search

RetireJS / retire.js

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
https://retirejs.github.io/retire.js/
Other
3.66k stars 414 forks source link

Update severities #333

Closed zbone3 closed 3 years ago

zbone3 commented 4 years ago

I updated all of the mismatching severities based on https://nvd.nist.gov/ using their official API as documented here:

https://csrc.nist.gov/CSRC/media/Projects/National-Vulnerability-Database/documents/web%20service%20documentation/Automation%20Support%20for%20CVE%20Retrieval.pdf

I also reformatted the file to be beautified. To see the actual diff you can look at the diff between the first and second commit.

eoftedal commented 4 years ago

Thanks for fixing this! I'd like to include commit ff1ddc5, but the reformatting make some of the single key arrays a bit too bloated for my taste.

chad commented 3 years ago

@eoftedal Are you planning to merge this? It would be nice to get all these severities matched up. Thanks!

eoftedal commented 3 years ago

Yes, I want to merge it, but as mentioned I dont really want the reformatting

hcf0x9d commented 3 years ago

@eoftedal Why don't you just merge ff1ddc5 and leave c3d1d12 out of it if that's the problem?

chad commented 3 years ago

@jfukura i guess the desired changes happened after the reformat, which makes it a mess to apply just the one. @eoftedal do you not use a formatter on this file anyway? Merge and then run the formatter?

eoftedal commented 3 years ago

I have manually fixed it now as there was conflicts as well. I did not want the formatting. No, I do not run a formatter, as formatters tend to make things a lot more verbose.