owasp-depscan 5.4.3__tar.gz → 5.4.5__tar.gz

{owasp_depscan-5.4.3/owasp_depscan.egg-info → owasp_depscan-5.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.4.3
+Version: 5.4.5
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.7.3
+Requires-Dist: appthreat-vulnerability-db==5.7.5
 Requires-Dist: defusedxml
 Requires-Dist: oras~=0.1.26
 Requires-Dist: PyYAML

{owasp_depscan-5.4.3 → owasp_depscan-5.4.5}/depscan/lib/analysis.py

@@ -601,7 +601,7 @@ def prepare_vdr(options: PrepareVdrOptions):
             has_poc_count += 1
             if pkg_severity in ("CRITICAL", "HIGH"):
                 pkg_requires_attn = True
-        if clinks.get("vendor") and package_type not in config.OS_PKG_TYPES:
+        if (clinks.get("vendor") and package_type not in config.OS_PKG_TYPES) or reached_purls.get(purl):
             if reached_purls.get(purl):
                 # If it has a poc, an insight might have gotten added above
                 if not pkg_requires_attn:

{owasp_depscan-5.4.3 → owasp_depscan-5.4.5}/depscan/lib/normalize.py

@@ -149,13 +149,13 @@ def create_pkg_variations(pkg_dict):
             # Issue #262
             # Eg: cpe:2.3:a:microsoft:azure_storage_blobs:*:*:*:*:*:python:*:*
             # pypi name is pkg:pypi/azure-storage-blob@12.8.0
-            if not name.endswith("s"):
+            # Issue #341 - do not change colorama to coloramas
+            if not name.endswith("s") and "-" in name:
                 name_aliases.add(name.replace("-", "_") + "s")
         vendor_aliases.add("pip")
         vendor_aliases.add("pypi")
         vendor_aliases.add("python")
         vendor_aliases.add("python-" + name)
-        vendor_aliases.add(name + "project")
     elif purl.startswith("pkg:npm"):
         # pg-promise CVE is filed as pg
         if name.endswith("-promise"):

{owasp_depscan-5.4.3 → owasp_depscan-5.4.5/owasp_depscan.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.4.3
+Version: 5.4.5
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.7.3
+Requires-Dist: appthreat-vulnerability-db==5.7.5
 Requires-Dist: defusedxml
 Requires-Dist: oras~=0.1.26
 Requires-Dist: PyYAML

{owasp_depscan-5.4.3 → owasp_depscan-5.4.5}/owasp_depscan.egg-info/requires.txt

@@ -1,4 +1,4 @@
-appthreat-vulnerability-db==5.7.3
+appthreat-vulnerability-db==5.7.5
 defusedxml
 oras~=0.1.26
 PyYAML

{owasp_depscan-5.4.3 → owasp_depscan-5.4.5}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "owasp-depscan"
-version = "5.4.3"
+version = "5.4.5"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},
 ]
 dependencies = [
-    "appthreat-vulnerability-db==5.7.3",
+    "appthreat-vulnerability-db==5.7.5",
     "defusedxml",
     "oras~=0.1.26",
     "PyYAML",