@lockhawk/core 0.2.4 → 0.2.6

package/README.md

@@ -1,12 +1,12 @@
 # @lockhawk/core
 
-The scanning engine behind [**lockhawk**](https://github.com/lockhawk/lockhawk) — lockfile
-parsing, dependency-graph building, [OSV.dev](https://osv.dev) matching, CVSS v3/v4 scoring, and
-report generation (table, JSON, SARIF, JUnit, HTML).
+The scanning engine behind [**lockhawk**](https://github.com/lockhawk/lockhawk): lockfile parsing,
+dependency graph building, [OSV.dev](https://osv.dev) matching, CVSS v3 and v4 scoring, and report
+generation (table, JSON, SARIF, JUnit, HTML).
 
 > **Most people want the CLI, not this package.** To scan a project, use
-> [`lockhawk`](https://www.npmjs.com/package/lockhawk) — `npx lockhawk scan`. Install
-> `@lockhawk/core` only if you're building a tool on top of the engine.
+> [`lockhawk`](https://www.npmjs.com/package/lockhawk) and run `npx lockhawk scan`. Install
+> `@lockhawk/core` only if you are building a tool on top of the engine.
 
 ## Install
 
@@ -24,8 +24,8 @@ console.log(result.summary, result.findings);
 ```
 
 `scan()` reads the project's lockfile (`package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml`),
-resolves the full dependency tree (including transitive dependencies), queries OSV.dev — offline
-from a cached database or online via the batch API — and returns scored, de-duplicated findings.
+resolves the full dependency tree including transitive dependencies, queries OSV.dev (offline from a
+cached database or online via the batch API), and returns scored, de-duplicated findings.
 
 ## Documentation
 

package/dist/index.d.ts

@@ -390,18 +390,23 @@ interface OnlineClientOptions {
     noCache?: boolean;
     cacheTtlHours?: number;
     retries?: number;
+    /** Per-request network timeout in milliseconds (default 15s). */
+    timeoutMs?: number;
 }
 /**
- * Online OSV source. Uses the batch endpoint (which returns only matched ids)
- * then hydrates each unique id to a full record — caching records by id so
- * repeat scans do no network work. All matching is re-validated downstream by
- * `buildFindings`, so this client only has to gather candidate records.
+ * Online OSV source. Queries the batch endpoint by package *name only* — never
+ * pinning an installed version — so OSV returns every advisory naming each
+ * package; lockhawk's own range matcher (`buildFindings` → `vulnerabilityAffects`)
+ * then decides what actually affects the installed version. Delegating the
+ * version match to OSV's server would cap coverage at OSV's matcher; doing it
+ * locally makes coverage depend only on lockhawk (and mirrors the offline path).
+ * Hydrated records are cached by id so repeat scans do no network work.
  */
 declare class OsvClient {
     private readonly opts;
     private readonly limit;
     constructor(opts: OnlineClientOptions);
-    /** Fetch advisories affecting the given packages, keyed by package name. */
+    /** Fetch advisories naming the given packages, keyed by package name. */
     fetchAdvisories(packages: PackageRef[]): Promise<Map<string, OsvVulnerability[]>>;
     private queryBatch;
     private hydrate;