freshness

package
v1.31.4 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 14, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Overview

Package freshness parses dependency manifest files for multiple languages and discovers them in repository directory trees.

Index

Constants

View Source
const (
	DefaultGoProxyURL  = "https://proxy.golang.org"
	DefaultNpmURL      = "https://registry.npmjs.org"
	DefaultPyPIURL     = "https://pypi.org"
	DefaultCratesURL   = "https://crates.io"
	DefaultMavenURL    = "https://search.maven.org"
	DefaultRubyGemsURL = "https://rubygems.org"
	DefaultNuGetURL    = "https://api.nuget.org"
)

Default base URLs for package registries.

View Source
const DefaultCacheTTL = 24 * time.Hour

Default TTL for cached registry lookups.

View Source
const DefaultGoDLURL = "https://go.dev/dl/?mode=json"

DefaultGoDLURL is the Go download API endpoint.

View Source
const DefaultOSVURL = "https://api.osv.dev/v1/query"

DefaultOSVURL is the default endpoint for the OSV.dev vulnerability API.

Variables

This section is empty.

Functions

func CheckGoRuntime

func CheckGoRuntime(ctx context.Context, client *http.Client, goVersion string) string

CheckGoRuntime compares the go.mod Go version against the latest stable release. Returns a status string: "current", "outdated (have X, latest Y)", or empty on error.

func EnrichWithCargoLock

func EnrichWithCargoLock(deps []Dependency, resolved map[string]string)

EnrichWithCargoLock overrides Dependency.Version for Rust deps using resolved versions from a parsed Cargo.lock map. Deps not present in the lock file are left unchanged.

func ParseCargoLock

func ParseCargoLock(data []byte) map[string]string

ParseCargoLock parses a Cargo.lock file and returns a map of crate name → resolved version. Only registry packages are included (those with a source field pointing to crates.io), so path/git deps are excluded naturally because they have no source line.

Types

type Cache

type Cache interface {
	Get(ctx context.Context, key string) (string, error)
	Set(ctx context.Context, key string, value string, ttl time.Duration) error
}

Cache provides a simple key-value cache interface for registry lookups.

type CachedRegistry

type CachedRegistry struct {
	// contains filtered or unexported fields
}

CachedRegistry wraps a Registry with cache-backed lookups. On cache miss or error, it falls back to the inner registry.

func NewCachedRegistry

func NewCachedRegistry(inner Registry, cache Cache, lang string, ttl time.Duration) *CachedRegistry

NewCachedRegistry returns a Registry that caches results from inner.

func (*CachedRegistry) Latest

func (c *CachedRegistry) Latest(ctx context.Context, name string) (string, error)

Latest returns the latest version for name, using cache when available. Cache errors are silently ignored — we fall back to the inner registry.

type CratesRegistry

type CratesRegistry struct {
	BaseURL string
	Client  *http.Client
}

CratesRegistry queries the crates.io registry.

func (*CratesRegistry) Latest

func (r *CratesRegistry) Latest(ctx context.Context, name string) (string, error)

Latest fetches the latest stable version from crates.io.

type Dependency

type Dependency struct {
	Name     string `json:"name"`
	Version  string `json:"version"`
	Language string `json:"language"`
}

Dependency represents a single declared dependency in a manifest file.

func CollectDeps

func CollectDeps(manifests []ManifestInfo) []Dependency

CollectDeps flattens all dependencies from multiple manifests into a single slice.

type FreshnessResult

type FreshnessResult struct {
	Total         int           `json:"total"`
	UpToDate      int           `json:"upToDate"`
	MinorOutdated int           `json:"minorOutdated"`
	MajorOutdated int           `json:"majorOutdated"`
	Ratio         float64       `json:"ratio"`
	RuntimeStatus string        `json:"runtimeStatus"`
	Outdated      []OutdatedDep `json:"outdated,omitempty"`
}

FreshnessResult summarizes the freshness state of a project's dependencies.

func CheckFreshness

func CheckFreshness(ctx context.Context, deps []Dependency, reg *MultiRegistry) *FreshnessResult

CheckFreshness checks all dependencies against their registries concurrently.

type GoRegistry

type GoRegistry struct {
	BaseURL string
	Client  *http.Client
}

GoRegistry queries the Go module proxy.

func (*GoRegistry) Latest

func (r *GoRegistry) Latest(ctx context.Context, name string) (string, error)

Latest fetches the latest version from the Go proxy.

type ManifestInfo

type ManifestInfo struct {
	Language       string       `json:"language"`
	RuntimeVersion string       `json:"runtimeVersion,omitempty"`
	Dependencies   []Dependency `json:"dependencies"`
	ManifestPath   string       `json:"manifestPath"`
}

ManifestInfo holds parsed metadata from a single manifest file.

func DiscoverManifests

func DiscoverManifests(root string) []ManifestInfo

DiscoverManifests walks a directory tree and parses all recognized manifests.

func ParseCargoTomlFreshness

func ParseCargoTomlFreshness(data []byte) ManifestInfo

ParseCargoTomlFreshness extracts dependencies with versions from Cargo.toml. Similar to polyglot.ParseCargoToml but includes version information.

func ParseCsproj

func ParseCsproj(data []byte) ManifestInfo

ParseCsproj extracts dependencies from a .csproj file.

func ParseGemfile

func ParseGemfile(data []byte) ManifestInfo

ParseGemfile extracts dependencies from a Ruby Gemfile. Uses line-based parsing for gem declarations.

func ParseGoMod

func ParseGoMod(data []byte) ManifestInfo

ParseGoMod extracts dependencies and Go version from go.mod content.

func ParsePackageJSON

func ParsePackageJSON(data []byte) ManifestInfo

ParsePackageJSON extracts dependencies from package.json content.

func ParsePomXML

func ParsePomXML(data []byte) ManifestInfo

ParsePomXML extracts dependencies from Maven pom.xml content.

func ParsePyProject

func ParsePyProject(data []byte) ManifestInfo

ParsePyProject extracts dependencies from pyproject.toml content. Uses line-based parsing to avoid adding a TOML library dependency.

func ParseRequirementsTxt

func ParseRequirementsTxt(data []byte) ManifestInfo

ParseRequirementsTxt extracts dependencies from requirements.txt content.

type MavenRegistry

type MavenRegistry struct {
	BaseURL string
	Client  *http.Client
}

MavenRegistry queries Maven Central.

func (*MavenRegistry) Latest

func (r *MavenRegistry) Latest(ctx context.Context, name string) (string, error)

Latest fetches the latest version from Maven Central. Name must be in "groupId:artifactId" format.

type MultiRegistry

type MultiRegistry struct {
	// contains filtered or unexported fields
}

MultiRegistry maps language names to their registries.

func NewMultiRegistry

func NewMultiRegistry(client *http.Client) *MultiRegistry

NewMultiRegistry creates a MultiRegistry with default registries for all languages.

func NewMultiRegistryWithCache

func NewMultiRegistryWithCache(client *http.Client, cache Cache) *MultiRegistry

NewMultiRegistryWithCache creates a MultiRegistry, optionally wrapping each language registry with cache. Pass nil cache to skip caching.

func (*MultiRegistry) ForLanguage

func (mr *MultiRegistry) ForLanguage(lang string) Registry

ForLanguage returns the registry for the given language, or nil if unsupported.

type NpmRegistry

type NpmRegistry struct {
	BaseURL string
	Client  *http.Client
}

NpmRegistry queries the npm registry.

func (*NpmRegistry) Latest

func (r *NpmRegistry) Latest(ctx context.Context, name string) (string, error)

Latest fetches the latest version from npm.

type NuGetRegistry

type NuGetRegistry struct {
	BaseURL string
	Client  *http.Client
}

NuGetRegistry queries the NuGet v3 flat container API.

func (*NuGetRegistry) Latest

func (r *NuGetRegistry) Latest(ctx context.Context, name string) (string, error)

Latest fetches the latest version from NuGet.

type OutdatedDep

type OutdatedDep struct {
	Name    string `json:"name"`
	Current string `json:"current"`
	Latest  string `json:"latest"`
	Kind    string `json:"kind"` // "minor" or "major"
}

OutdatedDep describes a single outdated dependency.

type PyPIRegistry

type PyPIRegistry struct {
	BaseURL string
	Client  *http.Client
}

PyPIRegistry queries the Python Package Index.

func (*PyPIRegistry) Latest

func (r *PyPIRegistry) Latest(ctx context.Context, name string) (string, error)

Latest fetches the latest version from PyPI.

type Registry

type Registry interface {
	Latest(ctx context.Context, name string) (string, error)
}

Registry looks up the latest version of a package.

type RubyGemsRegistry

type RubyGemsRegistry struct {
	BaseURL string
	Client  *http.Client
}

RubyGemsRegistry queries the RubyGems API.

func (*RubyGemsRegistry) Latest

func (r *RubyGemsRegistry) Latest(ctx context.Context, name string) (string, error)

Latest fetches the latest version from RubyGems.

type VulnDep

type VulnDep struct {
	Name     string `json:"name"`
	Version  string `json:"version"`
	ID       string `json:"id"`
	Severity string `json:"severity"`
	Summary  string `json:"summary"`
}

VulnDep describes a single vulnerability found in a dependency.

type VulnResult

type VulnResult struct {
	Total      int       `json:"total"`
	Vulnerable int       `json:"vulnerable"`
	Critical   int       `json:"critical"`
	High       int       `json:"high"`
	Medium     int       `json:"medium"`
	Low        int       `json:"low"`
	Ratio      float64   `json:"ratio"`
	Vulns      []VulnDep `json:"vulns,omitempty"`
}

VulnResult summarizes vulnerability scan results for a set of dependencies.

func CheckVulnerabilities

func CheckVulnerabilities(
	ctx context.Context,
	deps []Dependency,
	client *http.Client,
	osvURL string,
) *VulnResult

CheckVulnerabilities checks all dependencies against OSV.dev concurrently.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL