scan

package
v3.56.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 10, 2026 License: AGPL-3.0 Imports: 36 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// ConfidenceConfident: a clear requirements file — matched by name pattern or
	// by content carrying requirement syntax (version specs, --hash=, pip
	// directives). The build-or-lock gate treats these as definitive: an
	// unresolvable confident file is a fatal error.
	ConfidenceConfident = "confident"
	// ConfidenceTentative: an ambiguous file that is only bare package names. It is
	// confirmed a requirements file only by cross-checking its names against
	// installed packages; if it can't be confirmed it is silently disregarded.
	ConfidenceTentative = "tentative"
)

Detection confidence for content/name-detected pip requirements files.

View Source 
const (
	ScopeProduction  = parse.ScopeProduction
	ScopeDevelopment = parse.ScopeDevelopment
	ScopeTest        = parse.ScopeTest
	ScopePeer        = parse.ScopePeer
	ScopeOptional    = parse.ScopeOptional
	ScopeProvided    = parse.ScopeProvided
	ScopeRuntime     = parse.ScopeRuntime
	ScopeSystem      = parse.ScopeSystem
)
View Source 
const (
	SourceTypeManifest  = parse.SourceTypeManifest
	SourceTypeInstalled = parse.SourceTypeInstalled
)
View Source 
const MBRecentURL = "https://mb-api.abuse.ch/v2/files/exports/3a16bf5b8b1bfb83f8cd9286b7e2b4f18257cd23f3d475bf/sha256_recent.txt"

MBRecentURL is the MalwareBazaar recent SHA-256 corpus (last 30 days).

Variables

View Source 
var ManifestExtensions = map[string]ManifestInfo{
	".csproj":        {Type: "*.csproj", Ecosystem: "nuget", Language: "c#", IsLock: false},
	".fsproj":        {Type: "*.csproj", Ecosystem: "nuget", Language: "f#", IsLock: false},
	".vbproj":        {Type: "*.csproj", Ecosystem: "nuget", Language: "vb", IsLock: false},
	".tf":            {Type: "*.tf", Ecosystem: "terraform", Language: "hcl", IsLock: false},
	".opam":          {Type: "*.opam", Ecosystem: "opam", Language: "ocaml", IsLock: false},
	".cabal":         {Type: "*.cabal", Ecosystem: "cabal", Language: "haskell", IsLock: false},
	".dockerfile":    {Type: "Dockerfile", Ecosystem: "docker", Language: "docker", IsLock: false},
	".containerfile": {Type: "Dockerfile", Ecosystem: "docker", Language: "docker", IsLock: false},
}

ManifestExtensions maps file extensions to manifest metadata. Used for files whose names include a project-specific prefix (e.g. foo.csproj, main.tf).

View Source 
var ManifestFiles = map[string]ManifestInfo{

	"package-lock.json":   {Type: "package-lock.json", Ecosystem: "npm", Language: "javascript", IsLock: true},
	"npm-shrinkwrap.json": {Type: "package-lock.json", Ecosystem: "npm", Language: "javascript", IsLock: true},
	"package.json":        {Type: "package.json", Ecosystem: "npm", Language: "javascript", IsLock: false},
	"yarn.lock":           {Type: "yarn.lock", Ecosystem: "npm", Language: "javascript", IsLock: true},
	"pnpm-lock.yaml":      {Type: "pnpm-lock.yaml", Ecosystem: "npm", Language: "javascript", IsLock: true},

	"pyproject.toml":   {Type: "pyproject.toml", Ecosystem: "pypi", Language: "python", IsLock: false},
	"requirements.txt": {Type: "requirements.txt", Ecosystem: "pypi", Language: "python", IsLock: false},
	"requirements.in":  {Type: "requirements.in", Ecosystem: "pypi", Language: "python", IsLock: false},
	"setup.py":         {Type: "setup.py", Ecosystem: "pypi", Language: "python", IsLock: false},
	"setup.cfg":        {Type: "setup.cfg", Ecosystem: "pypi", Language: "python", IsLock: false},
	"Pipfile":          {Type: "Pipfile", Ecosystem: "pypi", Language: "python", IsLock: false},
	"Pipfile.lock":     {Type: "Pipfile.lock", Ecosystem: "pypi", Language: "python", IsLock: true},
	"poetry.lock":      {Type: "poetry.lock", Ecosystem: "pypi", Language: "python", IsLock: true},
	"uv.lock":          {Type: "uv.lock", Ecosystem: "pypi", Language: "python", IsLock: true},
	"pylock.toml":      {Type: "pylock.toml", Ecosystem: "pypi", Language: "python", IsLock: true},

	"environment.yml":  {Type: "environment.yml", Ecosystem: "conda", Language: "python", IsLock: false},
	"environment.yaml": {Type: "environment.yml", Ecosystem: "conda", Language: "python", IsLock: false},

	"go.sum": {Type: "go.sum", Ecosystem: "golang", Language: "go", IsLock: true},
	"go.mod": {Type: "go.mod", Ecosystem: "golang", Language: "go", IsLock: false},

	"Gemfile":      {Type: "Gemfile", Ecosystem: "rubygems", Language: "ruby", IsLock: false},
	"Gemfile.lock": {Type: "Gemfile.lock", Ecosystem: "rubygems", Language: "ruby", IsLock: true},

	"Cargo.toml": {Type: "Cargo.toml", Ecosystem: "cargo", Language: "rust", IsLock: false},
	"Cargo.lock": {Type: "Cargo.lock", Ecosystem: "cargo", Language: "rust", IsLock: true},

	"pom.xml":         {Type: "pom.xml", Ecosystem: "maven", Language: "java", IsLock: false},
	"build.gradle":    {Type: "build.gradle", Ecosystem: "maven", Language: "java", IsLock: false},
	"gradle.lockfile": {Type: "gradle.lockfile", Ecosystem: "maven", Language: "java", IsLock: true},

	"build.gradle.kts": {Type: "build.gradle.kts", Ecosystem: "maven", Language: "kotlin", IsLock: false},

	"composer.json": {Type: "composer.json", Ecosystem: "composer", Language: "php", IsLock: false},
	"composer.lock": {Type: "composer.lock", Ecosystem: "composer", Language: "php", IsLock: true},

	"packages.lock.json": {Type: "packages.lock.json", Ecosystem: "nuget", Language: "c#", IsLock: true},
	"packages.config":    {Type: "packages.config", Ecosystem: "nuget", Language: "c#", IsLock: false},
	"paket.dependencies": {Type: "paket.dependencies", Ecosystem: "nuget", Language: "c#", IsLock: false},
	"paket.lock":         {Type: "paket.lock", Ecosystem: "nuget", Language: "c#", IsLock: true},

	"Package.swift":    {Type: "Package.swift", Ecosystem: "swift", Language: "swift", IsLock: false},
	"Package.resolved": {Type: "Package.resolved", Ecosystem: "swift", Language: "swift", IsLock: true},

	"pubspec.yaml": {Type: "pubspec.yaml", Ecosystem: "pub", Language: "dart", IsLock: false},
	"pubspec.lock": {Type: "pubspec.lock", Ecosystem: "pub", Language: "dart", IsLock: true},

	"mix.exs":  {Type: "mix.exs", Ecosystem: "hex", Language: "elixir", IsLock: false},
	"mix.lock": {Type: "mix.lock", Ecosystem: "hex", Language: "elixir", IsLock: true},

	"build.sbt":  {Type: "build.sbt", Ecosystem: "maven", Language: "scala", IsLock: false},
	"build.lock": {Type: "build.lock", Ecosystem: "maven", Language: "scala", IsLock: true},
	"build.sc":   {Type: "build.sc", Ecosystem: "maven", Language: "scala", IsLock: false},

	"project.clj": {Type: "project.clj", Ecosystem: "clojars", Language: "clojure", IsLock: false},
	"deps.edn":    {Type: "deps.edn", Ecosystem: "clojars", Language: "clojure", IsLock: false},
	"bb.edn":      {Type: "deps.edn", Ecosystem: "clojars", Language: "clojure", IsLock: false},

	"Dockerfile":          {Type: "Dockerfile", Ecosystem: "docker", Language: "docker", IsLock: false},
	"Containerfile":       {Type: "Dockerfile", Ecosystem: "docker", Language: "docker", IsLock: false},
	"Gockerfile":          {Type: "Dockerfile", Ecosystem: "docker", Language: "docker", IsLock: false},
	"Pkgfile":             {Type: "Dockerfile", Ecosystem: "docker", Language: "docker", IsLock: false},
	"compose.yaml":        {Type: "compose.yaml", Ecosystem: "docker", Language: "docker", IsLock: false},
	"compose.yml":         {Type: "compose.yaml", Ecosystem: "docker", Language: "docker", IsLock: false},
	"docker-compose.yaml": {Type: "compose.yaml", Ecosystem: "docker", Language: "docker", IsLock: false},
	"docker-compose.yml":  {Type: "compose.yaml", Ecosystem: "docker", Language: "docker", IsLock: false},
	"podman-compose.yaml": {Type: "compose.yaml", Ecosystem: "docker", Language: "docker", IsLock: false},
	"podman-compose.yml":  {Type: "compose.yaml", Ecosystem: "docker", Language: "docker", IsLock: false},

	"Chart.yaml": {Type: "Chart.yaml", Ecosystem: "helm", Language: "helm", IsLock: false},
	"Chart.yml":  {Type: "Chart.yaml", Ecosystem: "helm", Language: "helm", IsLock: false},

	".npmrc":              {Type: "registry-config", Ecosystem: "npm", Language: "registry-config", IsLock: false},
	".yarnrc":             {Type: "registry-config", Ecosystem: "npm", Language: "registry-config", IsLock: false},
	".yarnrc.yml":         {Type: "registry-config", Ecosystem: "npm", Language: "registry-config", IsLock: false},
	"settings.gradle":     {Type: "registry-config", Ecosystem: "maven", Language: "registry-config", IsLock: false},
	"settings.gradle.kts": {Type: "registry-config", Ecosystem: "maven", Language: "registry-config", IsLock: false},

	"WORKSPACE":       {Type: "WORKSPACE", Ecosystem: "bazel", Language: "starlark", IsLock: false},
	"WORKSPACE.bazel": {Type: "WORKSPACE", Ecosystem: "bazel", Language: "starlark", IsLock: false},
	"MODULE.bazel":    {Type: "MODULE.bazel", Ecosystem: "bazel", Language: "starlark", IsLock: false},
	"BUCK":            {Type: "BUCK", Ecosystem: "buck", Language: "starlark", IsLock: false},
	"BUCK2":           {Type: "BUCK2", Ecosystem: "buck", Language: "starlark", IsLock: false},

	"conanfile.txt": {Type: "conanfile.txt", Ecosystem: "conan", Language: "c++", IsLock: false},
	"conanfile.py":  {Type: "conanfile.py", Ecosystem: "conan", Language: "c++", IsLock: false},
	"conan.lock":    {Type: "conan.lock", Ecosystem: "conan", Language: "c++", IsLock: true},

	"vcpkg.json": {Type: "vcpkg.json", Ecosystem: "vcpkg", Language: "c++", IsLock: false},

	"Podfile":      {Type: "Podfile", Ecosystem: "cocoapods", Language: "swift", IsLock: false},
	"Podfile.lock": {Type: "Podfile.lock", Ecosystem: "cocoapods", Language: "swift", IsLock: true},

	"Cartfile":          {Type: "Cartfile", Ecosystem: "carthage", Language: "swift", IsLock: false},
	"Cartfile.resolved": {Type: "Cartfile.resolved", Ecosystem: "carthage", Language: "swift", IsLock: true},

	"Project.toml":  {Type: "Project.toml", Ecosystem: "julia", Language: "julia", IsLock: false},
	"Manifest.toml": {Type: "Manifest.toml", Ecosystem: "julia", Language: "julia", IsLock: true},

	"shard.yml":  {Type: "shard.yml", Ecosystem: "crystal", Language: "crystal", IsLock: false},
	"shard.lock": {Type: "shard.lock", Ecosystem: "crystal", Language: "crystal", IsLock: true},

	"deno.json": {Type: "deno.json", Ecosystem: "deno", Language: "typescript", IsLock: false},
	"deno.lock": {Type: "deno.lock", Ecosystem: "deno", Language: "typescript", IsLock: true},

	"DESCRIPTION": {Type: "DESCRIPTION", Ecosystem: "cran", Language: "r", IsLock: false},
	"renv.lock":   {Type: "renv.lock", Ecosystem: "cran", Language: "r", IsLock: true},

	"rebar.config": {Type: "rebar.config", Ecosystem: "erlang", Language: "erlang", IsLock: false},
	"rebar.lock":   {Type: "rebar.lock", Ecosystem: "erlang", Language: "erlang", IsLock: true},

	"stack.yaml": {Type: "stack.yaml", Ecosystem: "stack", Language: "haskell", IsLock: false},

	"cabal.project.freeze": {Type: "cabal.project.freeze", Ecosystem: "cabal", Language: "haskell", IsLock: true},

	"opam": {Type: "opam", Ecosystem: "opam", Language: "ocaml", IsLock: false},

	"flake.nix":  {Type: "flake.nix", Ecosystem: "nix", Language: "nix", IsLock: false},
	"flake.lock": {Type: "flake.lock", Ecosystem: "nix", Language: "nix", IsLock: true},

	"build.zig.zon": {Type: "build.zig.zon", Ecosystem: "zig", Language: "zig", IsLock: false},

	"CPM.cmake": {Type: "CPM.cmake", Ecosystem: "cpm", Language: "cmake", IsLock: false},

	"meson.build": {Type: "meson.build", Ecosystem: "meson", Language: "c", IsLock: false},
}

ManifestFiles maps known manifest filenames (exact basename) to their metadata.

View Source 
var SupportedManifestTypes = map[string]bool{

	"package.json":      true,
	"package-lock.json": true,
	"yarn.lock":         true,
	"pnpm-lock.yaml":    true,

	"pyproject.toml":   true,
	"requirements.txt": true,
	"requirements.in":  true,
	"setup.py":         true,
	"setup.cfg":        true,
	"Pipfile":          true,
	"Pipfile.lock":     true,
	"poetry.lock":      true,
	"uv.lock":          true,
	"pylock.toml":      true,

	"environment.yml": true,

	"go.sum": true,
	"go.mod": true,

	"Gemfile":      true,
	"Gemfile.lock": true,

	"Cargo.toml": true,
	"Cargo.lock": true,

	"pom.xml":          true,
	"build.gradle":     true,
	"gradle.lockfile":  true,
	"build.gradle.kts": true,

	"composer.json": true,
	"composer.lock": true,

	"packages.lock.json": true,
	"packages.config":    true,
	"paket.dependencies": true,
	"paket.lock":         true,
	"*.csproj":           true,

	"project.clj": true,
	"deps.edn":    true,

	"Package.swift":    true,
	"Package.resolved": true,

	"pubspec.yaml": true,
	"pubspec.lock": true,

	"mix.exs":  true,
	"mix.lock": true,

	"build.sbt":  true,
	"build.lock": true,
	"build.sc":   true,

	"Dockerfile":   true,
	"compose.yaml": true,

	"kubernetes.yaml": true,
	"Chart.yaml":      true,

	"*.tf": true,

	"github-actions.yml": true,

	"conanfile.txt": true,
	"conan.lock":    true,

	"vcpkg.json": true,

	"Podfile":      true,
	"Podfile.lock": true,

	"Cartfile":          true,
	"Cartfile.resolved": true,

	"Project.toml":  true,
	"Manifest.toml": true,

	"shard.yml":  true,
	"shard.lock": true,

	"deno.json": true,
	"deno.lock": true,

	"DESCRIPTION": true,
	"renv.lock":   true,

	"rebar.config": true,
	"rebar.lock":   true,

	"stack.yaml": true,

	"*.cabal":              true,
	"cabal.project.freeze": true,

	"*.opam": true,
	"opam":   true,

	"flake.nix":  true,
	"flake.lock": true,

	"build.zig.zon": true,

	"meson.build": true,

	"WORKSPACE":    true,
	"MODULE.bazel": true,

	"BUCK":  true,
	"BUCK2": true,

	"CPM.cmake":      true,
	"CMakeLists.txt": true,
}

SupportedManifestTypes lists manifest types that have a local parser implemented. Files detected but absent from this map are shown as "[not supported]" in scan output.

View Source 
var ValidExploitThresholds = []string{"poc", "active", "weaponized"}

ValidExploitThresholds lists the accepted values for the --exploits flag, in ascending order of exploit maturity (least → most dangerous).

View Source 
var ValidSeverityThresholds = []string{"low", "medium", "high", "critical"}

ValidSeverityThresholds lists the accepted --severity flag values in ascending order.

Functions

func BulkHashlookup added in v3.28.0 

func BulkHashlookup(ctx context.Context, sha1s []string) (map[string]*HashlookupResult, error)

BulkHashlookup sends a batch of SHA-1 hashes to the CIRCL hashlookup API and returns results keyed by SHA-1 hex string. Errors are non-fatal — partial results are returned alongside any error.

func CheckMalwareBazaarInMemory added in v3.28.0 

func CheckMalwareBazaarInMemory(corpus map[string]bool, sha256 string) bool

CheckMalwareBazaarInMemory checks whether a SHA-256 hash appears in an in-memory set of known-malicious hashes.

func CheckMalwareBazaarLocal added in v3.28.0 

func CheckMalwareBazaarLocal(corpusPath, sha256 string) (bool, error)

CheckMalwareBazaarLocal checks whether a SHA-256 hash appears in a local MalwareBazaar corpus file (one hex hash per line).

func ComputeEnrichedSeverities 

func ComputeEnrichedSeverities(ev *EnrichedVuln)

ComputeEnrichedSeverities fills the per-source severity fields and MaxSeverity on ev after all score data has been populated.

func DownloadMalwareBazaarRecent added in v3.28.0 

func DownloadMalwareBazaarRecent(ctx context.Context, destPath string) error

DownloadMalwareBazaarRecent fetches the MalwareBazaar recent corpus and saves it to destPath. Best-effort — errors are returned but should be treated as non-fatal by callers.

func EvaluateAffectedEntry added in v3.25.1 

func EvaluateAffectedEntry(am map[string]interface{}, installedVer, ecosystem string) (string, versions.Status, string)

EvaluateAffectedEntry determines the version status of installedVer against one affected entry from a V2Affected response. Evaluation order:

  1. Structured `versions` array (+ defaultStatus) — CVE 5.1 precedence via versions.EvaluateStatus, so an exact "unaffected" match beats an affected range.
  2. String fields: "unaffectedVersions" (checked first), then "versionRange" / legacy string "versions".
  3. Neither present — StatusUnknown (caller decides the posture).

Returns the range expression used for the verdict, the status, and a match-method label for MatchMethod reporting.

func ExploitMeetsThreshold 

func ExploitMeetsThreshold(ev EnrichedVuln, threshold string) bool

ExploitMeetsThreshold reports whether ev's exploit signals reach the given tier.

Tiers form a strict hierarchy — each tier also captures all higher-maturity signals: 

poc       : any public exploit exists (ExploitCount > 0, or any KEV entry)
active    : known active exploitation (InCisaKev || InVulnCheckKev || InEuKev || HasWeaponized)
weaponized: weaponised in-the-wild (ExploitIntel.HasWeaponized)

func HasAnyKev 

func HasAnyKev(ev EnrichedVuln) bool

HasAnyKev returns true if the vulnerability is listed in any KEV catalog (CISA, VulnCheck, or EU ENISA).

func IsPythonGatedManifest added in v3.40.0 

func IsPythonGatedManifest(manifestType string) bool

PyGatedManifestTypes are the Python manifest types the build-or-lock gate applies to: unpinned manifests that need a lock or an installed env to scan at exact versions. Lock files are never gated.

func IsVersionAffected 

func IsVersionAffected(installedVersion, versionRange, ecosystem string) bool

IsVersionAffected checks whether installedVersion falls within the affected version range string returned by the VDB API.

Supported range formats (full grammar in internal/versions): 

">= 2.0.0, < 2.3.1"      comma-separated AND constraints
"1.14.1, 0.30.4"         bare comma list — OR exact matches
"[2.0.0, 2.3.1)"         interval notation
"< 3.0.0"                single constraint
">= 1.0.0 < 2.0.0"       space-separated AND constraints
"< 2.11.2 || = 3.0.1"    "||"-separated OR ranges
"≥ 0.31.0 < 1.2.0"       unicode operators
"2.3.1"                  exact version match
"*"                      all versions

Returns true if the installed version IS affected. When parsing fails the function returns true (assume affected) to err on the side of caution.

func IsVersionSpecPinned 

func IsVersionSpecPinned(spec string) bool

IsVersionSpecPinned reports whether spec represents an exact version pin. An empty spec (e.g. lock-file entries) is treated as pinned. Specs that begin with range operators (^, ~, >=, >, <=, <, !=) or are symbolic (*, latest, x) are considered unpinned.

func LoadMalwareBazaarCorpusFromFile added in v3.28.0 

func LoadMalwareBazaarCorpusFromFile(path string) (map[string]bool, error)

LoadMalwareBazaarCorpusFromFile reads a corpus file (one hex hash per line) into an in-memory set for fast lookups. Lines beginning with # are treated as comments and skipped.

func NormaliseReleaseForEOL 

func NormaliseReleaseForEOL(product, version string) string

NormaliseReleaseForEOL reduces a full version string to the form expected by the VDB EOL API for the given product. 

go     : major.minor  ("1.21.3" → "1.21",  "1.21" → "1.21")
nodejs : major only   ("18.20.4" → "18",   "18" → "18")
python : major.minor  ("3.10.4"  → "3.10", "3.10" → "3.10")
ruby   : major.minor  ("3.2.1"   → "3.2",  "3.2"  → "3.2")

Returns "" if the version string cannot be parsed.

func NpmLockfilePresent added in v3.34.0 

func NpmLockfilePresent(packageJSONPath string) bool

NpmLockfilePresent reports whether a package.json has a sibling npm-family lockfile. The no-lock installed resolver only runs when this returns false.

func ParseRemediationScores 

func ParseRemediationScores(data map[string]interface{}, ev *EnrichedVuln)

ParseRemediationScores extracts scores from the remediation plan response into the EnrichedVuln. These are displayed but not used for primary sorting.

func PopulateInstalledEdges 

func PopulateInstalledEdges(groups []ManifestGroup, rootPath string)

PopulateInstalledEdges attempts to build dependency graph edges for each manifest group by reading locally installed package manifests. This enriches both SBOM dependency trees and --paths output. Errors are silently skipped.

func PyLockfilePresent added in v3.40.0 

func PyLockfilePresent(dir string) bool

PyLockfilePresent reports whether dir contains any Python lock file. When one exists the lock is scanned with exact versions, so an unpinned sibling manifest does not need resolving from the installed environment.

func RequirementsFullyLocked added in v3.40.0 

func RequirementsFullyLocked(pkgs []ScopedPackage) bool

RequirementsFullyLocked reports whether every package is pinned enough to scan without consulting the installed environment: an exact version pin OR integrity hashes (pip freeze / pip-compile / pylock output). A bare name (no version, no hash) is not locked — its empty VersionSpec must not be mistaken for a pin.

func SSVCToSeverity 

func SSVCToSeverity(decision string) string

SSVCToSeverity maps an SSVC decision string to an approximate severity label. SSVC decisions are: Act, Attend, Track*, Track, Defer.

func ScopeIcon 

func ScopeIcon(scope string) string

ScopeIcon returns a display icon for a scope category.

func ScoreToSeverity 

func ScoreToSeverity(scoreType string, score float64) string

ScoreToSeverity converts a numeric score of a given type to a severity label. Supported types: epss, coalition_ess (cess), cvss* variants. Returns "unscored" when the type is unrecognised or the score is zero.

func SeverityLevel 

func SeverityLevel(severity string) int

SeverityLevel returns a numeric level for severity (higher = more severe). Used for threshold comparisons. 

unscored → 0
low      → 1
medium   → 2
high     → 3
critical → 4

func SeverityMeetsThreshold 

func SeverityMeetsThreshold(severity, threshold string) bool

SeverityMeetsThreshold reports whether the given severity meets or exceeds the threshold severity. "unscored" never triggers the threshold. Examples: 

SeverityMeetsThreshold("critical", "high")  → true
SeverityMeetsThreshold("medium",   "high")  → false
SeverityMeetsThreshold("high",     "high")  → true
SeverityMeetsThreshold("unscored", "low")   → false

func SynthesiseFromCDX added in v3.6.0 

func SynthesiseFromCDX(cdxDoc map[string]any, packages []ScopedPackage, purls []string) (findings []VulnFinding, enriched []EnrichedVuln, stats *LookupStats)

SynthesiseFromCDX converts an upstream CycloneDX 1.6 document into the internal finding shapes. Returns nil slices when the document is empty or malformed — callers should treat a nil result as "fall back to legacy".

packages and purls are parallel arrays — `purls[i]` is the PURL the caller computed (via cdx.BuildLocalPurl) for `packages[i]`. Empty purl entries are silently ignored. Keeping the purl derivation outside this package avoids a scan→cdx import cycle.

func ValidateAnalyzeRequest added in v3.28.0 

func ValidateAnalyzeRequest(body []byte) error

ValidateAnalyzeRequest validates a marshalled /v2/cli.analyze request body against the embedded JSON schema. A nil error means the body is well-formed; a non-nil error describes the first schema violations. A schema-compile failure (packaging bug) is returned as an error too, so callers can decide whether to proceed.

func VerifyLocationGone added in v3.2.0 

func VerifyLocationGone(rootPath string, loc memory.Location, lineSlack int) (bool, string)

VerifyLocationGone returns true when the finding evidence at loc is no longer present on disk. "Gone" means: the file is missing, OR the original snippet is not found within a ±lineSlack window around loc.StartLine.

rootPath is prepended when loc.File is relative. When loc.Snippet is empty (older records without snippet capture) the verifier returns gone=false so the caller leaves the record untouched — we never auto-resolve on a guess.

Types

type AffectedSymbols added in v3.6.0 

type AffectedSymbols struct {
	Routines []string
	Files    []string
	Modules  []string
}

AffectedSymbols carries the lower-efficacy symbol-level fallback shipped on every cli.sca response (all tiers). The CLI greps local source for these literal names to emit a "grep-match" reachability signal when the higher-efficacy tree-sitter path has no queries for the CVE.

func (*AffectedSymbols) HasAny added in v3.6.0 

func (a *AffectedSymbols) HasAny() bool

HasAny returns true if any list is populated.

type BinaryAnalysis added in v3.28.0 

type BinaryAnalysis struct {
	Path         string         `json:"path"`
	Size         int64          `json:"size"`
	ModTime      int64          `json:"modTime,omitempty"`
	ELFType      string         `json:"elfType,omitempty"`
	ELFArch      string         `json:"elfArch,omitempty"`
	ELFOSABI     string         `json:"elfOSABI,omitempty"`
	Hashes       BinaryHashes   `json:"hashes"`
	Weaknesses   []string       `json:"weaknesses,omitempty"`
	Capabilities []string       `json:"capabilities,omitempty"`
	Strings      []string       `json:"strings,omitempty"`
	Exif         map[string]any `json:"exif,omitempty"`
	Error        string         `json:"error,omitempty"`
}

BinaryAnalysis is the complete local analysis of one ELF binary.

type BinaryHashes added in v3.28.0 

type BinaryHashes struct {
	SHA256    string `json:"sha256"`
	MD5       string `json:"md5"`
	SHA1      string `json:"sha1"`
	SSDEEP    string `json:"ssdeep,omitempty"`
	TLSH      string `json:"tlsh,omitempty"`
	SHA256Raw string `json:"sha256Raw,omitempty"`
	MD5Raw    string `json:"md5Raw,omitempty"`
	SHA1Raw   string `json:"sha1Raw,omitempty"`
}

BinaryHashes carries every hash computed for one ELF binary.

type BinaryResult added in v3.28.0 

type BinaryResult struct {
	Path          string               `json:"path"`
	Size          int64                `json:"size"`
	ELFType       string               `json:"elfType,omitempty"`
	ELFArch       string               `json:"elfArch,omitempty"`
	ELFOSABI      string               `json:"elfOSABI,omitempty"`
	Hashes        BinaryHashes         `json:"hashes"`
	Weaknesses    []string             `json:"weaknesses,omitempty"`
	Capabilities  []string             `json:"capabilities,omitempty"`
	Strings       []string             `json:"strings,omitempty"`
	Exif          map[string]any       `json:"exif,omitempty"`
	Hashlookup    *HashlookupResult    `json:"hashlookup,omitempty"`
	MalwareBazaar *MalwareBazaarResult `json:"malwareBazaar,omitempty"`
}

BinaryResult is the wire shape sent to /v2/cli.analyze — BinaryAnalysis plus external lookup results.

type DepGraph 

type DepGraph struct {
	DirectDeps map[string]ScopedPackage     // name → direct dependency
	AllDeps    map[string]ScopedPackage     // name → any dependency (direct or transitive)
	Edges      map[string][]string          // parent module name → child module names (from go mod graph, etc.)
	EdgeRanges map[string]map[string]string // parent → child → declared range, when the lock/manifest exposes it
	// contains filtered or unexported fields
}

DepGraph tracks direct vs transitive dependency relationships for a manifest group. A manifest group is a set of related files in the same directory (e.g., go.mod + go.sum).

func BuildGenericDepGraph 

func BuildGenericDepGraph(directPkgs, lockPkgs []ScopedPackage) *DepGraph

BuildGenericDepGraph is a generic build graph correlator for ecosystems that have a simple direct manifest + lock file relationship (e.g., Cargo.toml/Cargo.lock).

func BuildGoDepGraph 

func BuildGoDepGraph(goModPkgs, goSumPkgs []ScopedPackage) *DepGraph

BuildGoDepGraph correlates go.mod (direct) and go.sum (all) packages from the same directory to determine which dependencies are direct vs transitive.

func BuildNpmDepGraph 

func BuildNpmDepGraph(pkgJsonPkgs, lockPkgs []ScopedPackage) *DepGraph

BuildNpmDepGraph correlates package.json (direct) and package-lock.json (all) packages from the same directory.

func BuildPypiDepGraph 

func BuildPypiDepGraph(directPkgs, lockPkgs []ScopedPackage) *DepGraph

BuildPypiDepGraph correlates pyproject.toml (direct) and lock files (uv.lock, poetry.lock, Pipfile.lock) to classify direct vs transitive dependencies. Package name comparison is case-folded and normalises dashes/underscores to handle the common PyPI naming quirks.

func (*DepGraph) DirectCount 

func (g *DepGraph) DirectCount() int

DirectCount returns the number of direct dependencies.

func (*DepGraph) FindPath 

func (g *DepGraph) FindPath(targetPkg string) []string

FindPath returns the shortest dependency chain from any direct dep to targetPkg. Returns nil if no path exists or edge data is unavailable. The returned slice is the chain: [direct-dep, intermediate, ..., targetPkg].

func (*DepGraph) FindPathMemo added in v3.32.1 

func (g *DepGraph) FindPathMemo(target string) []string

FindPathMemo is a memoised FindPath. The shortest chain to a given package is identical no matter which vulnerability references it, yet the display path was previously recomputed per finding (and again by the pretty-printer), making the introduced-paths render O(vulns × manifests × BFS). Callers share one *DepGraph, so caching on the graph collapses that to one BFS per distinct package.

Not safe for concurrent use; FindPath is only ever called from the sequential enrichment and rendering loops, consistent with the rest of DepGraph.

func (*DepGraph) IsDirect 

func (g *DepGraph) IsDirect(pkgName string) bool

IsDirect returns true if the package was declared directly in the manifest. For PyPI packages, name lookup is also attempted with dash/underscore/case normalisation so that e.g. "PyYAML" matches a key stored as "pyyaml".

func (*DepGraph) PopulateCargoLockEdges added in v3.41.0 

func (g *DepGraph) PopulateCargoLockEdges(dir string)

PopulateCargoLockEdges reads Cargo.lock's per-package `dependencies = [...]`.

func (*DepGraph) PopulateComposerLockEdges added in v3.41.0 

func (g *DepGraph) PopulateComposerLockEdges(dir string)

PopulateComposerLockEdges reads composer.lock per-package `require` (skipping php / ext-* / lib-* platform requirements).

func (*DepGraph) PopulateGemfileLockEdges added in v3.41.0 

func (g *DepGraph) PopulateGemfileLockEdges(dir string)

PopulateGemfileLockEdges reads Gemfile.lock spec→dependency indentation (4-space spec, 6-space dependency) into edges.

func (*DepGraph) PopulateGoModGraph 

func (g *DepGraph) PopulateGoModGraph(dir string) error

PopulateGoModGraph runs "go mod graph" in the given directory and populates the Edges map with the dependency relationships. Strips version suffixes so edges use bare module names matching package names.

func (*DepGraph) PopulateMixLockEdges added in v3.41.0 

func (g *DepGraph) PopulateMixLockEdges(dir string)

PopulateMixLockEdges reads mix.lock per-package dependency atoms into edges.

func (*DepGraph) PopulateNpmLockEdges 

func (g *DepGraph) PopulateNpmLockEdges(lockFilePath string) error

PopulateNpmLockEdges parses package-lock.json (v2/v3) and populates the Edges map from the nested node_modules path structure. In v3 format, the key "node_modules/foo/node_modules/bar" means foo depends on bar.

func (*DepGraph) PopulateNugetLockEdges added in v3.41.0 

func (g *DepGraph) PopulateNugetLockEdges(dir string)

PopulateNugetLockEdges reads packages.lock.json per-package `dependencies`.

func (*DepGraph) PopulatePypiLockEdges added in v3.40.0 

func (g *DepGraph) PopulatePypiLockEdges(dir string)

PopulatePypiLockEdges builds dependency-tree edges for a pypi manifest group from the lock files in dir. Edge keys/values are normalised (normPypi) so the lock, `# via`, and installed-METADATA sources all merge on one key form; BuildDependencies resolves SBOM component names against the same normalisation. uv.lock and pylock.toml carry an explicit dependency tree; a `pip/uv compile` requirements.txt carries it as inverted `# via` comments. All present sources are merged.

func (*DepGraph) TransitiveCount 

func (g *DepGraph) TransitiveCount() int

TransitiveCount returns the number of transitive (non-direct) dependencies.

type DetectedFile 

type DetectedFile struct {
	Path         string
	RelPath      string // relative to scan root
	FileType     FileType
	ManifestInfo *ManifestInfo // non-nil for manifest files
	SBOMVersion  string        // e.g. "SPDX-2.3", "1.5" for CycloneDX
	Supported    bool          // whether the backend accepts this file type
}

DetectedFile represents a detected scannable file

func WalkForScanFiles 

func WalkForScanFiles(opts WalkOptions) ([]DetectedFile, error)

WalkForScanFiles walks the filesystem from root, up to maxDepth, looking for manifest files and potential SBOM documents.

type EnrichOptions added in v3.19.2 

type EnrichOptions struct {
	SkipAffected    bool
	SkipExploits    bool
	SkipRemediation bool
}

EnrichOptions controls optional enrichment calls. A zero value preserves the historical behavior: fetch affected ranges, exploit intel, and remediation.

type EnrichedVuln 

type EnrichedVuln struct {
	VulnFinding
	Confirmed       bool    // true if installed version is in affected range
	IsMalicious     bool    // malware/malicious package — highest sort priority
	AffectedRange   string  // e.g., ">= 2.0.0, < 2.3.1"
	VersionStatus   string  // "affected" | "unaffected" | "unknown" — version evaluation verdict
	PathCount       int     // number of source files / transitive paths introducing this vuln
	ThreatExposure  float64 // x_threatExposure from VDB — primary sort key
	EPSSScore       float64 // displayed
	EPSSPercentile  float64 // displayed
	CVSSScore       float64 // displayed
	CoalitionESS    float64 // displayed
	ExploitIntel    *ExploitSummary
	Remediation     *RemediationInfo
	SSVCDecision    string // "Act", "Attend", "Track*", "Track"
	FixAvailability string // "available", "partial", "no_fix"
	IDSRules        []IDSRule

	// Per-source severity ratings (coerced from numeric scores / decisions).
	EPSSSeverity string // severity derived from EPSS probability
	CESSeverity  string // severity derived from Coalition ESS score
	CVSSSeverity string // severity derived from CVSS score
	SSVCSeverity string // severity derived from SSVC decision
	// MaxSeverity is the highest severity across all scoring sources for this vuln.
	// It is used for --severity threshold evaluation.
	MaxSeverity string

	// MatchMethod records how this vuln was matched to the package (e.g. "name+version", "cpe", "name-only").
	MatchMethod string

	// Reachability records the outcome of the local code-analysis pass
	// for this vuln. Values:
	//   "direct"      — vulnerable AST node lives inside the installed
	//                    package's own source (highest confidence).
	//   "transitive"  — vulnerable AST node lives in first-party code
	//                    that calls into the affected dep.
	//   "semantic"    — the lower-efficacy fallback: the affected
	//                    routine / file / module name appears literally
	//                    in your source (e.g. an import statement or
	//                    typed usage). Indicates intent to use the
	//                    affected element but not a proven call path.
	//   "unreachable" — queries ran and nothing matched.
	//   empty         — no analysis was performed (no data to compare).
	Reachability string

	// ReachabilityAssessed is true when tree-sitter queries actually ran
	// for this CVE (i.e. the CVE was in the evaluated set).
	ReachabilityAssessed bool

	// ReachabilityQueryHashes are the query hashes that ran for this CVE.
	// Populated when ReachabilityAssessed is true.
	ReachabilityQueryHashes []string

	// AffectedSymbols is the symbol-level fallback returned by the API for
	// every tier. Populated whether or not tree-sitter queries existed.
	AffectedSymbols *AffectedSymbols

	// SemanticMatches lists per-CVE source hits from the semantic
	// reachability pass — one entry per (file, line, symbol). Empty when
	// Reachability != "semantic".
	SemanticMatches []SemanticMatch
}

EnrichedVuln extends VulnFinding with version-filtered, enriched data. It is populated by SynthesiseFromCDX from the /v2/cli.sca response — the server now performs version filtering, exploit-intel, and remediation enrichment in the same round-trip, so there is no separate client-side enrichment loop.

type ExploitSummary 

type ExploitSummary struct {
	ExploitCount    int
	Sources         []string
	HasWeaponized   bool
	HighestMaturity string
}

ExploitSummary captures exploit intelligence for a vulnerability.

type FileType 

type FileType string

FileType represents the detected type of a file 

const (
	FileTypeManifest  FileType = "manifest"
	FileTypeSPDX      FileType = "spdx"
	FileTypeCycloneDX FileType = "cyclonedx"
	FileTypeUnknown   FileType = "unknown"
)

func DetectSBOM 

func DetectSBOM(filePath string) (FileType, string, bool)

DetectSBOM reads the first bytes of a JSON file and determines if it's an SPDX or CycloneDX document. Returns the file type, version string, and whether it's valid/supported.

type HashlookupParent added in v3.28.0 

type HashlookupParent struct {
	SHA1               string `json:"SHA-1,omitempty"`
	SHA256             string `json:"SHA-256,omitempty"`
	MD5                string `json:"MD5,omitempty"`
	PackageName        string `json:"PackageName,omitempty"`
	PackageVersion     string `json:"PackageVersion,omitempty"`
	PackageRelease     string `json:"PackageRelease,omitempty"`
	PackageArch        string `json:"PackageArch,omitempty"`
	PackageDescription string `json:"PackageDescription,omitempty"`
}

HashlookupParent is one parent entry from CIRCL (a known package that ships this binary). Only present on the single-lookup endpoint.

type HashlookupResult added in v3.28.0 

type HashlookupResult struct {
	FileName        string             `json:"FileName,omitempty"`
	FileSize        string             `json:"FileSize,omitempty"`
	MD5             string             `json:"MD5,omitempty"`
	SHA1            string             `json:"SHA-1,omitempty"`
	SHA256          string             `json:"SHA-256,omitempty"`
	SHA512          string             `json:"SHA-512,omitempty"`
	SSDEEP          string             `json:"SSDEEP,omitempty"`
	TLSH            string             `json:"TLSH,omitempty"`
	InsertTimestamp string             `json:"insert-timestamp,omitempty"`
	Source          string             `json:"source,omitempty"`
	PackageName     string             `json:"-"`
	PackageVersion  string             `json:"-"`
	Parents         []HashlookupParent `json:"parents,omitempty"`
}

HashlookupResult carries the CIRCL hashlookup response for one SHA-1 hash.

CIRCL returns NSRL-style PascalCase keys with hyphens ("SHA-1", "SHA-256", "MD5", "FileName", ...) — the json tags below mirror that exactly so the response unmarshals. PackageName/PackageVersion are NOT top-level CIRCL fields (they live in parents[] on the single-lookup endpoint, and are absent from the slim bulk response); they are derived in BulkHashlookup.

type IDSRule 

type IDSRule struct {
	Type    string // "snort" or "suricata"
	Content string
	Source  string
	CveID   string
}

IDSRule represents a snort or suricata detection rule.

func CollectIDSRules 

func CollectIDSRules(vulns []EnrichedVuln) []IDSRule

CollectIDSRules gathers all IDS rules from enriched vulns.

type LookupStats 

type LookupStats struct {
	Total     int // unique packages queried (after dedup)
	Succeeded int // packages resolved successfully
	Failed    int // packages that errored
	Skipped   int // packages skipped (name too short)
	Cancelled int // packages not attempted
}

LookupStats summarises the outcome of a VDB lookup. /v2/cli.sca populates it via SynthesiseFromCDX so the report layer can show coverage counts.

type MalwareBazaarResult added in v3.28.0 

type MalwareBazaarResult struct {
	Malicious bool   `json:"malicious"`
	FileName  string `json:"fileName,omitempty"`
}

MalwareBazaarResult is the local malware check result for one binary.

type ManifestGroup 

type ManifestGroup struct {
	Dir       string          // relative directory
	Ecosystem string          // e.g., "golang", "npm"
	Files     []string        // relative paths of constituent manifest files
	Graph     *DepGraph       // direct vs transitive classification
	Packages  []ScopedPackage // all packages from this group
}

ManifestGroup holds related manifest files from the same directory/ecosystem.

func BuildManifestGroups 

func BuildManifestGroups(filePackages map[string][]ScopedPackage, fileEcosystems map[string]string) []ManifestGroup

BuildManifestGroups correlates manifest results by directory and ecosystem, building dependency graphs where possible.

type ManifestInfo 

type ManifestInfo struct {
	Type      string // canonical filename used as the manifest "type" parameter
	Ecosystem string
	Language  string
	IsLock    bool

	// Confidence is set only for pip requirements files detected by name pattern
	// or content (ConfidenceConfident / ConfidenceTentative). Empty for every
	// other manifest, including exact-name matches of non-requirements files.
	Confidence string
}

ManifestInfo describes a known manifest file

func DetectManifest 

func DetectManifest(filename string) (*ManifestInfo, bool)

DetectManifest checks if a file is a known manifest. It checks in order: exact basename → file extension → path pattern (GitHub Actions).

type PackageChecksum added in v3.15.0 

type PackageChecksum = parse.PackageChecksum

PackageChecksum is one integrity hash extracted from a lock file.

type RegistryEndpoint added in v3.49.0 

type RegistryEndpoint = parse.RegistryEndpoint

RegistryEndpoint is a package registry discovered from a registry-config file.

func ParseRegistryConfig added in v3.49.0 

func ParseRegistryConfig(filePath, ecosystem string) []RegistryEndpoint

ParseRegistryConfig parses a registry-config file into its endpoints.

func SummarizeRegistryConfigs added in v3.49.0 

func SummarizeRegistryConfigs(files []DetectedFile) []RegistryEndpoint

SummarizeRegistryConfigs parses every registry-config file among the detected files and returns the endpoints found. Kept here (not in the parse module) because it depends on the CLI's DetectedFile detection layer.

type RemediationInfo 

type RemediationInfo struct {
	FixAvailability string
	FixVersion      string
	Actions         []string
}

RemediationInfo captures remediation plan details.

type ResolvedBinary added in v3.8.0 

type ResolvedBinary struct {
	Ecosystem      string
	Binary         string
	BinaryPath     string
	Version        string
	VersionCommand string
	Detected       bool
	Authoritative  bool
}

ResolvedBinary describes one package-manager binary candidate on the host.

func ResolvePackageManagerBinaries added in v3.8.0 

func ResolvePackageManagerBinaries(presentFiles []string) []ResolvedBinary

ResolvePackageManagerBinaries takes the set of manifest/lockfile basenames detected in the repo and returns one ResolvedBinary per candidate binary: whether it is installed (PATH), its resolved path + version, and whether a lockfile narrowed the manifest to this specific binary (Authoritative).

type RuntimePin 

type RuntimePin struct {
	Product    string // VDB EOL product name: "go", "nodejs", "python", "ruby"
	Release    string // normalised for the EOL API: "1.21", "18", "3.10"
	RawVersion string // raw version string from the file
	SourceFile string // relative path of the pin file within the project root
}

RuntimePin records a runtime version detected from a version-pin file.

func DetectRuntimeVersionPins 

func DetectRuntimeVersionPins(rootPath string) []RuntimePin

DetectRuntimeVersionPins scans rootPath for common runtime version-pin files and returns the detected runtime versions. Only the project root is inspected (no recursion). Errors reading individual files are silently skipped.

Files inspected: go.mod, .nvmrc, .node-version, .python-version, .tool-versions, .ruby-version, Gemfile, Dockerfile, Containerfile. LTS aliases in .nvmrc (e.g. "lts/hydrogen") are silently skipped.

type ScanResult added in v3.28.0 

type ScanResult struct {
	ScannerRunUUID string         `json:"scannerRunUuid,omitempty"`
	Path           string         `json:"path"`
	Total          int            `json:"total"`
	ELFCount       int            `json:"elfCount"`
	Binaries       []BinaryResult `json:"binaries"`
	Errors         []string       `json:"errors,omitempty"`
}

ScanResult is the top-level result of a container filesystem scan.

func ScanContainerFilesystem added in v3.28.0 

func ScanContainerFilesystem(root string) *ScanResult

ScanContainerFilesystem recursively walks root looking for ELF binaries, analyzes each one, and returns the full scan result.

func (*ScanResult) SetScannerRunUUID added in v3.28.0 

func (sr *ScanResult) SetScannerRunUUID(uuid string)

SetScannerRunUUID stamps the scan result with the scanner run identifier.

func (*ScanResult) ToJSON added in v3.28.0 

func (sr *ScanResult) ToJSON() ([]byte, error)

ToJSON returns the indented JSON representation of the scan result.

Deliberately NOT named MarshalJSON: that magic name would make *ScanResult implement json.Marshaler, and the json.MarshalIndent(sr, ...) call below would then recurse into itself indefinitely.

type ScopedPackage 

type ScopedPackage = parse.ScopedPackage

ScopedPackage is a parsed dependency with scope/provenance information.

func ApplyBuildOrLockGate added in v3.41.0 

func ApplyBuildOrLockGate(eco, manifestType, manifestPath, relPath string, confident bool, pkgs []ScopedPackage) (resolved []ScopedPackage, dropFile bool, err error)

ApplyBuildOrLockGate runs the build-or-lock gate for one parsed manifest. It returns the (possibly resolved) package set; dropFile=true when a tentative file could not be confirmed and the caller should skip it; and a fatal err when a confident manifest cannot be resolved (caller should return it → exit).

func ParseManifestWithScope 

func ParseManifestWithScope(filePath, manifestType string) ([]ScopedPackage, error)

ParseManifestWithScope reads a manifest file and returns scoped packages.

func ResolveCargoFromInstalled added in v3.41.0 

func ResolveCargoFromInstalled(manifestPath, relPath string, declared []ScopedPackage, strict bool) ([]ScopedPackage, error)

ResolveCargoFromInstalled resolves Cargo.toml deps from a project `vendor/` directory (full transitive set) or, failing that, the global cargo registry cache (declared-only).

func ResolveComposerFromInstalled added in v3.41.0 

func ResolveComposerFromInstalled(manifestPath, relPath string, declared []ScopedPackage, strict bool) ([]ScopedPackage, error)

ResolveComposerFromInstalled resolves composer.json deps from the project `vendor/` tree (full transitive set). Composer has no versioned global cache, so a missing `vendor/` is a build-or-lock error.

func ResolveGemsFromInstalled added in v3.41.0 

func ResolveGemsFromInstalled(manifestPath, relPath string, declared []ScopedPackage, strict bool) ([]ScopedPackage, error)

ResolveGemsFromInstalled resolves Gemfile deps from a project bundle (vendor/bundle, full transitive set) or the global gem home (declared-only).

func ResolveHexFromInstalled added in v3.41.0 

func ResolveHexFromInstalled(manifestPath, relPath string, declared []ScopedPackage, strict bool) ([]ScopedPackage, error)

ResolveHexFromInstalled resolves mix.exs deps from the project `deps/` tree (full transitive set; version from each dep's hex_metadata.config).

func ResolveJavaFromInstalled added in v3.41.0 

func ResolveJavaFromInstalled(manifestPath, relPath string, declared []ScopedPackage, strict bool) ([]ScopedPackage, error)

ResolveJavaFromInstalled resolves declared "group:artifact" coordinates against the global Maven (~/.m2) and Gradle (~/.gradle) caches (declared-only — these caches are shared across all projects, so transitives are never enumerated).

func ResolveNpmPackageJSONFromNodeModules added in v3.34.0 

func ResolveNpmPackageJSONFromNodeModules(packageJSONPath, relPath string, direct []ScopedPackage) ([]ScopedPackage, error)

ResolveNpmPackageJSONFromNodeModules replaces package.json version ranges with installed versions when no lockfile exists, and adds installed transitives by reading every package manifest found under node_modules.

func ResolveNugetFromInstalled added in v3.41.0 

func ResolveNugetFromInstalled(manifestPath, relPath string, declared []ScopedPackage, strict bool) ([]ScopedPackage, error)

ResolveNugetFromInstalled resolves project deps from a local `packages/` folder (old packages.config layout, full) or the global NuGet cache (declared-only).

func ResolvePubFromInstalled added in v3.41.0 

func ResolvePubFromInstalled(manifestPath, relPath string, declared []ScopedPackage, strict bool) ([]ScopedPackage, error)

ResolvePubFromInstalled resolves pubspec.yaml deps from the project's resolved set (.dart_tool/package_config.json, full) or the global pub-cache (declared-only).

func ResolvePythonRequirementsFromSitePackages added in v3.40.0 

func ResolvePythonRequirementsFromSitePackages(manifestPath, relPath string, declared []ScopedPackage, strict bool) ([]ScopedPackage, error)

ResolvePythonRequirementsFromSitePackages resolves an unpinned pip manifest's declared packages to exact installed versions. It mirrors the npm node_modules resolver, including SourceType/InstalledPath provenance.

A project venv (findPythonVenv) yields a full project-scoped resolution: declared packages (SourceType=manifest) plus every installed package as a transitive (SourceType=installed, InstalledPath set). When no venv is found it falls back to the global/user site-packages purely as an install check, resolving the declared packages only (globals are never enumerated into the SBOM as project dependencies).

strict (a confident detection) requires every declared package to be present, else it errors with the build-or-lock hint. Non-strict (a tentative detection) keeps whatever resolves and errors only when nothing matches.

type SemanticMatch added in v3.6.0 

type SemanticMatch struct {
	File   string
	Line   int
	Symbol string
	Kind   string // "routine" | "file" | "module"
}

SemanticMatch is one source hit produced by the semantic reachability fallback. The CLI's pretty-printer renders these under a Semantic Reachability section so users can jump straight to file:line.

type VulnFinding 

type VulnFinding struct {
	CveID          string
	PackageName    string
	PackageVer     string
	Ecosystem      string
	Scope          string
	Severity       string
	Score          float64
	MetricType     string
	VectorString   string
	SourceFile     string
	Source         string // upstream vulnerability source name (empty = vulnetix)
	InCisaKev      bool
	InVulnCheckKev bool
	InEuKev        bool
	ExploitCount   int
}

VulnFinding represents a vulnerability found during a local scan. It is populated from the CycloneDX document returned by /v2/cli.sca (see SynthesiseFromCDX) and consumed throughout the scan/report pipeline.

type WalkOptions 

type WalkOptions struct {
	RootPath string
	MaxDepth int
	Excludes []string // glob patterns to exclude
	// RespectGitignore, when true, prunes files and directories matched by
	// .gitignore files (accumulated top-down). The sca path leaves this false
	// because dependency manifests routinely live in gitignored install dirs.
	RespectGitignore bool
}

WalkOptions configures the filesystem walk behavior.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.