Trait OsvNaming 

pub trait OsvNaming: Send + Sync {
    // Provided methods
    fn osv_package_name(&self, dep: &dyn Dependency) -> Option<String> { ... }
    fn osv_version_to_native(&self, version: &str) -> String { ... }
    fn osv_version(&self, version: &str) -> String { ... }
}

Native <-> OSV.dev namespace bridging for package names and version strings.

Implementors guarantee every method is the identity transform unless this ecosystem’s native naming/versioning genuinely diverges from OSV.dev’s own convention for it — callers (the OSV scan-target builder and advisory matcher) rely on the defaults being safe no-ops for the common case of an ecosystem with no such divergence.

Provided Methods

fn osv_package_name(&self, dep: &dyn Dependency) -> Option<String>

OSV.dev’s canonical spelling for dep’s package name, or None if this dependency cannot be mapped (e.g. a non-GitHub Swift package).

Deliberately not routed through PackageNaming::normalize_package_name: that method produces this project’s internal lookup key, while this one produces the name sent on the wire to OSV. They coincide for most ecosystems and diverge for NuGet (case-preserving; normalizing would lowercase it and zero out results), Composer (OSV wants lowercase, overridden in deps-composer), and Swift (prefixed to github.com/{owner}/{repo}, overridden in deps-swift). Takes &dyn Dependency rather than &str because the Swift override needs to downcast to inspect the dependency’s source URL host — see architecture.md §2.

The default implementation is the identity: OSV is case-sensitive in every ecosystem this project supports except PyPI, and for Cargo, npm, Go, Maven, Gradle, Dart, Bundler, NuGet, and PyPI the manifest’s raw name already matches OSV’s canonical spelling.

fn osv_version_to_native(&self, version: &str) -> String

Converts a version string as it appears in an OSV advisory record (e.g. crate::osv::Advisory::fixed_versions) into this ecosystem’s own version namespace, as used in manifests and by the registry.

Default: identity — correct for ecosystems whose OSV records carry the native version string verbatim. Override when OSV’s namespace diverges from the native one (Go module versions carry a v prefix that OSV’s SEMVER ranges never use).

Examples

use deps_core::lsp_helpers::OsvNaming;

struct DefaultFormatter;
impl OsvNaming for DefaultFormatter {}

assert_eq!(DefaultFormatter.osv_version_to_native("1.2.3"), "1.2.3");

fn osv_version(&self, version: &str) -> String

Rewrites a native-ecosystem version string into the spelling OSV.dev’s SEMVER range matching expects.

Deliberately the inverse of Self::osv_package_name rather than a field on crate::osv::ScanTarget itself: the caller (deps-lsp’s scan-target builder) has only the native version string at hand, so each ecosystem’s formatter is the natural place to own the transform. The default implementation is the identity: OSV accepts every supported ecosystem’s native version spelling unchanged except Go, whose module versions carry a mandatory v prefix (golang.org/x/mod/module convention) that OSV’s SEMVER matcher rejects — overridden in deps-go to strip it.

Examples

use deps_core::lsp_helpers::OsvNaming;

struct DefaultFormatter;
impl OsvNaming for DefaultFormatter {}

assert_eq!(DefaultFormatter.osv_version("1.2.3"), "1.2.3");

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors