Skip to content

feat(security): package advisories from OSV for the dependency scanner - #2042

Merged
Makisuo merged 6 commits into
feat/depscan-1-lockfilesfrom
feat/depscan-2-advisories
Nov 1, 2026
Merged

feat(security): package advisories from OSV for the dependency scanner#2042
Makisuo merged 6 commits into
feat/depscan-1-lockfilesfrom
feat/depscan-2-advisories

fix(security): an advisory takes its GHSA id even when it is only an …

9050431
Select commit
Loading
Failed to load commit list.
Maple Review Bot / Maple / review succeeded Nov 1, 2026 in 23s

Confidence 8/10 · No issues found

🟢 Confidence 8/10 · likely safe to merge. Held at 8 because a fix has not been re-checked against the whole diff yet.
no findings · tests covered · risk low · 1 fix not yet re-checked against the whole diff

Takes the GHSA id from a record's aliases, so an advisory keeps a stable GitHub id when OSV returns only the GO- or RUSTSEC- record. The fix is contained and matches the documented contract; safe to merge.

  • mergeAdvisory picks a GHSA id from all names, not only record ids

Fixed since the last review

  • ✅ F1 · mergeAdvisory ignores a GHSA id that appears only as an alias

Production impact

Production traffic of the changed files (last 7 days)
File Calls/day Busiest operations
packages/backend/scripts/capture-osv-fixtures.ts 2.7k POST 1.7k/day, 0.1% err
POST 1.0k/day, 0.1% err
Telemetry this change adds and removes (8)
  • ➕ span name osv.querybatch · packages/backend/src/services/security/PackageAdvisoryCatalog.ts:106
  • ➕ attribute osv.dev · packages/backend/src/services/security/PackageAdvisoryCatalog.ts:108
  • ➕ attribute maple.depscan.query_count · packages/backend/src/services/security/PackageAdvisoryCatalog.ts:108
  • ➕ span name osv.vuln · packages/backend/src/services/security/PackageAdvisoryCatalog.ts:154
  • ➕ attribute maple.depscan.advisory_id · packages/backend/src/services/security/PackageAdvisoryCatalog.ts:156
  • ➕ span name PackageAdvisoryCatalog.advisories · packages/backend/src/services/security/PackageAdvisoryCatalog.ts:162
  • ➕ attribute maple.depscan.package_count · packages/backend/src/services/security/PackageAdvisoryCatalog.ts:172
  • ➕ attribute maple.depscan.vulnerability_count · packages/backend/src/services/security/PackageAdvisoryCatalog.ts:173
What was checked
  • Alias-derived id matches the real GHSA record id in the fixture (GO-2023-1988 aliases GHSA-2wrh-6pvc-2jm9)
  • groupByAlias merges anything sharing a name, so two groups cannot select the same alias as id
  • When the id is an alias no record carries, the ordered comparator falls back to localeCompare

9050431 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.

View more details on Maple Review Bot