ts-node-client 3.3.3 → 3.4.1

package/.github/workflows/publish.yml

@@ -7,9 +7,6 @@ on:
   push:
     branches:
       - 'main'
-  pull_request:
-    branches:
-      - 'main'
 
 jobs:
   publish:
@@ -29,7 +26,8 @@ jobs:
           node-version: ${{ matrix.node-version }}
           registry-url: 'https://registry.npmjs.org'
       - name: Install dependencies
-        run: yarn
-      - run: yarn publish
+        run: npm i
+      - name: Publish package
+        run: npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/scan.yml

@@ -25,5 +25,5 @@ jobs:
       - name: Install dependencies
         run: yarn
       - name: Scan dependencies
-        run: yarn node ./bin/ts-node-client.js --branch main --tag $GITHUB_REF_NAME --project Scanner --url https://app.trustsource.io/ --apiKey ${{ secrets.TS_TOKEN }}
+        run: yarn node ./bin/ts-node-client.js --branch main --tag $GITHUB_REF_NAME --project Scanner --url https://api.trustsource.io/ --apiKey ${{ secrets.TS_TOKEN }}
 

package/.yarnrc.yml

@@ -0,0 +1 @@
+nodeLinker: node-modules

package/CHANGELOG.md

@@ -8,6 +8,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## 3.4.1 - 2024-08-13
+
+### Fixed
+* axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
+
+### Changed
+* update to cyclonedx version 1.6
+
+
+## 3.4.0 - 2024-06-18
+
+### Changed
+* switch to API v2
+
+
 ## 3.3.3 - 2024-04-01
 
 ### Fixed

package/README.md

@@ -9,6 +9,9 @@
 
 > TrustSource node client - node module to transfer dependency information to TrustSource server.
 
+## Release 3.4.0
+Migrated to TrustSource API v2
+
 ## Release 3.2.0
 Package now support package-lock.json v.3
 
@@ -46,7 +49,7 @@ To store your credentials for automated transfer you may create `.tsrc.json` in
 ```
 {
   "apiKey": "apiKey",
-  "url": "https://app.trustsource.io",
+  "url": "https://api.trustsource.io",
   "project": "Project Description"
 }
 

package/bin/ts-node-client.js

@@ -11,7 +11,7 @@ const fs = require('fs');
 const yargs = require('yargs');
 const pckgJson = require('../package.json');
 
-const URL = 'https://app.trustsource.io';
+const URL = 'https://api.trustsource.io';
 const CRED_FILENAME = '/.tsrc.json';
 const FILL = '                      ';
 const execute = require('../lib/cli');

package/lib/convertor.js

@@ -184,7 +184,7 @@ Convertor.scanToCydx = function scanTo(scan) {
     const date = new Date();
     const cydx = {
         bomFormat: 'CycloneDX',
-        specVersion: '1.3',
+        specVersion: '1.6',
         serialNumber: 'urn:uuid:ea788421-7eb0-448b-833e-b32dd0f39d0c',
         version: 1,
         metadata: {

package/lib/npm-scanner.js

@@ -148,7 +148,7 @@ Scanner.prototype.walk = function walk(npmDependency, level, root) {
     if (npmDependency.name) {
         let pkg = root && root.packages && root.packages[`node_modules/${npmDependency.fullName || npmDependency.name}`];
         if (!pkg) {
-          pkg = root && root.packages && root.packages[''];
+            pkg = root && root.packages && root.packages[''];
         }
         let repository = npmDependency.repository && npmDependency.repository.url;
         if (!repository) {
@@ -177,7 +177,7 @@ Scanner.prototype.walk = function walk(npmDependency, level, root) {
                 const childDependency = npmDependency.packages[val];
                 if (childDependency) {
                     const parts = val.split('node_modules/');
-                    childDependency.name = parts.length > 1 ? parts[parts.length-1] : parts[0];
+                    childDependency.name = parts.length > 1 ? parts[parts.length - 1] : parts[0];
                     childDependency.fullName = parts.length > 1 ? parts.slice(1).join('node_modules/') : parts[0];
                 }
                 checkForChild(self, opts, dependency, childDependency, val, level, root);

package/lib/rest-client.js

@@ -83,14 +83,14 @@ RestClient.prototype.transfer = function transfer(scan, cb) {
 
     const reqOpts = options.requestOptions || {};
     reqOpts.method = 'post';
-    reqOpts.url = `${options.url}/api/v1/scans`;
+    reqOpts.url = `${options.url}/v2/core/scans`;
     if (options.proxy) {
         reqOpts.proxy = options.proxy;
     }
     reqOpts.headers = {
         'Content-Type': 'application/json',
         'User-Agent': `${pckgJson.name}/${pckgJson.version}`,
-        'X-ApiKey': options.apiKey
+        'x-api-key': options.apiKey
     };
     reqOpts.json = true;
     reqOpts.data = scan;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ts-node-client",
   "description": "npm / node module to transfer dependency information to TrustSource server.",
-  "version": "3.3.3",
+  "version": "3.4.1",
   "homepage": "https://app.trustsource.io/",
   "author": {
     "name": "Oleksandr Dmukhovskyi",
@@ -28,19 +28,19 @@
   },
   "dependencies": {
     "@yarnpkg/lockfile": "1.1.0",
-    "axios": "1.6.8",
+    "axios": "1.7.4",
     "debuglog": "1.0.1",
     "js-yaml": "4.1.0",
     "packageurl-js": "1.2.1",
-    "semver": "7.6.0",
+    "semver": "7.6.3",
     "yargs": "17.7.2"
   },
   "devDependencies": {
     "eslint": "8.57.0",
     "eslint-config-airbnb-base": "15.0.0",
     "eslint-plugin-import": "2.29.1",
-    "eslint-plugin-sonarjs": "0.24.0",
-    "mocha": "10.3.0",
+    "eslint-plugin-sonarjs": "0.25.1",
+    "mocha": "10.7.3",
     "nock": "13.5.4"
   },
   "keywords": [

package/test/rest-test.js

@@ -47,7 +47,7 @@ describe('RestClient', () => {
                 reqheaders: {
                     'Content-Type': JSON_TYPE
                 }
-            }).post('/api/v1/scans').reply(201, 'Test response');
+            }).post('/v2/core/scans').reply(201, 'Test response');
 
             restClient.transfer({}, (err, data) => {
                 assert.equal(err, null);
@@ -63,7 +63,7 @@ describe('RestClient', () => {
                 }
             }).defaultReplyHeaders({
                 'Content-Type': JSON_TYPE
-            }).post('/api/v1/scans').reply(201, '{"bli": "blub"}');
+            }).post('/v2/core/scans').reply(201, '{"bli": "blub"}');
 
             restClient.transfer({}, (err, data) => {
                 assert.equal(err, null);