sentinello 3.6.0 → 3.7.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -4
- package/dist/cli.cjs +15479 -702
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -52,7 +52,21 @@ published, and gemnasium is gated on its repository's HEAD commit, so a routine
|
|
|
52
52
|
nothing and completes in about a second.
|
|
53
53
|
|
|
54
54
|
The cache lives in `$XDG_CACHE_HOME/sentinello` or `~/.cache/sentinello`. It is the only thing written
|
|
55
|
-
outside your project.
|
|
55
|
+
outside your project. Beside the advisories it keeps the npm registry answers the fix check read
|
|
56
|
+
(`registry-npm.ndjson.gz`), reused for 24 hours so a repeat scan asks the registry nothing.
|
|
57
|
+
|
|
58
|
+
## Fixes are checked against npm
|
|
59
|
+
|
|
60
|
+
A fix version an advisory states is not trusted on its word. For every npm finding the CLI asks the npm
|
|
61
|
+
registry whether a version outside every source's affected range has actually been published, exactly
|
|
62
|
+
as the Sentinello portal does: a published one reads "upgrade to", none reads "No fixed version
|
|
63
|
+
released" with the way out (which dependency chain carries the package, whether a parent upgrade frees
|
|
64
|
+
it, and curated alternatives), and one the registry could not settle reads "not checked against the
|
|
65
|
+
registry" with the reason.
|
|
66
|
+
|
|
67
|
+
A project that cannot be read — a `package.json` with no lockfile, say — is reported as **cannot be
|
|
68
|
+
scanned**, with the reason and whose fix it is, in the summary, the markdown and the JSON
|
|
69
|
+
(`projects[].scanState`). It is never counted as clean.
|
|
56
70
|
|
|
57
71
|
## Privacy
|
|
58
72
|
|
|
@@ -60,8 +74,11 @@ outside your project.
|
|
|
60
74
|
history is kept between runs.
|
|
61
75
|
|
|
62
76
|
Outbound requests go to `osv-vulnerabilities.storage.googleapis.com` and `gitlab.com` to download public
|
|
63
|
-
advisory data,
|
|
64
|
-
|
|
77
|
+
advisory data, to `registry.npmjs.org` and `api.npmjs.org` to read the public metadata and download counts
|
|
78
|
+
of the packages with findings and of the chains the way out weighs (package names only), and `npm audit`
|
|
79
|
+
talks to your configured npm registry exactly as it always does. Use `--source osv,gemnasium` to skip npm
|
|
80
|
+
audit, or `--offline` to make no network requests at all — npm audit is then skipped and fixes read "not
|
|
81
|
+
checked against the registry (offline)".
|
|
65
82
|
|
|
66
83
|
## Options
|
|
67
84
|
|
|
@@ -77,7 +94,7 @@ Run `sentinello --help` for the full list. The ones people reach for:
|
|
|
77
94
|
| `--out <file\|->` | where the advisory goes |
|
|
78
95
|
| `--json` | machine-readable output |
|
|
79
96
|
| `-y, --yes` | accept the first-run download without asking. Required on a non-TTY |
|
|
80
|
-
| `--offline` | use the cache as-is, no network |
|
|
97
|
+
| `--offline` | use the cache as-is, no network — npm audit is skipped and fixes are not checked against npm |
|
|
81
98
|
| `--doctor` | cache status, resolved settings, and what was skipped and why |
|
|
82
99
|
|
|
83
100
|
Exit codes: `0` completed, `1` a scan or configuration error — including a `--fail-on` run that could
|