[Makisuo]

Part 2 of 5 of the dependency scanner (stack below).

PackageAdvisoryCatalog answers which known vulnerabilities affect a set of locked package versions, from OSV.dev:

• one querybatch per 1000 packages (paged, capped), then each vulnerability read once and edge-cached by id and modification time
• a failed read fails the whole call, so a scan never mistakes an outage for a clean dependency
• the records of one vulnerability (a GO- and a GHSA- entry, a RUSTSEC and its GHSA twin) merge into one advisory; severity is the curated rating, else the CVSS 3 base score; the fixed version follows each ecosystem's order
• severityOf now reads GitHub's MODERATE as medium, which also fixes the Runtimes tab

Verification

• Unit tests on real OSV answers captured by scripts/capture-osv-fixtures.ts, CVSS 3.0/3.1 scores against FIRST's calculator, cache hits, paging, outage.
• scripts/depscan-vs-osv-scanner.ts compares the answer with osv-scanner 2.7.0 on the same lockfiles: all 14 fixture lockfiles and Maple's own bun.lock (1614 packages, 30 advisories) match exactly.

Stack

1. feat(lockfiles): parse npm, pnpm, yarn, bun, Go and Cargo lockfiles #2041 lockfile parsers
2. feat(security): package advisories from OSV for the dependency scanner #2042 OSV advisory catalog
3. feat(security): store dependency scans, their matches and findings #2043 scan store
4. feat(security): scan connected repositories' lockfiles for vulnerable dependencies #2044 scanner, triggers and API
5. feat(security): Dependencies tab, ranked by what runs in production #2045 Dependencies tab, ranked by production traffic

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 39 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e920d413-bd81-4d2c-bbc0-0ccd57dc8812

Commits

Reviewing files that changed from the base of the PR and between 1739974 and 9050431.

Files ignored due to path filters: 1

• bun.lock is excluded by !**/*.lock

Files selected for processing: 14

• packages/backend/package.json
• packages/backend/scripts/capture-osv-fixtures.ts
• packages/backend/scripts/depscan-vs-osv-scanner.ts
• packages/backend/src/services/security/PackageAdvisoryCatalog.test.ts
• packages/backend/src/services/security/PackageAdvisoryCatalog.ts
• packages/backend/src/services/security/__fixtures__/osv.json
• packages/backend/src/services/security/cvss.test.ts
• packages/backend/src/services/security/cvss.ts
• packages/backend/src/services/security/osv-records.test.ts
• packages/backend/src/services/security/osv-records.ts
• packages/domain/package.json
• packages/domain/src/package-advisories.ts
• packages/domain/src/runtime-advisories.test.ts
• packages/domain/src/runtime-advisories.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[maple-review-bot]

Maple review

🟢 Confidence 8/10 · likely safe to merge. Held at 8 because a fix has not been re-checked against the whole diff yet.
_{no findings · tests covered · risk low · 1 fix not yet re-checked against the whole diff}

Takes the GHSA id from a record's aliases, so an advisory keeps a stable GitHub id when OSV returns only the GO- or RUSTSEC- record. The fix is contained and matches the documented contract; safe to merge.

• mergeAdvisory picks a GHSA id from all names, not only record ids

Fixed since the last review

• ✅ F1 · mergeAdvisory ignores a GHSA id that appears only as an alias

_{9050431 · What was checked, coverage and telemetry details are on the Maple / review check. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}