sentinello 3.1.0 → 3.1.1

package/dist/cli.cjs

@@ -13134,8 +13134,8 @@ function isSourceUnavailableReason(code) {
 }
 
 // ../../packages/core/src/advisory-rows.ts
-var OSV_NORMALIZER_VERSION = 3;
-var GEMNASIUM_NORMALIZER_VERSION = 2;
+var OSV_NORMALIZER_VERSION = 4;
+var GEMNASIUM_NORMALIZER_VERSION = 3;
 
 // ../../packages/core/src/advisory-export.ts
 var DEFAULT_EXPORT_PROMPT = `You are helping a development team triage and fix the vulnerabilities listed at the bottom of this document. Treat this as a remediation work list, not a checklist to rubber-stamp. Work in a planning posture from the start: if your tooling has a read-only planning mode (Claude Code's plan mode, for example), enter it now and stay in it until the human has approved the triage below. Nothing in this document authorises you to edit a file before then.
@@ -33428,18 +33428,21 @@ function normalizeOsvRecord(record2, ecosystem) {
   const url2 = pickUrl(r, advisoryId);
   const withdrawn = typeof r.withdrawn === "string" ? Date.parse(r.withdrawn) || null : null;
   const rows = [];
-  const seenPackages = /* @__PURE__ */ new Set();
+  const byPackage = /* @__PURE__ */ new Map();
   for (const affected of r.affected) {
     const pkg2 = affected.package;
     if (!pkg2 || pkg2.ecosystem !== ecosystem) continue;
     const packageName = typeof pkg2.name === "string" ? pkg2.name : null;
     if (!packageName) continue;
-    if (seenPackages.has(packageName)) continue;
-    seenPackages.add(packageName);
     const ranges = extractRanges(affected.ranges);
     const versions = extractVersions(affected.versions);
-    if (ranges.length === 0 && versions.length === 0 && !malicious) continue;
-    rows.push({
+    const existing = byPackage.get(packageName);
+    if (existing) {
+      for (const range of ranges) existing.ranges.push(range);
+      for (const version2 of versions) existing.versions.push(version2);
+      continue;
+    }
+    byPackage.set(packageName, {
       advisoryId,
       ecosystem,
       packageName,
@@ -33453,6 +33456,10 @@ function normalizeOsvRecord(record2, ecosystem) {
       withdrawn
     });
   }
+  for (const row of byPackage.values()) {
+    if (row.ranges.length === 0 && row.versions.length === 0 && !malicious) continue;
+    rows.push(row);
+  }
   return rows;
 }
 function extractVersions(versions) {
@@ -33737,8 +33744,11 @@ function normalizeGemnasiumRecord(record2, ecosystem, slugPrefix) {
   const advisoryId = typeof r.identifier === "string" && r.identifier.length > 0 ? r.identifier : identifiers[0] ?? null;
   if (!advisoryId) return [];
   const fixedVersions = stringArray(r.fixed_versions);
-  const parsed = parseAffectedRange(typeof r.affected_range === "string" ? r.affected_range : "", fixedVersions);
-  if (parsed.ranges.length === 0 && parsed.versions.length === 0) return [];
+  const parsed = parseAffectedRange(
+    typeof r.affected_range === "string" ? r.affected_range : "",
+    fixedVersions,
+    typeof r.affected_versions === "string" ? r.affected_versions : ""
+  );
   const severity = severityFromCvss(
     typeof r.cvss_v3 === "string" ? r.cvss_v3 : null,
     typeof r.cvss_v2 === "string" ? r.cvss_v2 : null
@@ -33760,19 +33770,15 @@ function normalizeGemnasiumRecord(record2, ecosystem, slugPrefix) {
     summary,
     url: url2,
     malicious: false,
-    withdrawn: null
+    withdrawn: null,
+    rangeSource: parsed.source
   }];
 }
-function parseAffectedRange(affectedRange, fixedVersions) {
+function parseAffectedRange(affectedRange, fixedVersions, affectedVersions = "") {
   const ranges = [];
   const versions = [];
   const trimmed = affectedRange.trim();
   const disjuncts = trimmed.length > 0 ? trimmed.split("||").map(trimToken).filter(nonEmpty) : [];
-  if (disjuncts.length === 0) {
-    const fixed = fixedVersions[0];
-    if (fixed !== void 0) return { ranges: [{ introduced: "0", fixed }], versions };
-    return { ranges, versions };
-  }
   for (const disjunct of disjuncts) {
     const interval = parseDisjunct(disjunct);
     if (!interval) continue;
@@ -33782,12 +33788,56 @@ function parseAffectedRange(affectedRange, fixedVersions) {
       ranges.push({ introduced: interval.introduced, fixed: interval.fixed });
     }
   }
+  if (versions.length === 0 && ranges.every(isEmptyInterval)) {
+    const prose = parseAffectedVersionsProse(affectedVersions);
+    if (prose) return { ranges: prose, versions, source: "prose" };
+    return { ranges: [], versions: [], source: "unresolved" };
+  }
   const only = ranges[0];
   const authoritativeFixed = fixedVersions[0];
-  if (ranges.length === 1 && versions.length === 0 && only && authoritativeFixed !== void 0) {
+  if (ranges.length === 1 && versions.length === 0 && only && fixedVersions.length === 1 && authoritativeFixed !== void 0) {
     ranges[0] = { introduced: only.introduced, fixed: authoritativeFixed };
   }
-  return { ranges, versions };
+  return { ranges, versions, source: "range" };
+}
+function isEmptyInterval(range) {
+  if (range.fixed === null) return false;
+  if (range.fixed === range.introduced) return true;
+  return isZeroVersion(range.introduced) && isZeroVersion(range.fixed);
+}
+function isZeroVersion(version2) {
+  return /^0(\.0)*$/.test(version2);
+}
+function parseAffectedVersionsProse(text) {
+  const sentence = text.replace(/\s+/g, " ").trim();
+  if (sentence.length === 0) return null;
+  const lower = sentence.toLowerCase();
+  if (lower === "none" || lower.startsWith("no version") || lower.startsWith("this advisory has been withdrawn")) return null;
+  const out = [];
+  for (const clause of sentence.split(",")) {
+    const c = clause.trim();
+    const fromBefore = /^all versions starting from (\S+) before (\S+)$/i.exec(c);
+    if (fromBefore && fromBefore[1] && fromBefore[2]) {
+      out.push({ introduced: stripV(fromBefore[1]), fixed: stripV(fromBefore[2]) });
+      continue;
+    }
+    const before = /^all versions before (\S+)$/i.exec(c);
+    if (before && before[1]) {
+      out.push({ introduced: "0", fixed: stripV(before[1]) });
+      continue;
+    }
+    const from = /^all versions starting from (\S+)$/i.exec(c);
+    if (from && from[1]) {
+      out.push({ introduced: stripV(from[1]), fixed: null });
+      continue;
+    }
+    if (/^all versions$/i.test(c)) {
+      out.push({ introduced: "0", fixed: null });
+      continue;
+    }
+    return null;
+  }
+  return out;
 }
 function parseDisjunct(disjunct) {
   const first = disjunct[0];
@@ -35376,8 +35426,8 @@ function createUi(options) {
 
 // src/help.ts
 var CLI_VERSION = (function resolveVersion() {
-  if ("3.1.0".length > 0) {
-    return "3.1.0";
+  if ("3.1.1".length > 0) {
+    return "3.1.1";
   }
   const fromEnv = process.env.SENTINELLO_VERSION;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sentinello",
-    "version": "3.1.0",
+    "version": "3.1.1",
     "license": "MIT",
     "description": "Scan the projects in a folder for vulnerable dependencies and write an advisory an agent can act on.",
     "keywords": [