Module osv 

OSV.dev vulnerability scanning.

OsvClient batches dependency versions against the OSV.dev API (POST /v1/querybatch) and resolves matching advisories (GET /v1/vulns/{id}), with a semantic cache of its own — not crate::cache::HttpCache’s entry map, since OSV sends no ETag/Last-Modified validators and the batch endpoint is a POST with a request-body-dependent response. See architecture.md §5 for why this is a deliberate deviation from reusing HttpCache wholesale, and §8 for the four correctness invariants this module exists to uphold (positional batch results, pagination truncation, scan observability, and bounded record fan-out).

OsvClient::scan never fails: every dependency passed in gets exactly one ScanOutcome back, so an OSV outage degrades to an empty-ish map rather than propagating an error into the LSP response (FR-007).

Structs

Advisory

A single vulnerability advisory, converted from OSV’s wire format at the crate boundary.

Capped

A list that may have been truncated when it was produced, paired with the true count of items that existed at the source.

DependencyVulnerabilities

Vulnerability data for one dependency that OSV reported as non-clean.

FixRecommendation

A single upgrade target recommended by DependencyVulnerabilities::recommended_fix.

OsvClient

Batches dependency versions against OSV.dev and resolves matching advisories, with its own semantic cache layered on top of HttpCache’s transport (post_json/get_cached).

ScanTarget

One dependency to query against OSV.

Enums

ScanOutcome

Outcome of scanning one dependency.

SkipReason

Why a dependency produced no advisories.

UpgradeStatus

Result of checking whether a recommended upgrade target is itself affected.

VulnSeverity

Severity bucket derived from an OSV advisory record.

Constants

ADVISORY_DISPLAY_CAP

Advisories fetched (invariant 3) and rendered (§7) per dependency, plus a trailing “+N more advisories” entry when Capped::total exceeds this.

Functions

diagnostic_severity_for

Maps a VulnSeverity to the [DiagnosticSeverity] used to render it.

vulnerability_keys

Computes the VulnerabilityMap key each occurrence in parse_result should be scanned/looked-up under.

Type Aliases

VulnerabilityMap

Per-scan result map.