Documentation
¶
Overview ¶
Package freshness parses dependency manifest files for multiple languages and discovers them in repository directory trees.
Index ¶
- Constants
- func CheckGoRuntime(ctx context.Context, client *http.Client, goVersion string) string
- func EnrichWithCargoLock(deps []Dependency, resolved map[string]string)
- func ParseCargoLock(data []byte) map[string]string
- type Cache
- type CachedRegistry
- type CratesRegistry
- type Dependency
- type FreshnessResult
- type GoRegistry
- type ManifestInfo
- func DiscoverManifests(root string) []ManifestInfo
- func ParseCargoTomlFreshness(data []byte) ManifestInfo
- func ParseCsproj(data []byte) ManifestInfo
- func ParseGemfile(data []byte) ManifestInfo
- func ParseGoMod(data []byte) ManifestInfo
- func ParsePackageJSON(data []byte) ManifestInfo
- func ParsePomXML(data []byte) ManifestInfo
- func ParsePyProject(data []byte) ManifestInfo
- func ParseRequirementsTxt(data []byte) ManifestInfo
- type MavenRegistry
- type MultiRegistry
- type NpmRegistry
- type NuGetRegistry
- type OutdatedDep
- type PyPIRegistry
- type Registry
- type RubyGemsRegistry
- type VulnDep
- type VulnResult
Constants ¶
const ( DefaultGoProxyURL = "https://proxy.golang.org" DefaultNpmURL = "https://registry.npmjs.org" DefaultPyPIURL = "https://pypi.org" DefaultCratesURL = "https://crates.io" DefaultMavenURL = "https://search.maven.org" DefaultRubyGemsURL = "https://rubygems.org" DefaultNuGetURL = "https://api.nuget.org" )
Default base URLs for package registries.
const DefaultCacheTTL = 24 * time.Hour
Default TTL for cached registry lookups.
const DefaultGoDLURL = "https://go.dev/dl/?mode=json"
DefaultGoDLURL is the Go download API endpoint.
const DefaultOSVURL = "https://api.osv.dev/v1/query"
DefaultOSVURL is the default endpoint for the OSV.dev vulnerability API.
Variables ¶
This section is empty.
Functions ¶
func CheckGoRuntime ¶
CheckGoRuntime compares the go.mod Go version against the latest stable release. Returns a status string: "current", "outdated (have X, latest Y)", or empty on error.
func EnrichWithCargoLock ¶
func EnrichWithCargoLock(deps []Dependency, resolved map[string]string)
EnrichWithCargoLock overrides Dependency.Version for Rust deps using resolved versions from a parsed Cargo.lock map. Deps not present in the lock file are left unchanged.
func ParseCargoLock ¶
ParseCargoLock parses a Cargo.lock file and returns a map of crate name → resolved version. Only registry packages are included (those with a source field pointing to crates.io), so path/git deps are excluded naturally because they have no source line.
Types ¶
type Cache ¶
type Cache interface {
Get(ctx context.Context, key string) (string, error)
Set(ctx context.Context, key string, value string, ttl time.Duration) error
}
Cache provides a simple key-value cache interface for registry lookups.
type CachedRegistry ¶
type CachedRegistry struct {
// contains filtered or unexported fields
}
CachedRegistry wraps a Registry with cache-backed lookups. On cache miss or error, it falls back to the inner registry.
func NewCachedRegistry ¶
NewCachedRegistry returns a Registry that caches results from inner.
type CratesRegistry ¶
CratesRegistry queries the crates.io registry.
type Dependency ¶
type Dependency struct {
Name string `json:"name"`
Version string `json:"version"`
Language string `json:"language"`
}
Dependency represents a single declared dependency in a manifest file.
func CollectDeps ¶
func CollectDeps(manifests []ManifestInfo) []Dependency
CollectDeps flattens all dependencies from multiple manifests into a single slice.
type FreshnessResult ¶
type FreshnessResult struct {
Total int `json:"total"`
UpToDate int `json:"upToDate"`
MinorOutdated int `json:"minorOutdated"`
MajorOutdated int `json:"majorOutdated"`
Ratio float64 `json:"ratio"`
RuntimeStatus string `json:"runtimeStatus"`
Outdated []OutdatedDep `json:"outdated,omitempty"`
}
FreshnessResult summarizes the freshness state of a project's dependencies.
func CheckFreshness ¶
func CheckFreshness(ctx context.Context, deps []Dependency, reg *MultiRegistry) *FreshnessResult
CheckFreshness checks all dependencies against their registries concurrently.
type GoRegistry ¶
GoRegistry queries the Go module proxy.
type ManifestInfo ¶
type ManifestInfo struct {
Language string `json:"language"`
RuntimeVersion string `json:"runtimeVersion,omitempty"`
Dependencies []Dependency `json:"dependencies"`
ManifestPath string `json:"manifestPath"`
}
ManifestInfo holds parsed metadata from a single manifest file.
func DiscoverManifests ¶
func DiscoverManifests(root string) []ManifestInfo
DiscoverManifests walks a directory tree and parses all recognized manifests.
func ParseCargoTomlFreshness ¶
func ParseCargoTomlFreshness(data []byte) ManifestInfo
ParseCargoTomlFreshness extracts dependencies with versions from Cargo.toml. Similar to polyglot.ParseCargoToml but includes version information.
func ParseCsproj ¶
func ParseCsproj(data []byte) ManifestInfo
ParseCsproj extracts dependencies from a .csproj file.
func ParseGemfile ¶
func ParseGemfile(data []byte) ManifestInfo
ParseGemfile extracts dependencies from a Ruby Gemfile. Uses line-based parsing for gem declarations.
func ParseGoMod ¶
func ParseGoMod(data []byte) ManifestInfo
ParseGoMod extracts dependencies and Go version from go.mod content.
func ParsePackageJSON ¶
func ParsePackageJSON(data []byte) ManifestInfo
ParsePackageJSON extracts dependencies from package.json content.
func ParsePomXML ¶
func ParsePomXML(data []byte) ManifestInfo
ParsePomXML extracts dependencies from Maven pom.xml content.
func ParsePyProject ¶
func ParsePyProject(data []byte) ManifestInfo
ParsePyProject extracts dependencies from pyproject.toml content. Uses line-based parsing to avoid adding a TOML library dependency.
func ParseRequirementsTxt ¶
func ParseRequirementsTxt(data []byte) ManifestInfo
ParseRequirementsTxt extracts dependencies from requirements.txt content.
type MavenRegistry ¶
MavenRegistry queries Maven Central.
type MultiRegistry ¶
type MultiRegistry struct {
// contains filtered or unexported fields
}
MultiRegistry maps language names to their registries.
func NewMultiRegistry ¶
func NewMultiRegistry(client *http.Client) *MultiRegistry
NewMultiRegistry creates a MultiRegistry with default registries for all languages.
func NewMultiRegistryWithCache ¶
func NewMultiRegistryWithCache(client *http.Client, cache Cache) *MultiRegistry
NewMultiRegistryWithCache creates a MultiRegistry, optionally wrapping each language registry with cache. Pass nil cache to skip caching.
func (*MultiRegistry) ForLanguage ¶
func (mr *MultiRegistry) ForLanguage(lang string) Registry
ForLanguage returns the registry for the given language, or nil if unsupported.
type NpmRegistry ¶
NpmRegistry queries the npm registry.
type NuGetRegistry ¶
NuGetRegistry queries the NuGet v3 flat container API.
type OutdatedDep ¶
type OutdatedDep struct {
Name string `json:"name"`
Current string `json:"current"`
Latest string `json:"latest"`
Kind string `json:"kind"` // "minor" or "major"
}
OutdatedDep describes a single outdated dependency.
type PyPIRegistry ¶
PyPIRegistry queries the Python Package Index.
type RubyGemsRegistry ¶
RubyGemsRegistry queries the RubyGems API.
type VulnDep ¶
type VulnDep struct {
Name string `json:"name"`
Version string `json:"version"`
ID string `json:"id"`
Severity string `json:"severity"`
Summary string `json:"summary"`
}
VulnDep describes a single vulnerability found in a dependency.
type VulnResult ¶
type VulnResult struct {
Total int `json:"total"`
Vulnerable int `json:"vulnerable"`
Critical int `json:"critical"`
High int `json:"high"`
Medium int `json:"medium"`
Low int `json:"low"`
Ratio float64 `json:"ratio"`
Vulns []VulnDep `json:"vulns,omitempty"`
}
VulnResult summarizes vulnerability scan results for a set of dependencies.
func CheckVulnerabilities ¶
func CheckVulnerabilities( ctx context.Context, deps []Dependency, client *http.Client, osvURL string, ) *VulnResult
CheckVulnerabilities checks all dependencies against OSV.dev concurrently.