retire 5.6.0 → 6.0.0

package/lib/scanner.js

@@ -52,19 +52,22 @@ const hash = {
         return shasum.digest('hex');
     },
 };
-function emitResults(finding, options, repo) {
+async function emitResults(finding, options, repo) {
     if (options.includeOsv === true) {
-        Promise.all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.component, r.version, options).then((v) => (r.vulnerabilities = (r.vulnerabilities ?? []).concat(v))))).then(() => filterAndEmitResults(finding, options, repo));
-    }
-    else {
-        filterAndEmitResults(finding, options, repo);
+        await Promise.all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.npmname ?? r.component, r.version, options).then((v) => (r.vulnerabilities = (r.vulnerabilities ?? []).concat(v)))));
     }
+    filterAndEmitResults(finding, options, repo);
 }
 function getIdentifiers(v) {
-    return (v.identifiers?.CVE ?? [])
-        .concat(v.identifiers?.bug ?? [])
-        .concat(v.identifiers?.issue ?? [])
-        .concat(v.identifiers?.githubID ?? []);
+    const identifiers = v.identifiers ?? {};
+    const canonical = (identifiers.CVE ?? []).map((id) => `CVE:${id}`);
+    if (identifiers.githubID)
+        canonical.push(`githubID:${identifiers.githubID}`);
+    if (canonical.length)
+        return canonical;
+    return Object.entries(identifiers)
+        .filter(([key, value]) => key !== 'summary' && value != null)
+        .flatMap(([key, value]) => (Array.isArray(value) ? value : [value]).map((id) => `${key}:${id}`));
 }
 function uniqueVulnerabilities(vulnerabilities) {
     if (!vulnerabilities)
@@ -144,7 +147,7 @@ function hasIdentifier(identifiers, key, value) {
     const identifier = identifiers[key];
     return Array.isArray(identifier) ? identifier.some((x) => x === value) : identifier === value;
 }
-function scanJsFile(file, repo, options) {
+async function scanJsFile(file, repo, options) {
     if (options.ignore && shouldIgnorePath([file], options.ignore)) {
         return;
     }
@@ -161,22 +164,25 @@ function scanJsFile(file, repo, options) {
             }
         }
     }
-    emitResults({ file: file, results: results }, options, repo);
+    await emitResults({ file: file, results: results }, options, repo);
 }
-function scanBowerFile(file, repo, options) {
+async function scanBowerFile(file, repo, options) {
     if (options.ignore && shouldIgnorePath([file], options.ignore)) {
         return;
     }
+    let results;
     try {
         const bower = JSON.parse(fs.readFileSync(file, 'utf-8'));
         if (bower.version) {
-            const results = retire.check(bower.name, bower.version, repo);
-            emitResults({ file: file, results: results }, options, repo);
+            results = retire.check(bower.name, bower.version, repo);
         }
     }
-    catch (e) {
+    catch {
         options.log.warn(`Could not parse file: ${file}`);
     }
+    if (results) {
+        await emitResults({ file: file, results: results }, options, repo);
+    }
 }
 function on(event, handler) {
     events.on(event, handler);

package/lib/types.d.ts

@@ -1,3 +1,4 @@
+import z from 'zod';
 import { Logger } from './reporting';
 export type Repository = Record<string, {
     bowername?: string[];
@@ -55,6 +56,7 @@ export declare const severityLevels: {
     readonly critical: 4;
 };
 export type SeverityLevel = keyof typeof severityLevels;
+export declare const severityParser: z.ZodEnum<["none" | "low" | "medium" | "high" | "critical"]>;
 export type PathDescriptor = {
     path: string;
     justification?: string;
@@ -93,4 +95,29 @@ export type Options = {
     includeOsv?: boolean;
     deep?: boolean;
 };
+export declare const ignoreFileParser: z.ZodArray<z.ZodIntersection<z.ZodObject<{
+    justification: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    justification: string;
+}, {
+    justification: string;
+}>, z.ZodUnion<[z.ZodObject<{
+    path: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+}, {
+    path: string;
+}>, z.ZodObject<{
+    component: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+    identifiers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    component: string;
+    version?: string | undefined;
+    identifiers?: Record<string, string> | undefined;
+}, {
+    component: string;
+    version?: string | undefined;
+    identifiers?: Record<string, string> | undefined;
+}>]>>, "many">;
 export {};

package/lib/types.js

@@ -1,6 +1,10 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.severityLevels = void 0;
+exports.ignoreFileParser = exports.severityParser = exports.severityLevels = void 0;
+const zod_1 = __importDefault(require("zod"));
 exports.severityLevels = {
     none: 0,
     low: 1,
@@ -8,3 +12,17 @@ exports.severityLevels = {
     high: 3,
     critical: 4,
 };
+exports.severityParser = zod_1.default.enum(Object.keys(exports.severityLevels));
+exports.ignoreFileParser = zod_1.default.array(zod_1.default
+    .object({
+    justification: zod_1.default.string(),
+})
+    .and(zod_1.default
+    .object({
+    path: zod_1.default.string(),
+})
+    .or(zod_1.default.object({
+    component: zod_1.default.string(),
+    version: zod_1.default.string().optional(),
+    identifiers: zod_1.default.record(zod_1.default.string(), zod_1.default.string()).optional(),
+}))));

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.6.0",
+  "version": "6.0.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -13,35 +13,35 @@
   },
   "main": "./lib/retire.js",
   "dependencies": {
-    "ansi-colors": "^4.1.1",
     "astronomical": "^3.2.0",
     "commander": "^10.0.1",
-    "proxy-agent": "^6.4.0",
     "walkdir": "0.4.1",
     "zod": "^3.22.4"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/node": "^18.13.0",
-    "@types/uuid": "^9.0.0",
-    "@typescript-eslint/eslint-plugin": "^7.1.1",
-    "@typescript-eslint/parser": "^7.1.1",
-    "eslint": "^8.34.0",
-    "eslint-config-prettier": "^9.0.0",
+    "@types/uuid": "^10.0.0",
+    "eslint": "^10.12.0",
+    "eslint-config-prettier": "^10.1.8",
+    "globals": "^17.13.0",
     "jsonschema": "^1.4.1",
     "prettier": "^3.1.0",
     "ts-node": "^10.9.2",
-    "typescript": "^5.0.4"
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.71.1"
   },
   "scripts": {
     "test": "TS_NODE_PROJECT=tsconfig.spec.json node --require ts-node/register --test \"spec/tests/**/*.spec.ts\"",
     "build": "tsc && chmod ugo+x lib/cli.js && cp src/retire.d.ts lib/retire.d.ts && cp ../LICENSE.md .",
     "watch": "tsc --watch ",
     "typecheck": "tsc --noEmit",
-    "lint": "eslint . --ext .ts --fix --ignore-path ../.gitignore",
+    "lint": "eslint . --fix",
+    "format": "prettier --write \"src/**/*.ts\" \"spec/**/*.ts\"",
     "check": "npm run lint && npm run typecheck"
   },
   "engines": {
-    "node": ">= 18.0.0"
+    "node": "^20.19.0 || >=22.12.0"
   },
   "keywords": [
     "sbom",