vite-plugin-vue-security 1.5.0 → 1.6.0

package/README.md

@@ -2,6 +2,10 @@
 
 A Vite plugin that performs security scans on Vue.js projects during the build process. This plugin integrates the Vue Security Scanner directly into your Vite build pipeline, allowing you to detect security vulnerabilities in real-time during development and build.
 
+## Vue 3.6 Support
+
+This plugin fully supports Vue 3.6, including the experimental Vapor Mode and other new features. It can detect security issues specific to Vue 3.6's enhanced reactivity system and optimized rendering pipeline.
+
 ## Installation
 
 ```bash
@@ -60,13 +64,43 @@ export default defineConfig({
 - `outputFile`: Optional path to write a JSON security report (default: null)
 - `exclude`: Array of patterns to exclude from scanning (default: [])
 
+### Advanced Configuration Options
+
+- `enableSemanticAnalysis`: Boolean to enable AST-based semantic analysis (default: true)
+- `enableDependencyScanning`: Boolean to enable dependency vulnerability scanning (default: true)
+- `enableAdvancedReport`: Boolean to enable advanced reporting with trends and compliance (default: false)
+- `reportHistoryPath`: Path for report history (default: '.vue-security-reports')
+- `complianceStandards`: Array of compliance standards to check (default: ['OWASP', 'GDPR', 'HIPAA', 'PCI-DSS', 'SOX'])
+
+### Performance Configuration
+
+- `performanceProfile`: Performance profile to use ('fast', 'balanced', 'thorough'; default: 'balanced')
+- `enableParallelScanning`: Boolean to enable parallel rule matching (default: true)
+- `enableIncrementalScanning`: Boolean to enable incremental scanning (default: true)
+- `memoryLimit`: Memory usage limit in MB (default: 512)
+
+### Trae CN Integration
+
+- `enableTraeCN`: Boolean to enable Trae CN integration (default: false)
+- `traeCNApiKey`: Trae CN API key
+- `traeCNProjectId`: Trae CN project ID
+- `traeCNAutoReport`: Boolean to auto-report vulnerabilities to Trae CN (default: true)
+- `traeCNRealtimePush`: Boolean to push scan results in realtime (default: false)
+
 ## Features
 
 - **Real-time Security Scanning**: Scans Vue, JS, and TS files during the build process
+- **Vue 3.6 Support**: Fully supports Vue 3.6 including experimental Vapor Mode
 - **Multiple Vulnerability Types**: Detects XSS, dependency issues, misconfigurations, hardcoded secrets, and more
 - **Enterprise Plugin Support**: Compatible with the Vue Security Scanner plugin system
 - **Flexible Reporting**: Configurable reporting levels and output formats
 - **Build Integration**: Option to fail builds on security issues
+- **Performance Optimizations**: Leverages the latest performance improvements from Vue Security Scanner 1.6.0
+  - Parallel rule matching using worker threads
+  - Incremental scanning with file change detection
+  - Rule classification and pre-filtering for faster scanning
+  - Memory usage optimization and automatic garbage collection
+- **Advanced Configuration**: Support for performance profiles (fast, balanced, thorough)
 
 ## Detected Vulnerabilities
 

package/index.js

@@ -28,6 +28,16 @@ function vueSecurityPlugin(options = {}) {
     reportHistoryPath: '.vue-security-reports', // Path for report history
     complianceStandards: ['OWASP', 'GDPR', 'HIPAA', 'PCI-DSS', 'SOX'], // Compliance standards to check
     
+    // Performance Configuration
+    performanceProfile: 'balanced', // 'fast', 'balanced', 'thorough'
+    enableParallelScanning: true, // Enable parallel rule matching
+    enableIncrementalScanning: true, // Enable incremental scanning
+    memoryLimit: 512, // Memory usage limit in MB
+    
+    // Vue 3.6 Support
+    enableVue36Features: true, // Enable Vue 3.6 specific feature detection
+    enableVaporModeScanning: true, // Enable scanning for Vapor Mode specific issues
+    
     // Trae CN Integration
     enableTraeCN: false, // Enable Trae CN integration
     traeCNApiKey: null, // Trae CN API key
@@ -80,11 +90,19 @@ function vueSecurityPlugin(options = {}) {
         performance: {
           enableSemanticAnalysis: config.enableSemanticAnalysis,
           enableNpmAudit: config.enableDependencyScanning,
-          enableVulnerabilityDB: config.enableDependencyScanning
+          enableVulnerabilityDB: config.enableDependencyScanning,
+          enableParallelScanning: config.enableParallelScanning,
+          enableIncrementalScanning: config.enableIncrementalScanning,
+          performanceProfile: config.performanceProfile,
+          memoryLimit: config.memoryLimit
         },
         compliance: {
           enabled: config.enableAdvancedReport,
           standards: config.complianceStandards
+        },
+        vue: {
+          enableVue36Features: config.enableVue36Features,
+          enableVaporModeScanning: config.enableVaporModeScanning
         }
       };
 
@@ -114,6 +132,11 @@ function vueSecurityPlugin(options = {}) {
         return null;
       }
 
+      // Skip virtual files (like vite/modulepreload-polyfill.js)
+      if (id.includes('vite/') || id.includes('\x00')) {
+        return null;
+      }
+
       // Only scan Vue files and JS/TS files
       if (!id.endsWith('.vue') && !id.endsWith('.js') && !id.endsWith('.ts') && !id.endsWith('.jsx') && !id.endsWith('.tsx')) {
         return null;
@@ -218,63 +241,73 @@ function vueSecurityPlugin(options = {}) {
       }
 
       // Generate report
-      if (allVulnerabilities.length > 0) {
-        const scanResult = {
-          summary: {
-            totalVulnerabilities: allVulnerabilities.length,
-            critical: allVulnerabilities.filter(v => v.severity === 'Critical').length,
-            high: allVulnerabilities.filter(v => v.severity === 'High').length,
-            medium: allVulnerabilities.filter(v => v.severity === 'Medium').length,
-            low: allVulnerabilities.filter(v => v.severity === 'Low').length
-          },
-          vulnerabilities: allVulnerabilities,
-          scanInfo: {
-            scannerVersion: '1.3.0',
-            scanDate: new Date().toISOString(),
-            projectPath: process.cwd()
-          }
-        };
-
-        // Generate advanced report if enabled
-        if (config.enableAdvancedReport && advancedReportGenerator) {
-          try {
-            const advancedReport = advancedReportGenerator.generateAdvancedReport(scanResult, {
-              includeTrends: true,
-              includeCompliance: true,
-              historyPath: config.reportHistoryPath
-            });
+      const scanResult = {
+        summary: {
+          totalVulnerabilities: allVulnerabilities.length,
+          critical: allVulnerabilities.filter(v => v.severity === 'Critical').length,
+          high: allVulnerabilities.filter(v => v.severity === 'High').length,
+          medium: allVulnerabilities.filter(v => v.severity === 'Medium').length,
+          low: allVulnerabilities.filter(v => v.severity === 'Low').length
+        },
+        vulnerabilities: allVulnerabilities,
+        scanInfo: {
+          scannerVersion: '1.6.0',
+          scanDate: new Date().toISOString(),
+          projectPath: process.cwd()
+        }
+      };
+
+      // Generate advanced report if enabled
+      if (config.enableAdvancedReport && advancedReportGenerator) {
+        try {
+          const advancedReport = advancedReportGenerator.generateAdvancedReport(scanResult, {
+            includeTrends: true,
+            includeCompliance: true,
+            historyPath: config.reportHistoryPath
+          });
+          
+          if (config.outputFile) {
+            const reportPath = config.outputFile.endsWith('.html') 
+              ? config.outputFile 
+              : config.outputFile.replace('.json', '.html');
             
-            if (config.outputFile) {
-              const reportPath = config.outputFile.endsWith('.html') 
-                ? config.outputFile 
-                : config.outputFile.replace('.json', '.html');
-              
-              await writeAdvancedReport(reportPath, advancedReport, 'html');
-            }
-          } catch (error) {
-            console.warn('Advanced report generation failed:', error.message);
+            await writeAdvancedReport(reportPath, advancedReport, 'html');
           }
+        } catch (error) {
+          console.warn('Advanced report generation failed:', error.message);
         }
+      }
 
-        // Write basic report
-        if (config.outputFile) {
-          await writeSecurityReport(config.outputFile, allVulnerabilities, scanResult);
-        }
+      // Write basic report
+      if (config.outputFile) {
+        await writeSecurityReport(config.outputFile, allVulnerabilities, scanResult);
+      }
 
-        // Report scan results to Trae CN if enabled
-        if (traeCNIntegration && config.traeCNRealtimePush) {
-          try {
-            const pushResult = await traeCNIntegration.reportScanResults(scanResult);
-            if (pushResult.success) {
-              console.log('Scan results pushed to Trae CN');
-            } else {
-              console.warn(`Failed to push scan results to Trae CN: ${pushResult.message}`);
-            }
-          } catch (error) {
-            console.warn(`Trae CN push error: ${error.message}`);
+      // Report scan results to Trae CN if enabled
+      if (traeCNIntegration && config.traeCNRealtimePush) {
+        try {
+          const pushResult = await traeCNIntegration.reportScanResults(scanResult);
+          if (pushResult.success) {
+            console.log('Scan results pushed to Trae CN');
+          } else {
+            console.warn(`Failed to push scan results to Trae CN: ${pushResult.message}`);
           }
+        } catch (error) {
+          console.warn(`Trae CN push error: ${error.message}`);
         }
       }
+
+      // Release resources
+      try {
+        // Shutdown parallel rule engine if it exists
+        const parallelRuleEngine = require('vue-security-scanner/src/rules/parallel-rule-engine');
+        if (parallelRuleEngine && parallelRuleEngine.shutdown) {
+          parallelRuleEngine.shutdown();
+          console.log('Parallel rule engine shutdown completed');
+        }
+      } catch (error) {
+        // Ignore shutdown errors
+      }
     }
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite-plugin-vue-security",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "A Vite plugin that performs security scans on Vue.js projects during the build process with advanced semantic analysis and enterprise-grade reporting",
   "main": "index.js",
   "scripts": {
@@ -10,6 +10,9 @@
     "vite",
     "plugin",
     "vue",
+    "vue3",
+    "vue3.6",
+    "vapor-mode",
     "security",
     "scanner",
     "vulnerability",
@@ -18,7 +21,9 @@
     "ast",
     "semantic-analysis",
     "dependency-scanning",
-    "compliance"
+    "compliance",
+    "performance",
+    "parallel-processing"
   ],
   "author": "ereddate",
   "license": "MIT",
@@ -28,7 +33,7 @@
   },
   "dependencies": {
     "cheerio": "^1.0.0-rc.12",
-    "vue-security-scanner": "^1.5.1"
+    "vue-security-scanner": "^1.6.0"
   },
   "repository": {
     "type": "git",