retire 5.7.0 → 6.1.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## [6.1.0]
+
+### Improvements
+
+- Repository validation errors (for an invalid `--jsrepo`, and from `repository/validate`) are now listed one per line with the location of each problem, instead of as a nested JSON tree:
+  ```
+  ✖ Invalid option: expected one of "none"|"low"|"medium"|"high"|"critical"
+    → at jquery.vulnerabilities[0].severity
+  ```
+- Positional arguments (e.g. `retire .` or `retire src/`) are still ignored, but now print a warning. Use `--path <path>` to choose what to scan.
+- Upgraded `commander` to 14 and `zod` to 4.
+
+### Bugfixes
+
+- Repository validation crashed with a `TypeError` on extractor regexes that contain `§§version§§` without a capture group (e.g. `jquery-§§version§§\.js`), instead of reporting the invalid regex. It now reports `Regex must contain (§§version§§) as first capture group`.
+
+## [6.0.0]
+
+### Breaking changes
+
+- Requires Node.js 20.19+ or 22.12+ (previously 18+).
+- `--proxy` (and the `http_proxy` environment variable) now only supports `http://` and `https://` proxy URLs. SOCKS (`socks://`, `socks5://`, ...) and PAC (`pac+http://`, ...) proxies are no longer supported and fail with an `Unsupported proxy protocol` error (let us know if socks or pac are needed and we can re-add).
+
+### Improvements
+
+- Replaced the `proxy-agent` dependency (and its 27 transitive packages) with a small built-in proxy client. Proxy credentials in the URL (`http://user:pass@host:port`) are still supported.
+- Removed the `ansi-colors` dependency.
+
+### Bugfixes
+
+- `--includeOsv` lookups ignored `--proxy`, `--insecure` and `--cacert`. They now use the same settings as the repository download.
+- `--includeOsv` looked up advisories under the repository's display name instead of the npm package name, so most components that declare an `npmname` silently got no OSV results (#626).
+- `--includeOsv` findings could be missing from the report, because the report was closed before the OSV lookups finished (#623).
+- Invalid CLI input (an unknown `--severity`, an unreadable `--cacert` or ignore file) now stops before scanning with an error message instead of a stack trace (#623).
+- Malformed repository files and malformed OSV responses are reported with their source, instead of crashing the scan (#623).
+- Errors while scanning files or `bower.json` are now reported, and the scan exits with code 1 (#623).
+- `bower.json` files were not detected on Windows paths (#623).
+- Distinct CVEs that share an issue were merged into one finding, while repeated advisories for the same vulnerability were not deduplicated (#623).
+- The upper bound of a license version range was treated as inclusive (#623).
+- CycloneDX output could change the scan results used by other reporters, and duplicate components are now merged together with their vulnerabilities and evidence (#625).
+
 ## [5.7.0]
 
 ### Improvements

package/lib/cli.js

@@ -47,11 +47,8 @@ const reporting = __importStar(require("./reporting"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
-const ansi_colors_1 = __importDefault(require("ansi-colors"));
-const events_1 = require("events");
 const types_1 = require("./types");
-const z = __importStar(require("zod"));
-const events = new events_1.EventEmitter();
+const parseIgnoreFile_1 = require("./parseIgnoreFile");
 let failProcess = false;
 const defaultIgnoreFiles = ['.retireignore', '.retireignore.json'];
 if (process.argv.includes('--node') || process.argv.includes('-n')) {
@@ -82,9 +79,12 @@ const prg = commander_1.program
     .option('--cacert <path>', 'Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files')
     .option('--includeOsv', 'Include OSV advisories in the output')
     .option('--deep', 'Deep scan (slower and experimental)')
+    // Positional arguments were never used, but were silently accepted before commander 13.
+    .allowExcessArguments()
     .parse()
     .opts();
-const colorwarn = prg.colors ? ansi_colors_1.default.red : (x) => x;
+const red = (x) => `\u001b[31m${x}\u001b[39m`;
+const colorwarn = prg.colors ? red : (x) => x;
 const jsrepolocation = (prg.jsrepo ?? "'central'")
     .split(',')
     .map((x) => x === "'central'"
@@ -103,9 +103,6 @@ const log = reporting.open({
     verbose: !!prg.verbose,
 });
 const severity = prg.severity ?? 'none';
-if (!(severity in types_1.severityLevels)) {
-    exitWithError(`Error: Invalid severity level (${severity}). Valid levels are: ${Object.keys(types_1.severityLevels).join(', ')}`);
-}
 const config = {
     path: scanpath,
     ignore: {
@@ -122,109 +119,87 @@ const config = {
     includeOsv: !!prg.includeOsv,
     verbose: !!prg.verbose,
     proxy: prg.proxy,
+    insecure: !!prg.insecure,
     deep: !!prg.deep,
     ext: prg.ext ?? 'js',
 };
-log.info(`retire.js v${retire.version}`);
-function exitWithError(msg) {
-    log.error(config.colorwarn(msg));
+function exitWithError(error) {
+    log.error(colorwarn(String(error)));
     process.exitCode = 1;
     log.close();
 }
-if (prg.cacert) {
-    if (!fs_1.default.existsSync(prg.cacert)) {
-        exitWithError(`Error: Could not read cacert file: ${prg.cacert}`);
-    }
-    config.cacertbuf = fs_1.default.readFileSync(prg.cacert);
+function scan() {
+    scanner.on('vulnerable-dependency-found', (result) => {
+        const levels = result.results.map((r) => {
+            return r.vulnerabilities
+                ? r.vulnerabilities.map((v) => {
+                    return types_1.severityLevels[v.severity ?? 'critical'];
+                })
+                : [];
+        });
+        const severity = utils.flatten(levels).reduce((x, y) => (x > y ? x : y));
+        if (severity >= types_1.severityLevels[config.severity]) {
+            failProcess = true;
+        }
+    });
+    scanner.on('vulnerable-dependency-found', log.logVulnerableDependency);
+    scanner.on('dependency-found', log.logDependency);
+    Promise.all(jsrepolocation.map((jsr) => jsr.match(/^https?:\/\//) ? repo.loadrepository(jsr, config) : repo.loadrepositoryFromFile(jsr, config)))
+        .then(async (jsRepos) => {
+        const scans = [];
+        let scanError;
+        const failed = (error) => {
+            scanError = error;
+        };
+        await new Promise((done) => {
+            resolve
+                .scanJsFiles(config.path, config)
+                .on('jsfile', (file) => {
+                jsRepos.forEach((jsRepo) => {
+                    scans.push(scanner.scanJsFile(file, jsRepo, config).catch(failed));
+                });
+            })
+                .on('bowerfile', (bowerfile) => {
+                jsRepos.forEach((jsRepo) => {
+                    const bowerRepo = repo.asbowerrepo(jsRepo);
+                    scans.push(scanner.scanBowerFile(bowerfile, bowerRepo, config).catch(failed));
+                });
+            })
+                .on('fail', (file, err) => failed(`Could not scan ${file}: ${err ?? 'Unknown error'}`))
+                .on('error', failed)
+                .on('end', done);
+        });
+        await Promise.all(scans);
+        if (scanError !== undefined)
+            throw scanError;
+        process.exitCode = failProcess ? config.exitwith : 0;
+        log.close();
+    })
+        .catch(exitWithError);
 }
-const ignoreFileParser = z.array(z
-    .object({
-    justification: z.string(),
-})
-    .and(z
-    .object({
-    path: z.string(),
-})
-    .or(z.object({
-    component: z.string(),
-    version: z.string().optional(),
-    identifiers: z.record(z.string(), z.string()).optional(),
-}))));
-if (ignorefile) {
-    if (!fs_1.default.existsSync(ignorefile)) {
-        exitWithError(`Error: Could not read ignore file: ${ignorefile}`);
+try {
+    if (!types_1.severityParser.safeParse(severity).success) {
+        throw new Error(`Invalid severity level (${severity}). Valid levels are: ${Object.keys(types_1.severityLevels).join(', ')}`);
     }
-    if (ignorefile.substr(-5) === '.json') {
-        try {
-            config.ignore.descriptors = ignoreFileParser.parse(JSON.parse(fs_1.default.readFileSync(ignorefile, 'utf-8')));
-        }
-        catch (e) {
-            exitWithError(`Error: Invalid ignore file: ${ignorefile}`);
+    log.info(`retire.js v${retire.version}`);
+    if (commander_1.program.args.length > 0) {
+        log.warn(colorwarn(`Warning: Ignoring unexpected argument(s) ${commander_1.program.args.map((arg) => `"${arg}"`).join(' ')}. Use --path <path> to choose what to scan (scanning ${scanpath}).`));
+    }
+    if (prg.cacert) {
+        if (!fs_1.default.existsSync(prg.cacert)) {
+            throw new Error(`Could not read cacert file: ${prg.cacert}`);
         }
-        const ignoredPaths = config.ignore.descriptors
-            ?.map((x) => ('path' in x ? x.path : undefined))
-            ?.filter((x) => x != undefined) ?? [];
-        config.ignore.pathsAsString = config.ignore.pathsAsString.concat(ignoredPaths);
+        config.cacertbuf = fs_1.default.readFileSync(prg.cacert);
     }
-    else {
-        const lines = fs_1.default
-            .readFileSync(ignorefile, 'utf-8')
-            .split(/\r\n|\n/g)
-            .filter((e) => e !== '');
-        const ignored = lines.map((e) => {
-            return e[0] === '@' ? e.slice(1) : path_1.default.resolve(e);
-        });
-        config.ignore.pathsAsString = config.ignore.pathsAsString.concat(ignored);
+    if (ignorefile) {
+        config.ignore.pathsAsString = (0, parseIgnoreFile_1.parseIgnoreFile)(ignorefile, config);
     }
+    config.ignore.paths = config.ignore.pathsAsString
+        .map((p) => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
+        .map((p) => p.replace(/[*]{1,2}/g, (a) => (a.length == 2 ? '.*' : '[^/]*')))
+        .map((s) => new RegExp(s));
+    scan();
+}
+catch (error) {
+    exitWithError(error);
 }
-config.ignore.paths = config.ignore.pathsAsString
-    .map((p) => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
-    .map((p) => p.replace(/[*]{1,2}/g, (a) => (a.length == 2 ? '.*' : '[^/]*')))
-    .map((s) => new RegExp(s));
-scanner.on('vulnerable-dependency-found', (result) => {
-    const levels = result.results.map((r) => {
-        return r.vulnerabilities
-            ? r.vulnerabilities.map((v) => {
-                return types_1.severityLevels[v.severity ?? 'critical'];
-            })
-            : [];
-    });
-    const severity = utils.flatten(levels).reduce((x, y) => (x > y ? x : y));
-    if (severity >= types_1.severityLevels[config.severity]) {
-        failProcess = true;
-    }
-});
-scanner.on('vulnerable-dependency-found', log.logVulnerableDependency);
-scanner.on('dependency-found', log.logDependency);
-events.on('scan-done', () => {
-    process.exitCode = failProcess ? config.exitwith : 0;
-    log.close();
-});
-process.on('uncaughtException', (err, ...rest) => {
-    console.warn('Exception caught: ', err, rest);
-    console.warn(err.stack);
-    process.exit(1);
-});
-events.on('stop', (err) => {
-    exitWithError(err);
-});
-Promise.all(jsrepolocation.map((jsr) => jsr.match(/^https?:\/\//) ? repo.loadrepository(jsr, config) : repo.loadrepositoryFromFile(jsr, config)))
-    .then((jsRepos) => {
-    resolve
-        .scanJsFiles(config.path, config)
-        .on('jsfile', (file) => {
-        jsRepos.forEach((jsRepo) => {
-            scanner.scanJsFile(file, jsRepo, config);
-        });
-    })
-        .on('bowerfile', (bowerfile) => {
-        jsRepos.forEach((jsRepo) => {
-            const bowerRepo = repo.asbowerrepo(jsRepo);
-            scanner.scanBowerFile(bowerfile, bowerRepo, config);
-        });
-    })
-        .on('end', () => {
-        events.emit('scan-done');
-    });
-})
-    .catch((e) => events.emit('stop', e));

package/lib/depsdev.js

@@ -1,31 +1,31 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkOSV = checkOSV;
-const https_1 = __importDefault(require("https"));
+const http_1 = require("./http");
 const retire_1 = require("./retire");
-function loadJson(url, options) {
+async function loadJson(url, options) {
     options.log.debug('Downloading ' + url + ' ...');
+    const res = await (0, http_1.get)(url, (0, http_1.requestSettings)(options));
     return new Promise((resolve, reject) => {
-        const req = https_1.default.request(url, (res) => {
-            if (res.statusCode == 404)
-                return resolve(undefined);
-            if (res.statusCode != 200) {
-                return reject('HTTP ' + res.statusCode + ' ' + res.statusMessage + ' for ' + url);
-            }
-            const data = [];
-            res.on('data', (c) => data.push(c));
-            res.on('end', () => {
-                const result = Buffer.concat(data).toString();
+        if (res.statusCode != 200)
+            res.resume();
+        if (res.statusCode == 404)
+            return resolve(undefined);
+        if (res.statusCode != 200) {
+            return reject('HTTP ' + res.statusCode + ' ' + res.statusMessage + ' for ' + url);
+        }
+        const data = [];
+        res.on('data', (c) => data.push(c));
+        res.on('error', reject);
+        res.on('end', () => {
+            const result = Buffer.concat(data).toString();
+            try {
                 resolve(JSON.parse(result));
-            });
-        });
-        req.on('error', (err) => {
-            reject(err);
+            }
+            catch (error) {
+                reject(`Invalid JSON from ${url}: ${error}`);
+            }
         });
-        req.end();
     });
 }
 function getVulnerabilities(packageName, version, options) {

package/lib/http.d.ts

@@ -0,0 +1,14 @@
+import * as http from 'http';
+import { Options } from './types';
+export type RequestSettings = {
+    proxy?: string;
+    insecure?: boolean;
+    ca?: Buffer;
+};
+export declare function requestSettings(options: Options): RequestSettings;
+/**
+ * GET a URL, optionally through an http:// or https:// proxy.
+ * Plain http targets are sent to the proxy as absolute-form requests,
+ * https targets are tunnelled through the proxy with CONNECT.
+ */
+export declare function get(url: string, settings?: RequestSettings): Promise<http.IncomingMessage>;

package/lib/http.js

@@ -0,0 +1,122 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestSettings = requestSettings;
+exports.get = get;
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const net = __importStar(require("net"));
+const tls = __importStar(require("tls"));
+function requestSettings(options) {
+    return {
+        proxy: options.proxy || process.env.http_proxy,
+        insecure: options.insecure,
+        ca: options.cacertbuf,
+    };
+}
+/**
+ * GET a URL, optionally through an http:// or https:// proxy.
+ * Plain http targets are sent to the proxy as absolute-form requests,
+ * https targets are tunnelled through the proxy with CONNECT.
+ */
+async function get(url, settings = {}) {
+    const target = new URL(url);
+    const tlsSettings = {
+        rejectUnauthorized: !settings.insecure,
+        ...(settings.ca ? { ca: [settings.ca] } : {}),
+    };
+    if (!settings.proxy) {
+        return send(target.protocol === 'http:' ? http : https, url, tlsSettings);
+    }
+    const proxy = new URL(settings.proxy);
+    if (proxy.protocol !== 'http:' && proxy.protocol !== 'https:') {
+        throw new Error(`Unsupported proxy protocol: ${proxy.protocol} (only http: and https: are supported)`);
+    }
+    const proxyModule = proxy.protocol === 'https:' ? https : http;
+    const proxyConnection = {
+        host: unbracket(proxy.hostname),
+        port: proxy.port || (proxy.protocol === 'https:' ? 443 : 80),
+        ...(proxy.protocol === 'https:' ? tlsSettings : {}),
+    };
+    if (target.protocol === 'http:') {
+        return send(proxyModule, {
+            ...proxyConnection,
+            path: url,
+            headers: { host: target.host, ...proxyAuthorization(proxy) },
+        });
+    }
+    const socket = await tunnel(proxyModule, proxyConnection, proxy, target);
+    const servername = net.isIP(unbracket(target.hostname)) ? undefined : target.hostname;
+    // No agent: Node only honours createConnection when the request has no agent.
+    return send(https, url, {
+        createConnection: () => tls.connect({ ...tlsSettings, socket, servername }),
+    });
+}
+function tunnel(proxyModule, proxyConnection, proxy, target) {
+    const authority = `${target.hostname}:${target.port || 443}`;
+    return new Promise((resolve, reject) => {
+        const req = proxyModule.request({
+            ...proxyConnection,
+            method: 'CONNECT',
+            path: authority,
+            agent: false,
+            headers: { host: authority, ...proxyAuthorization(proxy) },
+        });
+        req.on('connect', (res, socket) => {
+            if (res.statusCode !== 200) {
+                socket.destroy();
+                return reject(new Error(`Proxy refused tunnel to ${authority}: HTTP ${res.statusCode} ${res.statusMessage}`));
+            }
+            resolve(socket);
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+function send(module, url, options = {}) {
+    return new Promise((resolve, reject) => {
+        const req = typeof url === 'string' ? module.get(url, options, resolve) : module.get(url, resolve);
+        req.on('error', reject);
+    });
+}
+function proxyAuthorization(proxy) {
+    if (!proxy.username)
+        return {};
+    const credentials = `${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`;
+    return { 'proxy-authorization': `Basic ${Buffer.from(credentials).toString('base64')}` };
+}
+function unbracket(hostname) {
+    return hostname.replace(/^\[(.*)\]$/, '$1');
+}

package/lib/license.js

@@ -32,7 +32,7 @@ function evaluateLicense(licenses, version) {
         .filter((parsedLicense) => {
         return parsedLicense.ranges.some((range) => {
             if (range.from && range.to) {
-                return (0, retire_1.isAtOrAbove)(version, range.from) && (0, retire_1.isAtOrAbove)(range.to, version);
+                return (0, retire_1.isAtOrAbove)(version, range.from) && !(0, retire_1.isAtOrAbove)(version, range.to);
             }
             if (range.from) {
                 return (0, retire_1.isAtOrAbove)(version, range.from);

package/lib/parseIgnoreFile.d.ts

@@ -0,0 +1,2 @@
+import { Options } from './types';
+export declare function parseIgnoreFile(ignorefile: string, config: Options): string[];

package/lib/parseIgnoreFile.js

@@ -0,0 +1,36 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseIgnoreFile = parseIgnoreFile;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const types_1 = require("./types");
+function parseIgnoreFile(ignorefile, config) {
+    if (!fs_1.default.existsSync(ignorefile)) {
+        throw new Error(`Could not read ignore file: ${ignorefile}`);
+    }
+    if (ignorefile.endsWith('.json')) {
+        try {
+            config.ignore.descriptors = types_1.ignoreFileParser.parse(JSON.parse(fs_1.default.readFileSync(ignorefile, 'utf-8')));
+        }
+        catch (e) {
+            throw new Error(`Invalid ignore file: ${ignorefile}`, { cause: e });
+        }
+        const ignoredPaths = config.ignore.descriptors
+            ?.map((x) => ('path' in x ? x.path : undefined))
+            ?.filter((x) => x != undefined) ?? [];
+        return config.ignore.pathsAsString.concat(ignoredPaths);
+    }
+    else {
+        const lines = fs_1.default
+            .readFileSync(ignorefile, 'utf-8')
+            .split(/\r\n|\n/g)
+            .filter((e) => e !== '');
+        const ignored = lines.map((e) => {
+            return e[0] === '@' ? e.slice(1) : path_1.default.resolve(e);
+        });
+        return config.ignore.pathsAsString.concat(ignored);
+    }
+}

package/lib/repo.d.ts

@@ -1,6 +1,7 @@
 import { Options, Repository } from './types';
 import * as z from 'zod';
-export declare function validateRepository(repo: Repository, replacer?: Options['process']): z.SafeParseReturnType<unknown, Repository>;
+export declare function validateRepository(repo: Repository, replacer?: Options['process']): z.ZodSafeParseResult<Repository>;
+export declare function formatValidationError(error: z.ZodError): string;
 export declare function asbowerrepo(jsRepo: Repository): Repository;
 export declare function loadrepository(repoUrl: string, options: Options): Promise<Repository>;
 export declare function loadrepositoryFromFile(filepath: string, options: Options): Promise<Repository>;

package/lib/repo.js

@@ -34,16 +34,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateRepository = validateRepository;
+exports.formatValidationError = formatValidationError;
 exports.asbowerrepo = asbowerrepo;
 exports.loadrepository = loadrepository;
 exports.loadrepositoryFromFile = loadrepositoryFromFile;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const http = __importStar(require("http"));
-const https = __importStar(require("https"));
 const retire = __importStar(require("./retire"));
-const URL = __importStar(require("url"));
-const proxy_agent_1 = require("proxy-agent");
+const http_1 = require("./http");
 const z = __importStar(require("zod"));
 const types_1 = require("./types");
 function validateRepository(repo, replacer) {
@@ -91,47 +89,45 @@ function validateRepository(repo, replacer) {
             .strict()
             .superRefine((o, ctx) => {
             if (Object.keys(o).filter((k) => k != 'summary').length == 0)
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Must have at least one identifier' });
+                ctx.addIssue({ code: 'custom', message: 'Must have at least one identifier' });
             const ids = Object.values(o)
                 .map((x) => (Array.isArray(x) ? x : [x]))
                 .reduce((a, b) => a.concat(b), []).length;
             if (ids == 0)
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Must have at least one identifier' });
+                ctx.addIssue({ code: 'custom', message: 'Must have at least one identifier' });
         }),
         details: z.string().optional(),
         info: z.array(z.string().regex(/^https?:\/\/.+/)),
     })
         .strict();
     const regexValidator = z.string().superRefine((s, ctx) => {
-        if (ctx.path[0] == 'dont check')
-            return;
         try {
             new RegExp(s);
         }
-        catch (error) {
+        catch {
             ctx.addIssue({
-                code: z.ZodIssueCode.custom,
+                code: 'custom',
                 message: 'Invalid regex: ' + s,
             });
         }
         if (s.includes('[]'))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Regex must not contain []: ' + s });
+            ctx.addIssue({ code: 'custom', message: 'Regex must not contain []: ' + s });
         if (s.includes('{}'))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Regex must not contain {}: ' + s });
+            ctx.addIssue({ code: 'custom', message: 'Regex must not contain {}: ' + s });
         [/.*[^\\]\{[^0-9,\\]\}.*/, /[^,0-9\\]\}/, /[^\\]\{[^,0-9]/].forEach((r) => {
             if (r.test(s))
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'There is something odd with this regex: ' + s });
+                ctx.addIssue({ code: 'custom', message: 'There is something odd with this regex: ' + s });
         });
         let versionMatcher = '§§version§§';
         if (replacer)
             versionMatcher = JSON.parse(`"${replacer(versionMatcher)}"`);
         const versionIndex = s.indexOf(versionMatcher);
         if (versionIndex == -1 || (versionIndex > 0 && s.substring(versionIndex - 1, versionIndex) == '\\')) {
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Regex must contain (§§version§§): ' + s });
+            ctx.addIssue({ code: 'custom', message: 'Regex must contain (§§version§§): ' + s });
         }
-        else if (s.replace(/\(\?:/g, '').replace(/\\\(/g, '').split(/\(/)[1].indexOf(versionMatcher) != 0) {
+        else if (s.replace(/\(\?:/g, '').replace(/\\\(/g, '').split(/\(/)[1]?.indexOf(versionMatcher) != 0) {
             ctx.addIssue({
-                code: z.ZodIssueCode.custom,
+                code: 'custom',
                 message: 'Regex must contain (§§version§§) as first capture group: ' + s.replace(/\(\?:/g, '').replace(/\\\(/g, ''),
             });
         }
@@ -139,7 +135,7 @@ function validateRepository(repo, replacer) {
     const replaceValidator = z
         .string()
         .regex(/^\/(.*[^\\])\/([^/]+)\/$/, 'RegExp error - should be on format "/search/replacement/"');
-    const validator = z.record(z
+    const entryValidator = (extractorValidator) => z
         .object({
         bowername: z.array(z.string().regex(/^[a-z0-9.-]+$/i)).optional(),
         basePurl: z
@@ -154,9 +150,9 @@ function validateRepository(repo, replacer) {
         extractors: z
             .object({
             func: z.array(z.string().min(5)).optional(),
-            uri: z.array(regexValidator).optional(),
-            filename: z.array(regexValidator).optional(),
-            filecontent: z.array(regexValidator).optional(),
+            uri: z.array(extractorValidator).optional(),
+            filename: z.array(extractorValidator).optional(),
+            filecontent: z.array(extractorValidator).optional(),
             filecontentreplace: z.array(replaceValidator).optional(),
             hashes: z.record(z.string().regex(/^[a-f0-9]+$/i), versionValidator).optional(),
             ast: z.array(z.string()).optional(),
@@ -168,34 +164,35 @@ function validateRepository(repo, replacer) {
             .regex(/(\([A-Za-z\-0-9.]+( OR [A-Za-z\-0-9.]+)+\)|[A-Za-z\-0-9.]+) >=[0-9.]+( <[0-9.]+)?(;>=[0-9.]+( <[0-9.]+)?)*/))
             .optional(),
     })
-        .strict());
+        .strict();
+    // "dont check" lists URIs that are deliberately not version extractors, so its regexes are not validated.
+    const validator = z
+        .object({ 'dont check': entryValidator(z.string()).optional() })
+        .catchall(entryValidator(regexValidator));
     return validator.safeParse(repo);
 }
 function formatValidationError(error) {
-    return JSON.stringify(error.format(), (key, value) => (Array.isArray(value) && value.length === 0 ? undefined : value), 2);
+    return z.prettifyError(error);
 }
 async function loadJson(url, options) {
+    options.log.info('Downloading ' + url + ' ...');
+    let res;
+    try {
+        res = await (0, http_1.get)(url, (0, http_1.requestSettings)(options));
+    }
+    catch (e) {
+        throw `Error downloading: ${url}: ${e}`;
+    }
     return new Promise((resolve, reject) => {
-        options.log.info('Downloading ' + url + ' ...');
-        const reqOptions = { ...URL.parse(url), method: 'GET' };
-        const proxyUri = options.proxy || process.env.http_proxy;
-        if (proxyUri) {
-            reqOptions.agent = new proxy_agent_1.ProxyAgent({
-                getProxyForUrl: () => proxyUri,
-            });
+        if (res.statusCode != 200) {
+            res.resume();
+            return reject(`Error downloading: ${url}: HTTP ${res.statusCode} ${res.statusMessage}`);
         }
-        if (options.insecure) {
-            reqOptions.rejectUnauthorized = false;
-        }
-        if (options.cacertbuf) {
-            reqOptions.ca = [options.cacertbuf];
-        }
-        const req = (url.startsWith('http:') ? http : https).get(reqOptions, (res) => {
-            if (res.statusCode != 200)
-                return reject(`Error downloading: ${url}: HTTP ${res.statusCode} ${res.statusMessage}`);
-            const data = [];
-            res.on('data', (c) => data.push(c));
-            res.on('end', () => {
+        const data = [];
+        res.on('data', (c) => data.push(c));
+        res.on('error', (e) => reject(`Error downloading: ${url}: ${e}`));
+        res.on('end', () => {
+            try {
                 let d = Buffer.concat(data).toString();
                 d = options.process ? options.process(d) : d;
                 const json = JSON.parse(d);
@@ -204,12 +201,13 @@ async function loadJson(url, options) {
                     resolve(json);
                 }
                 else {
-                    reject(`Invalid repository from ${url}: ${formatValidationError(vresult.error)}`);
+                    reject(`Invalid repository from ${url}:\n${formatValidationError(vresult.error)}`);
                 }
-            });
+            }
+            catch (error) {
+                reject(`Invalid repository from ${url}: ${error}`);
+            }
         });
-        req.on('error', (e) => reject(`Error downloading: ${url}: ${e}`));
-        req.end();
     });
 }
 async function loadJsonFromFile(file, options) {
@@ -219,14 +217,19 @@ async function loadJsonFromFile(file, options) {
             if (err) {
                 return reject(err.toString());
             }
-            data = options.process ? options.process(data) : data;
-            const json = JSON.parse(data);
-            const vresult = validateRepository(json, options.process);
-            if (vresult.success) {
-                resolve(json);
+            try {
+                data = options.process ? options.process(data) : data;
+                const json = JSON.parse(data);
+                const vresult = validateRepository(json, options.process);
+                if (vresult.success) {
+                    resolve(json);
+                }
+                else {
+                    reject(`Invalid repository from ${file}:\n${formatValidationError(vresult.error)}`);
+                }
             }
-            else {
-                reject(`Invalid repository from ${file}: ${formatValidationError(vresult.error)}`);
+            catch (error) {
+                reject(`Invalid repository from ${file}: ${error}`);
             }
         });
     });

package/lib/reporters/cyclonedx-json-builder.js

@@ -102,7 +102,10 @@ function configureCycloneDXJSONLogger(specVersion, logger, writer, config, hash)
             .filter((d) => d.results)
             .map((r) => r.results
             .map((dep) => {
-            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
+            dep = {
+                ...dep,
+                version: (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.'),
+            };
             let hashes;
             const filepath = r.file;
             const evidence = { occurrences: [] };
@@ -119,11 +122,6 @@ function configureCycloneDXJSONLogger(specVersion, logger, writer, config, hash)
             }
             const purl = (0, utils_1.generatePURL)(dep);
             const existing = seen.get(purl);
-            if (existing) {
-                const missing = evidence.occurrences.filter((x) => !existing.evidence.occurrences.some((y) => y.location == x.location));
-                existing.evidence.occurrences.push(...missing);
-                return undefined;
-            }
             const identity = mapIdentity(dep);
             if (identity)
                 evidence.identity = [identity];
@@ -155,18 +153,29 @@ function configureCycloneDXJSONLogger(specVersion, logger, writer, config, hash)
                             affects: [],
                         });
                     }
-                    vulnerabilitiesCyclone.get(id).affects.push({
-                        ref: bomRef,
-                        versions: [
-                            {
-                                // "vers:npm/1.2.3|>=2.0.0|<5.0.0"
-                                range: 'vers:npm/' + (vuln.atOrAbove ? '>=' + vuln.atOrAbove + '|' : '') + '<' + vuln.below,
-                                status: 'affected',
-                            },
-                        ],
-                    });
+                    const affects = vulnerabilitiesCyclone.get(id).affects;
+                    let affected = affects.find((entry) => entry.ref === bomRef);
+                    if (!affected) {
+                        affected = { ref: bomRef, versions: [] };
+                        affects.push(affected);
+                    }
+                    const range = 'vers:npm/' + (vuln.atOrAbove ? '>=' + vuln.atOrAbove + '|' : '') + '<' + vuln.below;
+                    if (!affected.versions.some((entry) => entry.range === range)) {
+                        affected.versions.push({ range, status: 'affected' });
+                    }
                 });
             });
+            if (existing) {
+                const missing = evidence.occurrences.filter((x) => !existing.evidence.occurrences.some((y) => y.location == x.location));
+                existing.evidence.occurrences.push(...missing);
+                if (identity) {
+                    const identities = existing.evidence.identity ?? (existing.evidence.identity = []);
+                    if (!identities.some((entry) => entry.methods[0].value === identity.methods[0].value)) {
+                        identities.push(identity);
+                    }
+                }
+                return undefined;
+            }
             const result = {
                 'bom-ref': bomRef,
                 type: 'library',

package/lib/reporters/cyclonedx-json.js

@@ -65,7 +65,10 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     };
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
-        const properties = (0, utils_1.vulnerabilityRepositories)(config.jsRepo).map((repo) => ({ name: 'retirejs:vulnerability-repository', value: repo }));
+        const properties = (0, utils_1.vulnerabilityRepositories)(config.jsRepo).map((repo) => ({
+            name: 'retirejs:vulnerability-repository',
+            value: repo,
+        }));
         if (config.insecure) {
             properties.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
         }
@@ -74,7 +77,10 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
             .filter((d) => d.results)
             .map((r) => r.results
             .map((dep) => {
-            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
+            dep = {
+                ...dep,
+                version: (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.'),
+            };
             let hashes;
             const filepath = r.file;
             const properties = [];

package/lib/reporters/cyclonedx.js

@@ -81,7 +81,10 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
             .filter((d) => d.results.length > 0)
             .map((r) => r.results
             .map((dep) => {
-            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
+            dep = {
+                ...dep,
+                version: (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.'),
+            };
             const filepath = r.file;
             let hashes = '';
             if (filepath) {
@@ -120,9 +123,11 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
             <name>retire.js</name>
             <version>${retire.version}</version>
         </tool>
-    </tools>${properties ? `
+    </tools>${properties
+            ? `
     <properties>${properties}
-    </properties>` : ''}
+    </properties>`
+            : ''}
   </metadata>
   <components>${components}
   </components>
@@ -131,11 +136,7 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
     };
 }
 function escapeXml(value) {
-    return value
-        .replace(/&/g, '&amp;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;');
+    return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 }
 function mapLicenses(licenses) {
     if (!licenses)

package/lib/resolve.js

@@ -43,7 +43,7 @@ function scanJsFiles(path, options) {
         if (ext.some((e) => file.endsWith(e))) {
             finder.emit('jsfile', file);
         }
-        if (file.match(/\/bower.json$/)) {
+        if (file.match(/[\\/]bower\.json$/)) {
             finder.emit('bowerfile', file);
         }
     }

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.7.0';
+exports.version = '6.1.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

package/lib/scanner.d.ts

@@ -1,4 +1,4 @@
 import { Finding, Options, Repository } from './types';
-export declare function scanJsFile(file: string, repo: Repository, options: Options): void;
-export declare function scanBowerFile(file: string, repo: Repository, options: Options): void;
+export declare function scanJsFile(file: string, repo: Repository, options: Options): Promise<void>;
+export declare function scanBowerFile(file: string, repo: Repository, options: Options): Promise<void>;
 export declare function on(event: 'vulnerable-dependency-found' | 'dependency-found', handler: (finding: Finding) => void): void;

package/lib/scanner.js

@@ -52,19 +52,22 @@ const hash = {
         return shasum.digest('hex');
     },
 };
-function emitResults(finding, options, repo) {
+async function emitResults(finding, options, repo) {
     if (options.includeOsv === true) {
-        Promise.all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.component, r.version, options).then((v) => (r.vulnerabilities = (r.vulnerabilities ?? []).concat(v))))).then(() => filterAndEmitResults(finding, options, repo));
-    }
-    else {
-        filterAndEmitResults(finding, options, repo);
+        await Promise.all(finding.results.map((r) => (0, depsdev_1.checkOSV)(r.npmname ?? r.component, r.version, options).then((v) => (r.vulnerabilities = (r.vulnerabilities ?? []).concat(v)))));
     }
+    filterAndEmitResults(finding, options, repo);
 }
 function getIdentifiers(v) {
-    return (v.identifiers?.CVE ?? [])
-        .concat(v.identifiers?.bug ?? [])
-        .concat(v.identifiers?.issue ?? [])
-        .concat(v.identifiers?.githubID ?? []);
+    const identifiers = v.identifiers ?? {};
+    const canonical = (identifiers.CVE ?? []).map((id) => `CVE:${id}`);
+    if (identifiers.githubID)
+        canonical.push(`githubID:${identifiers.githubID}`);
+    if (canonical.length)
+        return canonical;
+    return Object.entries(identifiers)
+        .filter(([key, value]) => key !== 'summary' && value != null)
+        .flatMap(([key, value]) => (Array.isArray(value) ? value : [value]).map((id) => `${key}:${id}`));
 }
 function uniqueVulnerabilities(vulnerabilities) {
     if (!vulnerabilities)
@@ -144,7 +147,7 @@ function hasIdentifier(identifiers, key, value) {
     const identifier = identifiers[key];
     return Array.isArray(identifier) ? identifier.some((x) => x === value) : identifier === value;
 }
-function scanJsFile(file, repo, options) {
+async function scanJsFile(file, repo, options) {
     if (options.ignore && shouldIgnorePath([file], options.ignore)) {
         return;
     }
@@ -161,22 +164,25 @@ function scanJsFile(file, repo, options) {
             }
         }
     }
-    emitResults({ file: file, results: results }, options, repo);
+    await emitResults({ file: file, results: results }, options, repo);
 }
-function scanBowerFile(file, repo, options) {
+async function scanBowerFile(file, repo, options) {
     if (options.ignore && shouldIgnorePath([file], options.ignore)) {
         return;
     }
+    let results;
     try {
         const bower = JSON.parse(fs.readFileSync(file, 'utf-8'));
         if (bower.version) {
-            const results = retire.check(bower.name, bower.version, repo);
-            emitResults({ file: file, results: results }, options, repo);
+            results = retire.check(bower.name, bower.version, repo);
         }
     }
-    catch (e) {
+    catch {
         options.log.warn(`Could not parse file: ${file}`);
     }
+    if (results) {
+        await emitResults({ file: file, results: results }, options, repo);
+    }
 }
 function on(event, handler) {
     events.on(event, handler);

package/lib/types.d.ts

@@ -1,3 +1,4 @@
+import z from 'zod';
 import { Logger } from './reporting';
 export type Repository = Record<string, {
     bowername?: string[];
@@ -55,6 +56,13 @@ export declare const severityLevels: {
     readonly critical: 4;
 };
 export type SeverityLevel = keyof typeof severityLevels;
+export declare const severityParser: z.ZodEnum<{
+    none: "none";
+    low: "low";
+    medium: "medium";
+    high: "high";
+    critical: "critical";
+}>;
 export type PathDescriptor = {
     path: string;
     justification?: string;
@@ -93,4 +101,13 @@ export type Options = {
     includeOsv?: boolean;
     deep?: boolean;
 };
+export declare const ignoreFileParser: z.ZodArray<z.ZodIntersection<z.ZodObject<{
+    justification: z.ZodString;
+}, z.core.$strip>, z.ZodUnion<[z.ZodObject<{
+    path: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    component: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+    identifiers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>]>>>;
 export {};

package/lib/types.js

@@ -1,6 +1,10 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.severityLevels = void 0;
+exports.ignoreFileParser = exports.severityParser = exports.severityLevels = void 0;
+const zod_1 = __importDefault(require("zod"));
 exports.severityLevels = {
     none: 0,
     low: 1,
@@ -8,3 +12,17 @@ exports.severityLevels = {
     high: 3,
     critical: 4,
 };
+exports.severityParser = zod_1.default.enum(Object.keys(exports.severityLevels));
+exports.ignoreFileParser = zod_1.default.array(zod_1.default
+    .object({
+    justification: zod_1.default.string(),
+})
+    .and(zod_1.default
+    .object({
+    path: zod_1.default.string(),
+})
+    .or(zod_1.default.object({
+    component: zod_1.default.string(),
+    version: zod_1.default.string().optional(),
+    identifiers: zod_1.default.record(zod_1.default.string(), zod_1.default.string()).optional(),
+}))));

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.7.0",
+  "version": "6.1.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -13,35 +13,35 @@
   },
   "main": "./lib/retire.js",
   "dependencies": {
-    "ansi-colors": "^4.1.1",
     "astronomical": "^3.2.0",
-    "commander": "^10.0.1",
-    "proxy-agent": "^6.4.0",
+    "commander": "^14.0.3",
     "walkdir": "0.4.1",
-    "zod": "^3.22.4"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/node": "^18.13.0",
-    "@types/uuid": "^9.0.0",
-    "@typescript-eslint/eslint-plugin": "^7.1.1",
-    "@typescript-eslint/parser": "^7.1.1",
-    "eslint": "^8.34.0",
-    "eslint-config-prettier": "^9.0.0",
+    "@types/uuid": "^10.0.0",
+    "eslint": "^10.12.0",
+    "eslint-config-prettier": "^10.1.8",
+    "globals": "^17.13.0",
     "jsonschema": "^1.4.1",
     "prettier": "^3.1.0",
     "ts-node": "^10.9.2",
-    "typescript": "^5.0.4"
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.71.1"
   },
   "scripts": {
     "test": "TS_NODE_PROJECT=tsconfig.spec.json node --require ts-node/register --test \"spec/tests/**/*.spec.ts\"",
     "build": "tsc && chmod ugo+x lib/cli.js && cp src/retire.d.ts lib/retire.d.ts && cp ../LICENSE.md .",
     "watch": "tsc --watch ",
     "typecheck": "tsc --noEmit",
-    "lint": "eslint . --ext .ts --fix --ignore-path ../.gitignore",
+    "lint": "eslint . --fix",
+    "format": "prettier --write \"src/**/*.ts\" \"spec/**/*.ts\"",
     "check": "npm run lint && npm run typecheck"
   },
   "engines": {
-    "node": ">= 18.0.0"
+    "node": "^20.19.0 || >=22.12.0"
   },
   "keywords": [
     "sbom",