sentinello 3.1.1 → 3.2.0

package/dist/cli.cjs

@@ -13123,6 +13123,19 @@ function compareSeverity(a, b) {
 function meetsSeverityFloor(severity, floor) {
   return severityWeight(severity) >= severityWeight(floor);
 }
+function maxSeverity(severities) {
+  let best = "info";
+  let bestWeight = 0;
+  for (const s of severities) {
+    const normalized = s.trim().toLowerCase();
+    const known = SEVERITY_WEIGHT[normalized];
+    if (known !== void 0 && known > bestWeight) {
+      bestWeight = known;
+      best = normalized;
+    }
+  }
+  return best;
+}
 var SOURCE_UNAVAILABLE_REASON_CODES = [
   "osv_db_not_seeded",
   "osv_db_unavailable",
@@ -13135,7 +13148,7 @@ function isSourceUnavailableReason(code) {
 
 // ../../packages/core/src/advisory-rows.ts
 var OSV_NORMALIZER_VERSION = 4;
-var GEMNASIUM_NORMALIZER_VERSION = 3;
+var GEMNASIUM_NORMALIZER_VERSION = 4;
 
 // ../../packages/core/src/advisory-export.ts
 var DEFAULT_EXPORT_PROMPT = `You are helping a development team triage and fix the vulnerabilities listed at the bottom of this document. Treat this as a remediation work list, not a checklist to rubber-stamp. Work in a planning posture from the start: if your tooling has a read-only planning mode (Claude Code's plan mode, for example), enter it now and stay in it until the human has approved the triage below. Nothing in this document authorises you to edit a file before then.
@@ -33204,22 +33217,51 @@ function findingIdentityKeys(finding) {
 function findingPackageIdentity(finding) {
   return (finding.ecosystem ?? DEFAULT_ECOSYSTEM) + "|" + finding.packageName;
 }
-function reconcileAgainstReported(findings, reportedByPackage) {
+function reconcileAgainstReported(findings, reportedByPackage, source) {
   const kept = [];
+  const corroborations = [];
   for (const finding of findings) {
     const packageKey = findingPackageIdentity(finding);
-    const existing = reportedByPackage.get(packageKey);
+    const existing = reportedByPackage.get(packageKey) || /* @__PURE__ */ new Map();
     const keys = findingIdentityKeys(finding);
-    const isDup = existing ? keys.some(function seen(k) {
-      return existing.has(k);
-    }) : false;
-    if (isDup) continue;
+    const target = firstReported(existing, keys);
+    if (target) {
+      const by = { source, advisoryId: finding.advisoryId, severity: finding.severity };
+      corroborations.push({ target, by });
+      const attached = target.finding.corroborations || [];
+      if (!attached.some(function already(c) {
+        return c.source === by.source;
+      })) attached.push(by);
+      target.finding.corroborations = attached;
+      target.finding.severity = escalatedSeverity(target.severity, attached);
+      continue;
+    }
     kept.push(finding);
-    const set3 = existing || /* @__PURE__ */ new Set();
-    for (const k of keys) set3.add(k);
-    reportedByPackage.set(packageKey, set3);
+    const reported = {
+      source,
+      advisoryId: finding.advisoryId,
+      packageName: finding.packageName,
+      ecosystem: finding.ecosystem ?? DEFAULT_ECOSYSTEM,
+      severity: finding.severity,
+      finding
+    };
+    for (const key of keys) existing.set(key, reported);
+    reportedByPackage.set(packageKey, existing);
   }
-  return kept;
+  return { kept, corroborations };
+}
+function firstReported(existing, keys) {
+  for (const key of keys) {
+    const found = existing.get(key);
+    if (found) return found;
+  }
+  return null;
+}
+function escalatedSeverity(own, corroborations) {
+  if (corroborations.length === 0) return own;
+  return maxSeverity([own, ...corroborations.map(function grade(c) {
+    return c.severity;
+  })]);
 }
 
 // ../../packages/scanners/src/index.ts
@@ -33739,16 +33781,14 @@ function normalizeGemnasiumRecord(record2, ecosystem, slugPrefix) {
   if (!slug || !slug.startsWith(slugPrefix)) return [];
   const rawName = slug.slice(slugPrefix.length);
   if (rawName.length === 0) return [];
+  if (isRetractedUpstream(r)) return [];
   const packageName = ecosystem === "PyPI" ? normalizePyName2(rawName) : rawName;
   const identifiers = stringArray(r.identifiers);
   const advisoryId = typeof r.identifier === "string" && r.identifier.length > 0 ? r.identifier : identifiers[0] ?? null;
   if (!advisoryId) return [];
   const fixedVersions = stringArray(r.fixed_versions);
-  const parsed = parseAffectedRange(
-    typeof r.affected_range === "string" ? r.affected_range : "",
-    fixedVersions,
-    typeof r.affected_versions === "string" ? r.affected_versions : ""
-  );
+  const parsed = parseAffectedRange(typeof r.affected_range === "string" ? r.affected_range : "", fixedVersions);
+  if (parsed.ranges.length === 0 && parsed.versions.length === 0) return [];
   const severity = severityFromCvss(
     typeof r.cvss_v3 === "string" ? r.cvss_v3 : null,
     typeof r.cvss_v2 === "string" ? r.cvss_v2 : null
@@ -33770,11 +33810,29 @@ function normalizeGemnasiumRecord(record2, ecosystem, slugPrefix) {
     summary,
     url: url2,
     malicious: false,
-    withdrawn: null,
-    rangeSource: parsed.source
+    withdrawn: null
   }];
 }
-function parseAffectedRange(affectedRange, fixedVersions, affectedVersions = "") {
+var RETRACTION_PHRASES = [
+  "marked as false positive",
+  "marked as a false positive",
+  "this is a false positive",
+  "this advisory has been withdrawn",
+  "has been invalidated",
+  "cve being rejected",
+  "cve has been rejected"
+];
+function isRetractedUpstream(record2) {
+  const title = typeof record2.title === "string" ? record2.title.trim().toLowerCase() : "";
+  if (title === "false positive") return true;
+  if (title.startsWith("withdrawn advisory:")) return true;
+  if (title.startsWith("duplicate advisory:")) return true;
+  const description = typeof record2.description === "string" ? record2.description.replace(/\s+/g, " ").toLowerCase() : "";
+  return RETRACTION_PHRASES.some(function stated(phrase) {
+    return description.includes(phrase);
+  });
+}
+function parseAffectedRange(affectedRange, fixedVersions) {
   const ranges = [];
   const versions = [];
   const trimmed = affectedRange.trim();
@@ -33788,17 +33846,13 @@ function parseAffectedRange(affectedRange, fixedVersions, affectedVersions = "")
       ranges.push({ introduced: interval.introduced, fixed: interval.fixed });
     }
   }
-  if (versions.length === 0 && ranges.every(isEmptyInterval)) {
-    const prose = parseAffectedVersionsProse(affectedVersions);
-    if (prose) return { ranges: prose, versions, source: "prose" };
-    return { ranges: [], versions: [], source: "unresolved" };
-  }
+  if (versions.length === 0 && ranges.every(isEmptyInterval)) return { ranges: [], versions: [] };
   const only = ranges[0];
   const authoritativeFixed = fixedVersions[0];
   if (ranges.length === 1 && versions.length === 0 && only && fixedVersions.length === 1 && authoritativeFixed !== void 0) {
     ranges[0] = { introduced: only.introduced, fixed: authoritativeFixed };
   }
-  return { ranges, versions, source: "range" };
+  return { ranges, versions };
 }
 function isEmptyInterval(range) {
   if (range.fixed === null) return false;
@@ -33808,37 +33862,6 @@ function isEmptyInterval(range) {
 function isZeroVersion(version2) {
   return /^0(\.0)*$/.test(version2);
 }
-function parseAffectedVersionsProse(text) {
-  const sentence = text.replace(/\s+/g, " ").trim();
-  if (sentence.length === 0) return null;
-  const lower = sentence.toLowerCase();
-  if (lower === "none" || lower.startsWith("no version") || lower.startsWith("this advisory has been withdrawn")) return null;
-  const out = [];
-  for (const clause of sentence.split(",")) {
-    const c = clause.trim();
-    const fromBefore = /^all versions starting from (\S+) before (\S+)$/i.exec(c);
-    if (fromBefore && fromBefore[1] && fromBefore[2]) {
-      out.push({ introduced: stripV(fromBefore[1]), fixed: stripV(fromBefore[2]) });
-      continue;
-    }
-    const before = /^all versions before (\S+)$/i.exec(c);
-    if (before && before[1]) {
-      out.push({ introduced: "0", fixed: stripV(before[1]) });
-      continue;
-    }
-    const from = /^all versions starting from (\S+)$/i.exec(c);
-    if (from && from[1]) {
-      out.push({ introduced: stripV(from[1]), fixed: null });
-      continue;
-    }
-    if (/^all versions$/i.test(c)) {
-      out.push({ introduced: "0", fixed: null });
-      continue;
-    }
-    return null;
-  }
-  return out;
-}
 function parseDisjunct(disjunct) {
   const first = disjunct[0];
   if (first === "(" || first === "[") return parseIntervalNotation(disjunct);
@@ -35101,7 +35124,7 @@ async function scanProject(setup, resolved, scanners) {
       durationMs: result.durationMs
     });
     if (result.status !== "ok") continue;
-    for (const finding of reconcileAgainstReported(result.findings, reportedByPackage)) {
+    for (const finding of reconcileAgainstReported(result.findings, reportedByPackage, scanner.name).kept) {
       findings.push(finding);
     }
   }
@@ -35426,8 +35449,8 @@ function createUi(options) {
 
 // src/help.ts
 var CLI_VERSION = (function resolveVersion() {
-  if ("3.1.1".length > 0) {
-    return "3.1.1";
+  if ("3.2.0".length > 0) {
+    return "3.2.0";
   }
   const fromEnv = process.env.SENTINELLO_VERSION;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sentinello",
-    "version": "3.1.1",
+    "version": "3.2.0",
     "license": "MIT",
     "description": "Scan the projects in a folder for vulnerable dependencies and write an advisory an agent can act on.",
     "keywords": [