retire 6.0.0 → 6.1.0

package/CHANGELOG.md

@@ -1,11 +1,27 @@
 # Changelog
 
+## [6.1.0]
+
+### Improvements
+
+- Repository validation errors (for an invalid `--jsrepo`, and from `repository/validate`) are now listed one per line with the location of each problem, instead of as a nested JSON tree:
+  ```
+  ✖ Invalid option: expected one of "none"|"low"|"medium"|"high"|"critical"
+    → at jquery.vulnerabilities[0].severity
+  ```
+- Positional arguments (e.g. `retire .` or `retire src/`) are still ignored, but now print a warning. Use `--path <path>` to choose what to scan.
+- Upgraded `commander` to 14 and `zod` to 4.
+
+### Bugfixes
+
+- Repository validation crashed with a `TypeError` on extractor regexes that contain `§§version§§` without a capture group (e.g. `jquery-§§version§§\.js`), instead of reporting the invalid regex. It now reports `Regex must contain (§§version§§) as first capture group`.
+
 ## [6.0.0]
 
 ### Breaking changes
 
 - Requires Node.js 20.19+ or 22.12+ (previously 18+).
-- `--proxy` (and the `http_proxy` environment variable) now only supports `http://` and `https://` proxy URLs. SOCKS (`socks://`, `socks5://`, ...) and PAC (`pac+http://`, ...) proxies are no longer supported and fail with an `Unsupported proxy protocol` error.
+- `--proxy` (and the `http_proxy` environment variable) now only supports `http://` and `https://` proxy URLs. SOCKS (`socks://`, `socks5://`, ...) and PAC (`pac+http://`, ...) proxies are no longer supported and fail with an `Unsupported proxy protocol` error (let us know if socks or pac are needed and we can re-add).
 
 ### Improvements
 

package/lib/cli.js

@@ -79,6 +79,8 @@ const prg = commander_1.program
     .option('--cacert <path>', 'Use the specified certificate file to verify the peer used for fetching remote jsrepo/noderepo files')
     .option('--includeOsv', 'Include OSV advisories in the output')
     .option('--deep', 'Deep scan (slower and experimental)')
+    // Positional arguments were never used, but were silently accepted before commander 13.
+    .allowExcessArguments()
     .parse()
     .opts();
 const red = (x) => `\u001b[31m${x}\u001b[39m`;
@@ -180,6 +182,9 @@ try {
         throw new Error(`Invalid severity level (${severity}). Valid levels are: ${Object.keys(types_1.severityLevels).join(', ')}`);
     }
     log.info(`retire.js v${retire.version}`);
+    if (commander_1.program.args.length > 0) {
+        log.warn(colorwarn(`Warning: Ignoring unexpected argument(s) ${commander_1.program.args.map((arg) => `"${arg}"`).join(' ')}. Use --path <path> to choose what to scan (scanning ${scanpath}).`));
+    }
     if (prg.cacert) {
         if (!fs_1.default.existsSync(prg.cacert)) {
             throw new Error(`Could not read cacert file: ${prg.cacert}`);

package/lib/repo.d.ts

@@ -1,6 +1,7 @@
 import { Options, Repository } from './types';
 import * as z from 'zod';
-export declare function validateRepository(repo: Repository, replacer?: Options['process']): z.SafeParseReturnType<unknown, Repository>;
+export declare function validateRepository(repo: Repository, replacer?: Options['process']): z.ZodSafeParseResult<Repository>;
+export declare function formatValidationError(error: z.ZodError): string;
 export declare function asbowerrepo(jsRepo: Repository): Repository;
 export declare function loadrepository(repoUrl: string, options: Options): Promise<Repository>;
 export declare function loadrepositoryFromFile(filepath: string, options: Options): Promise<Repository>;

package/lib/repo.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateRepository = validateRepository;
+exports.formatValidationError = formatValidationError;
 exports.asbowerrepo = asbowerrepo;
 exports.loadrepository = loadrepository;
 exports.loadrepositoryFromFile = loadrepositoryFromFile;
@@ -88,47 +89,45 @@ function validateRepository(repo, replacer) {
             .strict()
             .superRefine((o, ctx) => {
             if (Object.keys(o).filter((k) => k != 'summary').length == 0)
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Must have at least one identifier' });
+                ctx.addIssue({ code: 'custom', message: 'Must have at least one identifier' });
             const ids = Object.values(o)
                 .map((x) => (Array.isArray(x) ? x : [x]))
                 .reduce((a, b) => a.concat(b), []).length;
             if (ids == 0)
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Must have at least one identifier' });
+                ctx.addIssue({ code: 'custom', message: 'Must have at least one identifier' });
         }),
         details: z.string().optional(),
         info: z.array(z.string().regex(/^https?:\/\/.+/)),
     })
         .strict();
     const regexValidator = z.string().superRefine((s, ctx) => {
-        if (ctx.path[0] == 'dont check')
-            return;
         try {
             new RegExp(s);
         }
         catch {
             ctx.addIssue({
-                code: z.ZodIssueCode.custom,
+                code: 'custom',
                 message: 'Invalid regex: ' + s,
             });
         }
         if (s.includes('[]'))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Regex must not contain []: ' + s });
+            ctx.addIssue({ code: 'custom', message: 'Regex must not contain []: ' + s });
         if (s.includes('{}'))
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Regex must not contain {}: ' + s });
+            ctx.addIssue({ code: 'custom', message: 'Regex must not contain {}: ' + s });
         [/.*[^\\]\{[^0-9,\\]\}.*/, /[^,0-9\\]\}/, /[^\\]\{[^,0-9]/].forEach((r) => {
             if (r.test(s))
-                ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'There is something odd with this regex: ' + s });
+                ctx.addIssue({ code: 'custom', message: 'There is something odd with this regex: ' + s });
         });
         let versionMatcher = '§§version§§';
         if (replacer)
             versionMatcher = JSON.parse(`"${replacer(versionMatcher)}"`);
         const versionIndex = s.indexOf(versionMatcher);
         if (versionIndex == -1 || (versionIndex > 0 && s.substring(versionIndex - 1, versionIndex) == '\\')) {
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Regex must contain (§§version§§): ' + s });
+            ctx.addIssue({ code: 'custom', message: 'Regex must contain (§§version§§): ' + s });
         }
-        else if (s.replace(/\(\?:/g, '').replace(/\\\(/g, '').split(/\(/)[1].indexOf(versionMatcher) != 0) {
+        else if (s.replace(/\(\?:/g, '').replace(/\\\(/g, '').split(/\(/)[1]?.indexOf(versionMatcher) != 0) {
             ctx.addIssue({
-                code: z.ZodIssueCode.custom,
+                code: 'custom',
                 message: 'Regex must contain (§§version§§) as first capture group: ' + s.replace(/\(\?:/g, '').replace(/\\\(/g, ''),
             });
         }
@@ -136,7 +135,7 @@ function validateRepository(repo, replacer) {
     const replaceValidator = z
         .string()
         .regex(/^\/(.*[^\\])\/([^/]+)\/$/, 'RegExp error - should be on format "/search/replacement/"');
-    const validator = z.record(z
+    const entryValidator = (extractorValidator) => z
         .object({
         bowername: z.array(z.string().regex(/^[a-z0-9.-]+$/i)).optional(),
         basePurl: z
@@ -151,9 +150,9 @@ function validateRepository(repo, replacer) {
         extractors: z
             .object({
             func: z.array(z.string().min(5)).optional(),
-            uri: z.array(regexValidator).optional(),
-            filename: z.array(regexValidator).optional(),
-            filecontent: z.array(regexValidator).optional(),
+            uri: z.array(extractorValidator).optional(),
+            filename: z.array(extractorValidator).optional(),
+            filecontent: z.array(extractorValidator).optional(),
             filecontentreplace: z.array(replaceValidator).optional(),
             hashes: z.record(z.string().regex(/^[a-f0-9]+$/i), versionValidator).optional(),
             ast: z.array(z.string()).optional(),
@@ -165,11 +164,15 @@ function validateRepository(repo, replacer) {
             .regex(/(\([A-Za-z\-0-9.]+( OR [A-Za-z\-0-9.]+)+\)|[A-Za-z\-0-9.]+) >=[0-9.]+( <[0-9.]+)?(;>=[0-9.]+( <[0-9.]+)?)*/))
             .optional(),
     })
-        .strict());
+        .strict();
+    // "dont check" lists URIs that are deliberately not version extractors, so its regexes are not validated.
+    const validator = z
+        .object({ 'dont check': entryValidator(z.string()).optional() })
+        .catchall(entryValidator(regexValidator));
     return validator.safeParse(repo);
 }
 function formatValidationError(error) {
-    return JSON.stringify(error.format(), (key, value) => (Array.isArray(value) && value.length === 0 ? undefined : value), 2);
+    return z.prettifyError(error);
 }
 async function loadJson(url, options) {
     options.log.info('Downloading ' + url + ' ...');
@@ -198,7 +201,7 @@ async function loadJson(url, options) {
                     resolve(json);
                 }
                 else {
-                    reject(`Invalid repository from ${url}: ${formatValidationError(vresult.error)}`);
+                    reject(`Invalid repository from ${url}:\n${formatValidationError(vresult.error)}`);
                 }
             }
             catch (error) {
@@ -222,7 +225,7 @@ async function loadJsonFromFile(file, options) {
                     resolve(json);
                 }
                 else {
-                    reject(`Invalid repository from ${file}: ${formatValidationError(vresult.error)}`);
+                    reject(`Invalid repository from ${file}:\n${formatValidationError(vresult.error)}`);
                 }
             }
             catch (error) {

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '6.0.0';
+exports.version = '6.1.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

package/lib/types.d.ts

@@ -56,7 +56,13 @@ export declare const severityLevels: {
     readonly critical: 4;
 };
 export type SeverityLevel = keyof typeof severityLevels;
-export declare const severityParser: z.ZodEnum<["none" | "low" | "medium" | "high" | "critical"]>;
+export declare const severityParser: z.ZodEnum<{
+    none: "none";
+    low: "low";
+    medium: "medium";
+    high: "high";
+    critical: "critical";
+}>;
 export type PathDescriptor = {
     path: string;
     justification?: string;
@@ -97,27 +103,11 @@ export type Options = {
 };
 export declare const ignoreFileParser: z.ZodArray<z.ZodIntersection<z.ZodObject<{
     justification: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    justification: string;
-}, {
-    justification: string;
-}>, z.ZodUnion<[z.ZodObject<{
+}, z.core.$strip>, z.ZodUnion<[z.ZodObject<{
     path: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    path: string;
-}, {
-    path: string;
-}>, z.ZodObject<{
+}, z.core.$strip>, z.ZodObject<{
     component: z.ZodString;
     version: z.ZodOptional<z.ZodString>;
     identifiers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-}, "strip", z.ZodTypeAny, {
-    component: string;
-    version?: string | undefined;
-    identifiers?: Record<string, string> | undefined;
-}, {
-    component: string;
-    version?: string | undefined;
-    identifiers?: Record<string, string> | undefined;
-}>]>>, "many">;
+}, z.core.$strip>]>>>;
 export {};

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -14,9 +14,9 @@
   "main": "./lib/retire.js",
   "dependencies": {
     "astronomical": "^3.2.0",
-    "commander": "^10.0.1",
+    "commander": "^14.0.3",
     "walkdir": "0.4.1",
-    "zod": "^3.22.4"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",