From 5f036bf21bf56d1441138cdaade566376034ed0c Mon Sep 17 00:00:00 2001 From: atishj99 Date: Fri, 18 Sep 2026 13:01:15 +0530 Subject: [PATCH 1/4] Bump AST CLI to v2.3.65 Updated the bundled Checkmarx AST CLI version from 2.3.60 to 2.3.65 and refreshed the platform checksum files for Windows, macOS, and Linux. Also bumped the package version to 1.0.41 to align the release metadata. --- checkmarx-ast-cli.checksums | 10 +++++----- checkmarx-ast-cli.version | 2 +- package-lock.json | 4 ++-- package.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/checkmarx-ast-cli.checksums b/checkmarx-ast-cli.checksums index 19b7f8f0..c529b009 100644 --- a/checkmarx-ast-cli.checksums +++ b/checkmarx-ast-cli.checksums @@ -1,7 +1,7 @@ { - "windows_x64": "210d85d34d29fad7b8e9932aafac5d65303a2f1af8b15dc4c29f03a85cdfa248", - "darwin_x64": "4492e953be85c342004f8d8a27440d31c0d6d11b37ecd0bbd3db5c614ce625d1", - "linux_x64": "ac974d10aab9843f6035f0d82ee4184b4311916930e682f3a7ef28c87e7ee547", - "linux_arm64": "254888d1a3eae8e188143cf1a15f5cc333a368811c35432ca3ffbf43f6398553", - "linux_armv6": "bfae583968e4d76fdc48630d28c06aaea62d15c29e9dfcd443e3d384d8fc9d00" + "windows_x64": "8bca820b5acd09e6846c43d4840bcedf2f4696958d8c19ff76722fd92e6249bc", + "darwin_x64": "3f956fd60e6fce5db5d9492b39df3510bad6171bb0d917d49b988d292c6cfeab", + "linux_x64": "311f67b21cd0f7c65f10439cc3a3517e8f8457f2fcac3340dd92f9cf07a73789", + "linux_arm64": "456fec50d0627eef730af4d13731785a8d7e242875bab8d09a717d8efd821180", + "linux_armv6": "2b99853303b53459bacec055dd34956c82ea0ff8a528438b4f3457ef1d9ae384" } diff --git a/checkmarx-ast-cli.version b/checkmarx-ast-cli.version index 678d59d4..489612f7 100644 --- a/checkmarx-ast-cli.version +++ b/checkmarx-ast-cli.version @@ -1 +1 @@ -2.3.60 +2.3.65 diff --git a/package-lock.json b/package-lock.json index e700f546..0a186487 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@Checkmarx/ast-cli-javascript-wrapper-runtime-cli", - "version": "1.0.40", + "version": "1.0.41", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@Checkmarx/ast-cli-javascript-wrapper-runtime-cli", - "version": "1.0.40", + "version": "1.0.41", "license": "ISC", "dependencies": { "async-mutex": "^0.5.0", diff --git a/package.json b/package.json index d799f022..e9634bb7 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@Checkmarx/ast-cli-javascript-wrapper-runtime-cli", - "version": "1.0.40", + "version": "1.0.41", "description": "AST CLI Javascript wrapper runtime CLI", "main": "dist/main/wrapper/CxWrapper.js", "typings": "dist/main/wrapper/CxWrapper.d.ts", From c11426af272a5ff5779295c5bab08be148ccf44d Mon Sep 17 00:00:00 2001 From: atishj99 Date: Fri, 18 Sep 2026 15:50:40 +0530 Subject: [PATCH 2/4] vulnerability fixes and integration test fix --- .github/workflows/ci.yml | 1 + package-lock.json | 14 +++++++------- package.json | 2 ++ 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ff3bc400..7d5d8ac8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -72,6 +72,7 @@ jobs: CX_CLIENT_ID: ${{ secrets.CX_CLIENT_ID}} CX_CLIENT_SECRET: ${{ secrets.CX_CLIENT_SECRET}} CX_BASE_URI: ${{ secrets.CX_BASE_URI }} + CX_BASE_AUTH_URI: ${{ secrets.CX_BASE_AUTH_URI }} CX_TENANT: ${{ secrets.CX_TENANT }} CX_APIKEY: ${{ secrets.CX_APIKEY }} run: npm test diff --git a/package-lock.json b/package-lock.json index 0a186487..f7631abf 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2931,12 +2931,12 @@ } }, "node_modules/adm-zip": { - "version": "0.5.18", - "resolved": "https://packages.echohq.com/artifactory/api/npm/npm/adm-zip/-/adm-zip-0.5.18.tgz", - "integrity": "sha512-ufJnssQGbxzLNS1Ho9bCtX4rQKCCvoVuDLHoJyc3F9dOGDB4BkWs2Ci0kv53lqocAEQ/Cbi+I2XCsNYGqVYqng==", + "version": "0.6.1", + "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/adm-zip/-/adm-zip-0.6.1.tgz", + "integrity": "sha512-Xwrja8nx9e5o2N1my4DsKCeKpdrnACyr1wtbPxBDgGzKzKyE9kRtBFA8mWldI+RVlD7CBZNWY/wQ2+ydwOR6kQ==", "license": "MIT", "engines": { - "node": ">=12.0" + "node": ">=14.0" } }, "node_modules/agent-base": { @@ -6872,9 +6872,9 @@ } }, "node_modules/qs": { - "version": "6.15.3", - "resolved": "https://packages.echohq.com/artifactory/api/npm/npm/qs/-/qs-6.15.3.tgz", - "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", + "version": "6.16.0", + "resolved": "https://npm.echohq.com/artifactory/api/npm/npm/qs/-/qs-6.16.0.tgz", + "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", diff --git a/package.json b/package.json index e9634bb7..aaa80c4f 100644 --- a/package.json +++ b/package.json @@ -56,6 +56,7 @@ "typescript": "^5.6.3" }, "overrides": { + "adm-zip": "0.6.1", "bluebird": "3.7.2", "browserslist": "4.28.7", "flatted": "^3.4.2", @@ -65,6 +66,7 @@ "underscore": "^1.13.8", "picomatch": "^2.3.2", "brace-expansion": "^2.1.4", + "qs": "6.16.0", "uuid": "^3.3.2" }, From 5d73941508ba8f11c145b08c267c456338f2d9eb Mon Sep 17 00:00:00 2001 From: atishj99 Date: Fri, 18 Sep 2026 17:30:11 +0530 Subject: [PATCH 3/4] Refactor PredicateTest: extract scan/result helper Extract getScanAndResult helper in PredicateTest to centralize logic for locating a completed scan and its SAST result. Add null-safe checks, use strict equality, and provide a fallback scanShow lookup when no scan is found to reduce flakiness. Update the test to use the helper and keep assertions for triageShow/triageUpdate. Improves readability and robustness of the test. --- src/tests/PredicateTest.test.ts | 46 ++++++++++++++++++++------------- 1 file changed, 28 insertions(+), 18 deletions(-) diff --git a/src/tests/PredicateTest.test.ts b/src/tests/PredicateTest.test.ts index df319a33..9763b6b2 100644 --- a/src/tests/PredicateTest.test.ts +++ b/src/tests/PredicateTest.test.ts @@ -9,35 +9,45 @@ const cxWrapperFactory = new CxWrapperFactory(); describe("Triage cases", () => { const cxScanConfig = new BaseTest(); - it('Triage Successful case', async () => { - const auth = await cxWrapperFactory.createWrapper(cxScanConfig); - + const getScanAndResult = async (auth: any): Promise<{ scan: any, result: CxResult }> => { const scanList: CxCommandOutput = await auth.scanList("statuses=Completed,limit=100"); - let result: CxResult; - let scan, output; - while (!output && scanList && scanList.payload && scanList.payload.length > 0) { - scan = scanList.payload.pop() - console.log("Triage Successful case - ScanId " + scan.id) - output = await auth.getResultsList(scan.id) - if (output.status == "Error in the json file.") { + let scan, output, result; + + while (!output && scanList?.payload?.length > 0) { + scan = scanList.payload.pop(); + output = await auth.getResultsList(scan.id); + if (output?.status === "Error in the json file.") { output = undefined; } else { - result = output.payload.find(res => res.type == CxConstants.SAST) - if (!result || !result.similarityId) { + result = output?.payload?.find(res => res.type === CxConstants.SAST); + if (!result?.similarityId) { output = undefined; } } } - const cxShow: CxCommandOutput = await auth.triageShow(scan.projectID, result.similarityId, result.type); + if (!scan) { + const scanShow = await auth.scanShow("d4354650-4ee1-4e10-9b1d-0feaf6c187a7"); + scan = scanShow?.payload?.pop(); + output = await auth.getResultsList(scan.id); + result = output?.payload?.find(res => res.type === CxConstants.SAST); + } - expect(cxShow.exitCode).toEqual(0); + return { scan, result }; + }; + + it('Triage Successful case', async () => { + const auth = await cxWrapperFactory.createWrapper(cxScanConfig); + const { scan, result } = await getScanAndResult(auth); - const cxUpdate: CxCommandOutput = await - auth.triageUpdate(scan.projectID, result.similarityId, result.type, result.state, - "Edited via JavascriptWrapper", - result.severity.toLowerCase() == "high" ? CxConstants.SEVERITY_MEDIUM : CxConstants.SEVERITY_HIGH); + const cxShow: CxCommandOutput = await auth.triageShow(scan.projectID, result.similarityId, result.type); + expect(cxShow.exitCode).toEqual(0); + const cxUpdate: CxCommandOutput = await auth.triageUpdate( + scan.projectID, result.similarityId, result.type, result.state, + "Edited via JavascriptWrapper", + result.severity.toLowerCase() === "high" ? CxConstants.SEVERITY_MEDIUM : CxConstants.SEVERITY_HIGH + ); expect(cxUpdate.exitCode).toEqual(0); }); }); \ No newline at end of file From d743cafa5ddda609f7e9647f96a547b084d80e55 Mon Sep 17 00:00:00 2001 From: atishj99 Date: Fri, 18 Sep 2026 17:49:14 +0530 Subject: [PATCH 4/4] fixing compilation error --- src/tests/PredicateTest.test.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/tests/PredicateTest.test.ts b/src/tests/PredicateTest.test.ts index 9763b6b2..67116f62 100644 --- a/src/tests/PredicateTest.test.ts +++ b/src/tests/PredicateTest.test.ts @@ -19,7 +19,7 @@ describe("Triage cases", () => { if (output?.status === "Error in the json file.") { output = undefined; } else { - result = output?.payload?.find(res => res.type === CxConstants.SAST); + result = output?.payload?.find((res: CxResult) => res.type === CxConstants.SAST); if (!result?.similarityId) { output = undefined; } @@ -30,7 +30,7 @@ describe("Triage cases", () => { const scanShow = await auth.scanShow("d4354650-4ee1-4e10-9b1d-0feaf6c187a7"); scan = scanShow?.payload?.pop(); output = await auth.getResultsList(scan.id); - result = output?.payload?.find(res => res.type === CxConstants.SAST); + result = output?.payload?.find((res: CxResult) => res.type === CxConstants.SAST); } return { scan, result };