Documentation
¶
Overview ¶
Package scaview renders one dependency's security picture as text.
It exists so the editor, the terminal and a coding agent cannot tell different stories about the same package. The language server builds a Subject from its workspace engine; the agent hook builds one from a single lookup; both call the same Card and Headline. A wording change lands in every surface at once, and a difference between them becomes impossible rather than merely unlikely.
Everything here is pure: no network, no settings lookup, no engine state. The caller resolves what it knows and hands over the answer, including the distinction between "asked and found nothing" and "did not ask" — see Fix and ExploitsGated, which exist for exactly that.
Index ¶
- func CVEIDs(vulns []scan.EnrichedVuln) []string
- func Card(s Subject) string
- func CountBySeverity(vulns []scan.EnrichedVuln) map[string]int
- func Headline(s Subject) string
- func IsCVE(id string) bool
- func LessSevere(a, b scan.EnrichedVuln) bool
- func NormaliseSeverity(severity string) string
- func PluralVulns(n int) string
- func SeverityKnown(severity string) bool
- func SeverityRank(severity string) int
- func SeveritySplit(counts map[string]int) string
- func TopVuln(vulns []scan.EnrichedVuln) scan.EnrichedVuln
- func WorstSeverity(vulns []scan.EnrichedVuln) string
- type Fix
- type FixState
- type Insight
- type Pkg
- type Subject
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CVEIDs ¶
func CVEIDs(vulns []scan.EnrichedVuln) []string
CVEIDs lists the distinct identifiers attributed to a line, sorted so the order is stable across scans.
func Card ¶
Card renders the full dependency card as Markdown.
A clean package still earns a card: the reassurance is the point of having checked.
func CountBySeverity ¶
func CountBySeverity(vulns []scan.EnrichedVuln) map[string]int
CountBySeverity tallies advisories by normalised severity label.
func Headline ¶
Headline renders the one-line message: what a reader scans for first, then how bad, then something to search.
When the vulnerability is transitive the message says so rather than implying the named package is itself vulnerable.
func LessSevere ¶
func LessSevere(a, b scan.EnrichedVuln) bool
LessSevere reports whether a ranks below b, using the same ordering as TopVuln so a card's list and its headline agree.
func NormaliseSeverity ¶
NormaliseSeverity folds vendor spellings onto the five labels used here.
func SeverityKnown ¶
SeverityKnown reports whether a label is one of the five this package ranks. An unrecognised severity floor is not a reason to hide anything, so callers filtering by severity check this before applying a rank comparison.
func SeverityRank ¶
SeverityRank orders severities worst-first, so a lower rank is more severe.
func SeveritySplit ¶
SeveritySplit renders "2 critical, 3 high", omitting the tail that carries no information: a reader deciding whether to act does not need the low count.
func TopVuln ¶
func TopVuln(vulns []scan.EnrichedVuln) scan.EnrichedVuln
TopVuln picks the one vulnerability to name in a one-line message: most severe, then known-exploited, then a CVE over a database-specific identifier, then highest exploit count, then newest identifier.
The CVE preference sits ahead of the exploit count rather than after it. The same advisory routinely arrives under both a CVE and a GHSA with different per-source exploit tallies, so ranking on the tally first picks a name by an accident of which database recorded more. The CVE is the name that appears in advisories, tickets and news, so it is the one worth showing.
The last tiebreak is not arbitrary either. Among equally severe advisories the more recent one is the more useful thing to name, and ordering by identifier keeps the choice stable across scans.
func WorstSeverity ¶
func WorstSeverity(vulns []scan.EnrichedVuln) string
WorstSeverity returns the most severe normalised label across the set.
Types ¶
type Fix ¶
type Fix struct {
State FixState
// Target is the version to bump to, set only when State is FixAvailable.
Target string
// Reason explains a FixNone, or annotates a FixAvailable when the server
// supplied a rationale.
Reason string
}
Fix is the resolved upgrade recommendation.
type FixState ¶
type FixState int
FixState distinguishes the four ways a fix recommendation can be absent, all of which render as nothing at all if collapsed into one.
const ( // FixNotApplicable means the package is clean, so there is nothing to fix. FixNotApplicable FixState = iota // FixPending means the Safe-Harbour lookup has not answered yet. FixPending // FixGated means the server withheld ranked versions on this plan. Reporting // this as FixNone would tell someone no fix exists when one may well. FixGated // FixNone means the lookup ran and there is genuinely no usable target. FixNone // FixAvailable means Target holds a version worth bumping to. FixAvailable )
type Insight ¶
type Insight struct {
Malicious bool
EOL bool
// EOLFrom is the date support ended, when known.
EOLFrom string
}
Insight carries the flags that are not vulnerabilities but change what the right action is.
type Pkg ¶
Pkg identifies the dependency being described.
func (Pkg) Label ¶
Label renders the package the way a reader would write it.
The version is omitted when there is not one, rather than rendered as a bare separator. An agent asking about a package it has not pinned yet produces exactly that case, and "left-pad@" reads as a truncation rather than as the absence of a pin.
type Subject ¶
type Subject struct {
Pkg Pkg
// Vulns is every advisory attributed to this line, including those rolled up
// from transitive packages.
Vulns []scan.EnrichedVuln
// OwnVulns counts the advisories against this package itself. When it is
// zero and Introduced is not, the package is the route to a problem rather
// than the problem, and the text says so.
OwnVulns int
// Introduced names the transitive packages rolled up onto this line, as
// "name@version".
Introduced []string
// ExploitsGated records that the server withheld exploit intelligence rather
// than reporting none. The two are the same empty section and opposite
// claims.
ExploitsGated bool
Fix Fix
Insight *Insight
}
Subject is everything the renderers need about one dependency.
Source Files