Struct OsvClient 

pub struct OsvClient { /* private fields */ }

Batches dependency versions against OSV.dev and resolves matching advisories, with its own semantic cache layered on top of HttpCache’s transport (post_json/get_cached).

One instance is shared server-lifetime on ServerState in deps-lsp, so every open document’s scan benefits from the same query/record cache.

Implementations

impl OsvClient

pub fn new(cache: Arc<HttpCache>) -> Self

Creates a client that reuses cache’s HTTP transport (Client, HTTPS enforcement, size cap, timeout) for both the batch POST and the per-advisory GET.

pub async fn scan( &self, ecosystem: EcosystemId, deps: &[ScanTarget], timeout: Duration, ) -> VulnerabilityMap

Phase A: scans deps and returns the map consumed by the rendering helpers.

timeout bounds the entire scan (all chunks and any truncation recovery), not any single request — the underlying reqwest client already caps each individual request at 30s. The deadline is checked between chunks/recovery items, not mid-request, so already-completed work is never discarded on timeout: only whatever had not yet started degrades to SkipReason::QueryFailed/SkipReason::Truncated (critique S5).

Never returns an error: every failure degrades to a ScanOutcome::Skipped entry, never an absent one. Logs a per-scan summary at info (§8 invariant 0).

pub async fn check_candidates( &self, ecosystem: EcosystemId, candidates: &[ScanTarget], timeout: Duration, ) -> HashMap<String, UpgradeStatus>

Phase B: checks whether the versions about to be recommended (e.g. “latest” from the registry) are themselves affected.

Only meaningful for dependencies phase A already flagged — callers should build candidates from that subset. timeout has the same meaning as in Self::scan.