diff --git a/cmd/brief/npm_test.go b/cmd/brief/npm_test.go new file mode 100644 index 0000000..5f552ba --- /dev/null +++ b/cmd/brief/npm_test.go @@ -0,0 +1,54 @@ +package main + +import ( + "encoding/json" + "os" + "os/exec" + "reflect" + "testing" + + "github.com/git-pkgs/brief" +) + +func TestScanCompactNPMLockfile(t *testing.T) { + const helperEnv = "BRIEF_COMPACT_NPM_ROOT" + if root := os.Getenv(helperEnv); root != "" { + cmdScan([]string{"-json", root}) + return + } + + root := t.TempDir() + writeScanFixture(t, root, "index.js", "console.log('hello');\n") + writeScanFixture(t, root, "package-lock.json", `{"name":"example","lockfileVersion":3,"packages":{"":{"devDependencies":{"eslint":"^9.0.0"}},"node_modules/eslint":{"version":"9.0.0","dev":true},"node_modules/@eslint/js":{"version":"9.0.0","dev":true}}}`) + cmd := exec.Command(os.Args[0], "-test.run=^TestScanCompactNPMLockfile$") + cmd.Env = append(os.Environ(), helperEnv+"="+root, "PATH=") + out, err := cmd.Output() + if err != nil { + t.Fatalf("scan failed: %v", err) + } + var report brief.Report + if err := json.Unmarshal(out, &report); err != nil { + t.Fatalf("parsing scan output: %v\n%s", err, out) + } + want := map[string]brief.DepInfo{ + "eslint": { + Manifest: "package-lock.json", Name: "eslint", Version: "9.0.0", + PURL: "pkg:npm/eslint@9.0.0", Scope: brief.ScopeDevelopment, Direct: true, + }, + "@eslint/js": { + Manifest: "package-lock.json", Name: "@eslint/js", Version: "9.0.0", + PURL: "pkg:npm/%40eslint/js@9.0.0", Scope: brief.ScopeDevelopment, + }, + } + if len(report.Dependencies) != len(want) { + t.Fatalf("dependencies = %+v, want %+v", report.Dependencies, want) + } + for _, dep := range report.Dependencies { + if !reflect.DeepEqual(dep, want[dep.Name]) { + t.Errorf("dependency = %+v, want %+v", dep, want[dep.Name]) + } + } + if !reportHasTool(&report, "lint", "ESLint") { + t.Error("compact lockfile did not trigger ESLint detection") + } +} diff --git a/go.mod b/go.mod index 1feb169..38e151a 100644 --- a/go.mod +++ b/go.mod @@ -6,20 +6,20 @@ toolchain go1.26.7 require ( github.com/BurntSushi/toml v1.6.0 - github.com/git-pkgs/archives v0.7.1 + github.com/git-pkgs/archives v0.8.1 github.com/git-pkgs/citation v0.1.0 - github.com/git-pkgs/clone v0.7.3 + github.com/git-pkgs/clone v0.7.5 github.com/git-pkgs/codemeta v0.3.0 github.com/git-pkgs/enrichment v0.7.1 - github.com/git-pkgs/forge v0.10.0 + github.com/git-pkgs/forge v0.10.1 github.com/git-pkgs/licensecheck v0.4.1 - github.com/git-pkgs/magic v0.4.0 - github.com/git-pkgs/manifests v0.12.2 - github.com/git-pkgs/outline v0.2.2 - github.com/git-pkgs/purl v0.1.20 - github.com/git-pkgs/registries v0.9.2 + github.com/git-pkgs/magic v0.5.0 + github.com/git-pkgs/manifests v0.12.3 + github.com/git-pkgs/outline v0.2.3 + github.com/git-pkgs/purl v0.1.21 + github.com/git-pkgs/registries v0.9.3 github.com/git-pkgs/roles v0.1.3 - github.com/git-pkgs/spdx v0.3.2 + github.com/git-pkgs/spdx v0.3.3 github.com/klauspost/compress v1.20.0 github.com/ulikunitz/xz v0.5.17 go.yaml.in/yaml/v3 v3.0.5 @@ -29,18 +29,18 @@ require ( require ( github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect github.com/bazelbuild/buildtools v0.0.0-20260716142318-04cf7de1434f // indirect - github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect + github.com/bmatcuk/doublestar/v4 v4.10.2 // indirect github.com/ecosyste-ms/ecosystems-go v0.4.0 // indirect - github.com/git-pkgs/gitignore v1.2.0 // indirect + github.com/git-pkgs/gitignore v1.3.0 // indirect github.com/git-pkgs/packageurl-go v0.3.1 // indirect - github.com/git-pkgs/pom v0.1.7 // indirect - github.com/git-pkgs/vers v0.7.1 // indirect - github.com/git-pkgs/vulns v0.2.3 // indirect + github.com/git-pkgs/pom v0.1.8 // indirect + github.com/git-pkgs/vers v0.7.2 // indirect + github.com/git-pkgs/vulns v0.2.4 // indirect github.com/github/go-spdx/v2 v2.7.0 // indirect github.com/google/uuid v1.6.0 // indirect github.com/oapi-codegen/nullable v1.2.0 // indirect github.com/oapi-codegen/runtime v1.6.0 // indirect - github.com/odvcencio/gotreesitter v0.51.0 // indirect + github.com/odvcencio/gotreesitter v0.53.0 // indirect github.com/package-url/packageurl-go v0.1.7 // indirect github.com/pandatix/go-cvss v0.6.4 // indirect golang.org/x/sys v0.48.0 // indirect diff --git a/go.sum b/go.sum index d8791ff..766af30 100644 --- a/go.sum +++ b/go.sum @@ -6,51 +6,51 @@ github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP github.com/bazelbuild/buildtools v0.0.0-20260716142318-04cf7de1434f h1:2mT6QcXmMFtvg7bezs1Fef7nnpJyeCmfWoWNjwtvNZ4= github.com/bazelbuild/buildtools v0.0.0-20260716142318-04cf7de1434f/go.mod h1:PLNUetjLa77TCCziPsz0EI8a6CUxgC+1jgmWv0H25tg= github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w= -github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs= -github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= +github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw= +github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/ecosyste-ms/ecosystems-go v0.4.0 h1:5A+zF+XWT8sYYYjlc2/tI1SmiDGzbHLyT9CapVc5dGA= github.com/ecosyste-ms/ecosystems-go v0.4.0/go.mod h1:FVswCrp3DQkur1HjVqfDF/gYrDSEmiFflntcB1G0DbA= -github.com/git-pkgs/archives v0.7.1 h1:xLGYZkezsukkSXwJN1tAC0oxSe3szTw8PPtILDSHmG8= -github.com/git-pkgs/archives v0.7.1/go.mod h1:vnRwCQ4eZ87tFzMiQ3GVIrOW6igJyog+2ad5YYCC3xQ= +github.com/git-pkgs/archives v0.8.1 h1:IcT1bVsAec8SqJ4m9vTnD644KiadQZ4ERrWnm/30t3o= +github.com/git-pkgs/archives v0.8.1/go.mod h1:gIyPXPQr5e+YrMqA5KQ7x6pLrFXHNF1+CjdedNJdGUU= github.com/git-pkgs/citation v0.1.0 h1:0toQBjxVOtaUsxRtcDJL9uZ6SYFb6IgbHgKpTpP0cv0= github.com/git-pkgs/citation v0.1.0/go.mod h1:4vrS78/jjHeusS+eozjP/d3pX2NogEi1R/7gLVqkgqs= -github.com/git-pkgs/clone v0.7.3 h1:QxlcCOAxRjPeLygc+gd74XSAE1BCVG6OQvKDczacwcQ= -github.com/git-pkgs/clone v0.7.3/go.mod h1:AzlK7H7mgTm016cTyePUDCyqLP5KRXqKgOyTsm+KJ3s= +github.com/git-pkgs/clone v0.7.5 h1:4wPOTqdYbCooV4MldaIkQxJIa+Z3rJkVFMXJCWNw19c= +github.com/git-pkgs/clone v0.7.5/go.mod h1:M1WCGotU8+AFYY4xCiF+m6m6VGRQwdSIlMEVeiMnWZE= github.com/git-pkgs/codemeta v0.3.0 h1:zkWndmquCv2tPIHCHb+JXx3eKjmxRoD48f4/3sNAlGw= github.com/git-pkgs/codemeta v0.3.0/go.mod h1:R1vGXVohTa22vVKaV3/8xVs3+tcgvqc4ziaMikdXc/I= github.com/git-pkgs/enrichment v0.7.1 h1:8PRYE7gaB8y4M5wnRw/ymNDk0uOHtbQ8CEE7hF09Bv0= github.com/git-pkgs/enrichment v0.7.1/go.mod h1:QYLG8MtVWPqZojnq7KBKK/lllBWSjLnqvJCWvzGuNwU= -github.com/git-pkgs/forge v0.10.0 h1:ANVH4tErN1Io+Fv3h9vLvjg4Krj00K9ha+RfN53wDr4= -github.com/git-pkgs/forge v0.10.0/go.mod h1:ndzvo2PMGu4t+mRrii1yjHnB8REsTP9rV7bcROge3C4= -github.com/git-pkgs/gitignore v1.2.0 h1:7vdR8/SvF31dvXqIdC1bKgCvyySefXuN8aY3xJLuFaM= -github.com/git-pkgs/gitignore v1.2.0/go.mod h1:Lr0XwhbvP071rZF/zIIhkY1gEhFDoWHH91lngwLpeUg= +github.com/git-pkgs/forge v0.10.1 h1:xuR5U63u7mo3uEDWZwwyr6pXnviejrss3D9He/eGD+M= +github.com/git-pkgs/forge v0.10.1/go.mod h1:bVXtYNMFoXxIuN837/Ru5sJxDU7VlRWkl4X890vQCAU= +github.com/git-pkgs/gitignore v1.3.0 h1:/lcTRp3QYzZDG1CyCLBZO2gxMb6oQWC5EnttSQg4zmU= +github.com/git-pkgs/gitignore v1.3.0/go.mod h1:zleLGZ4PhQrUXrJSsVQWKoeEllEjJH49+DjyKpzIFPM= github.com/git-pkgs/licensecheck v0.4.1 h1:b5ilmpIpgeeewBFjdhJ4W7jvwPIFsYQ7ujZma7sli6k= github.com/git-pkgs/licensecheck v0.4.1/go.mod h1:cfFO7yHHPeuXsoODHBWyevajH2yWcbfkIFELyG3ZpU0= -github.com/git-pkgs/magic v0.4.0 h1:oag0YiKuWOIIKWTKEjS47HYydGawUlfQiU96TwAqFyM= -github.com/git-pkgs/magic v0.4.0/go.mod h1:SXOqcsNmbmpZjJZHEEWnwxprbsFvpwWgTAZrgXp4Jm4= -github.com/git-pkgs/manifests v0.12.2 h1:8/8eyc7Z6xwWC3S/bDKKRAFKE2hLuHAN5Sc1Dt1h+UY= -github.com/git-pkgs/manifests v0.12.2/go.mod h1:fCgHIUuGunqJ4do1I8fOXU2IlXvaVMVkD5Vhv03+CNA= -github.com/git-pkgs/outline v0.2.2 h1:t415r8dgJg6+PedRfeBf1KdaVTpTTJ50XASm7PbEExM= -github.com/git-pkgs/outline v0.2.2/go.mod h1:ys/wKEppQrSP24WvlnSOBA/EkNp3H3c/oL5C6DVQvF4= +github.com/git-pkgs/magic v0.5.0 h1:Pm+4fkHR+K6kg9pwJM4hnwWUuBlkYdLmF1yIAI8lU9Q= +github.com/git-pkgs/magic v0.5.0/go.mod h1:SXOqcsNmbmpZjJZHEEWnwxprbsFvpwWgTAZrgXp4Jm4= +github.com/git-pkgs/manifests v0.12.3 h1:6lhpuQYOT10jDVkD1TdAvIZ9lBIKYWL+7tBLIux8Bp0= +github.com/git-pkgs/manifests v0.12.3/go.mod h1:jz0Vpic/FUdGHB8FZYGgYobjyH0LLpYONt6F0rzfzVU= +github.com/git-pkgs/outline v0.2.3 h1:sTCk4pjEwASQ7wYmqPBQLXMcPxZDEx9/VlmjtcGLd+Q= +github.com/git-pkgs/outline v0.2.3/go.mod h1:lHC7bzvHlXAdsuQZODQ63+wCVkmhk4D7z/1r8YRRuok= github.com/git-pkgs/packageurl-go v0.3.1 h1:WM3RBABQZLaRBxgKyYughc3cVBE8KyQxbSC6Jt5ak7M= github.com/git-pkgs/packageurl-go v0.3.1/go.mod h1:rcIxiG37BlQLB6FZfgdj9Fm7yjhRQd3l+5o7J0QPAk4= -github.com/git-pkgs/pom v0.1.7 h1:4yKdtw6eyShtjul6bcZdyz7yLQ+jdrYeYkKbskDGi4c= -github.com/git-pkgs/pom v0.1.7/go.mod h1:ufdMBe1lKzqOeP9IUb9NPZ458xKV8E8NvuyBMxOfwIk= -github.com/git-pkgs/purl v0.1.20 h1:a4qzvUy5mBZ2GGjOQNW2h/ocFqjTjOiTDMv2ONtivmM= -github.com/git-pkgs/purl v0.1.20/go.mod h1:hthV5mp+Q67HpQ9+LnRLLmsReu5ooyQ5EaJsCGrA8yE= -github.com/git-pkgs/registries v0.9.2 h1:YWn//VGIbwoVYpxNFt1UgS3A6oA0nGiWde23l5R5Z5g= -github.com/git-pkgs/registries v0.9.2/go.mod h1:BpXlfRCfu4S5bTzm7u7igppVu94mXgll/PENe0AjKmI= +github.com/git-pkgs/pom v0.1.8 h1:mXCuWw6XkrKKZb6IurRZyIznYLPhV5AYg5ZO38Uj/l8= +github.com/git-pkgs/pom v0.1.8/go.mod h1:sQBeYRzjCUn77fcABPn6I/a1aBHFxm55jTmkNxYtGtw= +github.com/git-pkgs/purl v0.1.21 h1:PDZUX43lxIiXPn2eHcsNiiiwQo+HajntZ/4TwSvCGlw= +github.com/git-pkgs/purl v0.1.21/go.mod h1:4dOmris48ehjiKmWBqSmMHguUQht48BLeXW+hQUnuj0= +github.com/git-pkgs/registries v0.9.3 h1:nXIP//6kVqLKqYXOWhEMoWUkJPDAZYVLRUYfHz3jM2Y= +github.com/git-pkgs/registries v0.9.3/go.mod h1:BpXlfRCfu4S5bTzm7u7igppVu94mXgll/PENe0AjKmI= github.com/git-pkgs/roles v0.1.3 h1:BkXoBFg0/4szCvBes8mD+UApRe1jITaZ/4bs+XtRxdw= github.com/git-pkgs/roles v0.1.3/go.mod h1:USQTDlh22S7jNyAxU5SwtMfXjbX0lyJpVsGLTccyYis= -github.com/git-pkgs/spdx v0.3.2 h1:PV0w09Bt8rIkAof1+zuo3vxNYKgCoFTxQY9E1Q85PL0= -github.com/git-pkgs/spdx v0.3.2/go.mod h1:n9rAicgw+Wqtfursju6oKaAL6cUCTiIS926mb1KWoKU= -github.com/git-pkgs/vers v0.7.1 h1:23VceCbOjQKib0jhbfNRqL3YqkBPiUwdkQNhJoZgnsU= -github.com/git-pkgs/vers v0.7.1/go.mod h1:ofLiBpPNkQmC0LB1k0zmN1gCv7Hi3MiZx8WtmWZ4A9A= -github.com/git-pkgs/vulns v0.2.3 h1:G8icINpR9WFgtwp+4mSdgO4THStiQvi6QuHl83J7iOs= -github.com/git-pkgs/vulns v0.2.3/go.mod h1:+z7pZMjctLmUxMsq+tZbciD6xAAoejljDosC6n2YXps= +github.com/git-pkgs/spdx v0.3.3 h1:xXlUoZzjDSkwxC6mWHfaW+kc8a0+LH6d+gGHuZWftqI= +github.com/git-pkgs/spdx v0.3.3/go.mod h1:n9rAicgw+Wqtfursju6oKaAL6cUCTiIS926mb1KWoKU= +github.com/git-pkgs/vers v0.7.2 h1:Ctex1O+Ai/FONmyDaw37EolBXg0og6UdxbCjjYbeRHs= +github.com/git-pkgs/vers v0.7.2/go.mod h1:ofLiBpPNkQmC0LB1k0zmN1gCv7Hi3MiZx8WtmWZ4A9A= +github.com/git-pkgs/vulns v0.2.4 h1:QnsQg9sWUfM8ZzA7A/1LSl8DJ/0/6Yrm7vfRwkpyXUY= +github.com/git-pkgs/vulns v0.2.4/go.mod h1:csd+UWvmYWVVAkka7FNbyz840/1R3QXS7LwD2Irsf4Q= github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ= github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -62,8 +62,8 @@ github.com/oapi-codegen/nullable v1.2.0 h1:VflFkDW980KhBPiFF7nWSyjg+r4Obqj8lXipV github.com/oapi-codegen/nullable v1.2.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY= github.com/oapi-codegen/runtime v1.6.0 h1:7Xx+GlueD6nRuyKoCPzL434Jfi3BetbiJOrzCHp/VPU= github.com/oapi-codegen/runtime v1.6.0/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU= -github.com/odvcencio/gotreesitter v0.51.0 h1:tSAcoC1wGyCIOgXF5BgwjiTgA+UW8jW2Lb15wDyXRWk= -github.com/odvcencio/gotreesitter v0.51.0/go.mod h1:hBVkghd0paaYAVwd2087vfwdeU984bQbMo9LvpE0moo= +github.com/odvcencio/gotreesitter v0.53.0 h1:VWoixJYMb01xde2BSXejzMmvLagj8B01sOSqNUUqsfA= +github.com/odvcencio/gotreesitter v0.53.0/go.mod h1:hBVkghd0paaYAVwd2087vfwdeU984bQbMo9LvpE0moo= github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY= github.com/package-url/packageurl-go v0.1.7/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0= github.com/pandatix/go-cvss v0.6.4 h1:9w2RCO/Q4UTiJyEgpCHRiVc6CfrsFEnkoX+OtATqKio=