How to reveal folderpaths to detected-as-vulnerable package.json's in nested folders? #493
-
|
In our monorepo there are many nested folders having their own package.json. When I run globally-installed cve-lite on the root folder of my monorepo working copy, and include --verbose, the output does not indicate in which package.json the detected vulnerabilities exist. This prevents me from updating those package.json's and pushing them to the monorepo. Instead the suggested commands seem they would have the effect of updating the global package.json (which is outside the root of my monorepo working copy) and prevents me from sharing the fixes. Or, perhaps I misunderstand and using the suggested "npm install" commands that have no "-g" will update all package.json's that reference the indicated package? If so, it would be good education to add that tip in your README.md (because I have not come across such information after more than a decade of using npm). |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 27 replies
-
|
Thanks for the detailed write-up. This is exactly the kind of feedback that helps. The workspace-scoped fix commands you are describing landed in v1.18.1 (released yesterday). When CVE Lite detects that a direct dependency lives in a workspace package rather than the root, the generated fix command now includes the workspace qualifier - Could you upgrade and try again? npm install -g cve-lite-cli@latest
cve-lite . --verboseIf the fix commands still look like bare |
Beta Was this translation helpful? Give feedback.
-
|
To clarify - we're not asking you to set up anything at the root, and there's no workaround needed here. Your repo doesn't have npm workspaces - you have independent subfolders, each with their own {
"name": "my-monorepo",
"workspaces": ["packages/*"]
}npm then links everything together under a single root Your setup is simpler - just independent subfolders. CVE Lite is designed to be run from the folder that contains a cd sessionManager
cve-lite .If you have other subfolders with their own Marking this as answered, but feel free to follow up if anything isn't working as expected. |
Beta Was this translation helpful? Give feedback.
-
|
One more thing - re-reading your last message, I want to make sure we address the actual ask. You're right that there's a real gap here: if you run That's exactly what we want to build. We've opened an issue to track it: #496 If you're open to it, sharing a sanitized version of your folder structure on that issue would help us design the right solution for your setup. |
Beta Was this translation helpful? Give feedback.
-
|
I'm making this comment in order to provide the most direct answer. As of today there is no anticipated version of cve-lite that will "reveal folderpaths to detected-as-vulnerable package.json's in nested folders" for the general case. However, if one has "workspaces, dependencies, and devDependencies fields [in the] package.json [of your top-level folder]", then cve-lite can suggest commands to fix detected problems in nested folders. |
Beta Was this translation helpful? Give feedback.
-
|
Good timing - we are working on exactly this right now. Issue #496 is the tracking issue, and implementation is underway today. When it ships, running We will post an update on #496 when there is a build you can try out. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you, I'm excited to try it when available. Sanitizing our folder structure would require a cli pipeline that generated a sanitized/opaque alternate name for every item, and I don't know of any set of linux commands that would do that. |
Beta Was this translation helpful? Give feedback.
-
|
Good news - multi-folder support is coming in the next release. I have a branch ready if you want to try it out now: npm install -g OWASP/cve-lite-cli#feature/issue-496-multi-folder-scanWhen CVE Lite finds no lockfile at the project root but discovers two or more lockfiles in subfolders, it automatically switches to multi-folder mode. You do not need any flags - it detects the layout on its own. In that mode it:
One thing worth knowing: when CVE Lite scans a folder and finds a lockfile there, it stops recursing into that folder's subdirectories. This prevents double-counting packages that appear in both a workspace root lockfile and a nested one. Workspace monorepos (where the root Let me know how it goes. |
Beta Was this translation helpful? Give feedback.
-
|
Btw, is the following a known issue? Then, I wasn't able to test it. Sorry I don't know how you want me to test, because the standard invocation isn't recognized: |
Beta Was this translation helpful? Give feedback.
-
|
Apologies for the confusion with the global install — that does not work because of a native dependency that needs pre-built binaries only available from the npm registry. A local install does work though: mkdir cve-lite-test && cd cve-lite-test
npm install OWASP/cve-lite-cli#feature/issue-496-multi-folder-scanThen run it with: node node_modules/cve-lite-cli/dist/index.js /path/to/your/projectReplace |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
Apologies for the friction — building from source requires the full TypeScript toolchain which is not a reasonable ask. We are publishing an alpha to npm right now so you can install it the normal way. Will post the command here shortly. |
Beta Was this translation helpful? Give feedback.
-
|
The alpha is now live on npm. Install it with: npm install -g cve-lite-cli@alphaThen run it from your parent directory: cve-lite . --verboseNo TypeScript toolchain needed. Let us know what you see. |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
The permission error is because Option 1 — run it with sudo: sudo cve-lite . --verboseOption 2 — fix the permissions once: sudo chmod +x /usr/local/bin/cve-liteThen run normally: cve-lite . --verboseOption 2 is cleaner going forward. |
Beta Was this translation helpful? Give feedback.
-
|
It looks to me that your alpha is working... |
Beta Was this translation helpful? Give feedback.
-
|
@ModalityZ Do you not see this chevron? 
|
Beta Was this translation helpful? Give feedback.
-
|
Great news — v1.19.0 is now live on npm with multi-folder scan as a stable feature. You can upgrade with: sudo npm install -g cve-lite-cli@latestNo more alpha needed. Thanks for helping us validate this — your real-world monorepo was the perfect test case. |
Beta Was this translation helpful? Give feedback.
-
I'm using Chrome 148.0.7778.215 (Official Build) (64-bit) on Kubuntu, a Framework 13 laptop.
|
Beta Was this translation helpful? Give feedback.
-
|
We will take a look @ModalityZ |
Beta Was this translation helpful? Give feedback.
-
|
@ModalityZ Would you be able to share how the CLI helped you and a bit about the use-case here: #481 |
Beta Was this translation helpful? Give feedback.
The permission error is because
sudo npm install -ginstalls the binary as root, so running it as a regular user is blocked. Two options:Option 1 — run it with sudo:
sudo cve-lite . --verboseOption 2 — fix the permissions once:
Then run normally:
cve-lite . --verboseOption 2 is cleaner going forward.