cyclonedx_json_builder_1.cycloneDXJSONLogger)('1.6');

package/lib/reporters/cyclonedx-1_7-json.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("../reporting").ConfigurableLogger;
+export default _default;

package/lib/reporters/cyclonedx-1_7-json.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const cyclonedx_json_builder_1 = require("./cyclonedx-json-builder");
+exports.default = (0, cyclonedx_json_builder_1.cycloneDXJSONLogger)('1.7');

package/lib/reporters/cyclonedx-json-builder.d.ts

@@ -0,0 +1,7 @@
+import { ConfigurableLogger } from '../reporting';
+/**
+ * Spec versions sharing this implementation. The 1.4 reporters are kept separate, as the
+ * modern object form of metadata.tools was only introduced in 1.5.
+ */
+export type CycloneDXSpecVersion = '1.6' | '1.7';
+export declare function cycloneDXJSONLogger(specVersion: CycloneDXSpecVersion): ConfigurableLogger;

package/lib/reporters/cyclonedx-json-builder.js

@@ -0,0 +1,281 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cycloneDXJSONLogger = cycloneDXJSONLogger;
+const retire = __importStar(require("../retire"));
+const fs = __importStar(require("fs"));
+const utils_1 = require("./utils");
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const TOOL_BOM_REF = 'retirejs-tool';
+const SCAN_TARGET_BOM_REF = 'retirejs:scan-target';
+/**
+ * Retire.js has no native confidence score, so the mapping from the detection method to a
+ * CycloneDX identity technique and confidence is a heuristic. Both technique and confidence
+ * are required by the schema.
+ */
+const identityTechniques = {
+    hash: { technique: 'hash-comparison', confidence: 1 },
+    ast: { technique: 'ast-fingerprint', confidence: 0.9 },
+    filecontent: { technique: 'source-code-analysis', confidence: 0.8 },
+    filecontentreplace: { technique: 'source-code-analysis', confidence: 0.8 },
+    func: { technique: 'dynamic-analysis', confidence: 0.8 },
+    filename: { technique: 'filename', confidence: 0.5 },
+    uri: { technique: 'filename', confidence: 0.5 },
+};
+function configureCycloneDXJSONLogger(specVersion, logger, writer, config, hash) {
+    let vulnsFound = false;
+    const finalResults = {
+        version: retire.version,
+        start: new Date().toISOString(),
+        data: [],
+        messages: [],
+        errors: [],
+    };
+    logger.info = finalResults.messages.push;
+    logger.debug = config.verbose
+        ? finalResults.messages.push
+        : function () {
+            return;
+        };
+    logger.warn = logger.error = finalResults.errors.push;
+    logger.logVulnerableDependency = function (finding) {
+        vulnsFound = true;
+        finalResults.data.push(finding);
+    };
+    logger.logDependency = function (finding) {
+        if (finding.results.length > 0) {
+            finalResults.data.push(finding);
+        }
+    };
+    logger.close = function (callback) {
+        const write = vulnsFound ? writer.err : writer.out;
+        const seen = new Map();
+        const vulnerabilitiesCyclone = new Map();
+        const includeVEX = config.outputformat?.endsWith('_VEX') ?? false;
+        const vulnerabilityRepositoriesList = (0, utils_1.vulnerabilityRepositories)(config.jsRepo);
+        // Only attributable to a single URL when exactly one repository was used
+        const retireSource = {
+            name: 'Retire.js',
+            url: vulnerabilityRepositoriesList.length === 1 ? vulnerabilityRepositoriesList[0] : undefined,
+        };
+        const properties = vulnerabilityRepositoriesList.map((repo) => ({
+            name: 'retirejs:vulnerability-repository',
+            value: repo,
+        }));
+        if (config.insecure) {
+            properties.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
+        }
+        const components = finalResults.data
+            .filter((d) => d.results)
+            .map((r) => r.results
+            .map((dep) => {
+            dep = {
+                ...dep,
+                version: (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.'),
+            };
+            let hashes;
+            const filepath = r.file;
+            const evidence = { occurrences: [] };
+            if (filepath) {
+                const file = fs.readFileSync(filepath);
+                const relativePath = path.relative(process.cwd(), filepath);
+                evidence.occurrences.push({ location: relativePath });
+                hashes = [
+                    { alg: 'MD5', content: hash.md5(file) },
+                    { alg: 'SHA-1', content: hash.sha1(file) },
+                    { alg: 'SHA-256', content: hash.sha256(file) },
+                    { alg: 'SHA-512', content: hash.sha512(file) },
+                ];
+            }
+            const purl = (0, utils_1.generatePURL)(dep);
+            const existing = seen.get(purl);
+            const identity = mapIdentity(dep);
+            if (identity)
+                evidence.identity = [identity];
+            const nameParts = dep.component.split('/').reverse();
+            const bomRef = purl;
+            dep.vulnerabilities?.forEach((vuln) => {
+                // Pick valid identifiers for VEX
+                const ids = vuln.identifiers?.CVE ?? (vuln.identifiers?.githubID ? [vuln.identifiers.githubID] : undefined);
+                if (!ids)
+                    return;
+                ids.forEach((id) => {
+                    if (!vulnerabilitiesCyclone.has(id)) {
+                        const { references, advisories } = mapUrls(vuln);
+                        const cwes = vuln.cwe?.map((c) => parseInt(c.split('-')[1]));
+                        vulnerabilitiesCyclone.set(id, {
+                            id,
+                            source: retireSource,
+                            cwes: cwes?.length ? cwes : undefined,
+                            description: vuln.identifiers?.summary,
+                            detail: vuln.details,
+                            advisories: advisories,
+                            references: references,
+                            ratings: [
+                                {
+                                    source: retireSource,
+                                    severity: vuln.severity,
+                                },
+                            ],
+                            affects: [],
+                        });
+                    }
+                    const affects = vulnerabilitiesCyclone.get(id).affects;
+                    let affected = affects.find((entry) => entry.ref === bomRef);
+                    if (!affected) {
+                        affected = { ref: bomRef, versions: [] };
+                        affects.push(affected);
+                    }
+                    const range = 'vers:npm/' + (vuln.atOrAbove ? '>=' + vuln.atOrAbove + '|' : '') + '<' + vuln.below;
+                    if (!affected.versions.some((entry) => entry.range === range)) {
+                        affected.versions.push({ range, status: 'affected' });
+                    }
+                });
+            });
+            if (existing) {
+                const missing = evidence.occurrences.filter((x) => !existing.evidence.occurrences.some((y) => y.location == x.location));
+                existing.evidence.occurrences.push(...missing);
+                if (identity) {
+                    const identities = existing.evidence.identity ?? (existing.evidence.identity = []);
+                    if (!identities.some((entry) => entry.methods[0].value === identity.methods[0].value)) {
+                        identities.push(identity);
+                    }
+                }
+                return undefined;
+            }
+            const result = {
+                'bom-ref': bomRef,
+                type: 'library',
+                name: nameParts[0],
+                group: nameParts[1],
+                version: dep.version,
+                purl: purl,
+                hashes: hashes,
+                evidence,
+                licenses: mapLicenses(dep.licenses, specVersion),
+            };
+            seen.set(purl, result);
+            return result;
+        })
+            .filter((x) => x != undefined))
+            .reduce((a, b) => a.concat(b), []);
+        const dependencies = [
+            { ref: SCAN_TARGET_BOM_REF, dependsOn: components.map((c) => c['bom-ref']) },
+            ...components.map((c) => ({ ref: c['bom-ref'], dependsOn: [] })),
+        ];
+        write(JSON.stringify({
+            $schema: `http://cyclonedx.org/schema/bom-${specVersion}.schema.json`,
+            bomFormat: 'CycloneDX',
+            specVersion,
+            serialNumber: `urn:uuid:${crypto.randomUUID()}`,
+            version: 1,
+            metadata: {
+                timestamp: finalResults.start,
+                tools: {
+                    components: [
+                        {
+                            type: 'application',
+                            'bom-ref': TOOL_BOM_REF,
+                            group: 'RetireJS',
+                            name: 'retire',
+                            version: retire.version,
+                        },
+                    ],
+                },
+                component: {
+                    type: 'application',
+                    'bom-ref': SCAN_TARGET_BOM_REF,
+                    name: scanTargetName(config.path),
+                },
+                properties: properties.length ? properties : undefined,
+            },
+            components: components,
+            dependencies,
+            vulnerabilities: includeVEX ? Array.from(vulnerabilitiesCyclone.values()) : undefined,
+        }, undefined, 2));
+        writer.close(callback);
+    };
+}
+function scanTargetName(scanPath) {
+    return path.basename(path.resolve(scanPath ?? '.'));
+}
+function mapIdentity(component) {
+    if (!component.detection)
+        return undefined;
+    const mapped = identityTechniques[component.detection];
+    if (!mapped)
+        return undefined;
+    return {
+        field: 'version',
+        confidence: mapped.confidence,
+        concludedValue: component.version,
+        methods: [{ technique: mapped.technique, confidence: mapped.confidence, value: component.detection }],
+    };
+}
+function mapLicense(license) {
+    return license == 'commercial' ? { license: { name: 'Commercial' } } : { expression: license };
+}
+function mapLicenses(licenses, specVersion) {
+    if (!licenses)
+        return [];
+    if (licenses.length == 0)
+        return [];
+    // Before 1.7, the licenses array could hold at most one SPDX expression, and expressions
+    // could not be mixed with named licenses.
+    if (specVersion === '1.6')
+        return [mapLicense(licenses[0])];
+    return licenses.map(mapLicense);
+}
+function mapUrls(vulnerability) {
+    const references = [];
+    if (vulnerability.identifiers?.CVE) {
+        const nvdlink = `https://nvd.nist.gov/vuln/detail/${vulnerability.identifiers.CVE[0]}`;
+        references.push({ id: vulnerability.identifiers.CVE[0], source: { name: 'NVD', url: nvdlink } });
+    }
+    if (vulnerability.identifiers?.githubID) {
+        const ghsa = `https://github.com/advisories/${vulnerability.identifiers.githubID}`;
+        references.push({ id: vulnerability.identifiers.githubID, source: { name: 'GitHub Advisories', url: ghsa } });
+    }
+    const advisories = vulnerability.info
+        .filter((url) => !url.startsWith('https://nvd.nist.gov/vuln/detail/') && !url.startsWith('https://github.com/advisories/'))
+        .map((u) => ({ url: u }));
+    return { references, advisories };
+}
+function cycloneDXJSONLogger(specVersion) {
+    return {
+        configure: (logger, writer, config, hash) => configureCycloneDXJSONLogger(specVersion, logger, writer, config, hash),
+    };
+}

package/lib/reporters/cyclonedx-json.js

@@ -65,7 +65,10 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     };
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
-        const properties = (0, utils_1.vulnerabilityRepositories)(config.jsRepo).map((repo) => ({ name: 'retirejs:vulnerability-repository', value: repo }));
+        const properties = (0, utils_1.vulnerabilityRepositories)(config.jsRepo).map((repo) => ({
+            name: 'retirejs:vulnerability-repository',
+            value: repo,
+        }));
         if (config.insecure) {
             properties.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
         }
@@ -74,7 +77,10 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
             .filter((d) => d.results)
             .map((r) => r.results
             .map((dep) => {
-            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
+            dep = {
+                ...dep,
+                version: (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.'),
+            };
             let hashes;
             const filepath = r.file;
             const properties = [];

package/lib/reporters/cyclonedx.js

@@ -81,7 +81,10 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
             .filter((d) => d.results.length > 0)
             .map((r) => r.results
             .map((dep) => {
-            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
+            dep = {
+                ...dep,
+                version: (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.'),
+            };
             const filepath = r.file;
             let hashes = '';
             if (filepath) {
@@ -120,9 +123,11 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
             <name>retire.js</name>
             <version>${retire.version}</version>
         </tool>
-    </tools>${properties ? `
+    </tools>${properties
+            ? `
     <properties>${properties}
-    </properties>` : ''}
+    </properties>`
+            : ''}
   </metadata>
   <components>${components}
   </components>
@@ -131,11 +136,7 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
     };
 }
 function escapeXml(value) {
-    return value
-        .replace(/&/g, '&amp;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;');
+    return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 }
 function mapLicenses(licenses) {
     if (!licenses)

package/lib/reporting.js

@@ -46,6 +46,7 @@ const depcheck_1 = __importDefault(require("./reporters/depcheck"));
 const cyclonedx_1 = __importDefault(require("./reporters/cyclonedx"));
 const cyclonedx_json_1 = __importDefault(require("./reporters/cyclonedx-json"));
 const cyclonedx_1_6_json_1 = __importDefault(require("./reporters/cyclonedx-1_6-json"));
+const cyclonedx_1_7_json_1 = __importDefault(require("./reporters/cyclonedx-1_7-json"));
 const loggers = {
     console: console_1.default,
     text: console_1.default,
@@ -55,6 +56,8 @@ const loggers = {
     cyclonedxJSON: cyclonedx_json_1.default,
     cyclonedxJSON1_6: cyclonedx_1_6_json_1.default,
     cyclonedxJSON1_6_VEX: cyclonedx_1_6_json_1.default,
+    cyclonedxJSON1_7: cyclonedx_1_7_json_1.default,
+    cyclonedxJSON1_7_VEX: cyclonedx_1_7_json_1.default,
     clean: console_1.default,
     jsonsimple: json_1.default,
 };

package/lib/resolve.js

@@ -43,7 +43,7 @@ function scanJsFiles(path, options) {
         if (ext.some((e) => file.endsWith(e))) {
             finder.emit('jsfile', file);
         }
-        if (file.match(/\/bower.json$/)) {
+        if (file.match(/[\\/]bower\.json$/)) {
             finder.emit('bowerfile', file);
         }
     }

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.6.0';
+exports.version = '6.0.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

package/lib/scanner.d.ts

@@ -1,4 +1,4 @@
 import { Finding, Options, Repository } from './types';
-export declare function scanJsFile(file: string, repo: Repository, options: Options): void;
-export declare function scanBowerFile(file: string, repo: Repository, options: Options): void;
+export declare function scanJsFile(file: string, repo: Repository, options: Options): Promise<void>;
+export declare function scanBowerFile(file: string, repo: Repository, options: Options): Promise<void>;
 export declare function on(event: 'vulnerable-dependency-found' | 'dependency-found', handler: (finding: Finding) => void): void;