owasp-depscan 5.1.2__tar.gz → 5.1.4__tar.gz

{owasp-depscan-5.1.2/owasp_depscan.egg-info → owasp-depscan-5.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.1.2
+Version: 5.1.4
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db>=5.5.6
+Requires-Dist: appthreat-vulnerability-db>=5.5.7
 Requires-Dist: defusedxml
 Requires-Dist: oras
 Requires-Dist: PyYAML
@@ -46,6 +46,37 @@ OWASP dep-scan is a next-generation security and risk audit tool based on known
 [![release](https://github.com/owasp-dep-scan/dep-scan/actions/workflows/pythonpublish.yml/badge.svg)](https://github.com/owasp-dep-scan/dep-scan/actions/workflows/pythonpublish.yml)
 [![Discord](https://img.shields.io/badge/-Discord-lime?style=for-the-badge&logo=discord&logoColor=white&color=black)](https://discord.gg/pF4BYWEJcS)
 
+## Contents
+- [Features](#features)
+    - [Vulnerability Data sources](#vulnerability-data-sources)
+    - [Linux distros](#linux-distros)
+- [Usage](#usage)
+    - [OCI Artifacts via ORAS cli](#oci-artifacts-via-oras-cli)
+    - [Single binary executables](#single-binary-executables)
+    - [Server mode](#server-mode)
+    - [Scanning projects locally (Python version)](#scanning-projects-locally-python-version)
+    - [Scanning containers locally (Python version)](#scanning-containers-locally-python-version)
+    - [Scanning projects locally (Docker container)](#scanning-projects-locally-docker-container)
+- [Supported languages and package format](#supported-languages-and-package-format)
+- [Reachability analysis](#reachability-analysis)
+    - [Example analysis for a Java project](#example-analysis-for-a-java-project)
+    - [Example analysis for a JavaScript project](#example-analysis-for-a-javascript-project)
+- [Customization through environment variables](#customization-through-environment-variables)
+- [GitHub Security Advisory](#github-security-advisory)
+- [Suggest mode](#suggest-mode)
+- [Package Risk audit](#package-risk-audit)
+    - [Automatic adjustment](#automatic-adjustment)
+    - [Configuring weights](#configuring-weights)
+- [Live OS scan](#live-os-scan)
+- [License scan](#license-scan)
+- [Kubernetes and Cloud apps](#kubernetes-and-cloud-apps)
+- [PDF reports](#pdf-reports)
+- [Custom reports](#custom-reports)
+- [Performance tuning](#performance-tuning)
+    - [Use nydus to speed up the initial vdb download](#use-nydus-to-speed-up-the-initial-vdb-download)
+- [Discord support](#discord-support)
+- [License](#license)
+
 ## Features
 
 -   Scan most application code - local repos, Linux container images, Kubernetes manifests, and OS - to identify known CVEs with prioritization

{owasp-depscan-5.1.2 → owasp-depscan-5.1.4}/README.md

@@ -7,6 +7,37 @@ OWASP dep-scan is a next-generation security and risk audit tool based on known
 [![release](https://github.com/owasp-dep-scan/dep-scan/actions/workflows/pythonpublish.yml/badge.svg)](https://github.com/owasp-dep-scan/dep-scan/actions/workflows/pythonpublish.yml)
 [![Discord](https://img.shields.io/badge/-Discord-lime?style=for-the-badge&logo=discord&logoColor=white&color=black)](https://discord.gg/pF4BYWEJcS)
 
+## Contents
+- [Features](#features)
+    - [Vulnerability Data sources](#vulnerability-data-sources)
+    - [Linux distros](#linux-distros)
+- [Usage](#usage)
+    - [OCI Artifacts via ORAS cli](#oci-artifacts-via-oras-cli)
+    - [Single binary executables](#single-binary-executables)
+    - [Server mode](#server-mode)
+    - [Scanning projects locally (Python version)](#scanning-projects-locally-python-version)
+    - [Scanning containers locally (Python version)](#scanning-containers-locally-python-version)
+    - [Scanning projects locally (Docker container)](#scanning-projects-locally-docker-container)
+- [Supported languages and package format](#supported-languages-and-package-format)
+- [Reachability analysis](#reachability-analysis)
+    - [Example analysis for a Java project](#example-analysis-for-a-java-project)
+    - [Example analysis for a JavaScript project](#example-analysis-for-a-javascript-project)
+- [Customization through environment variables](#customization-through-environment-variables)
+- [GitHub Security Advisory](#github-security-advisory)
+- [Suggest mode](#suggest-mode)
+- [Package Risk audit](#package-risk-audit)
+    - [Automatic adjustment](#automatic-adjustment)
+    - [Configuring weights](#configuring-weights)
+- [Live OS scan](#live-os-scan)
+- [License scan](#license-scan)
+- [Kubernetes and Cloud apps](#kubernetes-and-cloud-apps)
+- [PDF reports](#pdf-reports)
+- [Custom reports](#custom-reports)
+- [Performance tuning](#performance-tuning)
+    - [Use nydus to speed up the initial vdb download](#use-nydus-to-speed-up-the-initial-vdb-download)
+- [Discord support](#discord-support)
+- [License](#license)
+
 ## Features
 
 -   Scan most application code - local repos, Linux container images, Kubernetes manifests, and OS - to identify known CVEs with prioritization

{owasp-depscan-5.1.2 → owasp-depscan-5.1.4}/depscan/cli.py

@@ -536,6 +536,7 @@ def download_rafs_based_image():
                     nydus_download_command,
                     check=True,
                     stdout=subprocess.DEVNULL,
+                    stderr=subprocess.DEVNULL,
                 )
                 if os.path.exists(os.path.join(data_dir, "vdb.tar")):
                     rafs_image_downloaded = True

{owasp-depscan-5.1.2 → owasp-depscan-5.1.4}/depscan/lib/logger.py

@@ -57,11 +57,16 @@ logging.basicConfig(
     ],
 )
 LOG = logging.getLogger(__name__)
-for _ in ("httpx", "oras"):
-    logging.getLogger(_).disabled = True
 
 # Set logging level
-if os.getenv("SCAN_DEBUG_MODE") == "debug" or os.getenv("AT_DEBUG_MODE") == "debug":
+if (
+    os.getenv("SCAN_DEBUG_MODE") == "debug"
+    or os.getenv("AT_DEBUG_MODE") == "debug"
+):
     LOG.setLevel(logging.DEBUG)
 
 DEBUG = logging.DEBUG
+
+for log_name, log_obj in logging.Logger.manager.loggerDict.items():
+    if log_name != __name__:
+        log_obj.disabled = True

{owasp-depscan-5.1.2 → owasp-depscan-5.1.4}/depscan/lib/normalize.py

@@ -54,11 +54,10 @@ def create_pkg_variations(pkg_dict):
             if purl_obj:
                 pkg_type = purl_obj.get("type")
                 qualifiers = purl_obj.get("qualifiers", {})
-                namespace = purl_obj.get("namespace")
-                # npm is known for packages with no group
-                # To reduce false positives we retain such empty groups here
-                if pkg_type in ("npm",) and namespace is None:
-                    vendor_aliases.add("")
+                # npm is resulting in false positives
+                # Let's disable aliasing for now. See #194, #195, #196
+                if pkg_type in ("npm",):
+                    return pkg_list
                 if qualifiers and qualifiers.get("distro_name"):
                     os_distro_name = qualifiers.get("distro_name")
                     name_aliases.add(f"""{os_distro_name}/{name}""")

{owasp-depscan-5.1.2 → owasp-depscan-5.1.4/owasp_depscan.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.1.2
+Version: 5.1.4
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db>=5.5.6
+Requires-Dist: appthreat-vulnerability-db>=5.5.7
 Requires-Dist: defusedxml
 Requires-Dist: oras
 Requires-Dist: PyYAML
@@ -46,6 +46,37 @@ OWASP dep-scan is a next-generation security and risk audit tool based on known
 [![release](https://github.com/owasp-dep-scan/dep-scan/actions/workflows/pythonpublish.yml/badge.svg)](https://github.com/owasp-dep-scan/dep-scan/actions/workflows/pythonpublish.yml)
 [![Discord](https://img.shields.io/badge/-Discord-lime?style=for-the-badge&logo=discord&logoColor=white&color=black)](https://discord.gg/pF4BYWEJcS)
 
+## Contents
+- [Features](#features)
+    - [Vulnerability Data sources](#vulnerability-data-sources)
+    - [Linux distros](#linux-distros)
+- [Usage](#usage)
+    - [OCI Artifacts via ORAS cli](#oci-artifacts-via-oras-cli)
+    - [Single binary executables](#single-binary-executables)
+    - [Server mode](#server-mode)
+    - [Scanning projects locally (Python version)](#scanning-projects-locally-python-version)
+    - [Scanning containers locally (Python version)](#scanning-containers-locally-python-version)
+    - [Scanning projects locally (Docker container)](#scanning-projects-locally-docker-container)
+- [Supported languages and package format](#supported-languages-and-package-format)
+- [Reachability analysis](#reachability-analysis)
+    - [Example analysis for a Java project](#example-analysis-for-a-java-project)
+    - [Example analysis for a JavaScript project](#example-analysis-for-a-javascript-project)
+- [Customization through environment variables](#customization-through-environment-variables)
+- [GitHub Security Advisory](#github-security-advisory)
+- [Suggest mode](#suggest-mode)
+- [Package Risk audit](#package-risk-audit)
+    - [Automatic adjustment](#automatic-adjustment)
+    - [Configuring weights](#configuring-weights)
+- [Live OS scan](#live-os-scan)
+- [License scan](#license-scan)
+- [Kubernetes and Cloud apps](#kubernetes-and-cloud-apps)
+- [PDF reports](#pdf-reports)
+- [Custom reports](#custom-reports)
+- [Performance tuning](#performance-tuning)
+    - [Use nydus to speed up the initial vdb download](#use-nydus-to-speed-up-the-initial-vdb-download)
+- [Discord support](#discord-support)
+- [License](#license)
+
 ## Features
 
 -   Scan most application code - local repos, Linux container images, Kubernetes manifests, and OS - to identify known CVEs with prioritization

{owasp-depscan-5.1.2 → owasp-depscan-5.1.4}/owasp_depscan.egg-info/requires.txt

@@ -1,4 +1,4 @@
-appthreat-vulnerability-db>=5.5.6
+appthreat-vulnerability-db>=5.5.7
 defusedxml
 oras
 PyYAML

{owasp-depscan-5.1.2 → owasp-depscan-5.1.4}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "owasp-depscan"
-version = "5.1.2"
+version = "5.1.4"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},
 ]
 dependencies = [
-    "appthreat-vulnerability-db>=5.5.6",
+    "appthreat-vulnerability-db>=5.5.7",
     "defusedxml",
     "oras",
     "PyYAML",