Repository navigation
Fix OSV matching - #7
Merged
Merged
Conversation
- Offer only the queried package's fixed versions. One advisory can cover several packages with their own releases: for illuminate/database 6.20.10, GHSA-3p32-j457-pg5x suggested 6.20.11, which is laravel/framework's fix and still vulnerable (6.20.12 is). - Skip advisories for components without a version. OSV returns every advisory a package ever had for a versionless PURL; malware (any version) is still reported, and a warning lists such components. - Report every failed OSV lookup, not only timeouts. The scan printed "No vulnerabilities" with exit 0 under --fail-on when OSV was unreachable; it now prints an ERROR and exits 1 under --fail-on. - Tell direct from transitive by the dependency graph. cdxgen marks dev dependencies (require-dev, devDependencies) optional, so they were shown as transitive. - Show package names with their group (guzzlehttp/guzzle, not guzzle) in the components table, fix plan, dependency paths and license list; fix-plan groups no longer merge same-named packages of different vendors.
The summary counted scope=required as direct and the rest as transitive, which is production vs dev, not direct vs transitive: a Symfony app with 67 requirements reported 191/55. ORIGIN marked a required package transitive as soon as something else also pulled it in (twig/twig via twig-bundle), and the dependency paths then starred that parent for update instead of the package itself. A component is now direct when a root of the dependency graph depends on it (new "direct" field), and the summary, ORIGIN and the * marker all follow it. cdxgen leaves the root out for a composer.json without a "name", the usual case for applications, so the project's require and require-dev from composer.json supply it; versions still come from composer.lock and the added root stays out of the report. Without a root or a project directory, packages nothing else requires count as direct. Go modules marked indirect stay transitive.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing: 21
✨ Finishing Touches
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.