Documentation
¶
Overview ¶
Package cve checks project dependencies against known vulnerabilities via OSV.dev (PRD section 18, RF-09). codefit keeps NO vulnerability database of its own: on each scan it queries OSV.dev (free, no API key, aggregating the GitHub Advisory Database, Linux distro feeds and more), so the data is always fresh and maintained by infrastructure the whole world already runs.
Status: SKELETON — implementation pending (RF-09). This declares the Dependency and Vulnerability types and the Client contract only; the OSV.dev HTTP client and the dependency-manifest parsing are not implemented yet.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client interface {
Query(ctx context.Context, deps []Dependency) (map[string][]Vulnerability, error)
}
Client queries OSV.dev for the vulnerabilities affecting a set of dependencies, keyed by "name@version". The default implementation is NewOSVClient.
func NewOSVClient ¶ added in v0.1.4
NewOSVClient returns a Client backed by OSV.dev.
type Dependency ¶
Dependency is one parsed project dependency (from go.mod, package.json, ...) at an exact version, in its ecosystem (OSV.dev uses the ecosystem to scope the query, e.g. "Go", "npm", "PyPI").
type ManifestScan ¶ added in v0.1.4
type ManifestScan struct {
Dependencies []Dependency
Notes []string
}
ManifestScan is the result of reading a project's dependency manifests: the exact-versioned dependencies found, plus honest notes about anything that could NOT be resolved (a manifest present without its lockfile, or no manifest at all), so the caller never mistakes "no dependencies parsed" for "no dependencies present".
func ParseManifests ¶ added in v0.1.4
func ParseManifests(root string) (ManifestScan, error)
ParseManifests reads the supported dependency manifests at the project root and returns the exact-versioned dependencies across ecosystems. Version resolution is from LOCKFILES / go.mod only (RF-09 decision A): the ranges in package.json are never resolved — codefit reports what is pinned, not a guess. A manifest present but unparseable is a loud error (never silently dropped); an absent manifest is fine and recorded as a note.
Known limits (declared): only package-lock.json (npm) and go.mod (Go) are read at the project root — yarn/pnpm lockfiles and nested/monorepo manifests are not yet covered.
type OSVOption ¶ added in v0.1.4
type OSVOption func(*osvClient)
OSVOption configures an osvClient.
func WithBaseURL ¶ added in v0.1.4
WithBaseURL overrides the OSV API base URL (used by tests to point at a mock).
func WithHTTPClient ¶ added in v0.1.4
WithHTTPClient overrides the HTTP client (timeouts, transport).
Source Files