sentinello 3.3.1 → 3.3.2

package/dist/cli.cjs

@@ -13153,8 +13153,8 @@ function isSourceUnavailableReason(code) {
 }
 
 // ../../packages/core/src/advisory-rows.ts
-var OSV_NORMALIZER_VERSION = 4;
-var GEMNASIUM_NORMALIZER_VERSION = 5;
+var OSV_NORMALIZER_VERSION = 5;
+var GEMNASIUM_NORMALIZER_VERSION = 6;
 
 // ../../packages/core/src/advisory-export.ts
 var DEFAULT_EXPORT_PROMPT = `You are helping a development team triage and fix the vulnerabilities listed at the bottom of this document. Treat this as a remediation work list, not a checklist to rubber-stamp. Work in a planning posture from the start: if your tooling has a read-only planning mode (Claude Code's plan mode, for example), enter it now and stay in it until the human has approved the triage below. Nothing in this document authorises you to edit a file before then.
@@ -13468,7 +13468,7 @@ function aboveLowerBound(installed, range, comparator) {
 }
 
 // ../../packages/versions/src/compare.ts
-__toESM(require_semver2());
+var import_semver2 = __toESM(require_semver2());
 
 // ../../packages/versions/src/comparators/semver.ts
 var import_semver = __toESM(require_semver2());
@@ -13498,6 +13498,26 @@ var semverComparator = {
   }
 };
 
+// ../../packages/versions/src/compare.ts
+function compareVersions(a, b) {
+  const left = normalizeSemver(a);
+  const right = normalizeSemver(b);
+  if (left === null || right === null) {
+    if (left === null && right === null) return a < b ? -1 : a > b ? 1 : 0;
+    return left === null ? -1 : 1;
+  }
+  if ((0, import_semver2.lt)(left, right)) return -1;
+  if ((0, import_semver2.gt)(left, right)) return 1;
+  return 0;
+}
+function highestVersion(versions) {
+  let best = null;
+  for (const candidate of versions) {
+    if (best === null || compareVersions(candidate, best) > 0) best = candidate;
+  }
+  return best;
+}
+
 // ../../packages/versions/src/comparators/pep440.ts
 var PRE_RANK = { a: 0, b: 1, rc: 2 };
 var PEP440_RE = new RegExp(
@@ -33535,7 +33555,7 @@ function normalizeOsvRecord(record2, ecosystem) {
     if (!pkg2 || pkg2.ecosystem !== ecosystem) continue;
     const packageName = typeof pkg2.name === "string" ? pkg2.name : null;
     if (!packageName) continue;
-    const ranges = extractRanges(affected.ranges);
+    const ranges = extractRanges(affected.ranges, affected.database_specific?.last_known_affected_version_range);
     const versions = extractVersions(affected.versions);
     const existing = byPackage.get(packageName);
     if (existing) {
@@ -33571,7 +33591,7 @@ function extractVersions(versions) {
   }
   return out;
 }
-function extractRanges(ranges) {
+function extractRanges(ranges, lastKnownAffected) {
   if (!Array.isArray(ranges)) return [];
   const out = [];
   for (const range of ranges) {
@@ -33603,6 +33623,20 @@ function extractRanges(ranges) {
       out.push({ type: type2, introduced, fixed: null, lastAffected });
     }
   }
+  return boundOpenEndedRange(out, lastKnownAffected);
+}
+function boundOpenEndedRange(ranges, lastKnownAffected) {
+  if (ranges.length !== 1 || typeof lastKnownAffected !== "string") return ranges;
+  const text = lastKnownAffected.trim();
+  const inclusive = text.startsWith("<=");
+  if (!inclusive && !text.startsWith("<")) return ranges;
+  const version2 = text.slice(inclusive ? 2 : 1).trim();
+  if (version2.length === 0 || /[\s,|]/.test(version2)) return ranges;
+  const out = [];
+  for (const range of ranges) {
+    const open = range.fixed === null && range.lastAffected === null;
+    out.push(open ? { ...range, fixed: inclusive ? null : version2, lastAffected: inclusive ? version2 : null } : range);
+  }
   return out;
 }
 function pickSeverity2(r) {
@@ -33911,7 +33945,13 @@ function parseAffectedRange(affectedRange, fixedVersions) {
   if (ranges.length === 1 && versions.length === 0 && only && fixedVersions.length === 1 && authoritativeFixed !== void 0) {
     ranges[0] = toRange(only.introduced, only.introducedExclusive === true, authoritativeFixed, null);
   }
-  return { ranges, versions };
+  const highestFixed = highestVersion(fixedVersions);
+  const bounded = [];
+  for (const range of ranges) {
+    const openEnded = range.fixed === null && range.lastAffected === null;
+    bounded.push(highestFixed !== null && openEnded && compareVersions(highestFixed, range.introduced) > 0 ? toRange(range.introduced, range.introducedExclusive === true, highestFixed, null) : range);
+  }
+  return { ranges: bounded, versions };
 }
 function toRange(introduced, introducedExclusive, fixed, lastAffected) {
   const range = { introduced, fixed, lastAffected };
@@ -33955,7 +33995,7 @@ function parseIntervalNotation(disjunct) {
   };
 }
 function parseComparatorForm(disjunct) {
-  const tokens = disjunct.split(/\s+/).filter(nonEmpty);
+  const tokens = disjunct.split(/[\s,]+/).filter(nonEmpty);
   if (tokens.length === 0) return null;
   let introduced = "0";
   let introducedExclusive = false;
@@ -35535,8 +35575,8 @@ function createUi(options) {
 
 // src/help.ts
 var CLI_VERSION = (function resolveVersion() {
-  if ("3.3.1".length > 0) {
-    return "3.3.1";
+  if ("3.3.2".length > 0) {
+    return "3.3.2";
   }
   const fromEnv = process.env.SENTINELLO_VERSION;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sentinello",
-    "version": "3.3.1",
+    "version": "3.3.2",
     "license": "MIT",
     "description": "Scan the projects in a folder for vulnerable dependencies and write an advisory an agent can act on.",
     "keywords": [