Repository navigation
feat(osv): grade dependency reachability and promote reachable CVEs (main) - #12
Merged
Merged
Conversation
Make the dependency-CVE path deterministic at the two steps where it was silently losing reachable advisories to run-to-run variance. - threat model: buildContext now emits a required, graded "Dependency reachability" block — one line per dependency (HIGH/MEDIUM/LOW + call site + consequence), covering every advisory osv found, instead of a soft "note where it's used" prose instruction that collapsed into a vague summary on noisier runs. - investigation: CORE_PROMPT now treats those grades as promotion guidance — HIGH with a confirmed call site is a finding to promote (not "just a library default"), MEDIUM is judged on its merits, LOW stays as context unless a missed call site is found. Reachability is gated upstream; the investigation confirms and writes it up. Verified on fastapi: the Starlette unbounded-body DoS now promotes to a located finding (dropped as context in prior runs), while transitive anyio/idna stay LOW with zero false-positive findings. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the dependency-reachability grading + promotion rule to fork main (same change as on the PR vercel-labs#190 branch
osv-adapter-upstream, commit e5d681f).What it does
buildContextemits a required graded Dependency reachability block — one line per dependency (HIGH/MEDIUM/LOW + call site + consequence), for every advisory osv found, instead of soft prose that collapsed to a vague summary on noisier runs.CORE_PROMPTtreats those grades as promotion guidance — HIGH + confirmed call site promotes, MEDIUM is judged on merits, LOW stays context unless a missed call site is found.Verified on fastapi
🤖 Generated with Claude Code