Newer version of vue and pdfjs is not detected by retirejs

[rashmimehta300]

Retire.js version: 4.3.1

node version: 18.3.1

Description: Newer version of vuejs(3.x) and is not detected.

Expected behaviour: Retire js should detect newer version of vuejs and pdfjs

If this is a false positive or false negative: False negative

• How did you run the tool? Command line? Browser extension? Command line tool
• Can you provide a link to the file(s) containing the libraries?
• Are the libraries bundeled with a minifier? If so which one?

[eoftedal]

Please be more specific. Which versions did you test with?

[rashmimehta300]

Retire version: 4.3.1
Below is not getting detected
Pdfjs used in code version 4.2.67
vue version 3.4.27

[eoftedal]

Are these minified in some way? Can you share a link to the file? Detection works for all versions of pdf.js in the testcases in https://github.com/RetireJS/retire.js/blob/master/repository/testcases.json#L638
I have improved the detection for Vue, which might resolve the Vue issue

[rashmimehta300]

Link to the file
https://github.com/mozilla/pdf.js/releases/download/v4.2.67/pdfjs-4.2.67-dist.zip

[eoftedal]

It does detect that version from the CDNs.
If you scan the contents of that zip file, it won't detect it as it doesn't look at .mjs files. Should probably change that.

But I'm still wondering where you found this problem to begin with. What were you scanning?

[eoftedal]

The --ext CLI argument was not working. Will be fixed in retire 5.2.5. With that you can run retire --ext mjs,js to also scan mjs files

[rashmimehta300]

I was scanning a war file. Earlier it had pdf.js file, so version of same was detectable. After pdfjs upgrade files changed to mjs which was not detected.

[eoftedal]

Ok, then you should be able to use the --ext option, but maybe we need to make mjs,js the default...

[eoftedal]

Will add this fix to retire v4.4.4 as well, allthough it's proably be better to be on v5

[eoftedal]

Try version 4.4.4 with --ext mjs,js

[rashmimehta300]

pdf.js file is getting detected.
vue version is getting detected from vue.js file but not from vue.min.js
vue version 3.4.27

[eoftedal]

Can you share the vue.min.js file here?

[eoftedal]

@rashmimehta300 Can you share the vue.min.js file here? We have tests for 3.4.27, so not sure why it's not detecting it.