snyk 1.1121.0 → 1.1123.0

package/dist/cli/95.index.js

@@ -132618,6 +132618,7 @@ exports.isSupportedSize = exports.DECOMPRESSING_IGNORE_DIR = exports.DECOMPRESSI
 const os = __webpack_require__(12087);
 const process_1 = __webpack_require__(61765);
 exports.isWin = process_1.platform === 'win32';
+// Current implementation supports up to 2GB per file
 exports.MAX_SUPPORTED_FILE_SIZE = 2 * 1024 * 1024 * 1024 - 1;
 exports.HASHING_CONCURRENCY_LEVEL = os.cpus().length;
 exports.DECOMPRESSING_CONCURRENCY_LEVEL = os.cpus().length * 8;
@@ -132742,20 +132743,14 @@ function displayIssues(depGraph, issues, issuesData) {
     const issuesCount = issues.length == 1 ? '1 issue' : `${issues.length} issues`;
     const hasIssues = issues.length > 0;
     if (hasIssues) {
-        result.push(chalk.whiteBright('Issues:'));
-        for (const { pkgName: name, pkgVersion: version, issueId: vulnId, } of issues) {
-            const { title, severity } = issuesData[vulnId];
-            const color = common_1.getColorBySeverity(severity);
-            const severityAndTitle = color(`\n ✗ [${common_1.capitalize(severity)}] ${title}`);
-            const dependencyName = computeDependencyName(name, version);
-            const vulnDetailsUrl = `https://security.snyk.io/vuln/${vulnId}`;
-            const introducedThrough = common_1.leftPad(`Introduced through: ${dependencyName}`);
-            const urlText = common_1.leftPad(`URL: ${vulnDetailsUrl}`);
-            result.push(severityAndTitle);
-            result.push(introducedThrough);
-            result.push(urlText);
+        const vulnerabilityIssues = issues.filter((issue) => issue.type === 'vulnerability');
+        if (vulnerabilityIssues.length > 0) {
+            prepareResults(result, vulnerabilityIssues, issuesData, 'Issues:');
+        }
+        const licenseIssues = issues.filter((issue) => issue.type === 'license');
+        if (licenseIssues.length > 0) {
+            prepareResults(result, licenseIssues, issuesData, 'License issues:');
         }
-        result.push('');
     }
     const issuesFound = hasIssues
         ? chalk.redBright(issuesCount)
@@ -132767,6 +132762,22 @@ function displayIssues(depGraph, issues, issuesData) {
     return result;
 }
 exports.displayIssues = displayIssues;
+function prepareResults(result, issues, issuesData, typeTitle) {
+    result.push(chalk.bold(typeTitle));
+    for (const { pkgName: name, pkgVersion: version, issueId: vulnId, } of issues) {
+        const { title, severity } = issuesData[vulnId];
+        const color = common_1.getColorBySeverity(severity);
+        const severityAndTitle = color.bold(`\n ✗ [${common_1.capitalize(severity)}] ${title}`);
+        const dependencyName = computeDependencyName(name, version);
+        const vulnDetailsUrl = `https://security.snyk.io/vuln/${vulnId}`;
+        const introducedThrough = common_1.leftPad(`Introduced through: ${dependencyName}`, 3);
+        const urlText = common_1.leftPad(`URL: ${vulnDetailsUrl}`, 3);
+        result.push(severityAndTitle);
+        result.push(introducedThrough);
+        result.push(urlText);
+    }
+    result.push('');
+}
 function displayErrors(errors) {
     const result = [];
     if (errors.length) {
@@ -132813,6 +132824,9 @@ async function display(scanResults, testResults, errors, options) {
             result = result.concat(display_1.displaySignatures(scanResults));
         }
         for (const testResult of testResults) {
+            testResult.issues.forEach((issue) => (issue.type = issue.issueId.startsWith('snyk:lic:unmanaged:')
+                ? 'license'
+                : 'vulnerability'));
             const depGraph = dep_graph_1.createFromJSON(testResult.depGraphData);
             const [dependencies, issues] = display_1.selectDisplayStrategy(options, depGraph, testResult);
             if (testResult.depGraphData.pkgs.length > 1) {
@@ -180909,10 +180923,10 @@ const manifest = __webpack_require__(91314);
 const lockFile = __webpack_require__(95531);
 const poetryDepGraphBuilder = __webpack_require__(42393);
 function buildDepGraph(manifestFileContents, lockFileContents, includeDevDependencies = false) {
-    const dependencyNames = manifest.getDependencyNamesFrom(manifestFileContents, includeDevDependencies);
+    const dependencies = manifest.getDependenciesFrom(manifestFileContents, includeDevDependencies);
     const pkgDetails = manifest.pkgInfoFrom(manifestFileContents);
     const pkgSpecs = lockFile.packageSpecsFrom(lockFileContents);
-    return poetryDepGraphBuilder.build(pkgDetails, dependencyNames, pkgSpecs);
+    return poetryDepGraphBuilder.build(pkgDetails, dependencies, pkgSpecs);
 }
 exports.buildDepGraph = buildDepGraph;
 //# sourceMappingURL=index.js.map
@@ -180958,7 +180972,7 @@ exports.LockFileNotValid = LockFileNotValid;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.ManifestFileNotValid = exports.getDependencyNamesFrom = exports.pkgInfoFrom = void 0;
+exports.ManifestFileNotValid = exports.getDependenciesFrom = exports.pkgInfoFrom = void 0;
 const toml = __webpack_require__(5022);
 function pkgInfoFrom(manifestFileContents) {
     let manifest;
@@ -180974,21 +180988,44 @@ function pkgInfoFrom(manifestFileContents) {
     }
 }
 exports.pkgInfoFrom = pkgInfoFrom;
-function getDependencyNamesFrom(manifestFileContents, includeDevDependencies) {
+function getDependenciesFrom(manifestFileContents, includeDevDependencies) {
     var _a;
     const manifest = toml.parse(manifestFileContents);
     if (!((_a = manifest.tool) === null || _a === void 0 ? void 0 : _a.poetry)) {
         throw new ManifestFileNotValid();
     }
-    const dependencies = dependenciesFrom(manifest);
-    const devDependencies = includeDevDependencies
-        ? devDependenciesFrom(manifest)
+    const dependencies = dependenciesFrom(manifest).map((dep) => ({
+        name: dep,
+        isDev: false,
+    }));
+    const devDependencies = (includeDevDependencies ? devDependenciesFrom(manifest) : []).map((devDep) => ({
+        name: devDep,
+        isDev: true,
+    }));
+    return [...dependencies, ...devDependencies].filter((pkg) => pkg.name != 'python');
+}
+exports.getDependenciesFrom = getDependenciesFrom;
+const getGroupDevDepNames = (obj) => {
+    const groupDevDepNames = Object.values(obj)
+        .map((group) => group.dependencies)
+        .map((depsObj) => Object.keys(depsObj))
+        .reduce((acc, curr) => [...acc, ...curr], []);
+    return groupDevDepNames;
+};
+function getAllDevDependencyNames(manifest) {
+    var _a;
+    // pre-v1.2.0 naming convention
+    const devDepsProperty = Object.keys((_a = manifest.tool.poetry['dev-dependencies']) !== null && _a !== void 0 ? _a : []);
+    // post-v1.2.0 dependency groups
+    // https://python-poetry.org/docs/master/managing-dependencies
+    // we will handle all tool.poetry.group.<group> as dev-deps
+    const groupDevDepsProperty = manifest.tool.poetry.group
+        ? getGroupDevDepNames(manifest.tool.poetry.group)
         : [];
-    return [...dependencies, ...devDependencies].filter((pkgName) => pkgName != 'python');
+    return [...devDepsProperty, ...groupDevDepsProperty];
 }
-exports.getDependencyNamesFrom = getDependencyNamesFrom;
 function devDependenciesFrom(manifest) {
-    return Object.keys(manifest.tool.poetry['dev-dependencies'] || []);
+    return getAllDevDependencyNames(manifest);
 }
 function dependenciesFrom(manifest) {
     return Object.keys(manifest.tool.poetry.dependencies || []);
@@ -181021,18 +181058,19 @@ const IGNORED_DEPENDENCIES = [
     'pip',
     'wheel',
 ];
-function build(pkgDetails, pkgDependencyNames, pkgSpecs) {
+function build(pkgDetails, dependencies, pkgSpecs) {
     const builder = new dep_graph_1.DepGraphBuilder({ name: 'poetry' }, pkgDetails);
-    addDependenciesToGraph(pkgDependencyNames, pkgSpecs, builder.rootNodeId, builder);
+    addDependenciesToGraph(dependencies, pkgSpecs, builder.rootNodeId, builder);
     return builder.build();
 }
 exports.build = build;
-function addDependenciesToGraph(pkgNames, pkgSpecs, parentNodeId, builder) {
-    for (const pkgName of pkgNames) {
-        addDependenciesForPkg(pkgName, pkgSpecs, parentNodeId, builder);
+function addDependenciesToGraph(dependencies, pkgSpecs, parentNodeId, builder) {
+    for (const dep of dependencies) {
+        addDependenciesForPkg(dep, pkgSpecs, parentNodeId, builder);
     }
 }
-function addDependenciesForPkg(pkgName, pkgSpecs, parentNodeId, builder) {
+function addDependenciesForPkg(dependency, pkgSpecs, parentNodeId, builder) {
+    const pkgName = dependency.name;
     if (IGNORED_DEPENDENCIES.includes(pkgName)) {
         return;
     }
@@ -181045,8 +181083,15 @@ function addDependenciesForPkg(pkgName, pkgSpecs, parentNodeId, builder) {
         return;
     }
     const pkgInfo = { name: pkg.name, version: pkg.version };
-    builder.addPkgNode(pkgInfo, pkg.name).connectDep(parentNodeId, pkg.name);
-    addDependenciesToGraph(pkg.dependencies, pkgSpecs, pkg.name, builder);
+    builder
+        .addPkgNode(pkgInfo, pkg.name, {
+        labels: { scope: dependency.isDev ? 'dev' : 'prod' },
+    })
+        .connectDep(parentNodeId, pkg.name);
+    addDependenciesToGraph(pkg.dependencies.map((dep) => ({
+        name: dep,
+        isDev: dependency.isDev,
+    })), pkgSpecs, pkg.name, builder);
 }
 function isPkgAlreadyInGraph(pkg, builder) {
     return builder
@@ -181223,6 +181268,18 @@ function createAssets() {
         path.join(__dirname, '../../pysrc/pytoml/core.py'),
         path.join(__dirname, '../../pysrc/pytoml/parser.py'),
         path.join(__dirname, '../../pysrc/pytoml/writer.py'),
+        path.join(__dirname, '../../pysrc/packaging/tags.py'),
+        path.join(__dirname, '../../pysrc/packaging/_typing.py'),
+        path.join(__dirname, '../../pysrc/packaging/version.py'),
+        path.join(__dirname, '../../pysrc/packaging/__init__.py'),
+        path.join(__dirname, '../../pysrc/packaging/utils.py'),
+        path.join(__dirname, '../../pysrc/packaging/requirements.py'),
+        path.join(__dirname, '../../pysrc/packaging/_structures.py'),
+        path.join(__dirname, '../../pysrc/packaging/markers.py'),
+        path.join(__dirname, '../../pysrc/packaging/__about__.py'),
+        path.join(__dirname, '../../pysrc/packaging/_compat.py'),
+        path.join(__dirname, '../../pysrc/packaging/specifiers.py'),
+        path.join(__dirname, '../../pysrc/pyparsing.py'),
     ];
 }
 function writeFile(writeFilePath, contents) {