brew-vulns 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 80d99be04bbb5f94ac9b6ce0572699c06291a38d3cad5643f40fcc5991a11bcf
-  data.tar.gz: 50af431e418e7af72b006acbdbc3d88dcf177726f0796eb2ead936406c5242ba
+  metadata.gz: a4db816ba6a05913a6c043982fa279cd27c20637ee999737323480519c504ce5
+  data.tar.gz: 47a3baef2449740c693d43f09e90dfe87d5f9b1ab3b596cffeb5f2afaa0c0371
 SHA512:
-  metadata.gz: c45915f201f9b804298836a2ccf16f815eeb48899253499c315ae74a7684e52da207b344682fe8b48af14afe4003bbcdeffb233a11a984cca5821554e687626d
-  data.tar.gz: 4aea92e8df8fe2143d8e1f4268d0173c98d11f721ce1195b79e68c5c67e41357a2f9b96ded95d5b57d62baf821bf20e5cd43beebf18995fc039d8da6cb2b746c
+  metadata.gz: f11cd24893e2a5609b5a499932c9aa3d11d00e7579aeec82ad381945df16a2508a1b90b022f787a28959414f165d7e14e02c639ebcc593942151b14af6c6877b
+  data.tar.gz: 137ad2269080760fd54751bf662ec26283b4bc1054b0ed4ec683bb2a2aba88c194402a3e74b5f8a9911f6a47fe8ccb297bc1299d8c3ef6afa81ebd4178654b9a

data/CHANGELOG.md

@@ -1,4 +1,10 @@
-## [Unreleased]
+## [0.5.0] - 2026-07-14
+
+- Deprecate in favour of the built-in `brew vulns` command shipped in Homebrew 6.0.11 (see [Homebrew/brew#23080](https://github.com/Homebrew/brew/pull/23080)). A deprecation notice is now printed to stderr on every run and after `gem install`. The formula is marked deprecated. This tap and gem will be archived after one release cycle.
+- Query OSV for formulae whose source is not on GitHub/GitLab/Codeberg by falling back to the formula's `head` git URL, a `tag:`-style stable git URL, or a forge URL in `homepage`, with the bare formula version. Removes the forge whitelist; any formula with a derivable git repository URL is now sent in the batch query
+- CycloneDX output: percent-encode `@` in `pkg:brew/` purls so versioned formula names like `glibc@2.13` are not misparsed as `name@version`
+- Add `--osv-export DIR` (experimental) to write OSV-schema records under a `Homebrew` ecosystem for every CVE listed in a formula's `patches[].resolves`. Each record marks the formula as fixed at the currently shipped version+revision and carries the resolving patch detail in `ecosystem_specific`. Intended as the seed for a published Homebrew advisory feed.
+- Retry the final OSV API attempt over IPv4 (via `Net::HTTP#ipaddr=`) when earlier attempts time out or fail to connect, to work around IPv6 paths that complete the TCP/TLS handshake but then drop data. Add `--ipv4` to force IPv4 from the first attempt.
 
 ## [0.4.0] - 2026-06-28
 

data/Formula/brew-vulns.rb

@@ -1,10 +1,12 @@
 class BrewVulns < Formula
   desc "Check Homebrew packages for known vulnerabilities via osv.dev"
   homepage "https://github.com/Homebrew/homebrew-brew-vulns"
-  url "https://github.com/Homebrew/homebrew-brew-vulns/archive/refs/tags/v0.3.0.tar.gz"
-  sha256 "1b9fbb03d46192350ad7dcac4279b382debb917d40688a4b816319214a2570d4"
+  url "https://github.com/Homebrew/homebrew-brew-vulns/archive/refs/tags/v0.5.0.tar.gz"
+  sha256 "f20b9dadb01d3ec8c4e97fe5e3225aac58ca609f935ce17928b23deabd415ba7"
   license "MIT"
 
+  deprecate! date: "2026-07-14", because: "is now built into Homebrew as `brew vulns`"
+
   depends_on "ruby"
 
   def install
@@ -19,6 +21,14 @@ class BrewVulns < Formula
     bin.env_script_all_files(libexec/"bin", GEM_HOME: ENV.fetch("GEM_HOME", nil))
   end
 
+  def caveats
+    <<~EOS
+      `brew vulns` is now a built-in Homebrew command. Run `brew update` and
+      use `brew vulns` directly, then `brew uninstall brew-vulns` and
+      `brew untap homebrew/brew-vulns`.
+    EOS
+  end
+
   test do
     system bin/"brew-vulns", "--help"
   end

data/README.md

@@ -1,5 +1,18 @@
 # brew-vulns
 
+> [!WARNING]
+> **Deprecated.** `brew vulns` is now a built-in Homebrew command as of Homebrew 6.0.11. Run `brew update` and use `brew vulns` directly; this tap and gem are no longer needed and will be archived. See [Homebrew/brew#23080](https://github.com/Homebrew/brew/pull/23080).
+>
+> Interface changes in the built-in command:
+>
+> - `--all` is dropped; with no arguments the built-in command scans every trusted formula (or just installed formulae if tap trust is disabled)
+> - `-b` short flag is dropped; use `--brewfile`
+> - `--sarif`, `--cyclonedx` and `--ipv4` are not available (SARIF and CycloneDX are planned as follow-ups)
+> - `--osv-export` moved to `brew generate-vulns-advisories` ([Homebrew/brew#23106](https://github.com/Homebrew/brew/pull/23106)); its output lives at [Homebrew/advisory-database](https://github.com/Homebrew/advisory-database)
+> - Errors no longer exit with code `2`; brew's standard error handling applies. Exit `0` (clean) and `1` (vulnerabilities found) are unchanged.
+>
+> To migrate: `brew uninstall brew-vulns && brew untap homebrew/brew-vulns` (or `gem uninstall brew-vulns`).
+
 A Homebrew subcommand that checks installed packages for known vulnerabilities using the [OSV.dev](https://osv.dev) database.
 
 ## Installation
@@ -91,11 +104,11 @@ brew vulns --help
 ## How it works
 
 1. Reads Homebrew formulae via `brew info --json=v2` (installed packages by default, or any named formulae passed as arguments)
-2. Extracts the repository URL and version tag from each formula's source URL
+2. Derives a git repository URL for each formula from its stable source URL, `head` URL or homepage, and a version from the release tag or formula version
 3. Queries the OSV API using the GIT ecosystem to find known vulnerabilities
 4. Reports any vulnerabilities found with their severity and CVE identifiers
 
-Packages with GitHub, GitLab, or Codeberg source URLs are checked. Packages from other sources are skipped.
+A formula is queried when a repository URL can be derived. GitHub, GitLab and Codeberg URLs are recognised in any of the stable, `head` or homepage fields; for other hosts, the `head` URL or a `tag:`-style stable git URL is used as-is. Formulae with none of these are skipped.
 
 ### Patched vulnerabilities
 
@@ -106,8 +119,8 @@ This relies on `patches[].resolves` data in `brew info --json=v2`, available fro
 ## Example output
 
 ```
-Checking 104 packages for vulnerabilities...
-(119 packages skipped - no supported source URL)
+Checking 181 packages for vulnerabilities...
+(42 packages skipped - no source repository URL or version)
 
 expat (2.7.3)
   CVE-2025-66382 (HIGH) - XML parsing vulnerability...
@@ -197,7 +210,7 @@ See [examples/](examples/) for workflows that check changed formulae on tap pull
 
 ```bash
 git clone https://github.com/Homebrew/homebrew-brew-vulns
-cd brew-vulns
+cd homebrew-brew-vulns
 bin/setup
 rake test
 ```

data/examples/pr-vuln-check.yml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@main
+        uses: Homebrew/actions/setup-homebrew@1f8e202ffddf94def7f42f6fa3a482e821489f9c # 2026.07.10.1
 
       - name: Install brew-vulns
         run: brew install homebrew/brew-vulns/brew-vulns

data/examples/scan-all.yml

@@ -16,7 +16,7 @@ jobs:
       contents: write
     steps:
       - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@main
+        uses: Homebrew/actions/setup-homebrew@1f8e202ffddf94def7f42f6fa3a482e821489f9c # 2026.07.10.1
 
       - name: Install brew-vulns
         run: brew install homebrew/brew-vulns/brew-vulns

data/exe/brew-vulns

@@ -3,4 +3,6 @@
 
 require "brew/vulns"
 
+warn Brew::Vulns::DEPRECATION_MESSAGE
+
 exit Brew::Vulns::CLI.run(ARGV)

data/lib/brew/vulns/cli.rb

@@ -5,12 +5,15 @@ module Brew
     class CLI
       def self.run(args)
         new(args).run
+      rescue Error => e
+        $stderr.puts "Error: #{e.message}"
+        2
       end
 
       DEFAULT_MAX_SUMMARY = 60
       SEVERITY_LEVELS = { "low" => 1, "medium" => 2, "high" => 3, "critical" => 4 }.freeze
       MAX_VULN_FETCH_THREADS = 15
-      FLAGS_WITH_VALUE = %w[-b --brewfile -m --max-summary -s --severity].freeze
+      FLAGS_WITH_VALUE = %w[-b --brewfile -m --max-summary -s --severity --osv-export].freeze
 
       def initialize(args)
         @args = args
@@ -25,6 +28,8 @@ module Brew
         @max_summary = parse_max_summary(args)
         @min_severity = parse_severity(args)
         @brewfile = parse_brewfile_path(args)
+        @osv_export_dir = parse_osv_export_dir(args)
+        @force_ipv4 = args.include?("--ipv4")
       end
 
       def parse_formula_names(args)
@@ -71,6 +76,23 @@ module Brew
         0
       end
 
+      def parse_osv_export_dir(args)
+        args.each_with_index do |arg, idx|
+          if arg == "--osv-export"
+            value = args[idx + 1]
+            return value if value && !value.empty? && !value.start_with?("-")
+
+            raise Error, "--osv-export requires a directory argument"
+          elsif arg.start_with?("--osv-export=")
+            value = arg.split("=", 2).last
+            raise Error, "--osv-export requires a directory argument" if value.empty?
+
+            return value
+          end
+        end
+        nil
+      end
+
       def parse_brewfile_path(args)
         args.each_with_index do |arg, idx|
           if arg == "--brewfile" || arg == "-b"
@@ -90,18 +112,20 @@ module Brew
           return 0
         end
 
+        return run_osv_export if @osv_export_dir
+
         formulae = load_formulae
         if formulae.empty?
           puts "No formulae found."
           return 0
         end
 
-        queryable = formulae.select(&:supported_forge?).select(&:tag)
+        queryable = formulae.select(&:to_osv_query)
         skipped = formulae.size - queryable.size
 
         unless @json_output || @sarif_output || @cyclonedx_output
           puts "Checking #{queryable.size} packages for vulnerabilities..."
-          puts "(#{skipped} packages skipped - no supported source URL)" if skipped > 0
+          puts "(#{skipped} packages skipped - no source repository URL or version)" if skipped > 0
           puts
         end
 
@@ -118,6 +142,28 @@ module Brew
         2
       end
 
+      # OSV export always operates on the full homebrew-core set (it generates
+      # an ecosystem-wide advisory feed), or on explicitly named formulae for
+      # testing. --brewfile / installed selection are intentionally ignored.
+      def run_osv_export
+        formulae = if @formula_names.any?
+          Formula.load_named(@formula_names)
+        else
+          Formula.load_all
+        end
+
+        annotated = formulae.select { |f| f.resolved_vulnerability_ids.any? }
+        $stderr.puts "#{annotated.size} formulae with security `resolves` annotations"
+
+        written = OsvExport.run(annotated, @osv_export_dir)
+        written.each { |p| $stderr.puts "  wrote #{p}" }
+        $stderr.puts "#{written.size} records written to #{@osv_export_dir}"
+        0
+      rescue Error => e
+        $stderr.puts "Error: #{e.message}"
+        2
+      end
+
       private
 
       def load_formulae
@@ -133,7 +179,7 @@ module Brew
       end
 
       def scan_vulnerabilities(formulae)
-        client = OsvClient.new
+        client = OsvClient.new(force_ipv4: @force_ipv4)
         queries = formulae.map(&:to_osv_query).compact
 
         vuln_results = client.query_batch(queries)
@@ -213,7 +259,7 @@ module Brew
             type:    "library",
             name:    formula.name,
             version: formula.version,
-            purl:    "pkg:brew/#{formula.name}@#{formula.version}",
+            purl:    formula.purl,
           }
           pedigree = formula.cyclonedx_pedigree
           component[:pedigree] = pedigree if pedigree
@@ -255,7 +301,7 @@ module Brew
           source:      { name: "OSV", url: "https://osv.dev" },
           ratings:     [{ severity: vuln.severity_display&.downcase }],
           description: vuln.summary,
-          affects:     [{ ref: "pkg:brew/#{formula.name}@#{formula.version}" }],
+          affects:     [{ ref: formula.purl }],
         }
       end
 
@@ -421,8 +467,10 @@ module Brew
             -j, --json           Output results as JSON
             --cyclonedx          Output results as CycloneDX SBOM with vulnerabilities
             --sarif              Output results as SARIF for GitHub code scanning
+            --osv-export DIR     Write OSV-schema records for patch-resolved CVEs to DIR (experimental)
             -m, --max-summary N  Truncate summaries to N characters (default: 60, 0 for no limit)
             -s, --severity LEVEL Only show vulnerabilities at or above LEVEL (low, medium, high, critical)
+            --ipv4               Connect to api.osv.dev over IPv4 only
             -h, --help           Show this help message
 
           Examples:
@@ -438,6 +486,7 @@ module Brew
             brew vulns --cyclonedx        Output as CycloneDX SBOM
             brew vulns --sarif            Output as SARIF for GitHub Actions
             brew vulns --severity high    Only show HIGH and CRITICAL vulnerabilities
+            brew vulns --osv-export ./advisories  Generate Homebrew-ecosystem OSV records
         HELP
       end
     end

data/lib/brew/vulns/formula.rb

@@ -2,21 +2,47 @@
 
 require "json"
 require "open3"
+require "purl"
 
 module Brew
   module Vulns
     class Formula
-      attr_reader :name, :version, :source_url, :head_url, :dependencies, :patches
+      attr_reader :name, :version, :revision, :source_url, :head_url, :homepage, :dependencies, :patches
 
       def initialize(data)
         @name = data["name"] || data["full_name"]
         @version = data.dig("versions", "stable") || data["version"]
+        @revision = data["revision"].to_i
         @source_url = data.dig("urls", "stable", "url")
+        @stable_tag = data.dig("urls", "stable", "tag")
         @head_url = data.dig("urls", "head", "url")
+        @homepage = data["homepage"]
         @dependencies = data["dependencies"] || []
         @patches = data["patches"] || []
       end
 
+      # The Homebrew package version including the revision suffix, e.g. "1.81.6_6".
+      # This is the version string as it appears in `pkg:brew/` purls and bottle paths.
+      def full_version
+        revision.zero? ? version : "#{version}_#{revision}"
+      end
+
+      # Package URL for this formula. Uses the `purl` gem so that special
+      # characters in the formula name (notably `@` in versioned formulae like
+      # `glibc@2.13`) are percent-encoded; otherwise the `@` would be parsed as
+      # the version separator.
+      def purl(with_version: true)
+        Purl::PackageURL.new(type: "brew", name: name, version: with_version ? version : nil).to_s
+      end
+
+      # Patches whose `resolves` list contains `vuln_id` (case-insensitive).
+      def patches_resolving(vuln_id)
+        target = vuln_id.to_s.upcase
+        patches.select do |p|
+          Array(p["resolves"]).any? { |r| r.is_a?(Hash) && r["type"] == "security" && r["id"].to_s.upcase == target }
+        end
+      end
+
       # CVE/GHSA identifiers declared as resolved by this formula's patches.
       # Populated from `brew info --json=v2` `patches[].resolves[]` (Homebrew >= 6.0.4);
       # empty on older Homebrew versions or for formulae with no annotated patches.
@@ -66,32 +92,32 @@ module Brew
         { patches: cdx_patches }
       end
 
+      # The git repository URL to use as the OSV `GIT` ecosystem package name.
+      # In order of preference:
+      #   1. owner/repo extracted from a recognised forge URL on stable, head,
+      #      or homepage. Known forges are preferred even over a canonical
+      #      non-forge git URL, because OSV's GIT coverage is much better there.
+      #   2. the stable URL itself when stable is a git checkout (`url ..., tag: ...`)
+      #   3. the head URL verbatim (head specs are always git URLs)
+      # Returns nil when none of the above yield a URL.
       def repo_url
         return @repo_url if defined?(@repo_url)
 
-        @repo_url = extract_repo_url(source_url) || extract_repo_url(head_url)
+        @repo_url = extract_repo_url(source_url) ||
+                    extract_repo_url(head_url) ||
+                    extract_repo_url(homepage) ||
+                    (source_url if @stable_tag) ||
+                    head_url
       end
 
+      # The version identifier to send as the OSV query `version`. Prefers an
+      # explicit git tag (from a `tag:` stable spec or parsed from a forge
+      # tarball URL); falls back to the bare formula version, which OSV's GIT
+      # ecosystem accepts for at least some upstreams.
       def tag
         return @tag if defined?(@tag)
 
-        @tag = extract_tag_from_url(source_url)
-      end
-
-      def github?
-        repo_url&.include?("github.com")
-      end
-
-      def gitlab?
-        repo_url&.include?("gitlab.com")
-      end
-
-      def codeberg?
-        repo_url&.include?("codeberg.org")
-      end
-
-      def supported_forge?
-        github? || gitlab? || codeberg?
+        @tag = @stable_tag || extract_tag_from_url(source_url) || version
       end
 
       def to_osv_query

data/lib/brew/vulns/osv_client.rb

@@ -3,6 +3,7 @@
 require "net/http"
 require "json"
 require "uri"
+require "socket"
 require "brew/vulns/version"
 
 module Brew
@@ -20,6 +21,10 @@ module Brew
 
       USER_AGENT = "brew-vulns/#{Brew::Vulns::VERSION} (+https://github.com/Homebrew/homebrew-brew-vulns)"
 
+      def initialize(force_ipv4: false)
+        @force_ipv4 = force_ipv4
+      end
+
       def query(repo_url:, version:)
         payload = {
           package: {
@@ -86,6 +91,7 @@ module Brew
 
       def execute_request(uri, request)
         attempts = 0
+        ipv4_addr = resolve_ipv4(uri.host) if @force_ipv4
 
         begin
           attempts += 1
@@ -94,6 +100,7 @@ module Brew
           http.verify_mode = OpenSSL::SSL::VERIFY_PEER
           http.open_timeout = OPEN_TIMEOUT
           http.read_timeout = READ_TIMEOUT
+          http.ipaddr = ipv4_addr if ipv4_addr
 
           response = http.request(request)
 
@@ -107,12 +114,14 @@ module Brew
           raise ApiError, "Invalid JSON response from OSV API: #{e.message}"
         rescue Net::OpenTimeout, Net::ReadTimeout => e
           if attempts < MAX_RETRIES
+            ipv4_addr ||= resolve_ipv4(uri.host) if attempts == MAX_RETRIES - 1
             sleep RETRY_DELAY
             retry
           end
           raise ApiError, "OSV API timeout after #{attempts} attempts: #{e.message}"
         rescue SocketError, Errno::ECONNREFUSED => e
           if attempts < MAX_RETRIES
+            ipv4_addr ||= resolve_ipv4(uri.host) if attempts == MAX_RETRIES - 1
             sleep RETRY_DELAY
             retry
           end
@@ -122,6 +131,15 @@ module Brew
         end
       end
 
+      # Resolve the first IPv4 address for `host`, for use with Net::HTTP#ipaddr=
+      # to bypass a misbehaving IPv6 path. Returns nil (so the caller falls back
+      # to default resolution) if no A record is found or DNS fails.
+      def resolve_ipv4(host)
+        Addrinfo.getaddrinfo(host, nil, Socket::AF_INET, Socket::SOCK_STREAM).first&.ip_address
+      rescue SocketError
+        nil
+      end
+
       MAX_PAGES = 100
 
       def fetch_all_pages(response, original_payload)

data/lib/brew/vulns/osv_export.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require "json"
+require "time"
+require "fileutils"
+
+module Brew
+  module Vulns
+    # Emits OSV-schema records for a `Homebrew` ecosystem describing CVEs that
+    # homebrew-core formulae resolve via shipped patches.
+    #
+    # One record is written per (formula, vulnerability id) pair found in
+    # `patches[].resolves`. The record states that the formula was affected up
+    # to (but not including) the currently shipped version+revision; this is the
+    # "fixed at or before what we ship today" approximation, since the precise
+    # fix boundary requires homebrew-core git archaeology.
+    #
+    # Record shape follows the OSV 1.7 schema and mirrors the Debian DSA layout
+    # (`upstream` listing the source CVE, `affected[].ranges` of type
+    # `ECOSYSTEM`, `ecosystem_specific` carrying the patch detail).
+    module OsvExport
+      SCHEMA_VERSION = "1.7.3"
+      ECOSYSTEM = "Homebrew"
+      ID_PREFIX = "BREW"
+
+      module_function
+
+      def run(formulae, dir, client: OsvClient.new, now: Time.now.utc)
+        FileUtils.mkdir_p(dir)
+        written = []
+
+        formulae.each do |formula|
+          formula.resolved_vulnerability_ids.each do |vuln_id|
+            upstream = fetch_upstream(client, vuln_id)
+            record = record_for(formula, vuln_id, upstream: upstream, now: now)
+            path = File.join(dir, "#{record[:id]}.json")
+            File.write(path, JSON.pretty_generate(record))
+            written << path
+          end
+        end
+
+        written
+      end
+
+      def record_for(formula, vuln_id, upstream: nil, now: Time.now.utc)
+        record = {
+          schema_version: SCHEMA_VERSION,
+          id:             record_id(formula, vuln_id),
+          modified:       now.strftime("%Y-%m-%dT%H:%M:%SZ"),
+          upstream:       [vuln_id],
+          affected:       [affected_entry(formula, vuln_id)],
+        }
+
+        if upstream
+          record[:summary] = upstream["summary"] if upstream["summary"]
+          record[:details] = upstream["details"] if upstream["details"]
+          record[:severity] = upstream["severity"] if upstream["severity"]
+          record[:upstream] = ([vuln_id] + Array(upstream["aliases"])).uniq
+          record[:references] = upstream["references"] if upstream["references"]
+        end
+
+        record
+      end
+
+      def record_id(formula, vuln_id)
+        "#{ID_PREFIX}-#{formula.name}-#{vuln_id}"
+      end
+
+      def affected_entry(formula, vuln_id)
+        {
+          package: {
+            ecosystem: ECOSYSTEM,
+            name:      formula.name,
+            purl:      formula.purl(with_version: false),
+          },
+          ranges: [
+            {
+              type:   "ECOSYSTEM",
+              events: [
+                { introduced: "0" },
+                { fixed: formula.full_version },
+              ],
+            },
+          ],
+          ecosystem_specific: {
+            fix:     "patch",
+            patches: formula.patches_resolving(vuln_id).filter_map { |p| patch_ref(p) },
+          },
+        }
+      end
+
+      def patch_ref(patch)
+        ref = {}
+        ref[:type] = patch["type"] if patch["type"]
+        ref[:url] = patch["url"] if patch["url"]
+        ref[:file] = patch["file"] if patch["file"]
+        ref[:apply] = patch["apply"] if patch["apply"]
+        ref[:data] = true if patch["data"]
+        ref.empty? ? nil : ref
+      end
+
+      def fetch_upstream(client, vuln_id)
+        client.get_vulnerability(vuln_id)
+      rescue OsvClient::Error
+        nil
+      end
+    end
+  end
+end

data/lib/brew/vulns/version.rb

@@ -2,6 +2,13 @@
 
 module Brew
   module Vulns
-    VERSION = "0.4.0"
+    VERSION = "0.5.0"
+
+    DEPRECATION_MESSAGE = <<~MSG.freeze
+      brew-vulns is deprecated: `brew vulns` is now built into Homebrew.
+      Run `brew update` and use `brew vulns` directly, then remove this
+      package with `brew uninstall brew-vulns` or `gem uninstall brew-vulns`.
+      See https://github.com/Homebrew/brew/pull/23080 for details.
+    MSG
   end
 end

data/lib/brew/vulns.rb

@@ -7,6 +7,7 @@ require_relative "vulns/version"
 require_relative "vulns/osv_client"
 require_relative "vulns/formula"
 require_relative "vulns/vulnerability"
+require_relative "vulns/osv_export"
 require_relative "vulns/cli"
 
 module Brew

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: brew-vulns
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Andrew Nesbitt
@@ -110,6 +110,7 @@ files:
 - lib/brew/vulns/cli.rb
 - lib/brew/vulns/formula.rb
 - lib/brew/vulns/osv_client.rb
+- lib/brew/vulns/osv_export.rb
 - lib/brew/vulns/version.rb
 - lib/brew/vulns/vulnerability.rb
 - sig/brew/vulns.rbs
@@ -120,6 +121,11 @@ metadata:
   homepage_uri: https://github.com/Homebrew/homebrew-brew-vulns
   source_code_uri: https://github.com/Homebrew/homebrew-brew-vulns
   changelog_uri: https://github.com/Homebrew/homebrew-brew-vulns/blob/main/CHANGELOG.md
+post_install_message: |
+  brew-vulns is deprecated: `brew vulns` is now built into Homebrew.
+  Run `brew update` and use `brew vulns` directly, then remove this
+  package with `brew uninstall brew-vulns` or `gem uninstall brew-vulns`.
+  See https://github.com/Homebrew/brew/pull/23080 for details.
 rdoc_options: []
 require_paths:
 - lib
@@ -134,7 +140,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.12
 specification_version: 4
 summary: Check Homebrew packages for known vulnerabilities
 test_files: []