Skip to content

Commit aaf86f6

Browse files
wraithgarwraithgar
authored
deps: @npmcli/[email protected] (#4674)
* include cwe and cvss in advisories
1 parent de4de30 commit aaf86f6

File tree

3 files changed

+46
-36
lines changed

3 files changed

+46
-36
lines changed

‎node_modules/@npmcli/metavuln-calculator/lib/advisory.js

Lines changed: 23 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ class Advisory {
3939
this.severity = source.severity || 'high'
4040
this.versions = []
4141
this.vulnerableVersions = []
42+
this.cwe = source.cwe
43+
this.cvss = source.cvss
4244

4345
// advisories have the range, metavulns do not
4446
// if an advisory doesn't specify range, assume all are vulnerable
@@ -326,7 +328,7 @@ class Advisory {
326328
list.push(v)
327329
}
328330

329-
for (const list of versionSets) {
331+
for (const set of versionSets) {
330332
// it's common to have version lists like:
331333
// 1.0.0
332334
// 1.0.1-alpha.0
@@ -340,54 +342,54 @@ class Advisory {
340342
// 1.0.2
341343
// with a huge number of prerelease versions that are not installable
342344
// anyway.
343-
// If mid has a prerelease tag, and list[0] does not, then walk it
345+
// If mid has a prerelease tag, and set[0] does not, then walk it
344346
// back until we hit a non-prerelease version
345-
// If mid has a prerelease tag, and list[list.length-1] does not,
347+
// If mid has a prerelease tag, and set[set.length-1] does not,
346348
// then walk it forward until we hit a version without a prerelease tag
347349
// Similarly, if the head/tail is a prerelease, but there is a non-pr
348-
// version in the list, then start there instead.
350+
// version in the set, then start there instead.
349351
let h = 0
350-
const origHeadVuln = this.testVersion(list[h])
351-
while (h < list.length && /-/.test(String(list[h]))) {
352+
const origHeadVuln = this.testVersion(set[h])
353+
while (h < set.length && /-/.test(String(set[h]))) {
352354
h++
353355
}
354356

355357
// don't filter out the whole list! they might all be pr's
356-
if (h === list.length) {
358+
if (h === set.length) {
357359
h = 0
358360
} else if (origHeadVuln) {
359361
// if the original was vulnerable, assume so are all of these
360362
for (let hh = 0; hh < h; hh++) {
361-
this[_markVulnerable](list[hh])
363+
this[_markVulnerable](set[hh])
362364
}
363365
}
364366

365-
let t = list.length - 1
366-
const origTailVuln = this.testVersion(list[t])
367-
while (t > h && /-/.test(String(list[t]))) {
367+
let t = set.length - 1
368+
const origTailVuln = this.testVersion(set[t])
369+
while (t > h && /-/.test(String(set[t]))) {
368370
t--
369371
}
370372

371373
// don't filter out the whole list! might all be pr's
372374
if (t === h) {
373-
t = list.length - 1
375+
t = set.length - 1
374376
} else if (origTailVuln) {
375377
// if original tail was vulnerable, assume these are as well
376-
for (let tt = list.length - 1; tt > t; tt--) {
377-
this[_markVulnerable](list[tt])
378+
for (let tt = set.length - 1; tt > t; tt--) {
379+
this[_markVulnerable](set[tt])
378380
}
379381
}
380382

381383
const headVuln = h === 0 ? origHeadVuln
382-
: this.testVersion(list[h])
384+
: this.testVersion(set[h])
383385

384-
const tailVuln = t === list.length - 1 ? origTailVuln
385-
: this.testVersion(list[t])
386+
const tailVuln = t === set.length - 1 ? origTailVuln
387+
: this.testVersion(set[t])
386388

387389
// if head and tail both vulnerable, whole list is thrown out
388390
if (headVuln && tailVuln) {
389391
for (let v = h; v < t; v++) {
390-
this[_markVulnerable](list[v])
392+
this[_markVulnerable](set[v])
391393
}
392394
continue
393395
}
@@ -397,9 +399,9 @@ class Advisory {
397399
continue
398400
}
399401

400-
const mid = Math.floor(list.length / 2)
401-
const pre = list.slice(0, mid)
402-
const post = list.slice(mid)
402+
const mid = Math.floor(set.length / 2)
403+
const pre = set.slice(0, mid)
404+
const post = set.slice(mid)
403405

404406
// if the parent list wasn't prereleases, then drop pr tags
405407
// from end of the pre list, and beginning of the post list,

‎node_modules/@npmcli/metavuln-calculator/package.json

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,16 @@
11
{
22
"name": "@npmcli/metavuln-calculator",
3-
"version": "3.0.1",
3+
"version": "3.1.0",
44
"main": "lib/index.js",
55
"files": [
6-
"bin",
7-
"lib"
6+
"bin/",
7+
"lib/"
88
],
99
"description": "Calculate meta-vulnerabilities from package security advisories",
10-
"repository": "https://github.com/npm/metavuln-calculator",
10+
"repository": {
11+
"type": "git",
12+
"url": "https://github.com/npm/metavuln-calculator.git"
13+
},
1114
"author": "GitHub Inc.",
1215
"license": "ISC",
1316
"scripts": {
@@ -19,19 +22,20 @@
1922
"postversion": "npm publish",
2023
"prepublishOnly": "git push origin --follow-tags",
2124
"eslint": "eslint",
22-
"lint": "eslint '**/*.js'",
25+
"lint": "eslint \"**/*.js\"",
2326
"lintfix": "npm run lint -- --fix",
24-
"postlint": "npm-template-check",
25-
"template-copy": "npm-template-copy --force"
27+
"postlint": "template-oss-check",
28+
"template-oss-apply": "template-oss-apply --force"
2629
},
2730
"tap": {
2831
"check-coverage": true,
2932
"coverage-map": "map.js"
3033
},
3134
"devDependencies": {
32-
"@npmcli/template-oss": "^2.9.2",
35+
"@npmcli/eslint-config": "^3.0.1",
36+
"@npmcli/template-oss": "3.2.0",
3337
"require-inject": "^1.4.4",
34-
"tap": "^15.1.6"
38+
"tap": "^16.0.1"
3539
},
3640
"dependencies": {
3741
"cacache": "^16.0.0",
@@ -40,9 +44,10 @@
4044
"semver": "^7.3.5"
4145
},
4246
"engines": {
43-
"node": "^12.13.0 || ^14.15.0 || >=16"
47+
"node": "^12.13.0 || ^14.15.0 || >=16.0.0"
4448
},
4549
"templateOSS": {
46-
"version": "2.9.2"
50+
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
51+
"version": "3.2.0"
4752
}
4853
}

‎package-lock.json

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -936,16 +936,17 @@
936936
}
937937
},
938938
"node_modules/@npmcli/metavuln-calculator": {
939-
"version": "3.0.1",
940-
"license": "ISC",
939+
"version": "3.1.0",
940+
"resolved": "https://registry.npmjs.org/@npmcli/metavuln-calculator/-/metavuln-calculator-3.1.0.tgz",
941+
"integrity": "sha512-Q5fbQqGDlYqk7kWrbg6E2j/mtqQjZop0ZE6735wYA1tYNHguIDjAuWs+kFb5rJCkLIlXllfapvsyotYKiZOTBA==",
941942
"dependencies": {
942943
"cacache": "^16.0.0",
943944
"json-parse-even-better-errors": "^2.3.1",
944945
"pacote": "^13.0.3",
945946
"semver": "^7.3.5"
946947
},
947948
"engines": {
948-
"node": "^12.13.0 || ^14.15.0 || >=16"
949+
"node": "^12.13.0 || ^14.15.0 || >=16.0.0"
949950
}
950951
},
951952
"node_modules/@npmcli/move-file": {
@@ -10311,7 +10312,9 @@
1031110312
}
1031210313
},
1031310314
"@npmcli/metavuln-calculator": {
10314-
"version": "3.0.1",
10315+
"version": "3.1.0",
10316+
"resolved": "https://registry.npmjs.org/@npmcli/metavuln-calculator/-/metavuln-calculator-3.1.0.tgz",
10317+
"integrity": "sha512-Q5fbQqGDlYqk7kWrbg6E2j/mtqQjZop0ZE6735wYA1tYNHguIDjAuWs+kFb5rJCkLIlXllfapvsyotYKiZOTBA==",
1031510318
"requires": {
1031610319
"cacache": "^16.0.0",
1031710320
"json-parse-even-better-errors": "^2.3.1",

0 commit comments

Comments
 (0)