owasp-depscan 5.2.14__tar.gz → 5.3.0__tar.gz

{owasp-depscan-5.2.14/owasp_depscan.egg-info → owasp-depscan-5.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.2.14
+Version: 5.3.0
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.6.4
+Requires-Dist: appthreat-vulnerability-db==5.6.6
 Requires-Dist: defusedxml
 Requires-Dist: oras~=0.1.26
 Requires-Dist: PyYAML

{owasp-depscan-5.2.14 → owasp-depscan-5.3.0}/depscan/lib/analysis.py

@@ -1224,6 +1224,7 @@ def analyse_pkg_risks(
         if risk_metrics.get("risk_score") and (
             risk_metrics.get("risk_score") > config.pkg_max_risk_score
             or risk_metrics.get("pkg_private_on_public_registry_risk")
+            or risk_metrics.get("pkg_deprecated_risk")
         ):
             risk_score = f"""{round(risk_metrics.get("risk_score"), 2)}"""
             data = [

{owasp-depscan-5.2.14 → owasp-depscan-5.3.0}/depscan/lib/pkg_query.py

@@ -319,6 +319,11 @@ def pypi_pkg_risk(pkg_metadata, is_private_pkg, scope):
     versions_dict = pkg_metadata.get("releases", {})
     versions = [ver[0] for k, ver in versions_dict.items() if ver]
     is_deprecated = info.get("yanked") and info.get("yanked_reason")
+    # Some packages like pypi:azure only mention deprecated in the description
+    # without yanking the package
+    pkg_description = info.get("description", "").lower()
+    if not is_deprecated and ("is deprecated" in pkg_description or "no longer maintained" in pkg_description):
+        is_deprecated = True
     latest_deprecated = False
     first_version = None
     latest_version = None

{owasp-depscan-5.2.14 → owasp-depscan-5.3.0/owasp_depscan.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.2.14
+Version: 5.3.0
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.6.4
+Requires-Dist: appthreat-vulnerability-db==5.6.6
 Requires-Dist: defusedxml
 Requires-Dist: oras~=0.1.26
 Requires-Dist: PyYAML

{owasp-depscan-5.2.14 → owasp-depscan-5.3.0}/owasp_depscan.egg-info/requires.txt

@@ -1,4 +1,4 @@
-appthreat-vulnerability-db==5.6.4
+appthreat-vulnerability-db==5.6.6
 defusedxml
 oras~=0.1.26
 PyYAML

{owasp-depscan-5.2.14 → owasp-depscan-5.3.0}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "owasp-depscan"
-version = "5.2.14"
+version = "5.3.0"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},
 ]
 dependencies = [
-    "appthreat-vulnerability-db==5.6.4",
+    "appthreat-vulnerability-db==5.6.6",
     "defusedxml",
     "oras~=0.1.26",
     "PyYAML",