# Changelog ## [5.4.3] * Remove dependencies that are not needed anymore ## [5.4.2] * Fix build scripts ## [5.4.1] * Upgrade dependencies ## [5.4.0] ### Improvements - Add possibility to exclude specific versions for a vulnerability (example: jquery-1.12.4-aem which has some extra patches). ## [5.3.0] ### Improvement - Add cyclonedxJSON1_6_VEX as output format for CycloneDX 1.6 with vulnerability information ## [5.2.8] ### Bugfix - ignorefile cli argument was not working ## [5.2.7] ### Performance fix - Upgrade to ASTronomical 2.0.0 to reduce memory usage ## [5.2.6] ### Bugfix - Don't crash on invalid code when using deep scan ## [5.2.5] ### Bugfix - CLI argument `--ext` was not working ## [5.2.4] ### Bugfix - Fix name vs group for scoped components in CycloneDX output ## [5.2.3] ### Bugfix - Fix license handling for complex licenses ## [5.2.2] ### Bugfix - Encode purls correctly in SBOM ## [5.2.1] ### Bugfix - Add missing CWEs in response ## [5.2.0] ### Enhancement - Add license information to SBOM ## [5.1.4] ### Bugfix - Fix bug where deepScan would sometimes not report vulnerabilities ## [5.1.3] ### Bugfix - Use URI detector on file paths as well ## [5.1.2] ### Bugfix - JSON format should not include results without vulnerabilities unless `--verbose` is specified. ## [5.1.1] ### Bugfix - Remove duplicates in filename output in CycloneDX JSON formats ## [5.1.0] ### Add - Support for CycloneDX 1.6 JSON as output format - Adding file location as property in CycloneDX 1.4 JSON output ## [5.0.1] ### Fix - Fix filename issue for windows file paths ## [5.0.0] No changes. Just moving from beta to final. ## [5.0.0-beta.1] ### Added - Deepscan option with `--deep` where retire.js will also try to detect libraries using JavaScript AST (slower) ## [4.4.2] ### Fix - Fix matching to include all matches ## [4.4.1] ### Chore - Dependency upgrades ## [4.4.0] ### Added - Adding proper repository validation to ensure it's on the expected format ## [4.3.4] ### Bugfix - Bug: `--jspath` is not being honoured ## [4.3.3] ### Bugfix - Fixes #420 where ignore was not honoured ## [4.3.2] ### Bugfix - Types did not work for `lib/retire.js` due to symlinked type file ## [4.3.1] ### Bugfix - Should always include detected libraries in SBOM reports regardless of if they are vulnerable or not ## [4.3.0] ### Changes - Support basePurl in repository to generate purls in SBOM ## [4.2.3] ### Bugfix - Generate correct purl for moment.js ## [4.2.2] ### Bugfix - Proxy setting did not work ## [4.2.1] ### Changes - Fix provenance settings ## [4.2.0] ### Changes - Use prettier to get formatting of code - Add provenance ## Security fixes - Upgrade dependencies ## [4.1.1] ### Bugfixes - Handle error if OSV does not have library or version ## [4.1.0] ### Additions - Option to check results for the component from OSV - Option to use more than one JS repository ### Bugfixes - Remove dropexternal as it never worked ## [4.0.1] ### Breaking changes - Not really a breaking change as the change was introduced in 4.0.0, but node.js >= 14.0.0 is required to run retire.js >= 4.0.0 going forward ## [4.0.0] ### Breaking changes - npm scanning no longer supported ### Changes - Complete rewrite to typescript ## [3.2.3] - Fix caching bug in CycloneDX JSON output ## [3.2.2] - Fix bug in CycloneDX JSON output (wrapped components array) ## [3.2.1] - Remove unintended use of arrow functions ## [3.2.0] - Add `--ext` to allow specifying other file extensions ## [3.1.3] - Fixes a typo ## [3.1.2] - Remove some unused variables and tmp files ## [3.1.1] - Update VM2 due to vuln in that library ## [3.1.0] - Adding support for cycloneDX JSON format - Updating CycloneDX XML format to version 1.4 - Adding schema parsing tests for cyclonedx ## [3.0.7] ### Fixes - Updating proxy library to fix proxy issues ## [3.0.6] ### Security - Switch the `colors` package with `ansi-colors` ## [3.0.4] / [3.0.5] ### Security - Pin colors dependency to avoid DOS from colors author ## [3.0.3] ### Bug - Fix version number ## [3.0.2] ### Dependency update - always output JSON to stdout, to avoid conflict with deprecation warning ## [3.0.1] ### Dependency update - glob-parent, lodash and hosted-git-info had vulnerabilities and was updated ## [3.0.0] ### Deprecation notice - The node scanner is deprecated: https://github.com/RetireJS/retire.js/wiki/Deprecating-the-node.js-scanner ## [2.2.5] ### Dependency update - y18n had a vulnerability and was updated ## [2.2.4] ### Bugfix - Fixes [#343](https://github.com/RetireJS/retire.js/pull/343) where symlink to nonexistent file causes it to crash with exception. Now it will log it as warn instead. ## [2.2.3] ### Bugfix - Fixes [#337](https://github.com/RetireJS/retire.js/issues/337) where symlinks are not read ## [2.2.2] ### Bugfix - Fixes [#334](https://github.com/RetireJS/retire.js/issues/334) where detected libraries without vulnerabilities show in output even when verbose is not specified ## [2.2.1] ### Bugfix - Fixes [#321](https://github.com/RetireJS/retire.js/issues/321) where write output to file did not always work as expected ## [2.2.0] ### Added - Support `--cacert ` or `--insecure` when loading the repos (thanks to [adamcohen](https://github.com/adamcohen)) [PR#322](https://github.com/RetireJS/retire.js/pull/322) ## [2.1.1] - 2020-03-20 ### Bugfix - Fix compatibility with node 6 ## [2.1.1] - 2020-03-16 ### Modified - Remove `request` as it is deprecated ## [2.1.0] - 2020-03-16 ### Modified - Support ** and \* in ignore paths (** = any number of folders)