sentinello 3.7.6 → 3.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +42 -21
  2. package/dist/cli.cjs +3641 -1514
  3. package/package.json +1 -1
package/README.md CHANGED
@@ -13,11 +13,25 @@ Scan the projects in a folder for vulnerable dependencies and get back an adviso
13
13
  npx sentinello
14
14
  ```
15
15
 
16
- Walks the current directory for JavaScript projects, checks their dependencies against **npm audit**,
17
- **OSV**, and **GitLab gemnasium**, and writes a markdown advisory with a remediation prompt attached.
16
+ Walks the current directory for projects — Node.js, Python, Go, Rust and Ruby — checks their
17
+ dependencies against **npm audit**, **OSV**, and **GitLab gemnasium**, and writes a markdown advisory with a
18
+ remediation prompt attached.
18
19
 
19
- It is `npm audit` with two differences that matter: it covers a folder of repositories rather than one
20
- project, and it sees things npm audit cannot — including OSV's ~214,000 malicious-package records.
20
+ | ecosystem | lockfiles read |
21
+ |---|---|
22
+ | npm | `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock` (Yarn 2 and later) |
23
+ | PyPI | `poetry.lock`, `Pipfile.lock`, `requirements.txt` (its `==` pins), `uv.lock` |
24
+ | Go | `go.mod` (`go.sum` only where there is no `go.mod`) |
25
+ | crates.io | `Cargo.lock` |
26
+ | RubyGems | `Gemfile.lock` |
27
+
28
+ npm audit answers for npm only; OSV and GitLab gemnasium answer for all five. A `package.json`,
29
+ `pyproject.toml`, `Pipfile`, `Cargo.toml` or `Gemfile` with no lockfile is reported as cannot be scanned,
30
+ never as clean. No pip, go, cargo or bundle is run: every lockfile is read as a file.
31
+
32
+ For npm projects it is `npm audit` with two differences that matter: it covers a folder of repositories
33
+ rather than one project, and it sees things npm audit cannot — including OSV's ~214,000 malicious-package
34
+ records.
21
35
 
22
36
  ## Use it
23
37
 
@@ -46,23 +60,28 @@ manifest, and never close a finding by muting it. Print it with `--print-prompt`
46
60
 
47
61
  ## The advisory cache
48
62
 
49
- The first run downloads the advisory databases (~200 MB for OSV, ~80 MB for gemnasium) and asks before
50
- it does. After that every run refreshes incrementally: OSV answers `304 Not Modified` when nothing was
51
- published, and gemnasium is gated on its repository's HEAD commit, so a routine scan transfers almost
52
- nothing and completes in about a second.
63
+ The first run downloads the advisory databases for the ecosystems the folder holds, and asks before it
64
+ does: OSV publishes one export per ecosystem (~200 MB for npm, 37.5 MB for PyPI, 12.7 MB for Go, 5.2 MB
65
+ for RubyGems, 3.7 MB for crates.io), and GitLab gemnasium is one ~80 MB archive for all of them. After
66
+ that every run refreshes incrementally: OSV answers `304 Not Modified` when nothing was published, and
67
+ gemnasium is gated on its repository's HEAD commit, so a routine scan transfers almost nothing and
68
+ completes in about a second.
53
69
 
54
70
  The cache lives in `$XDG_CACHE_HOME/sentinello` or `~/.cache/sentinello`. It is the only thing written
55
- outside your project. Beside the advisories it keeps the npm registry answers the fix check read
56
- (`registry-npm.ndjson.gz`), reused for 24 hours so a repeat scan asks the registry nothing.
71
+ outside your project. Beside the advisories it keeps the registry answers the fix check read, one file
72
+ per ecosystem (`registry-npm.ndjson.gz`, `registry-PyPI.ndjson.gz`, …), reused for 24 hours so a repeat
73
+ scan asks the registries nothing.
57
74
 
58
- ## Fixes are checked against npm
75
+ ## Fixes are checked against each registry
59
76
 
60
- A fix version an advisory states is not trusted on its word. For every npm finding the CLI asks the npm
61
- registry whether a version outside every source's affected range has actually been published, exactly
62
- as the Sentinello portal does: a published one reads "upgrade to", none reads "No fixed version
63
- released" with the way out (which dependency chain carries the package, whether a parent upgrade frees
64
- it, and curated alternatives), and one the registry could not settle reads "not checked against the
65
- registry" with the reason.
77
+ A fix version an advisory states is not trusted on its word. For every finding the CLI asks its
78
+ ecosystem's registry — npm, PyPI, the Go module proxy, the crates.io index or rubygems.org — whether a
79
+ version outside every source's affected range has actually been published, exactly as the Sentinello
80
+ portal does: a published one reads "upgrade to"; none reads "No fixed version released", with the way out
81
+ for npm (which dependency chain carries the package, whether a parent upgrade frees it, and curated
82
+ alternatives); and one the registry could not settle reads "not checked against the registry" with the
83
+ reason. `SENTINELLO_NPM_REGISTRY_URL`, `SENTINELLO_PYPI_URL`, `SENTINELLO_GOPROXY_URL`,
84
+ `SENTINELLO_CRATES_INDEX_URL` and `SENTINELLO_RUBYGEMS_URL` point a check at a mirror.
66
85
 
67
86
  A project that cannot be read — a `package.json` with no lockfile, say — is reported as **cannot be
68
87
  scanned**, with the reason and whose fix it is, in the summary, the markdown and the JSON
@@ -74,9 +93,11 @@ scanned**, with the reason and whose fix it is, in the summary, the markdown and
74
93
  history is kept between runs.
75
94
 
76
95
  Outbound requests go to `osv-vulnerabilities.storage.googleapis.com` and `gitlab.com` to download public
77
- advisory data, to `registry.npmjs.org` and `api.npmjs.org` to read the public metadata and download counts
78
- of the packages with findings and of the chains the way out weighs (package names only), and `npm audit`
79
- talks to your configured npm registry exactly as it always does. Use `--source osv,gemnasium` to skip npm
96
+ advisory data; to `registry.npmjs.org` and `api.npmjs.org` to read the public metadata and download counts
97
+ of the npm packages with findings and of the chains the way out weighs; to `pypi.org`, `proxy.golang.org`,
98
+ `index.crates.io` and `rubygems.org` to read which versions of the other packages with findings are
99
+ published (package names only, everywhere); and `npm audit` talks to your configured npm registry exactly
100
+ as it always does. Use `--source osv,gemnasium` to skip npm
80
101
  audit, or `--offline` to make no network requests at all — npm audit is then skipped and fixes read "not
81
102
  checked against the registry (offline)".
82
103
 
@@ -94,7 +115,7 @@ Run `sentinello --help` for the full list. The ones people reach for:
94
115
  | `--out <file\|->` | where the advisory goes |
95
116
  | `--json` | machine-readable output |
96
117
  | `-y, --yes` | accept the first-run download without asking. Required on a non-TTY |
97
- | `--offline` | use the cache as-is, no network — npm audit is skipped and fixes are not checked against npm |
118
+ | `--offline` | use the cache as-is, no network — npm audit is skipped and fixes are not checked against any registry |
98
119
  | `--doctor` | cache status, resolved settings, and what was skipped and why |
99
120
 
100
121
  Exit codes: `0` completed, `1` a scan or configuration error — including a `--fail-on` run that could