Merge pull request #163 from actions/dependabot/npm_and_yarn/zod-3.17.9

Bump zod from 3.17.4 to 3.17.9

.github/dependabot.yml

@@ -9,3 +9,6 @@ updates:
     directory: /
     schedule:
       interval: daily
+    ignore:
+      - dependency-name: '@types/node'
+        update-types: ['version-update:semver-major']

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16
+          cache: npm
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+      - name: Test
+        run: |
+          npm test
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16
+          cache: npm
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+      - name: Check format
+        run: |
+          npm run format-check
+      - name: Lint
+        run: |
+          npm run lint

.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+  "recommendations": ["dbaeumer.vscode-eslint", "esbenp.prettier-vscode"]
+}

.vscode/settings.json

@@ -0,0 +1,4 @@
+{
+  "editor.formatOnSave": true,
+  "editor.defaultFormatter": "esbenp.prettier-vscode"
+}

CONTRIBUTING.md

@@ -102,8 +102,8 @@ minor/patch updates.
 
 To do this just force-create a new annotated tag and push it:
 ```
-git tag -fa v1 -m "Updating v1 tag"
+git tag -fa v2 -m "Updating v2 to 2.3.4"
-git push origin v1 --force
+git push origin v2 --force
 ```
 
 ## Resources

README.md

@@ -2,7 +2,7 @@
 
 This action scans your pull requests for dependency changes and will raise an error if any new dependencies have existing vulnerabilities. The action is supported by an [API endpoint](https://docs.github.com/en/rest/reference/dependency-graph#dependency-review) that diffs the dependencies between any two revisions.
 
-The action is available for all public repositories, as well as private repositories that have Github Advanced Security licensed.
+The action is available for all public repositories, as well as private repositories that have GitHub Advanced Security licensed.
 
 <img width="854" alt="Screen Shot 2022-03-31 at 1 10 51 PM" src="https://user-images.githubusercontent.com/2161/161042286-b22d7dd3-13cb-458d-8744-ce70ed9bf562.png">
 
@@ -52,7 +52,7 @@ jobs:
           # Possible values: "critical", "high", "moderate", "low"
           # fail-on-severity: critical
           #
-          # You can only can only include one of these two options: `allow-licenses` and `deny-licences`
+          # You can only include one of these two options: `allow-licenses` and `deny-licenses`
           #
           # Possible values: Any `spdx_id` value(s) from https://docs.github.com/en/rest/licenses
           # allow-licenses: GPL-3.0, BSD-3-Clause, MIT

__tests__/filter.test.ts

@@ -15,7 +15,7 @@ let npmChange: Change = {
     {
       severity: 'critical',
       advisory_ghsa_id: 'first-random_string',
-      advisory_summary: 'very dangerouns',
+      advisory_summary: 'very dangerous',
       advisory_url: 'github.com/future-funk'
     }
   ]
@@ -34,7 +34,7 @@ let rubyChange: Change = {
     {
       severity: 'moderate',
       advisory_ghsa_id: 'second-random_string',
-      advisory_summary: 'not so dangerouns',
+      advisory_summary: 'not so dangerous',
       advisory_url: 'github.com/future-funk'
     },
     {

__tests__/licenses.test.ts

@@ -15,7 +15,7 @@ let npmChange: Change = {
     {
       severity: 'critical',
       advisory_ghsa_id: 'first-random_string',
-      advisory_summary: 'very dangerouns',
+      advisory_summary: 'very dangerous',
       advisory_url: 'github.com/future-funk'
     }
   ]
@@ -34,7 +34,7 @@ let rubyChange: Change = {
     {
       severity: 'moderate',
       advisory_ghsa_id: 'second-random_string',
-      advisory_summary: 'not so dangerouns',
+      advisory_summary: 'not so dangerous',
       advisory_url: 'github.com/future-funk'
     },
     {
@@ -68,3 +68,31 @@ test('it fails all license checks when allow is provided an empty array', async
   })
   expect(invalidChanges.length).toBe(2)
 })
+
+test('it does not fail if a license outside the allow list is found in removed changes', async () => {
+  const changes: Changes = [
+    {...npmChange, change_type: 'removed'},
+    {...rubyChange, change_type: 'removed'}
+  ]
+  const [invalidChanges, _] = getDeniedLicenseChanges(changes, {allow: ['BSD']})
+  expect(invalidChanges).toStrictEqual([])
+})
+
+test('it does not fail if a license inside the deny list is found in removed changes', async () => {
+  const changes: Changes = [
+    {...npmChange, change_type: 'removed'},
+    {...rubyChange, change_type: 'removed'}
+  ]
+  const [invalidChanges, _] = getDeniedLicenseChanges(changes, {deny: ['BSD']})
+  expect(invalidChanges).toStrictEqual([])
+})
+
+test('it fails if a license outside the allow list is found in both of added and removed changes', async () => {
+  const changes: Changes = [
+    {...npmChange, change_type: 'removed'},
+    npmChange,
+    {...rubyChange, change_type: 'removed'}
+  ]
+  const [invalidChanges, _] = getDeniedLicenseChanges(changes, {allow: ['BSD']})
+  expect(invalidChanges).toStrictEqual([npmChange])
+})

dist/index.js

@@ -81,11 +81,14 @@ exports.getDeniedLicenseChanges = void 0;
  * @returns {[Array<Change>, Array<Change]} A tuple where the first element is the list of denied changes and the second one is the list of changes with unknown licenses
  */
 function getDeniedLicenseChanges(changes, licenses) {
-    let { allow, deny } = licenses;
+    const { allow, deny } = licenses;
-    let disallowed = [];
+    const disallowed = [];
-    let unknown = [];
+    const unknown = [];
     for (const change of changes) {
-        let license = change.license;
+        if (change.change_type === 'removed') {
+            continue;
+        }
+        const license = change.license;
         if (license === null) {
             unknown.push(change);
             continue;
@@ -171,14 +174,14 @@ function run() {
                 baseRef: pull_request.base.sha,
                 headRef: pull_request.head.sha
             });
-            let config = (0, config_1.readConfig)();
+            const config = (0, config_1.readConfig)();
-            let minSeverity = config.fail_on_severity;
+            const minSeverity = config.fail_on_severity;
             let failed = false;
-            let licenses = {
+            const licenses = {
                 allow: config.allow_licenses,
                 deny: config.deny_licenses
             };
-            let filteredChanges = (0, filter_1.filterChangesBySeverity)(minSeverity, changes);
+            const filteredChanges = (0, filter_1.filterChangesBySeverity)(minSeverity, changes);
             for (const change of filteredChanges) {
                 if (change.change_type === 'added' &&
                     change.vulnerabilities !== undefined &&
@@ -187,9 +190,9 @@ function run() {
                     failed = true;
                 }
             }
-            let [licenseErrors, unknownLicenses] = (0, licenses_1.getDeniedLicenseChanges)(changes, licenses);
+            const [licenseErrors, unknownLicenses] = (0, licenses_1.getDeniedLicenseChanges)(changes, licenses);
             if (licenseErrors.length > 0) {
-                printLicensesError(licenseErrors, licenses);
+                printLicensesError(licenseErrors);
                 core.setFailed('Dependency review detected incompatible licenses.');
             }
             printNullLicenses(unknownLicenses);
@@ -233,17 +236,19 @@ function renderSeverity(severity) {
     }[severity];
     return `${ansi_styles_1.default.color[color].open}(${severity} severity)${ansi_styles_1.default.color[color].close}`;
 }
-function printLicensesError(changes, licenses) {
+function printLicensesError(changes) {
-    if (changes.length == 0) {
+    if (changes.length === 0) {
         return;
     }
-    let { allow = [], deny = [] } = licenses;
     core.info('\nThe following dependencies have incompatible licenses:\n');
     for (const change of changes) {
         core.info(`${ansi_styles_1.default.bold.open}${change.manifest} » ${change.name}@${change.version}${ansi_styles_1.default.bold.close} – License: ${ansi_styles_1.default.color.red.open}${change.license}${ansi_styles_1.default.color.red.close}`);
     }
 }
 function printNullLicenses(changes) {
+    if (changes.length === 0) {
+        return;
+    }
     core.info('\nWe could not detect a license for the following dependencies:\n');
     for (const change of changes) {
         core.info(`${ansi_styles_1.default.bold.open}${change.manifest} » ${change.name}@${change.version}${ansi_styles_1.default.bold.close}`);
@@ -317,7 +322,7 @@ exports.ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).default([])
 })
     .partial()
-    .refine(obj => !(obj.allow_licenses && obj.deny_licenses), "Your workflow file has both an allow_licenses list and deny_licenses list, but you can only set one or the other.");
+    .refine(obj => !(obj.allow_licenses && obj.deny_licenses), 'Your workflow file has both an allow_licenses list and deny_licenses list, but you can only set one or the other.');
 exports.ChangesSchema = z.array(exports.ChangeSchema);
 
 
@@ -747,6 +752,13 @@ Object.defineProperty(exports, "summary", ({ enumerable: true, get: function ()
  */
 var summary_2 = __nccwpck_require__(1327);
 Object.defineProperty(exports, "markdownSummary", ({ enumerable: true, get: function () { return summary_2.markdownSummary; } }));
+/**
+ * Path exports
+ */
+var path_utils_1 = __nccwpck_require__(2981);
+Object.defineProperty(exports, "toPosixPath", ({ enumerable: true, get: function () { return path_utils_1.toPosixPath; } }));
+Object.defineProperty(exports, "toWin32Path", ({ enumerable: true, get: function () { return path_utils_1.toWin32Path; } }));
+Object.defineProperty(exports, "toPlatformPath", ({ enumerable: true, get: function () { return path_utils_1.toPlatformPath; } }));
 //# sourceMappingURL=core.js.map
 
 /***/ }),
@@ -884,6 +896,71 @@ exports.OidcClient = OidcClient;
 
 /***/ }),
 
+/***/ 2981:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.toPlatformPath = exports.toWin32Path = exports.toPosixPath = void 0;
+const path = __importStar(__nccwpck_require__(1017));
+/**
+ * toPosixPath converts the given path to the posix form. On Windows, \\ will be
+ * replaced with /.
+ *
+ * @param pth. Path to transform.
+ * @return string Posix path.
+ */
+function toPosixPath(pth) {
+    return pth.replace(/[\\]/g, '/');
+}
+exports.toPosixPath = toPosixPath;
+/**
+ * toWin32Path converts the given path to the win32 form. On Linux, / will be
+ * replaced with \\.
+ *
+ * @param pth. Path to transform.
+ * @return string Win32 path.
+ */
+function toWin32Path(pth) {
+    return pth.replace(/[/]/g, '\\');
+}
+exports.toWin32Path = toWin32Path;
+/**
+ * toPlatformPath converts the given path to a platform-specific path. It does
+ * this by replacing instances of / and \ with the platform-specific path
+ * separator.
+ *
+ * @param pth The path to platformize.
+ * @return string The platform-specific path.
+ */
+function toPlatformPath(pth) {
+    return pth.replace(/[/\\]/g, path.sep);
+}
+exports.toPlatformPath = toPlatformPath;
+//# sourceMappingURL=path-utils.js.map
+
+/***/ }),
+
 /***/ 1327:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
@@ -4413,7 +4490,7 @@ var endpoint = __nccwpck_require__(9440);
 var universalUserAgent = __nccwpck_require__(5030);
 var isPlainObject = __nccwpck_require__(3287);
 var nodeFetch = _interopDefault(__nccwpck_require__(467));
-var requestError = __nccwpck_require__(537);
+var requestError = __nccwpck_require__(13);
 
 const VERSION = "5.6.3";
 
@@ -4582,6 +4659,88 @@ exports.request = request;
 //# sourceMappingURL=index.js.map
 
 
+/***/ }),
+
+/***/ 13:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+
+function _interopDefault (ex) { return (ex && (typeof ex === 'object') && 'default' in ex) ? ex['default'] : ex; }
+
+var deprecation = __nccwpck_require__(8932);
+var once = _interopDefault(__nccwpck_require__(1223));
+
+const logOnceCode = once(deprecation => console.warn(deprecation));
+const logOnceHeaders = once(deprecation => console.warn(deprecation));
+/**
+ * Error with extra properties to help with debugging
+ */
+
+class RequestError extends Error {
+  constructor(message, statusCode, options) {
+    super(message); // Maintains proper stack trace (only available on V8)
+
+    /* istanbul ignore next */
+
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
+    }
+
+    this.name = "HttpError";
+    this.status = statusCode;
+    let headers;
+
+    if ("headers" in options && typeof options.headers !== "undefined") {
+      headers = options.headers;
+    }
+
+    if ("response" in options) {
+      this.response = options.response;
+      headers = options.response.headers;
+    } // redact request credentials without mutating original request options
+
+
+    const requestCopy = Object.assign({}, options.request);
+
+    if (options.request.headers.authorization) {
+      requestCopy.headers = Object.assign({}, options.request.headers, {
+        authorization: options.request.headers.authorization.replace(/ .*$/, " [REDACTED]")
+      });
+    }
+
+    requestCopy.url = requestCopy.url // client_id & client_secret can be passed as URL query parameters to increase rate limit
+    // see https://developer.github.com/v3/#increasing-the-unauthenticated-rate-limit-for-oauth-applications
+    .replace(/\bclient_secret=\w+/g, "client_secret=[REDACTED]") // OAuth tokens can be passed as URL query parameters, although it is not recommended
+    // see https://developer.github.com/v3/#oauth2-token-sent-in-a-header
+    .replace(/\baccess_token=\w+/g, "access_token=[REDACTED]");
+    this.request = requestCopy; // deprecations
+
+    Object.defineProperty(this, "code", {
+      get() {
+        logOnceCode(new deprecation.Deprecation("[@octokit/request-error] `error.code` is deprecated, use `error.status`."));
+        return statusCode;
+      }
+
+    });
+    Object.defineProperty(this, "headers", {
+      get() {
+        logOnceHeaders(new deprecation.Deprecation("[@octokit/request-error] `error.headers` is deprecated, use `error.response.headers`."));
+        return headers || {};
+      }
+
+    });
+  }
+
+}
+
+exports.RequestError = RequestError;
+//# sourceMappingURL=index.js.map
+
+
 /***/ }),
 
 /***/ 3682:
@@ -10633,7 +10792,8 @@ function wrappy (fn, cb) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.setErrorMap = exports.overrideErrorMap = exports.defaultErrorMap = exports.ZodError = exports.quotelessJson = exports.ZodIssueCode = void 0;
+exports.getErrorMap = exports.setErrorMap = exports.defaultErrorMap = exports.ZodError = exports.quotelessJson = exports.ZodIssueCode = void 0;
+const parseUtil_1 = __nccwpck_require__(888);
 const util_1 = __nccwpck_require__(3985);
 exports.ZodIssueCode = util_1.util.arrayToEnum([
     "invalid_type",
@@ -10734,7 +10894,7 @@ class ZodError extends Error {
         return this.message;
     }
     get message() {
-        return JSON.stringify(this.issues, null, 2);
+        return JSON.stringify(this.issues, parseUtil_1.jsonStringifyReplacer, 2);
     }
     get isEmpty() {
         return this.issues.length === 0;
@@ -10774,7 +10934,7 @@ const defaultErrorMap = (issue, _ctx) => {
             }
             break;
         case exports.ZodIssueCode.invalid_literal:
-            message = `Invalid literal value, expected ${JSON.stringify(issue.expected)}`;
+            message = `Invalid literal value, expected ${JSON.stringify(issue.expected, parseUtil_1.jsonStringifyReplacer)}`;
             break;
         case exports.ZodIssueCode.unrecognized_keys:
             message = `Unrecognized key(s) in object: ${util_1.util.joinValues(issue.keys, ", ")}`;
@@ -10798,10 +10958,23 @@ const defaultErrorMap = (issue, _ctx) => {
             message = `Invalid date`;
             break;
         case exports.ZodIssueCode.invalid_string:
-            if (issue.validation !== "regex")
+            if (typeof issue.validation === "object") {
+                if ("startsWith" in issue.validation) {
+                    message = `Invalid input: must start with "${issue.validation.startsWith}"`;
+                }
+                else if ("endsWith" in issue.validation) {
+                    message = `Invalid input: must start with "${issue.validation.endsWith}"`;
+                }
+                else {
+                    util_1.util.assertNever(issue.validation);
+                }
+            }
+            else if (issue.validation !== "regex") {
                 message = `Invalid ${issue.validation}`;
-            else
+            }
+            else {
                 message = "Invalid";
+            }
             break;
         case exports.ZodIssueCode.too_small:
             if (issue.type === "array")
@@ -10810,6 +10983,8 @@ const defaultErrorMap = (issue, _ctx) => {
                 message = `String must contain ${issue.inclusive ? `at least` : `over`} ${issue.minimum} character(s)`;
             else if (issue.type === "number")
                 message = `Number must be greater than ${issue.inclusive ? `or equal to ` : ``}${issue.minimum}`;
+            else if (issue.type === "date")
+                message = `Date must be greater than ${issue.inclusive ? `or equal to ` : ``}${new Date(issue.minimum)}`;
             else
                 message = "Invalid input";
             break;
@@ -10820,6 +10995,8 @@ const defaultErrorMap = (issue, _ctx) => {
                 message = `String must contain ${issue.inclusive ? `at most` : `under`} ${issue.maximum} character(s)`;
             else if (issue.type === "number")
                 message = `Number must be less than ${issue.inclusive ? `or equal to ` : ``}${issue.maximum}`;
+            else if (issue.type === "date")
+                message = `Date must be smaller than ${issue.inclusive ? `or equal to ` : ``}${new Date(issue.maximum)}`;
             else
                 message = "Invalid input";
             break;
@@ -10839,11 +11016,15 @@ const defaultErrorMap = (issue, _ctx) => {
     return { message };
 };
 exports.defaultErrorMap = defaultErrorMap;
-exports.overrideErrorMap = exports.defaultErrorMap;
+let overrideErrorMap = exports.defaultErrorMap;
-const setErrorMap = (map) => {
+function setErrorMap(map) {
-    exports.overrideErrorMap = map;
+    overrideErrorMap = map;
-};
+}
 exports.setErrorMap = setErrorMap;
+function getErrorMap() {
+    return overrideErrorMap;
+}
+exports.getErrorMap = getErrorMap;
 
 
 /***/ }),
@@ -10898,7 +11079,7 @@ var errorUtil;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.isAsync = exports.isValid = exports.isDirty = exports.isAborted = exports.OK = exports.DIRTY = exports.INVALID = exports.ParseStatus = exports.addIssueToContext = exports.EMPTY_PATH = exports.makeIssue = void 0;
+exports.jsonStringifyReplacer = exports.isAsync = exports.isValid = exports.isDirty = exports.isAborted = exports.OK = exports.DIRTY = exports.INVALID = exports.ParseStatus = exports.addIssueToContext = exports.EMPTY_PATH = exports.makeIssue = void 0;
 const ZodError_1 = __nccwpck_require__(9892);
 const makeIssue = (params) => {
     const { data, path, errorMaps, issueData } = params;
@@ -10931,7 +11112,7 @@ function addIssueToContext(ctx, issueData) {
         errorMaps: [
             ctx.common.contextualErrorMap,
             ctx.schemaErrorMap,
-            ZodError_1.overrideErrorMap,
+            ZodError_1.getErrorMap(),
             ZodError_1.defaultErrorMap,
         ].filter((x) => !!x),
     });
@@ -11006,6 +11187,13 @@ const isValid = (x) => x.status === "valid";
 exports.isValid = isValid;
 const isAsync = (x) => typeof Promise !== undefined && x instanceof Promise;
 exports.isAsync = isAsync;
+const jsonStringifyReplacer = (_, value) => {
+    if (typeof value === "bigint") {
+        return value.toString();
+    }
+    return value;
+};
+exports.jsonStringifyReplacer = jsonStringifyReplacer;
 
 
 /***/ }),
@@ -11029,6 +11217,8 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getParsedType = exports.ZodParsedType = exports.util = void 0;
 var util;
 (function (util) {
+    function assertEqual(_cond) { }
+    util.assertEqual = assertEqual;
     function assertNever(_x) {
         throw new Error();
     }
@@ -11234,11 +11424,10 @@ function processCreateParams(params) {
     const customMap = (iss, ctx) => {
         if (iss.code !== "invalid_type")
             return { message: ctx.defaultError };
-        if (typeof ctx.data === "undefined" && required_error)
+        if (typeof ctx.data === "undefined") {
-            return { message: required_error };
+            return { message: required_error !== null && required_error !== void 0 ? required_error : ctx.defaultError };
-        if (params.invalid_type_error)
+        }
-            return { message: params.invalid_type_error };
+        return { message: invalid_type_error !== null && invalid_type_error !== void 0 ? invalid_type_error : ctx.defaultError };
-        return { message: ctx.defaultError };
     };
     return { errorMap: customMap, description };
 }
@@ -11598,6 +11787,28 @@ class ZodString extends ZodType {
             else if (check.kind === "trim") {
                 input.data = input.data.trim();
             }
+            else if (check.kind === "startsWith") {
+                if (!input.data.startsWith(check.value)) {
+                    ctx = this._getOrReturnCtx(input, ctx);
+                    parseUtil_1.addIssueToContext(ctx, {
+                        code: ZodError_1.ZodIssueCode.invalid_string,
+                        validation: { startsWith: check.value },
+                        message: check.message,
+                    });
+                    status.dirty();
+                }
+            }
+            else if (check.kind === "endsWith") {
+                if (!input.data.endsWith(check.value)) {
+                    ctx = this._getOrReturnCtx(input, ctx);
+                    parseUtil_1.addIssueToContext(ctx, {
+                        code: ZodError_1.ZodIssueCode.invalid_string,
+                        validation: { endsWith: check.value },
+                        message: check.message,
+                    });
+                    status.dirty();
+                }
+            }
             else {
                 util_1.util.assertNever(check);
             }
@@ -11629,6 +11840,20 @@ class ZodString extends ZodType {
             ...errorUtil_1.errorUtil.errToObj(message),
         });
     }
+    startsWith(value, message) {
+        return this._addCheck({
+            kind: "startsWith",
+            value: value,
+            ...errorUtil_1.errorUtil.errToObj(message),
+        });
+    }
+    endsWith(value, message) {
+        return this._addCheck({
+            kind: "endsWith",
+            value: value,
+            ...errorUtil_1.errorUtil.errToObj(message),
+        });
+    }
     min(minLength, message) {
         return this._addCheck({
             kind: "min",
@@ -11659,25 +11884,23 @@ class ZodString extends ZodType {
         return !!this._def.checks.find((ch) => ch.kind === "cuid");
     }
     get minLength() {
-        let min = -Infinity;
+        let min = null;
-        this._def.checks.map((ch) => {
+        for (const ch of this._def.checks) {
             if (ch.kind === "min") {
-                if (min === null || ch.value > min) {
+                if (min === null || ch.value > min)
                     min = ch.value;
             }
         }
-        });
         return min;
     }
     get maxLength() {
         let max = null;
-        this._def.checks.map((ch) => {
+        for (const ch of this._def.checks) {
             if (ch.kind === "max") {
-                if (max === null || ch.value < max) {
+                if (max === null || ch.value < max)
                     max = ch.value;
             }
         }
-        });
         return max;
     }
 }
@@ -11952,15 +12175,89 @@ class ZodDate extends ZodType {
             });
             return parseUtil_1.INVALID;
         }
+        const status = new parseUtil_1.ParseStatus();
+        let ctx = undefined;
+        for (const check of this._def.checks) {
+            if (check.kind === "min") {
+                if (input.data.getTime() < check.value) {
+                    ctx = this._getOrReturnCtx(input, ctx);
+                    parseUtil_1.addIssueToContext(ctx, {
+                        code: ZodError_1.ZodIssueCode.too_small,
+                        message: check.message,
+                        inclusive: true,
+                        minimum: check.value,
+                        type: "date",
+                    });
+                    status.dirty();
+                }
+            }
+            else if (check.kind === "max") {
+                if (input.data.getTime() > check.value) {
+                    ctx = this._getOrReturnCtx(input, ctx);
+                    parseUtil_1.addIssueToContext(ctx, {
+                        code: ZodError_1.ZodIssueCode.too_big,
+                        message: check.message,
+                        inclusive: true,
+                        maximum: check.value,
+                        type: "date",
+                    });
+                    status.dirty();
+                }
+            }
+            else {
+                util_1.util.assertNever(check);
+            }
+        }
         return {
-            status: "valid",
+            status: status.value,
             value: new Date(input.data.getTime()),
         };
     }
+    _addCheck(check) {
+        return new ZodDate({
+            ...this._def,
+            checks: [...this._def.checks, check],
+        });
+    }
+    min(minDate, message) {
+        return this._addCheck({
+            kind: "min",
+            value: minDate.getTime(),
+            message: errorUtil_1.errorUtil.toString(message),
+        });
+    }
+    max(maxDate, message) {
+        return this._addCheck({
+            kind: "max",
+            value: maxDate.getTime(),
+            message: errorUtil_1.errorUtil.toString(message),
+        });
+    }
+    get minDate() {
+        let min = null;
+        for (const ch of this._def.checks) {
+            if (ch.kind === "min") {
+                if (min === null || ch.value > min)
+                    min = ch.value;
+            }
+        }
+        return min != null ? new Date(min) : null;
+    }
+    get maxDate() {
+        let max = null;
+        for (const ch of this._def.checks) {
+            if (ch.kind === "max") {
+                if (max === null || ch.value < max)
+                    max = ch.value;
+            }
+        }
+        return max != null ? new Date(max) : null;
+    }
 }
 exports.ZodDate = ZodDate;
 ZodDate.create = (params) => {
     return new ZodDate({
+        checks: [],
         typeName: ZodFirstPartyTypeKind.ZodDate,
         ...processCreateParams(params),
     });
@@ -12457,6 +12754,9 @@ class ZodObject extends ZodType {
             shape: () => newShape,
         });
     }
+    keyof() {
+        return createZodEnum(util_1.util.objectKeys(this.shape));
+    }
 }
 exports.ZodObject = ZodObject;
 ZodObject.create = (shape, params) => {
@@ -13052,7 +13352,7 @@ class ZodFunction extends ZodType {
                 errorMaps: [
                     ctx.common.contextualErrorMap,
                     ctx.schemaErrorMap,
-                    ZodError_1.overrideErrorMap,
+                    ZodError_1.getErrorMap(),
                     ZodError_1.defaultErrorMap,
                 ].filter((x) => !!x),
                 issueData: {
@@ -13068,7 +13368,7 @@ class ZodFunction extends ZodType {
                 errorMaps: [
                     ctx.common.contextualErrorMap,
                     ctx.schemaErrorMap,
-                    ZodError_1.overrideErrorMap,
+                    ZodError_1.getErrorMap(),
                     ZodError_1.defaultErrorMap,
                 ].filter((x) => !!x),
                 issueData: {
@@ -13739,13 +14039,13 @@ const schemas_1 = __nccwpck_require__(1129);
 function filterChangesBySeverity(severity, changes) {
     const severityIdx = schemas_1.SEVERITIES.indexOf(severity);
     let filteredChanges = [];
-    for (let change of changes) {
+    for (const change of changes) {
         if (change === undefined ||
             change.vulnerabilities === undefined ||
             change.vulnerabilities.length === 0) {
             continue;
         }
-        let fChange = Object.assign(Object.assign({}, change), { vulnerabilities: change.vulnerabilities.filter(vuln => {
+        const fChange = Object.assign(Object.assign({}, change), { vulnerabilities: change.vulnerabilities.filter(vuln => {
                 const vulnIdx = schemas_1.SEVERITIES.indexOf(vuln.severity);
                 if (vulnIdx <= severityIdx) {
                     return true;
@@ -13825,7 +14125,7 @@ exports.ConfigurationOptionsSchema = z
     deny_licenses: z.array(z.string()).default([])
 })
     .partial()
-    .refine(obj => !(obj.allow_licenses && obj.deny_licenses), "Your workflow file has both an allow_licenses list and deny_licenses list, but you can only set one or the other.");
+    .refine(obj => !(obj.allow_licenses && obj.deny_licenses), 'Your workflow file has both an allow_licenses list and deny_licenses list, but you can only set one or the other.');
 exports.ChangesSchema = z.array(exports.ChangeSchema);
 
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dependency-review-action",
-  "version": "2.0.1",
+  "version": "2.0.4",
   "private": true,
   "description": "A GitHub Action for Dependency Review",
   "main": "lib/main.js",
@@ -25,30 +25,30 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/core": "^1.8.2",
+    "@actions/core": "^1.9.0",
     "@actions/github": "^5.0.3",
     "@octokit/plugin-retry": "^3.0.9",
-    "@octokit/request-error": "^2.1.0",
+    "@octokit/request-error": "^3.0.0",
     "ansi-styles": "^6.1.0",
     "got": "^12.1.0",
-    "nodemon": "^2.0.16",
+    "nodemon": "^2.0.19",
     "yaml": "^2.1.1",
-    "zod": "^3.17.3"
+    "zod": "^3.17.9"
   },
   "devDependencies": {
-    "@types/node": "^17.0.43",
+    "@types/node": "^16.11.45",
-    "@typescript-eslint/eslint-plugin": "^5.28.0",
+    "@typescript-eslint/eslint-plugin": "^5.30.7",
-    "@typescript-eslint/parser": "^5.28.0",
+    "@typescript-eslint/parser": "^5.30.7",
     "@vercel/ncc": "^0.34.0",
     "esbuild-register": "^3.3.3",
-    "eslint": "^8.17.0",
+    "eslint": "^8.20.0",
     "eslint-plugin-github": "^4.3.6",
-    "eslint-plugin-jest": "^26.5.3",
+    "eslint-plugin-jest": "^26.6.0",
     "jest": "^27.5.1",
     "js-yaml": "^4.1.0",
-    "nodemon": "^2.0.16",
+    "nodemon": "^2.0.19",
-    "prettier": "2.7.0",
+    "prettier": "2.7.1",
     "ts-jest": "^27.1.4",
-    "typescript": "^4.7.3"
+    "typescript": "^4.7.4"
   }
 }

src/filter.ts

@@ -1,5 +1,4 @@
-import {Changes} from './schemas'
+import {Changes, Severity, SEVERITIES} from './schemas'
-import {Severity, SEVERITIES} from './schemas'
 
 export function filterChangesBySeverity(
   severity: Severity,
@@ -7,7 +6,7 @@ export function filterChangesBySeverity(
 ): Changes {
   const severityIdx = SEVERITIES.indexOf(severity)
   let filteredChanges = []
-  for (let change of changes) {
+  for (const change of changes) {
     if (
       change === undefined ||
       change.vulnerabilities === undefined ||
@@ -16,7 +15,7 @@ export function filterChangesBySeverity(
       continue
     }
 
-    let fChange = {
+    const fChange = {
       ...change,
       vulnerabilities: change.vulnerabilities.filter(vuln => {
         const vulnIdx = SEVERITIES.indexOf(vuln.severity)

src/licenses.ts

@@ -1,4 +1,4 @@
-import {Change, ChangeSchema} from './schemas'
+import {Change} from './schemas'
 
 /**
  * Loops through a list of changes, filtering and returning the
@@ -13,19 +13,23 @@ import {Change, ChangeSchema} from './schemas'
  * @returns {[Array<Change>, Array<Change]} A tuple where the first element is the list of denied changes and the second one is the list of changes with unknown licenses
  */
 export function getDeniedLicenseChanges(
-  changes: Array<Change>,
+  changes: Change[],
   licenses: {
-    allow?: Array<string>
+    allow?: string[]
-    deny?: Array<string>
+    deny?: string[]
   }
-): [Array<Change>, Array<Change>] {
+): [Change[], Change[]] {
-  let {allow, deny} = licenses
+  const {allow, deny} = licenses
 
-  let disallowed: Change[] = []
+  const disallowed: Change[] = []
-  let unknown: Change[] = []
+  const unknown: Change[] = []
 
   for (const change of changes) {
-    let license = change.license
+    if (change.change_type === 'removed') {
+      continue
+    }
+
+    const license = change.license
     if (license === null) {
       unknown.push(change)
       continue

src/main.ts

@@ -27,16 +27,16 @@ async function run(): Promise<void> {
       headRef: pull_request.head.sha
     })
 
-    let config = readConfig()
+    const config = readConfig()
-    let minSeverity = config.fail_on_severity
+    const minSeverity = config.fail_on_severity
     let failed = false
 
-    let licenses = {
+    const licenses = {
       allow: config.allow_licenses,
       deny: config.deny_licenses
     }
 
-    let filteredChanges = filterChangesBySeverity(
+    const filteredChanges = filterChangesBySeverity(
       minSeverity as Severity,
       changes
     )
@@ -52,13 +52,13 @@ async function run(): Promise<void> {
       }
     }
 
-    let [licenseErrors, unknownLicenses] = getDeniedLicenseChanges(
+    const [licenseErrors, unknownLicenses] = getDeniedLicenseChanges(
       changes,
       licenses
     )
 
     if (licenseErrors.length > 0) {
-      printLicensesError(licenseErrors, licenses)
+      printLicensesError(licenseErrors)
       core.setFailed('Dependency review detected incompatible licenses.')
     }
 
@@ -90,7 +90,7 @@ async function run(): Promise<void> {
   }
 }
 
-function printChangeVulnerabilities(change: Change) {
+function printChangeVulnerabilities(change: Change): void {
   for (const vuln of change.vulnerabilities) {
     core.info(
       `${styles.bold.open}${change.manifest} » ${change.name}@${
@@ -117,19 +117,11 @@ function renderSeverity(
   return `${styles.color[color].open}(${severity} severity)${styles.color[color].close}`
 }
 
-function printLicensesError(
+function printLicensesError(changes: Change[]): void {
-  changes: Array<Change>,
+  if (changes.length === 0) {
-  licenses: {
-    allow?: Array<string>
-    deny?: Array<string>
-  }
-): void {
-  if (changes.length == 0) {
     return
   }
 
-  let {allow = [], deny = []} = licenses
-
   core.info('\nThe following dependencies have incompatible licenses:\n')
   for (const change of changes) {
     core.info(
@@ -138,7 +130,11 @@ function printLicensesError(
   }
 }
 
-function printNullLicenses(changes: Array<Change>): void {
+function printNullLicenses(changes: Change[]): void {
+  if (changes.length === 0) {
+    return
+  }
+
   core.info('\nWe could not detect a license for the following dependencies:\n')
   for (const change of changes) {
     core.info(

src/schemas.ts

@@ -39,7 +39,7 @@ export const ConfigurationOptionsSchema = z
   .partial()
   .refine(
     obj => !(obj.allow_licenses && obj.deny_licenses),
-    "Your workflow file has both an allow_licenses list and deny_licenses list, but you can only set one or the other."
+    'Your workflow file has both an allow_licenses list and deny_licenses list, but you can only set one or the other.'
   )
 
 export const ChangesSchema = z.array(ChangeSchema)