sentinello 3.1.0 → 3.2.0

package/dist/cli.cjs

@@ -13123,6 +13123,19 @@ function compareSeverity(a, b) {
 function meetsSeverityFloor(severity, floor) {
   return severityWeight(severity) >= severityWeight(floor);
 }
+function maxSeverity(severities) {
+  let best = "info";
+  let bestWeight = 0;
+  for (const s of severities) {
+    const normalized = s.trim().toLowerCase();
+    const known = SEVERITY_WEIGHT[normalized];
+    if (known !== void 0 && known > bestWeight) {
+      bestWeight = known;
+      best = normalized;
+    }
+  }
+  return best;
+}
 var SOURCE_UNAVAILABLE_REASON_CODES = [
   "osv_db_not_seeded",
   "osv_db_unavailable",
@@ -13134,8 +13147,8 @@ function isSourceUnavailableReason(code) {
 }
 
 // ../../packages/core/src/advisory-rows.ts
-var OSV_NORMALIZER_VERSION = 3;
-var GEMNASIUM_NORMALIZER_VERSION = 2;
+var OSV_NORMALIZER_VERSION = 4;
+var GEMNASIUM_NORMALIZER_VERSION = 4;
 
 // ../../packages/core/src/advisory-export.ts
 var DEFAULT_EXPORT_PROMPT = `You are helping a development team triage and fix the vulnerabilities listed at the bottom of this document. Treat this as a remediation work list, not a checklist to rubber-stamp. Work in a planning posture from the start: if your tooling has a read-only planning mode (Claude Code's plan mode, for example), enter it now and stay in it until the human has approved the triage below. Nothing in this document authorises you to edit a file before then.
@@ -33204,22 +33217,51 @@ function findingIdentityKeys(finding) {
 function findingPackageIdentity(finding) {
   return (finding.ecosystem ?? DEFAULT_ECOSYSTEM) + "|" + finding.packageName;
 }
-function reconcileAgainstReported(findings, reportedByPackage) {
+function reconcileAgainstReported(findings, reportedByPackage, source) {
   const kept = [];
+  const corroborations = [];
   for (const finding of findings) {
     const packageKey = findingPackageIdentity(finding);
-    const existing = reportedByPackage.get(packageKey);
+    const existing = reportedByPackage.get(packageKey) || /* @__PURE__ */ new Map();
     const keys = findingIdentityKeys(finding);
-    const isDup = existing ? keys.some(function seen(k) {
-      return existing.has(k);
-    }) : false;
-    if (isDup) continue;
+    const target = firstReported(existing, keys);
+    if (target) {
+      const by = { source, advisoryId: finding.advisoryId, severity: finding.severity };
+      corroborations.push({ target, by });
+      const attached = target.finding.corroborations || [];
+      if (!attached.some(function already(c) {
+        return c.source === by.source;
+      })) attached.push(by);
+      target.finding.corroborations = attached;
+      target.finding.severity = escalatedSeverity(target.severity, attached);
+      continue;
+    }
     kept.push(finding);
-    const set3 = existing || /* @__PURE__ */ new Set();
-    for (const k of keys) set3.add(k);
-    reportedByPackage.set(packageKey, set3);
+    const reported = {
+      source,
+      advisoryId: finding.advisoryId,
+      packageName: finding.packageName,
+      ecosystem: finding.ecosystem ?? DEFAULT_ECOSYSTEM,
+      severity: finding.severity,
+      finding
+    };
+    for (const key of keys) existing.set(key, reported);
+    reportedByPackage.set(packageKey, existing);
   }
-  return kept;
+  return { kept, corroborations };
+}
+function firstReported(existing, keys) {
+  for (const key of keys) {
+    const found = existing.get(key);
+    if (found) return found;
+  }
+  return null;
+}
+function escalatedSeverity(own, corroborations) {
+  if (corroborations.length === 0) return own;
+  return maxSeverity([own, ...corroborations.map(function grade(c) {
+    return c.severity;
+  })]);
 }
 
 // ../../packages/scanners/src/index.ts
@@ -33428,18 +33470,21 @@ function normalizeOsvRecord(record2, ecosystem) {
   const url2 = pickUrl(r, advisoryId);
   const withdrawn = typeof r.withdrawn === "string" ? Date.parse(r.withdrawn) || null : null;
   const rows = [];
-  const seenPackages = /* @__PURE__ */ new Set();
+  const byPackage = /* @__PURE__ */ new Map();
   for (const affected of r.affected) {
     const pkg2 = affected.package;
     if (!pkg2 || pkg2.ecosystem !== ecosystem) continue;
     const packageName = typeof pkg2.name === "string" ? pkg2.name : null;
     if (!packageName) continue;
-    if (seenPackages.has(packageName)) continue;
-    seenPackages.add(packageName);
     const ranges = extractRanges(affected.ranges);
     const versions = extractVersions(affected.versions);
-    if (ranges.length === 0 && versions.length === 0 && !malicious) continue;
-    rows.push({
+    const existing = byPackage.get(packageName);
+    if (existing) {
+      for (const range of ranges) existing.ranges.push(range);
+      for (const version2 of versions) existing.versions.push(version2);
+      continue;
+    }
+    byPackage.set(packageName, {
       advisoryId,
       ecosystem,
       packageName,
@@ -33453,6 +33498,10 @@ function normalizeOsvRecord(record2, ecosystem) {
       withdrawn
     });
   }
+  for (const row of byPackage.values()) {
+    if (row.ranges.length === 0 && row.versions.length === 0 && !malicious) continue;
+    rows.push(row);
+  }
   return rows;
 }
 function extractVersions(versions) {
@@ -33732,6 +33781,7 @@ function normalizeGemnasiumRecord(record2, ecosystem, slugPrefix) {
   if (!slug || !slug.startsWith(slugPrefix)) return [];
   const rawName = slug.slice(slugPrefix.length);
   if (rawName.length === 0) return [];
+  if (isRetractedUpstream(r)) return [];
   const packageName = ecosystem === "PyPI" ? normalizePyName2(rawName) : rawName;
   const identifiers = stringArray(r.identifiers);
   const advisoryId = typeof r.identifier === "string" && r.identifier.length > 0 ? r.identifier : identifiers[0] ?? null;
@@ -33763,16 +33813,30 @@ function normalizeGemnasiumRecord(record2, ecosystem, slugPrefix) {
     withdrawn: null
   }];
 }
+var RETRACTION_PHRASES = [
+  "marked as false positive",
+  "marked as a false positive",
+  "this is a false positive",
+  "this advisory has been withdrawn",
+  "has been invalidated",
+  "cve being rejected",
+  "cve has been rejected"
+];
+function isRetractedUpstream(record2) {
+  const title = typeof record2.title === "string" ? record2.title.trim().toLowerCase() : "";
+  if (title === "false positive") return true;
+  if (title.startsWith("withdrawn advisory:")) return true;
+  if (title.startsWith("duplicate advisory:")) return true;
+  const description = typeof record2.description === "string" ? record2.description.replace(/\s+/g, " ").toLowerCase() : "";
+  return RETRACTION_PHRASES.some(function stated(phrase) {
+    return description.includes(phrase);
+  });
+}
 function parseAffectedRange(affectedRange, fixedVersions) {
   const ranges = [];
   const versions = [];
   const trimmed = affectedRange.trim();
   const disjuncts = trimmed.length > 0 ? trimmed.split("||").map(trimToken).filter(nonEmpty) : [];
-  if (disjuncts.length === 0) {
-    const fixed = fixedVersions[0];
-    if (fixed !== void 0) return { ranges: [{ introduced: "0", fixed }], versions };
-    return { ranges, versions };
-  }
   for (const disjunct of disjuncts) {
     const interval = parseDisjunct(disjunct);
     if (!interval) continue;
@@ -33782,13 +33846,22 @@ function parseAffectedRange(affectedRange, fixedVersions) {
       ranges.push({ introduced: interval.introduced, fixed: interval.fixed });
     }
   }
+  if (versions.length === 0 && ranges.every(isEmptyInterval)) return { ranges: [], versions: [] };
   const only = ranges[0];
   const authoritativeFixed = fixedVersions[0];
-  if (ranges.length === 1 && versions.length === 0 && only && authoritativeFixed !== void 0) {
+  if (ranges.length === 1 && versions.length === 0 && only && fixedVersions.length === 1 && authoritativeFixed !== void 0) {
     ranges[0] = { introduced: only.introduced, fixed: authoritativeFixed };
   }
   return { ranges, versions };
 }
+function isEmptyInterval(range) {
+  if (range.fixed === null) return false;
+  if (range.fixed === range.introduced) return true;
+  return isZeroVersion(range.introduced) && isZeroVersion(range.fixed);
+}
+function isZeroVersion(version2) {
+  return /^0(\.0)*$/.test(version2);
+}
 function parseDisjunct(disjunct) {
   const first = disjunct[0];
   if (first === "(" || first === "[") return parseIntervalNotation(disjunct);
@@ -35051,7 +35124,7 @@ async function scanProject(setup, resolved, scanners) {
       durationMs: result.durationMs
     });
     if (result.status !== "ok") continue;
-    for (const finding of reconcileAgainstReported(result.findings, reportedByPackage)) {
+    for (const finding of reconcileAgainstReported(result.findings, reportedByPackage, scanner.name).kept) {
       findings.push(finding);
     }
   }
@@ -35376,8 +35449,8 @@ function createUi(options) {
 
 // src/help.ts
 var CLI_VERSION = (function resolveVersion() {
-  if ("3.1.0".length > 0) {
-    return "3.1.0";
+  if ("3.2.0".length > 0) {
+    return "3.2.0";
   }
   const fromEnv = process.env.SENTINELLO_VERSION;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sentinello",
-    "version": "3.1.0",
+    "version": "3.2.0",
     "license": "MIT",
     "description": "Scan the projects in a folder for vulnerable dependencies and write an advisory an agent can act on.",
     "keywords": [