[Makisuo]

Part 3 of 5 of the dependency scanner (stack below).

Three tables and DependencyScanStore:

• dependency_scans: one read of a repository's lockfiles at a commit (lockfile statuses, counts, error)
• dependency_scan_matches: the vulnerable packages each scan found, kept per scan so an older commit still running in production can be shown
• dependency_findings: one per (repository, lockfile, package, advisory) with the code audit's lifecycle: a fixed finding that comes back reopens, a dismissed one stays dismissed

Only a scan of the tracked branch head reconciles findings. A lockfile the scan could not read (or skipped) keeps its findings; scans of one repository settle one at a time under an advisory lock, and an older scan never undoes a newer one; an incomplete scan stores its matches but reconciles nothing; a finding keeps its id and triage when OSV later links its advisory to another record. Separate from the code audit tables, which hold an agent's record and verdict per target and fingerprint.

Verification

• Migration generated with db:generate; parity.test.ts passes.
• 12 store tests on PGlite: open, fix, reopen, dismissed stays dismissed, unreadable and deleted lockfiles, production scans, tenant isolation, late older scan, incomplete scan, advisory id carry-over.

Stack

1. feat(lockfiles): parse npm, pnpm, yarn, bun, Go and Cargo lockfiles #2041 lockfile parsers
2. feat(security): package advisories from OSV for the dependency scanner #2042 OSV advisory catalog
3. feat(security): store dependency scans, their matches and findings #2043 scan store
4. feat(security): scan connected repositories' lockfiles for vulnerable dependencies #2044 scanner, triggers and API
5. feat(security): Dependencies tab, ranked by what runs in production #2045 Dependencies tab, ranked by production traffic

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 38 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f96c75cf-0202-4bbe-acc8-1740cfafd6ff

Commits

Reviewing files that changed from the base of the PR and between 9050431 and b40f040.

Files selected for processing: 10

• packages/backend/src/services/dependency-scan/DependencyScanStore.test.ts
• packages/backend/src/services/dependency-scan/DependencyScanStore.ts
• packages/backend/src/services/org/OrganizationService.ts
• packages/db/drizzle/20261031225742_dependency_scans/migration.sql
• packages/db/drizzle/20261031225742_dependency_scans/snapshot.json
• packages/db/src/tables/dependency-scan.ts
• packages/db/src/tables/index.ts
• packages/domain/package.json
• packages/domain/src/dependency-scan.ts
• packages/domain/src/package-advisories.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[maple-review-bot]

1 inline note from Maple's review. The score and summary are in the review comment above.

[maple-review-bot]

1 inline note from Maple's review. The score and summary are in the review comment above.

[maple-review-bot]

Maple review

🟢 Confidence 10/10 · safe to merge. New tables and a self-contained store; the alias case F3 raised is fixed at reconcileFindings and pinned by a PGlite test.
_{no findings · tests covered · risk medium · 1/1 new units observable}

Adds the dependency-scan persistence layer: three org-scoped tables with their migration, plus DependencyScanStore, which stores a scan's matches and reconciles findings on tracked-branch scans. Safe to merge.

• DependencyScanStore settles a scan and its matches in one transaction, reconciling findings in the same one
• A fixed finding reopens when a match returns; a dismissed one keeps its status
• Reconcile skips findings of a lockfile the scan could not read, and of a head scan a newer one outranks
• Refs are re-keyed onto a known advisory so a merged OSV record keeps the finding's id and triage

Before merge

• Migration · Check it is safe on production data and with the code still deployed · packages/db/drizzle/20261031225742_dependency_scans/migration.sql

Fixed since the last review

• ✅ F3 · reconcileFindings marks an open finding fixed when OSV reports its advisory only as an alias

_{b40f040 · What was checked, coverage and telemetry details are on the Maple / review check. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}