bumping version

Fix GHSA Filtering

__tests__/filter.test.ts

@@ -19,7 +19,7 @@ const npmChange: Change = {
   vulnerabilities: [
     {
       severity: 'critical',
-      advisory_ghsa_id: 'first-random_string',
+      advisory_ghsa_id: 'vulnerable-ghsa-id',
       advisory_summary: 'very dangerous',
       advisory_url: 'github.com/future-funk'
     }
@@ -39,13 +39,13 @@ const rubyChange: Change = {
   vulnerabilities: [
     {
       severity: 'moderate',
-      advisory_ghsa_id: 'second-random_string',
+      advisory_ghsa_id: 'moderate-ghsa-id',
       advisory_summary: 'not so dangerous',
       advisory_url: 'github.com/future-funk'
     },
     {
       severity: 'low',
-      advisory_ghsa_id: 'third-random_string',
+      advisory_ghsa_id: 'low-ghsa-id',
       advisory_summary: 'dont page me',
       advisory_url: 'github.com/future-funk'
     }
@@ -65,6 +65,64 @@ const noVulnNpmChange: Change = {
   vulnerabilities: []
 }
 
+const lodashChange: Change = {
+  change_type: 'added',
+  manifest: 'package.json',
+  ecosystem: 'npm',
+  name: 'lodash',
+  version: '4.17.0',
+  package_url: 'pkg:npm/lodash@4.17.0',
+  license: 'MIT',
+  source_repository_url: 'https://github.com/lodash/lodash',
+  scope: 'runtime',
+  vulnerabilities: [
+    {
+      severity: 'critical',
+      advisory_ghsa_id: 'GHSA-jf85-cpcp-j695',
+      advisory_summary: 'Prototype Pollution in lodash',
+      advisory_url: 'https://github.com/advisories/GHSA-jf85-cpcp-j695'
+    },
+    {
+      severity: 'high',
+      advisory_ghsa_id: 'GHSA-4xc9-xhrj-v574',
+      advisory_summary: 'Prototype Pollution in lodash',
+      advisory_url: 'https://github.com/advisories/GHSA-4xc9-xhrj-v574'
+    },
+    {
+      severity: 'high',
+      advisory_ghsa_id: 'GHSA-35jh-r3h4-6jhm',
+      advisory_summary: 'Command Injection in lodash',
+      advisory_url: 'https://github.com/advisories/GHSA-35jh-r3h4-6jhm'
+    },
+    {
+      severity: 'high',
+      advisory_ghsa_id: 'GHSA-p6mc-m468-83gw',
+      advisory_summary: 'Prototype Pollution in lodash',
+      advisory_url: 'https://github.com/advisories/GHSA-p6mc-m468-83gw'
+    },
+    {
+      severity: 'moderate',
+      advisory_ghsa_id: 'GHSA-x5rq-j2xg-h7qm',
+      advisory_summary:
+        'Regular Expression Denial of Service (ReDoS) in lodash',
+      advisory_url: 'https://github.com/advisories/GHSA-x5rq-j2xg-h7qm'
+    },
+    {
+      severity: 'moderate',
+      advisory_ghsa_id: 'GHSA-29mw-wpgm-hmr9',
+      advisory_summary:
+        'Regular Expression Denial of Service (ReDoS) in lodash',
+      advisory_url: 'https://github.com/advisories/GHSA-29mw-wpgm-hmr9'
+    },
+    {
+      severity: 'low',
+      advisory_ghsa_id: 'GHSA-fvqr-27wr-82fm',
+      advisory_summary: 'Prototype Pollution in lodash',
+      advisory_url: 'https://github.com/advisories/GHSA-fvqr-27wr-82fm'
+    }
+  ]
+}
+
 test('it properly filters changes by severity', async () => {
   const changes = [npmChange, rubyChange]
   let result = filterChangesBySeverity('high', changes)
@@ -99,25 +157,61 @@ test('it properly handles undefined advisory IDs', async () => {
 test('it properly filters changes with allowed vulnerabilities', async () => {
   const changes = [npmChange, rubyChange, noVulnNpmChange]
 
-  let result = filterAllowedAdvisories(['notrealGHSAID'], changes)
-  expect(result).toEqual([npmChange, rubyChange, noVulnNpmChange])
-
-  result = filterAllowedAdvisories(['first-random_string'], changes)
-  expect(result).toEqual([rubyChange, noVulnNpmChange])
-
-  result = filterAllowedAdvisories(
-    ['second-random_string', 'third-random_string'],
-    changes
-  )
-  expect(result).toEqual([npmChange, noVulnNpmChange])
-
-  result = filterAllowedAdvisories(
-    ['first-random_string', 'second-random_string', 'third-random_string'],
-    changes
-  )
-  expect(result).toEqual([noVulnNpmChange])
-
-  // if we have a change with multiple vulnerabilities but only one is allowed, we still should not filter out that change
-  result = filterAllowedAdvisories(['second-random_string'], changes)
-  expect(result).toEqual([npmChange, rubyChange, noVulnNpmChange])
+  const fakeGHSAChanges = filterAllowedAdvisories(['notrealGHSAID'], changes)
+  expect(fakeGHSAChanges).toEqual([npmChange, rubyChange, noVulnNpmChange])
+})
+
+test('it properly filters only allowed vulnerabilities', async () => {
+  const changes = [npmChange, rubyChange, noVulnNpmChange]
+  const oldVulns = [
+    ...npmChange.vulnerabilities,
+    ...rubyChange.vulnerabilities,
+    ...noVulnNpmChange.vulnerabilities
+  ]
+
+  const vulnerable = filterAllowedAdvisories(['vulnerable-ghsa-id'], changes)
+
+  const newVulns = vulnerable.map(change => change.vulnerabilities).flat()
+
+  expect(newVulns.length).toEqual(oldVulns.length - 1)
+  expect(newVulns).not.toContainEqual(
+    expect.objectContaining({advisory_ghsa_id: 'vulnerable-ghsa-id'})
+  )
+})
+
+test('does not drop dependencies when filtering by GHSA', async () => {
+  const changes = [npmChange, rubyChange, noVulnNpmChange]
+  const result = filterAllowedAdvisories(
+    ['moderate-ghsa-id', 'low-ghsa-id', 'GHSA-jf85-cpcp-j695'],
+    changes
+  )
+
+  expect(result.map(change => change.name)).toEqual(
+    changes.map(change => change.name)
+  )
+})
+
+test('it properly filters multiple GHSAs', async () => {
+  const allowedGHSAs = ['vulnerable-ghsa-id', 'moderate-ghsa-id', 'low-ghsa-id']
+  const changes = [npmChange, rubyChange, noVulnNpmChange]
+  const oldVulns = changes.map(change => change.vulnerabilities).flat()
+
+  const result = filterAllowedAdvisories(allowedGHSAs, changes)
+
+  const newVulns = result.map(change => change.vulnerabilities).flat()
+
+  expect(newVulns.length).toEqual(oldVulns.length - 3)
+})
+
+test('it filters out GHSA dependencies', async () => {
+  const lodash = filterAllowedAdvisories(
+    ['GHSA-jf85-cpcp-j695'],
+    [lodashChange]
+  )[0]
+  // the filter should have removed a single GHSA from the list
+  const expected = lodashChange.vulnerabilities.filter(
+    vuln => vuln.advisory_ghsa_id !== 'GHSA-jf85-cpcp-j695'
+  )
+  expect(expected.length).toEqual(lodashChange.vulnerabilities.length - 1)
+  expect(lodash.vulnerabilities).toEqual(expected)
 })

dist/index.js

@@ -351,7 +351,7 @@ function getInvalidLicenseChanges(changes, licenses) {
     return __awaiter(this, void 0, void 0, function* () {
         const { allow, deny } = licenses;
         const licenseExclusions = (_a = licenses.licenseExclusions) === null || _a === void 0 ? void 0 : _a.map((pkgUrl) => {
-            return packageurl_js_1.PackageURL.fromString(pkgUrl);
+            return packageurl_js_1.PackageURL.fromString(encodeURI(pkgUrl));
         });
         const groupedChanges = yield groupChanges(changes);
         // Takes the changes from the groupedChanges object and filters out the ones that are part of the exclusions list
@@ -360,7 +360,7 @@ function getInvalidLicenseChanges(changes, licenses) {
             if (change.package_url.length === 0) {
                 return true;
             }
-            const changeAsPackageURL = packageurl_js_1.PackageURL.fromString(change.package_url);
+            const changeAsPackageURL = packageurl_js_1.PackageURL.fromString(encodeURI(change.package_url));
             // We want to find if the licenseExclussion list contains the PackageURL of the Change
             // If it does, we want to filter it out and therefore return false
             // If it doesn't, we want to keep it and therefore return true
@@ -606,12 +606,10 @@ function run() {
                 core.info('No Dependency Changes found. Skipping Dependency Review.');
                 return;
             }
-            const minSeverity = config.fail_on_severity;
             const scopedChanges = (0, filter_1.filterChangesByScopes)(config.fail_on_scopes, changes);
             const filteredChanges = (0, filter_1.filterAllowedAdvisories)(config.allow_ghsas, scopedChanges);
-            const vulnerableChanges = (0, filter_1.filterChangesBySeverity)(minSeverity, filteredChanges).filter(change => change.change_type === 'added' &&
-                change.vulnerabilities !== undefined &&
-                change.vulnerabilities.length > 0);
+            const minSeverity = config.fail_on_severity;
+            const vulnerableChanges = (0, filter_1.filterChangesBySeverity)(minSeverity, filteredChanges);
             const invalidLicenseChanges = yield (0, licenses_1.getInvalidLicenseChanges)(filteredChanges, {
                 allow: config.allow_licenses,
                 deny: config.deny_licenses,
@@ -55933,6 +55931,14 @@ function validatePURL(allow_dependencies_licenses) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.filterAllowedAdvisories = exports.filterChangesByScopes = exports.filterChangesBySeverity = void 0;
 const schemas_1 = __nccwpck_require__(1129);
+/**
+ * Filters changes by a severity level. Only vulnerable
+ * dependencies will be returned.
+ *
+ * @param severity - The severity level to filter by.
+ * @param changes - The array of changes to filter.
+ * @returns The filtered array of changes that match the specified severity level and have vulnerabilities.
+ */
 function filterChangesBySeverity(severity, changes) {
     const severityIdx = schemas_1.SEVERITIES.indexOf(severity);
     let filteredChanges = [];
@@ -55952,7 +55958,10 @@ function filterChangesBySeverity(severity, changes) {
     }
     // don't want to deal with changes with no vulnerabilities
     filteredChanges = filteredChanges.filter(change => change.vulnerabilities.length > 0);
-    return filteredChanges;
+    // only report vulnerability additions
+    return filteredChanges.filter(change => change.change_type === 'added' &&
+        change.vulnerabilities !== undefined &&
+        change.vulnerabilities.length > 0);
 }
 exports.filterChangesBySeverity = filterChangesBySeverity;
 function filterChangesByScopes(scopes, changes) {
@@ -55979,22 +55988,15 @@ function filterAllowedAdvisories(ghsas, changes) {
     if (ghsas === undefined) {
         return changes;
     }
-    const filteredChanges = changes.filter(change => {
+    const filteredChanges = changes.map(change => {
         const noAdvisories = change.vulnerabilities === undefined ||
             change.vulnerabilities.length === 0;
         if (noAdvisories) {
-            return true;
-        }
-        let allAllowedAdvisories = true;
-        // if there's at least one advisory that is not allowlisted, we will keep the change
-        for (const vulnerability of change.vulnerabilities) {
-            if (!ghsas.includes(vulnerability.advisory_ghsa_id)) {
-                allAllowedAdvisories = false;
-            }
-            if (!allAllowedAdvisories) {
-                return true;
-            }
+            return change;
         }
+        const newChange = Object.assign({}, change);
+        newChange.vulnerabilities = change.vulnerabilities.filter(vuln => !ghsas.includes(vuln.advisory_ghsa_id));
+        return newChange;
     });
     return filteredChanges;
 }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dependency-review-action",
-  "version": "3.1.2",
+  "version": "3.1.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dependency-review-action",
-      "version": "3.1.2",
+      "version": "3.1.4",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.1",
@@ -26,10 +26,10 @@
         "zod": "^3.22.3"
       },
       "devDependencies": {
-        "@types/node": "^16.18.58",
+        "@types/node": "^16.18.62",
         "@types/spdx-expression-parse": "^3.0.4",
         "@types/spdx-satisfies": "^0.1.1",
-        "@typescript-eslint/eslint-plugin": "^6.9.1",
+        "@typescript-eslint/eslint-plugin": "^6.12.0",
         "@typescript-eslint/parser": "^6.9.1",
         "@vercel/ncc": "^0.38.0",
         "esbuild-register": "^3.5.0",
@@ -40,7 +40,7 @@
         "js-yaml": "^4.1.0",
         "nodemon": "^3.0.1",
         "prettier": "3.0.3",
-        "typescript": "^5.2.2"
+        "typescript": "^5.3.2"
       }
     },
     "node_modules/@aashutoshrathi/word-wrap": {
@@ -2308,9 +2308,9 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "16.18.61",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.61.tgz",
-      "integrity": "sha512-k0N7BqGhJoJzdh6MuQg1V1ragJiXTh8VUBAZTWjJ9cUq23SG0F0xavOwZbhiP4J3y20xd6jxKx+xNUhkMAi76Q=="
+      "version": "16.18.62",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.62.tgz",
+      "integrity": "sha512-/zbPnIBkef8sT+6vw6BxdvU3dCxRI0v6rBu/6IvXnRNtOPILucigqhUBPYxtQ/8JdAna0JLTAcNTCDmQ77QYkQ=="
     },
     "node_modules/@types/semver": {
       "version": "7.5.5",
@@ -2349,16 +2349,16 @@
       "integrity": "sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ=="
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-6.10.0.tgz",
-      "integrity": "sha512-uoLj4g2OTL8rfUQVx2AFO1hp/zja1wABJq77P6IclQs6I/m9GLrm7jCdgzZkvWdDCQf1uEvoa8s8CupsgWQgVg==",
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-6.12.0.tgz",
+      "integrity": "sha512-XOpZ3IyJUIV1b15M7HVOpgQxPPF7lGXgsfcEIu3yDxFPaf/xZKt7s9QO/pbk7vpWQyVulpJbu4E5LwpZiQo4kA==",
       "dev": true,
       "dependencies": {
         "@eslint-community/regexpp": "^4.5.1",
-        "@typescript-eslint/scope-manager": "6.10.0",
-        "@typescript-eslint/type-utils": "6.10.0",
-        "@typescript-eslint/utils": "6.10.0",
-        "@typescript-eslint/visitor-keys": "6.10.0",
+        "@typescript-eslint/scope-manager": "6.12.0",
+        "@typescript-eslint/type-utils": "6.12.0",
+        "@typescript-eslint/utils": "6.12.0",
+        "@typescript-eslint/visitor-keys": "6.12.0",
         "debug": "^4.3.4",
         "graphemer": "^1.4.0",
         "ignore": "^5.2.4",
@@ -2383,6 +2383,53 @@
         }
       }
     },
+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/scope-manager": {
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-6.12.0.tgz",
+      "integrity": "sha512-5gUvjg+XdSj8pcetdL9eXJzQNTl3RD7LgUiYTl8Aabdi8hFkaGSYnaS6BLc0BGNaDH+tVzVwmKtWvu0jLgWVbw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "6.12.0",
+        "@typescript-eslint/visitor-keys": "6.12.0"
+      },
+      "engines": {
+        "node": "^16.0.0 || >=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/types": {
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-6.12.0.tgz",
+      "integrity": "sha512-MA16p/+WxM5JG/F3RTpRIcuOghWO30//VEOvzubM8zuOOBYXsP+IfjoCXXiIfy2Ta8FRh9+IO9QLlaFQUU+10Q==",
+      "dev": true,
+      "engines": {
+        "node": "^16.0.0 || >=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/@typescript-eslint/visitor-keys": {
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-6.12.0.tgz",
+      "integrity": "sha512-rg3BizTZHF1k3ipn8gfrzDXXSFKyOEB5zxYXInQ6z0hUvmQlhaZQzK+YmHmNViMA9HzW5Q9+bPPt90bU6GQwyw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "6.12.0",
+        "eslint-visitor-keys": "^3.4.1"
+      },
+      "engines": {
+        "node": "^16.0.0 || >=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
     "node_modules/@typescript-eslint/parser": {
       "version": "6.10.0",
       "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-6.10.0.tgz",
@@ -2429,13 +2476,13 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-6.10.0.tgz",
-      "integrity": "sha512-wYpPs3hgTFblMYwbYWPT3eZtaDOjbLyIYuqpwuLBBqhLiuvJ+9sEp2gNRJEtR5N/c9G1uTtQQL5AhV0fEPJYcg==",
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-6.12.0.tgz",
+      "integrity": "sha512-WWmRXxhm1X8Wlquj+MhsAG4dU/Blvf1xDgGaYCzfvStP2NwPQh6KBvCDbiOEvaE0filhranjIlK/2fSTVwtBng==",
       "dev": true,
       "dependencies": {
-        "@typescript-eslint/typescript-estree": "6.10.0",
-        "@typescript-eslint/utils": "6.10.0",
+        "@typescript-eslint/typescript-estree": "6.12.0",
+        "@typescript-eslint/utils": "6.12.0",
         "debug": "^4.3.4",
         "ts-api-utils": "^1.0.1"
       },
@@ -2455,6 +2502,63 @@
         }
       }
     },
+    "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/types": {
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-6.12.0.tgz",
+      "integrity": "sha512-MA16p/+WxM5JG/F3RTpRIcuOghWO30//VEOvzubM8zuOOBYXsP+IfjoCXXiIfy2Ta8FRh9+IO9QLlaFQUU+10Q==",
+      "dev": true,
+      "engines": {
+        "node": "^16.0.0 || >=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/typescript-estree": {
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-6.12.0.tgz",
+      "integrity": "sha512-vw9E2P9+3UUWzhgjyyVczLWxZ3GuQNT7QpnIY3o5OMeLO/c8oHljGc8ZpryBMIyympiAAaKgw9e5Hl9dCWFOYw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "6.12.0",
+        "@typescript-eslint/visitor-keys": "6.12.0",
+        "debug": "^4.3.4",
+        "globby": "^11.1.0",
+        "is-glob": "^4.0.3",
+        "semver": "^7.5.4",
+        "ts-api-utils": "^1.0.1"
+      },
+      "engines": {
+        "node": "^16.0.0 || >=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/type-utils/node_modules/@typescript-eslint/visitor-keys": {
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-6.12.0.tgz",
+      "integrity": "sha512-rg3BizTZHF1k3ipn8gfrzDXXSFKyOEB5zxYXInQ6z0hUvmQlhaZQzK+YmHmNViMA9HzW5Q9+bPPt90bU6GQwyw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "6.12.0",
+        "eslint-visitor-keys": "^3.4.1"
+      },
+      "engines": {
+        "node": "^16.0.0 || >=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
     "node_modules/@typescript-eslint/types": {
       "version": "6.10.0",
       "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-6.10.0.tgz",
@@ -2496,17 +2600,17 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "6.10.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-6.10.0.tgz",
-      "integrity": "sha512-v+pJ1/RcVyRc0o4wAGux9x42RHmAjIGzPRo538Z8M1tVx6HOnoQBCX/NoadHQlZeC+QO2yr4nNSFWOoraZCAyg==",
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-6.12.0.tgz",
+      "integrity": "sha512-LywPm8h3tGEbgfyjYnu3dauZ0U7R60m+miXgKcZS8c7QALO9uWJdvNoP+duKTk2XMWc7/Q3d/QiCuLN9X6SWyQ==",
       "dev": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.4.0",
         "@types/json-schema": "^7.0.12",
         "@types/semver": "^7.5.0",
-        "@typescript-eslint/scope-manager": "6.10.0",
-        "@typescript-eslint/types": "6.10.0",
-        "@typescript-eslint/typescript-estree": "6.10.0",
+        "@typescript-eslint/scope-manager": "6.12.0",
+        "@typescript-eslint/types": "6.12.0",
+        "@typescript-eslint/typescript-estree": "6.12.0",
         "semver": "^7.5.4"
       },
       "engines": {
@@ -2520,6 +2624,80 @@
         "eslint": "^7.0.0 || ^8.0.0"
       }
     },
+    "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/scope-manager": {
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-6.12.0.tgz",
+      "integrity": "sha512-5gUvjg+XdSj8pcetdL9eXJzQNTl3RD7LgUiYTl8Aabdi8hFkaGSYnaS6BLc0BGNaDH+tVzVwmKtWvu0jLgWVbw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "6.12.0",
+        "@typescript-eslint/visitor-keys": "6.12.0"
+      },
+      "engines": {
+        "node": "^16.0.0 || >=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/types": {
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-6.12.0.tgz",
+      "integrity": "sha512-MA16p/+WxM5JG/F3RTpRIcuOghWO30//VEOvzubM8zuOOBYXsP+IfjoCXXiIfy2Ta8FRh9+IO9QLlaFQUU+10Q==",
+      "dev": true,
+      "engines": {
+        "node": "^16.0.0 || >=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/typescript-estree": {
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-6.12.0.tgz",
+      "integrity": "sha512-vw9E2P9+3UUWzhgjyyVczLWxZ3GuQNT7QpnIY3o5OMeLO/c8oHljGc8ZpryBMIyympiAAaKgw9e5Hl9dCWFOYw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "6.12.0",
+        "@typescript-eslint/visitor-keys": "6.12.0",
+        "debug": "^4.3.4",
+        "globby": "^11.1.0",
+        "is-glob": "^4.0.3",
+        "semver": "^7.5.4",
+        "ts-api-utils": "^1.0.1"
+      },
+      "engines": {
+        "node": "^16.0.0 || >=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/utils/node_modules/@typescript-eslint/visitor-keys": {
+      "version": "6.12.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-6.12.0.tgz",
+      "integrity": "sha512-rg3BizTZHF1k3ipn8gfrzDXXSFKyOEB5zxYXInQ6z0hUvmQlhaZQzK+YmHmNViMA9HzW5Q9+bPPt90bU6GQwyw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "6.12.0",
+        "eslint-visitor-keys": "^3.4.1"
+      },
+      "engines": {
+        "node": "^16.0.0 || >=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
     "node_modules/@typescript-eslint/visitor-keys": {
       "version": "6.10.0",
       "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-6.10.0.tgz",
@@ -8206,9 +8384,9 @@
       }
     },
     "node_modules/typescript": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.2.2.tgz",
-      "integrity": "sha512-mI4WrpHsbCIcwT9cF4FZvr80QUeKvsUsUvKDoR+X/7XHQH98xYD8YHZg7ANtz2GtZt/CBq2QJ0thkGJMHfqc1w==",
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.3.2.tgz",
+      "integrity": "sha512-6l+RyNy7oAHDfxC4FzSJcz9vnjTKxrLpDG5M2Vu4SHRVNg6xzqZp6LYSR9zjqQTu8DU/f5xwxUdADOkbrIX2gQ==",
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "3.1.2",
+  "version": "3.1.4",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",
@@ -42,10 +42,10 @@
     "zod": "^3.22.3"
   },
   "devDependencies": {
-    "@types/node": "^16.18.58",
+    "@types/node": "^16.18.62",
     "@types/spdx-expression-parse": "^3.0.4",
     "@types/spdx-satisfies": "^0.1.1",
-    "@typescript-eslint/eslint-plugin": "^6.9.1",
+    "@typescript-eslint/eslint-plugin": "^6.12.0",
     "@typescript-eslint/parser": "^6.9.1",
     "@vercel/ncc": "^0.38.0",
     "esbuild-register": "^3.5.0",
@@ -56,6 +56,6 @@
     "js-yaml": "^4.1.0",
     "nodemon": "^3.0.1",
     "prettier": "3.0.3",
-    "typescript": "^5.2.2"
+    "typescript": "^5.3.2"
   }
 }

src/filter.ts

@@ -1,5 +1,13 @@
 import {Changes, Severity, SEVERITIES, Scope} from './schemas'
 
+/**
+ * Filters changes by a severity level. Only vulnerable
+ * dependencies will be returned.
+ *
+ * @param severity - The severity level to filter by.
+ * @param changes - The array of changes to filter.
+ * @returns The filtered array of changes that match the specified severity level and have vulnerabilities.
+ */
 export function filterChangesBySeverity(
   severity: Severity,
   changes: Changes
@@ -31,7 +39,14 @@ export function filterChangesBySeverity(
   filteredChanges = filteredChanges.filter(
     change => change.vulnerabilities.length > 0
   )
-  return filteredChanges
+
+  // only report vulnerability additions
+  return filteredChanges.filter(
+    change =>
+      change.change_type === 'added' &&
+      change.vulnerabilities !== undefined &&
+      change.vulnerabilities.length > 0
+  )
 }
 
 export function filterChangesByScopes(
@@ -67,25 +82,20 @@ export function filterAllowedAdvisories(
     return changes
   }
 
-  const filteredChanges = changes.filter(change => {
+  const filteredChanges = changes.map(change => {
     const noAdvisories =
       change.vulnerabilities === undefined ||
       change.vulnerabilities.length === 0
 
     if (noAdvisories) {
-      return true
+      return change
     }
+    const newChange = {...change}
+    newChange.vulnerabilities = change.vulnerabilities.filter(
+      vuln => !ghsas.includes(vuln.advisory_ghsa_id)
+    )
 
-    let allAllowedAdvisories = true
-    // if there's at least one advisory that is not allowlisted, we will keep the change
-    for (const vulnerability of change.vulnerabilities) {
-      if (!ghsas.includes(vulnerability.advisory_ghsa_id)) {
-        allAllowedAdvisories = false
-      }
-      if (!allAllowedAdvisories) {
-        return true
-      }
-    }
+    return newChange
   })
 
   return filteredChanges

src/licenses.ts

@@ -32,7 +32,7 @@ export async function getInvalidLicenseChanges(
   const {allow, deny} = licenses
   const licenseExclusions = licenses.licenseExclusions?.map(
     (pkgUrl: string) => {
-      return PackageURL.fromString(pkgUrl)
+      return PackageURL.fromString(encodeURI(pkgUrl))
     }
   )
 
@@ -45,7 +45,9 @@ export async function getInvalidLicenseChanges(
       return true
     }
 
-    const changeAsPackageURL = PackageURL.fromString(change.package_url)
+    const changeAsPackageURL = PackageURL.fromString(
+      encodeURI(change.package_url)
+    )
 
     // We want to find if the licenseExclussion list contains the PackageURL of the Change
     // If it does, we want to filter it out and therefore return false

src/main.ts

@@ -80,21 +80,17 @@ async function run(): Promise<void> {
       return
     }
 
-    const minSeverity = config.fail_on_severity
     const scopedChanges = filterChangesByScopes(config.fail_on_scopes, changes)
+
     const filteredChanges = filterAllowedAdvisories(
       config.allow_ghsas,
       scopedChanges
     )
 
+    const minSeverity = config.fail_on_severity
     const vulnerableChanges = filterChangesBySeverity(
       minSeverity,
       filteredChanges
-    ).filter(
-      change =>
-        change.change_type === 'added' &&
-        change.vulnerabilities !== undefined &&
-        change.vulnerabilities.length > 0
     )
 
     const invalidLicenseChanges = await getInvalidLicenseChanges(