Repository navigation
fix(osv): address review findings in the dependency-CVE adapter (main) - #14
Merged
Merged
Conversation
Setup state and INFO.md handling: - Remember the last explicit --osv / --no-osv choice in setup state, and carry --osv in the printed resume command. Previously a plain resume or a later bare init/setup flipped the info checkpoint digest, re-ran the analysis without dependency context, and dropped the reachability verdicts. --no-osv is new and is the way to turn the step back off. - Keep a hand-edited INFO.md on every re-run. Only the agent's "### Dependency reachability" block is refreshed (spliced into the Threat model section), kept as-is when osv produced nothing, and removed when osv is off. - Stop the osv section strip at the next "## " heading instead of cutting to end of file. - Record the dependency matcher pass only after it completes, keyed to a digest of the vulnerable-dependency set, so a failed pass is retried and a newly found dependency gets its own pass. - Ignore a leftover osv-findings.json when osv is disabled. Scanning: - Resolve ranges with --resolution lowest-direct instead of lowest, so only declared dependencies are floored. Plain lowest also pinned transitive dependencies to versions no real install picks; on fastapi this cut the report from 3 packages / 22 advisories to starlette / 14. - Capture osv-scanner stderr so "No package sources found" (exit 128, empty stdout) is treated as a clean result and clears stale findings. - Match vendored trees against the path relative to the project root, so a project checked out under a vendor/ directory is not filtered out. - Warn when uv or syft fails to resolve a manifest instead of reporting it as clean. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the review fixes to fork main (same change as commit 7ac1bc0 on the PR vercel-labs#190 branch
osv-adapter-upstream).--osv/--no-osvchoice so resumes and later bareinit/setupdon't flip it;--no-osvturns the step off.lowest-direct(fastapi: 3 packages / 22 advisories → starlette / 14).Unit tests: 2412 passing. Lint and typecheck clean.
🤖 Generated with Claude Code