[5.7.0]

Improvements

• Added CycloneDX 1.7 output: --outputformat cyclonedxJSON1_7 and cyclonedxJSON1_7_VEX.
• CycloneDX 1.7 reports every resolved license, each as its own SPDX expression. Earlier spec versions only allow a single expression per component, so 1.4/1.6 output still reports the first license only.
• The CycloneDX 1.6 and 1.7 reports now include:
  • $schema, pointing at the schema for the emitted spec version.
  • metadata.tools in the object form introduced in 1.5, replacing the deprecated legacy array.
  • metadata.component, describing the scanned path as the subject of the BOM.
  • dependencies, linking the scan target to every detected component.
  • evidence.identity, reporting how the version was detected (filecontent, filename, hash, ast, ...) as a CycloneDX identity technique and confidence.
  • vulnerabilities[].detail, when the repository supplies details (VEX variants only).

Bugfixes

• CycloneDX 1.6 output threw when a vulnerability in a custom --jsrepo had no cwe, and could throw on a vulnerability with no identifiers.

[5.6.0]

Improvements

• Report when repository certificate errors are ignored (--insecure): as ignoreRepositoryCertificateErrors in the JSON report, and as a retirejs:ignore-repository-certificate-errors entry under metadata.properties in all CycloneDX reports. The entry is only present when the option is set.

[5.5.0]

Improvements

• Include the vulnerability repositories used for the scan in the output: as vulnerabilityRepositories in the JSON report, and as retirejs:vulnerability-repository entries under metadata.properties in all CycloneDX reports.
• CycloneDX 1.6 VEX output now identifies Retire.js as the source of each vulnerability and rating, including the repository URL when a single repository is used.

Bugfixes

• CycloneDX 1.6 VEX output was not schema valid: ratings[].source was a string rather than an object, and version ranges were reported as affects[].range rather than nested under affects[].versions[].

[5.4.3]

• Remove dependencies that are not needed anymore

Fixes build scripts

• Upgrade dependencies

Improvements

• Add possibility to exclude specific versions for a vulnerability (example: jquery-1.12.4-aem which has some extra patches).

[5.3.0]

Improvement

• Add cyclonedxJSON1_6_VEX as output format for CycloneDX 1.6 with vulnerability information

Bugfix

• ignorefile cli argument was not working

Performance fix

• Upgrade to ASTronomical 2.0.0 to reduce memory usage