Skip to content

Commit c4fc615

Browse files
kleyowkleyow
committed
chore: dep update
1 parent a472c60 commit c4fc615

File tree

4 files changed

+258
-9
lines changed

4 files changed

+258
-9
lines changed

‎audit-ci.jsonc‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,7 @@
33
// audit-ci supports reading JSON, JSONC, and JSON5 config files.
44
// Only use one of ["low": true, "moderate": true, "high": true, "critical": true]
55
"moderate": true,
6-
"allowlist": [ // NOTE: Please add as much information as possible to any items added to the allowList
7-
// Currently no fixes available for the following
8-
"GHSA-xxjr-mmjv-4gpg",
6+
"allowlist": [
97
"GHSA-37qj-frw5-hhjh"
108
]
119
}

‎package-lock.json‎

Lines changed: 53 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@
6262
"license:check": "npm run license:list -- --failOn `cat .licensebanned | grep '^[^#;]' | awk 'BEGIN { ORS=\"\" } { print p$0\";\"; } END { print \n }'`",
6363
"dep:check": "npx ncu -e 2",
6464
"dep:update": "npx ncu -u",
65+
"dep:automate": "sh ./updateDepAndAudit.sh",
6566
"release": "npx standard-version --no-verify --releaseCommitMessageFormat 'chore(release): {{currentTag}} [skip ci]'",
6667
"snapshot": "npx standard-version --no-verify --skip.changelog --prerelease snapshot --releaseCommitMessageFormat 'chore(snapshot): {{currentTag}}'",
6768
"wait-4-docker": "node ./scripts/_wait4_all.js"
@@ -80,7 +81,7 @@
8081
"@mojaloop/central-services-shared": "18.35.2",
8182
"@mojaloop/central-services-stream": "11.9.0",
8283
"@mojaloop/event-sdk": "14.8.2",
83-
"@mojaloop/ml-schema-transformer-lib": "2.8.1",
84+
"@mojaloop/ml-schema-transformer-lib": "2.9.0",
8485
"@mojaloop/sdk-standard-components": "19.18.6",
8586
"@now-ims/hapi-now-auth": "2.1.0",
8687
"axios": "1.13.4",

‎updateDepAndAudit.sh‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
#!/bin/sh
2+
set -e
3+
4+
# Check for required dependencies
5+
echo "Checking for required dependencies..."
6+
MISSING_DEPS=""
7+
8+
# Check for jq
9+
if ! command -v jq > /dev/null 2>&1; then
10+
MISSING_DEPS="$MISSING_DEPS jq"
11+
fi
12+
13+
# Check for awk (should be present on most systems, but verify)
14+
if ! command -v awk > /dev/null 2>&1; then
15+
MISSING_DEPS="$MISSING_DEPS awk"
16+
fi
17+
18+
# Check for npm
19+
if ! command -v npm > /dev/null 2>&1; then
20+
MISSING_DEPS="$MISSING_DEPS npm"
21+
fi
22+
23+
# Check for curl (needed for grype installation)
24+
if ! command -v curl > /dev/null 2>&1; then
25+
MISSING_DEPS="$MISSING_DEPS curl"
26+
fi
27+
28+
# If any dependencies are missing, report and exit
29+
if [ -n "$MISSING_DEPS" ]; then
30+
echo "Error: The following required tools are not installed:"
31+
for dep in $MISSING_DEPS; do
32+
echo " - $dep"
33+
done
34+
echo ""
35+
echo "Please install the missing dependencies before running this script."
36+
echo "Installation suggestions:"
37+
echo " - jq: https://stedolan.github.io/jq/download/"
38+
echo " - yq: https://github.com/mikefarah/yq#install"
39+
echo " - curl: Usually available via package manager (apt, yum, brew, etc.)"
40+
exit 1
41+
fi
42+
43+
echo "All required dependencies are available."
44+
echo ""
45+
46+
echo "Starting dependency update and audit process..."
47+
48+
# Step 1: Update dependencies
49+
echo "Step 1: Updating dependencies..."
50+
npm run dep:update
51+
npm install
52+
53+
# Step 2: Run npm audit fix
54+
echo "Step 2: Running npm audit fix..."
55+
npm run audit:fix || true
56+
57+
# Step 3: Get unfixed vulnerabilities
58+
echo "Step 3: Checking for unfixed vulnerabilities..."
59+
# Get advisory IDs (GHSA-* format) only from vulnerabilities with no fix available and that have a GitHub advisory URL
60+
UNFIXED_GHSA=$(npm audit --json 2>/dev/null | jq -r '.vulnerabilities | to_entries[] | .value.via[] | select(type == "object" and .url != null and (.url | contains("github.com/advisories/GHSA-"))) | .url' | grep -oE 'GHSA-[a-z0-9-]+' | sort -u)
61+
62+
if [ -z "$UNFIXED" ] && [ -z "$UNFIXED_GHSA" ]; then
63+
echo "No unfixed vulnerabilities found."
64+
UNFIXED_GHSA=""
65+
else
66+
echo "Unfixed vulnerabilities found:"
67+
echo "Advisory IDs: $UNFIXED_GHSA"
68+
fi
69+
70+
# Step 4: Update audit-ci.jsonc with unfixed vulnerabilities
71+
echo "Step 4: Updating audit-ci.jsonc..."
72+
TEMP_FILE=$(mktemp)
73+
74+
# Read current allowlist from audit-ci.jsonc
75+
CURRENT_ALLOWLIST=$(grep -v '^[[:space:]]*//' audit-ci.jsonc | jq -r '.allowlist[]' 2>/dev/null | grep '^GHSA-' || true)
76+
77+
# Combine current allowlist with both package names and GHSA IDs, remove duplicates
78+
COMBINED=$(printf "%s\n%s\n" "$CURRENT_ALLOWLIST" "$UNFIXED_GHSA" | grep -v '^$' | sort -u)
79+
80+
# Build new allowlist array
81+
if [ -n "$COMBINED" ]; then
82+
ALLOWLIST_JSON=$(echo "$COMBINED" | jq -R . | jq -s .)
83+
else
84+
ALLOWLIST_JSON='[]'
85+
fi
86+
87+
# Update the allowlist in audit-ci.jsonc while preserving comments
88+
awk -v allowlist="$ALLOWLIST_JSON" '
89+
# Detect the allowlist property line
90+
/^[[:space:]]*"allowlist"[[:space:]]*:/ {
91+
# Capture indentation before the opening quote of "allowlist"
92+
allowlist_indent = substr($0, 1, match($0, /"/) - 1)
93+
94+
# Handle case where the entire array is on a single line
95+
if ($0 ~ /\[/ && $0 ~ /\]/) {
96+
has_comma = ($0 ~ /\],/)
97+
print allowlist_indent "\"allowlist\": " allowlist (has_comma ? "," : "")
98+
in_allowlist = 0
99+
} else {
100+
# Multi-line array: skip lines until closing bracket is found
101+
in_allowlist = 1
102+
}
103+
next
104+
}
105+
106+
# While inside the original allowlist array, look for the closing bracket line
107+
in_allowlist && $0 ~ /^[[:space:]]*\][[:space:]]*,?[[:space:]]*(\/\/.*)?$/ {
108+
has_comma = ($0 ~ /\],/)
109+
# Format allowlist with proper indentation for array items
110+
formatted_allowlist = ""
111+
n = split(allowlist, items, /[,\[\]]/)
112+
# First pass: collect non-empty items
113+
item_count = 0
114+
for (i = 1; i <= n; i++) {
115+
item = items[i]
116+
sub(/^[[:space:]"]+/, "", item)
117+
sub(/[[:space:]"]+$/, "", item)
118+
if (item != "") {
119+
item_count++
120+
clean_items[item_count] = item
121+
}
122+
}
123+
# Second pass: format with correct comma placement
124+
for (i = 1; i <= item_count; i++) {
125+
formatted_allowlist = formatted_allowlist allowlist_indent " \"" clean_items[i] "\""
126+
if (i < item_count) {
127+
formatted_allowlist = formatted_allowlist ","
128+
}
129+
formatted_allowlist = formatted_allowlist "\n"
130+
}
131+
print allowlist_indent "\"allowlist\": ["
132+
printf "%s", formatted_allowlist
133+
print allowlist_indent "]" (has_comma ? "," : "")
134+
in_allowlist = 0
135+
next
136+
}
137+
138+
# Skip all other lines that are part of the original allowlist array
139+
in_allowlist {
140+
next
141+
}
142+
143+
# Print all other lines unchanged
144+
{
145+
print
146+
}
147+
' audit-ci.jsonc > "$TEMP_FILE"
148+
mv "$TEMP_FILE" audit-ci.jsonc
149+
150+
echo "audit-ci.jsonc updated successfully."
151+
152+
# Step 5: Run audit check
153+
echo "Step 5: Running audit check..."
154+
npm run audit:check || true
155+
156+
# Step 6: Install grype if not present
157+
echo "Step 6: Verifying grype installation..."
158+
if ! command -v grype > /dev/null 2>&1; then
159+
echo "Error: grype is not installed or not in PATH"
160+
echo "Please install grype from: https://github.com/anchore/grype"
161+
exit 1
162+
fi
163+
echo "grype is available at $(which grype)"
164+
165+
# Step 7: Run grype scan
166+
echo "Step 7: Running grype scan..."
167+
grype dir:. --config .grype.yaml --only-fixed --fail-on critical || true
168+
169+
# Step 8: Update .grype.yaml with unfixed vulnerabilities
170+
echo "Step 8: Updating .grype.yaml with unfixed vulnerabilities..."
171+
GRYPE_VULNS=$(grype dir:. --config .grype.yaml -o json | jq -r '.matches[]? | select(.vulnerability.fix.state == "not-fixed" or .vulnerability.fix.state == "unknown") | .vulnerability.id' | sort -u)
172+
173+
if [ -n "$GRYPE_VULNS" ]; then
174+
echo "Adding unfixed vulnerabilities to .grype.yaml ignore list:"
175+
echo "$GRYPE_VULNS"
176+
177+
GRYPE_TEMP=$(mktemp)
178+
179+
# Read current ignore list
180+
CURRENT_IGNORE=$(yq e '.ignore[]?.vulnerability' .grype.yaml 2>/dev/null || echo "")
181+
182+
# Combine and deduplicate
183+
COMBINED_IGNORE=$(echo -e "$CURRENT_IGNORE\n$GRYPE_VULNS" | grep -v '^$' | sort -u)
184+
185+
# Build yq expression to reset and populate ignore list in one pass
186+
GRYPE_EXPR='.ignore = []'
187+
echo "$COMBINED_IGNORE" | while IFS= read -r vuln; do
188+
[ -n "$vuln" ] || continue
189+
GRYPE_EXPR="$GRYPE_EXPR | .ignore += [{\"vulnerability\": \"$vuln\"}]"
190+
done
191+
192+
# Update .grype.yaml using the constructed expression
193+
yq e "$GRYPE_EXPR" .grype.yaml > "$GRYPE_TEMP"
194+
mv "$GRYPE_TEMP" .grype.yaml
195+
echo ".grype.yaml updated successfully."
196+
else
197+
echo "No unfixed vulnerabilities found in grype scan."
198+
fi
199+
200+
echo "Process completed successfully!"
201+
202+
exit 0

0 commit comments

Comments
 (0)