sentinello 3.7.3 → 3.7.4

package/dist/cli.cjs

@@ -13885,7 +13885,7 @@ function asError(err) {
 }
 
 // ../../packages/core/src/advisory-rows.ts
-var OSV_NORMALIZER_VERSION = 6;
+var OSV_NORMALIZER_VERSION = 7;
 var GEMNASIUM_NORMALIZER_VERSION = 7;
 
 // ../../packages/core/src/advisory-export.ts
@@ -34133,6 +34133,10 @@ function createGemnasiumScanner(deps) {
         durationMs: Date.now() - startedAt
       };
     }
+    const notReady = evidenceNotReady(graph.packages, deps);
+    if (notReady !== null) {
+      return unauditable4("osv_db_not_seeded", "OSV withdrawal data for " + notReady + " is not complete yet", startedAt);
+    }
     let findings;
     try {
       findings = matchPackages2(graph.packages, deps.lookup, deps.isEnabled);
@@ -34176,6 +34180,13 @@ function matchPackages2(packages, lookup, isEnabled) {
   }
   return findings;
 }
+function evidenceNotReady(packages, deps) {
+  for (const ecosystem of groupByEcosystem2(packages).keys()) {
+    if (!deps.isEnabled(ecosystem) || !comparatorForEcosystem(ecosystem)) continue;
+    if (!deps.withdrawalEvidenceReady(ecosystem)) return ecosystem;
+  }
+  return null;
+}
 function toCanonicalAdvisory2(packageName, ecosystem, advisory) {
   return {
     id: advisory.advisoryId,
@@ -34191,7 +34202,7 @@ function toCanonicalAdvisory2(packageName, ecosystem, advisory) {
     severity: advisory.severity,
     summary: advisory.summary,
     url: advisory.url,
-    withdrawn: null
+    withdrawn: advisory.withdrawn
   };
 }
 function groupByEcosystem2(packages) {
@@ -34219,6 +34230,37 @@ function unauditable4(reasonCode, message, startedAt) {
   };
 }
 
+// ../../packages/scanners/src/withdrawn.ts
+function stampWithdrawn(advisories, links) {
+  return advisories.map(function stamp(advisory) {
+    const withdrawn = withdrawnAt(advisory, links);
+    return withdrawn === null ? advisory : { ...advisory, withdrawn };
+  });
+}
+function stampWithdrawnByPackage(byPackage, linksByPackage) {
+  const out = /* @__PURE__ */ new Map();
+  for (const [name, advisories] of byPackage.entries()) {
+    out.set(name, stampWithdrawn(advisories, linksByPackage.get(name) ?? []));
+  }
+  return out;
+}
+function withdrawnAt(advisory, links) {
+  const identity = /* @__PURE__ */ new Set([advisory.advisoryId, ...advisory.aliases]);
+  let latest = null;
+  for (const link2 of links) {
+    if (!sharesIdentifier(identity, link2)) continue;
+    if (link2.withdrawn === null) return null;
+    if (latest === null || link2.withdrawn > latest) latest = link2.withdrawn;
+  }
+  return latest;
+}
+function sharesIdentifier(identity, link2) {
+  if (identity.has(link2.advisoryId)) return true;
+  return link2.aliases.some(function inIdentity(alias) {
+    return identity.has(alias);
+  });
+}
+
 // ../../packages/scanners/src/engine/reconcile.ts
 function findingIdentityKeys(finding) {
   const keys = [finding.advisoryId.toLowerCase()];
@@ -34504,7 +34546,7 @@ function normalizeOsvRecord(record2, ecosystem) {
     });
   }
   for (const row of byPackage.values()) {
-    if (row.ranges.length === 0 && row.versions.length === 0 && !malicious) continue;
+    if (row.ranges.length === 0 && row.versions.length === 0 && !malicious && row.withdrawn === null) continue;
     rows.push(row);
   }
   return rows;
@@ -34670,10 +34712,7 @@ async function fetchOsvChangedIds(ecosystem, cursorMs, etag, options) {
 async function fetchOsvAdvisoryRows(id, ecosystem, options) {
   const record2 = await getJsonOrNull(osvAdvisoryUrl(id, ecosystem), options);
   if (record2 === null) return [];
-  const rows = normalizeOsvRecord(record2, ecosystem);
-  return rows.filter(function notWithdrawn(row) {
-    return row.withdrawn === null;
-  });
+  return normalizeOsvRecord(record2, ecosystem);
 }
 function selectChangedIds(csv, cursorMs) {
   const ids = [];
@@ -48995,23 +49034,32 @@ function safeParse3(json3) {
 }
 
 // src/cache/lookup.ts
-async function loadCacheForPackages(cacheDir, ecosystem, packageNames, sources) {
+async function loadCacheForPackages(cacheDir, ecosystem, packageNames, sources, meta3) {
   const wanted = new Set(packageNames);
   const osv = /* @__PURE__ */ new Map();
   const gemnasium = /* @__PURE__ */ new Map();
+  const withGemnasium = sources.includes("gemnasium");
+  const evidenceComplete = withGemnasium && isSeeded(meta3, "osv", ecosystem, OSV_NORMALIZER_VERSION);
+  let osvRows = /* @__PURE__ */ new Map();
+  if (sources.includes("osv") || evidenceComplete) {
+    osvRows = await readRowsForPackages(advisoryFilePath(cacheDir, "osv", ecosystem), wanted);
+  }
   if (sources.includes("osv")) {
-    const rows = await readRowsForPackages(advisoryFilePath(cacheDir, "osv", ecosystem), wanted);
-    for (const [name, list] of rows.entries()) {
+    for (const [name, list] of osvRows.entries()) {
       osv.set(name, list.map(toOsvAdvisory));
     }
   }
-  if (sources.includes("gemnasium")) {
+  if (withGemnasium) {
     const rows = await readRowsForPackages(advisoryFilePath(cacheDir, "gemnasium", ecosystem), wanted);
     for (const [name, list] of rows.entries()) {
       gemnasium.set(name, list.map(toGemnasiumAdvisory));
     }
   }
-  return { osv, gemnasium };
+  return {
+    osv,
+    gemnasium: evidenceComplete ? stampWithdrawnByPackage(gemnasium, osvRows) : gemnasium,
+    withdrawalsChecked: evidenceComplete
+  };
 }
 function toOsvAdvisory(row) {
   return {
@@ -49034,7 +49082,8 @@ function toGemnasiumAdvisory(row) {
     versions: row.versions,
     severity: row.severity,
     summary: row.summary,
-    url: row.url
+    url: row.url,
+    withdrawn: null
   };
 }
 function registryFilePath(cacheDir) {
@@ -49151,17 +49200,26 @@ async function registryCacheSummary(cacheDir) {
 }
 
 // src/cache/sync.ts
+function syncTargets(sources) {
+  const targets = sources.map(function forFindings(source) {
+    return { source, purpose: "findings" };
+  });
+  if (sources.includes("gemnasium") && !sources.includes("osv")) {
+    targets.push({ source: "osv", purpose: "withdrawal-evidence" });
+  }
+  return targets;
+}
 async function planSync(options) {
   const meta3 = await readCacheMeta(options.cacheDir);
   const items = [];
   let seedBytes = 0;
-  for (const source of options.sources) {
+  for (const { source, purpose } of syncTargets(options.sources)) {
     if (source === "osv" && osvFeedDisabled()) continue;
     if (source === "gemnasium" && gemnasiumFeedDisabled()) continue;
     const normalizerVersion = source === "osv" ? OSV_NORMALIZER_VERSION : GEMNASIUM_NORMALIZER_VERSION;
     const seeded = isSeeded(meta3, source, options.ecosystem, normalizerVersion);
     if (seeded) {
-      items.push({ source, ecosystem: options.ecosystem, kind: "refresh", downloadBytes: null, downloadBytesEstimated: false });
+      items.push({ source, ecosystem: options.ecosystem, purpose, kind: "refresh", downloadBytes: null, downloadBytesEstimated: false });
       continue;
     }
     const estimate = await estimateSeedBytes(source, options.ecosystem, options.abortSignal);
@@ -49169,6 +49227,7 @@ async function planSync(options) {
     items.push({
       source,
       ecosystem: options.ecosystem,
+      purpose,
       kind: "seed",
       downloadBytes: estimate.bytes,
       downloadBytesEstimated: estimate.estimated
@@ -49307,32 +49366,38 @@ async function refreshOsv(options, meta3, item) {
     return { source: "osv", ecosystem: item.ecosystem, status: "unchanged", rowCount: state?.recordCount ?? 0, message: null };
   }
   const append = [];
-  const replaced = /* @__PURE__ */ new Set();
-  let skipped = 0;
+  let failure = null;
   for (const id of changed.ids) {
     if (options.abortSignal && options.abortSignal.aborted) {
-      skipped += 1;
+      failure = "the refresh was cancelled before every changed advisory was re-read";
       break;
     }
     try {
       const rows = await fetchOsvAdvisoryRows(id, item.ecosystem, fetchOptionsFor(options, item));
       for (const row of rows) append.push(row);
-      replaced.add(id);
-    } catch {
-      skipped += 1;
-      continue;
+    } catch (err) {
+      failure = id + " could not be re-read (" + errText(err) + ")";
+      break;
     }
   }
+  if (failure !== null) {
+    if (state) state.etag = null;
+    return {
+      source: "osv",
+      ecosystem: item.ecosystem,
+      status: "error",
+      rowCount: state?.recordCount ?? 0,
+      message: failure + "; the previous OSV data is kept until a refresh re-reads all " + changed.ids.length + " changed advisories"
+    };
+  }
   const path = advisoryFilePath(options.cacheDir, "osv", item.ecosystem);
-  const rowCount = await rewriteRows(path, { dropAdvisoryIds: replaced, append });
-  const complete = skipped === 0;
-  const previousCursor = state?.cursorIso ?? null;
+  const rowCount = await rewriteRows(path, { dropAdvisoryIds: new Set(changed.ids), append });
   setSourceState(meta3, "osv", item.ecosystem, {
     normalizerVersion: OSV_NORMALIZER_VERSION,
     recordCount: rowCount,
     refreshedAt: Date.now(),
-    cursorIso: complete ? changed.newestIso ?? previousCursor : previousCursor,
-    etag: complete ? changed.etag : null
+    cursorIso: changed.newestIso ?? state?.cursorIso ?? null,
+    etag: changed.etag
   });
   return {
     source: "osv",
@@ -49893,6 +49958,12 @@ function buildScanners(setup, cache) {
       },
       isEnabled: function isEnabled(ecosystem) {
         return ecosystem === setup.ecosystem;
+      },
+      // Always ready: the cache was stamped (or not) before the scan, and a one-shot report with no
+      // complete OSV evidence reports gemnasium unstamped under a warning instead of refusing it.
+      // Only the portal, whose findings persist across scans, has to wait for the evidence.
+      withdrawalEvidenceReady: function withdrawalEvidenceReady() {
+        return true;
       }
     }));
   }
@@ -50100,6 +50171,9 @@ function createUi(options) {
     write("");
     for (const item of seeds) {
       write("    " + sourceLabel(item.source) + c.dim + "  " + formatBytes(item.downloadBytes, item.downloadBytesEstimated) + c.reset);
+      if (item.purpose === "withdrawal-evidence") {
+        write("      " + c.dim + "used only to drop advisories GitHub has withdrawn" + c.reset);
+      }
     }
     write("");
     write("  " + c.dim + "Downloaded once from the upstream feeds, then kept fresh incrementally \u2014" + c.reset);
@@ -50208,6 +50282,9 @@ function createUi(options) {
       write("    " + c.green + "\u2713" + c.reset + " " + sourceLabel(outcome.source) + c.dim + " " + verb + " (" + outcome.rowCount.toLocaleString() + " advisories)" + c.reset);
     }
   }
+  function withdrawalsUnchecked() {
+    write("    " + c.yellow + "!" + c.reset + c.dim + " OSV withdrawal data is not downloaded \u2014 GitLab gemnasium may list advisories GitHub has withdrawn" + c.reset);
+  }
   function sourceLabel(source) {
     if (source === "osv") return "OSV";
     if (source === "gemnasium") return "GitLab gemnasium";
@@ -50366,6 +50443,7 @@ function createUi(options) {
     syncProgress,
     syncRetry,
     syncDone,
+    withdrawalsUnchecked,
     scanStart,
     scanProject: scanProject2,
     scanProjectDone,
@@ -50377,8 +50455,8 @@ function createUi(options) {
 
 // src/help.ts
 var CLI_VERSION = (function resolveVersion() {
-  if ("3.7.3".length > 0) {
-    return "3.7.3";
+  if ("3.7.4".length > 0) {
+    return "3.7.4";
   }
   const fromEnv = process.env.SENTINELLO_VERSION;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();
@@ -50642,10 +50720,11 @@ async function runScan(options, cacheDir, ui) {
   } else if (options.offline) {
     ui.offlineNotice(options.includeNpmAudit);
   }
+  const meta3 = await readCacheMeta(cacheDir);
   const resolved2 = await resolveProjects(projects);
   const packageNames = collectPackageNames(resolved2);
-  const cache = await loadCacheForPackages(cacheDir, DEFAULT_ECOSYSTEM, packageNames, sources);
-  const meta3 = await readCacheMeta(cacheDir);
+  const cache = await loadCacheForPackages(cacheDir, DEFAULT_ECOSYSTEM, packageNames, sources, meta3);
+  if (sources.includes("gemnasium") && !cache.withdrawalsChecked) ui.withdrawalsUnchecked();
   const registryStore = options.offline ? null : await loadRegistryStore(cacheDir);
   const setup = {
     cacheDir,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sentinello",
-    "version": "3.7.3",
+    "version": "3.7.4",
     "license": "MIT",
     "description": "Scan the projects in a folder for vulnerable dependencies and write an advisory an agent can act on.",
     "keywords": [