cve

package

v0.1.0-alpha.2 Latest Latest Go to latest Published: Jun 25, 2026 License: Apache-2.0 Imports: 1 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/codefit-cli/codefit

Links

Open Source Insights

Documentation ¶

Overview ¶

Package cve checks project dependencies against known vulnerabilities via OSV.dev (PRD section 18, RF-09). codefit keeps NO vulnerability database of its own: on each scan it queries OSV.dev (free, no API key, aggregating the GitHub Advisory Database, Linux distro feeds and more), so the data is always fresh and maintained by infrastructure the whole world already runs.

Status: SKELETON. This declares the Dependency and Vulnerability types and the Client contract. The OSV.dev HTTP client is implemented in Fase 1.

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Client ¶

type Client interface {
	Query(ctx context.Context, deps []Dependency) (map[string][]Vulnerability, error)
}

Client queries OSV.dev for the vulnerabilities affecting a set of dependencies.

Skeleton: no implementation yet (Fase 1).

type Dependency ¶

type Dependency struct {
	Name      string
	Version   string
	Ecosystem string
}

Dependency is one parsed project dependency (from go.mod, package.json, ...) at an exact version, in its ecosystem (OSV.dev uses the ecosystem to scope the query, e.g. "Go", "npm", "PyPI").

type Vulnerability ¶

type Vulnerability struct {
	ID         string // e.g. "GHSA-..." or "CVE-..."
	Summary    string
	Severity   string // CVSS-derived
	FixedIn    string // first fixed version, if known
	References []string
}

Vulnerability is a known vulnerability OSV.dev reports for a dependency.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL