vulnera

vulnera copied to clipboard

This PR was automatically created by Snyk using the credentials of a real user.Snyk has created this PR to upgrade semver from 7.3.7 to 7.3.8. :information_source: Keep your dependencies up-to-date....

fraxken

Currently, the `npm` strategy only works for `package-lock.json` and `npm-shrinkwrap.json` lock files. We could actually extend that to `pnpm-lock.yaml` using the `npm` strategy using programmatically the [library provided by the...

antoine-coulon

Make the API work for a given manifest path (or payload).

4

Vuln is originally designed to work with NodeSecure/scanner. However i would like to expand the API to allow any third-party codes to use this package. The hydratePayloadDependencies method is very...

fraxken

For now, the strategy around Sonatype is not taking into account rate and payload limits imposed by the API. - ### Payload limit When requesting multiple `components`, there is a...

antoine-coulon

The main idea of **@nodesecure/vuln** is to expose a set of strategies to detect vulnerabilities within a given project. In my opinion, it would be great to process some benchmarks...

antoine-coulon

Merging multiple strategies in one ?

2

Hello 👋, One of the thing to explore is to merge multiple strategies in one to maybe get a better end results ? Any ideas are welcome.

fraxken

Bumps the github-actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action). Updates `github/codeql-action` from 3.24.8 to 3.24.9 Changelog Sourced from github/codeql-action's changelog. CodeQL Action Changelog See the releases page for the relevant changes...

dependabot[bot]

feat: start implementing useFormat including OSV

1

fraxken

Implement OSV in the classical Scanner workflow

1

Add a new strategy / set of API to support the new OpenSSF project OSV: https://osv.dev/ Also see the official GitHub repository: https://github.com/ossf/malicious-packages

fraxken

Support National Vulnerability Database (NVD)

4

Add a new strategy to support NVD: https://nvd.nist.gov/ The API has a ratelimit but an API key can be requested [here](https://nvd.nist.gov/developers/request-an-api-key) Maybe we need to somehow thinks how to design...

fraxken