guardvibe 3.0.52 → 3.0.53

package/build/tools/full-audit.js

@@ -223,11 +223,30 @@ export async function runFullAudit(path, options) {
     }
     // --- Section 3: Dependencies ---
     if (!options?.skipDeps) {
-        const manifestPath = resolve(projectRoot, "package.json");
+        // Prefer lockfiles for resolved (installed) versions over package.json spec ranges.
+        // package.json says `"@clerk/nextjs": "^7.0.1"` but the installed version may be 7.2.8.
+        // OSV needs the resolved version to give accurate vuln matches; spec lower bound
+        // produces false positives where the bug was already patched in a higher minor.
+        const lockCandidates = ["package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml"];
+        let manifestPath = resolve(projectRoot, "package.json");
+        for (const lock of lockCandidates) {
+            const lockPath = resolve(projectRoot, lock);
+            if (existsSync(lockPath)) {
+                manifestPath = lockPath;
+                break;
+            }
+        }
         if (existsSync(manifestPath)) {
             try {
                 const depsJson = await scanDependencies(manifestPath, "json");
                 const parsed = safeJsonParse(depsJson);
+                if (!parsed) {
+                    // scanDependencies returned a markdown error (OSV API unreachable, parse failed, etc).
+                    // Push a dependencies section so downstream consumers always see it; surface the
+                    // error in `details` so users can troubleshoot instead of silently missing the section.
+                    const errSnippet = (depsJson.match(/Error:[^\n]+/) || ["Scan failed"])[0];
+                    sections.push({ name: "dependencies", status: "error", findings: 0, critical: 0, high: 0, medium: 0, details: errSnippet });
+                }
                 if (parsed) {
                     const vulnPackages = parsed.summary?.vulnerable ?? 0;
                     const depFindings = [];

package/build/utils/osv-client.js

@@ -15,47 +15,51 @@ export async function queryOsv(name, version, ecosystem) {
     return data.vulns ?? [];
 }
 export async function queryOsvBatch(packages) {
-    const queries = packages.map(pkg => ({
-        package: { name: pkg.name, ecosystem: pkg.ecosystem },
-        version: pkg.version,
-    }));
-    const response = await fetch("https://api.osv.dev/v1/querybatch", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ queries }),
-        signal: AbortSignal.timeout(10000),
-    });
     const results = new Map();
-    if (!response.ok) {
-        throw new Error(`OSV batch API error: ${response.status} ${response.statusText}`);
-    }
-    const data = await response.json();
-    // Batch API returns minimal vuln info (just id). Fetch full details for each.
-    for (let i = 0; i < packages.length; i++) {
-        const key = `${packages[i].name}@${packages[i].version}`;
-        const batchVulns = data.results[i]?.vulns || [];
-        if (batchVulns.length === 0) {
-            results.set(key, []);
-            continue;
+    // OSV batch can time out on large monorepo lockfiles (1000+ packages),
+    // and very-large requests can be rate-limited. Chunk into 500-pkg batches
+    // and process sequentially so the per-request timeout is generous.
+    const CHUNK_SIZE = 500;
+    for (let start = 0; start < packages.length; start += CHUNK_SIZE) {
+        const chunk = packages.slice(start, start + CHUNK_SIZE);
+        const queries = chunk.map(pkg => ({
+            package: { name: pkg.name, ecosystem: pkg.ecosystem },
+            version: pkg.version,
+        }));
+        const response = await fetch("https://api.osv.dev/v1/querybatch", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ queries }),
+            signal: AbortSignal.timeout(60000),
+        });
+        if (!response.ok) {
+            throw new Error(`OSV batch API error: ${response.status} ${response.statusText}`);
         }
-        // Fetch full vulnerability details by ID
-        const fullVulns = [];
-        for (const bv of batchVulns) {
-            try {
-                const vulnResponse = await fetch(`https://api.osv.dev/v1/vulns/${bv.id}`, {
-                    signal: AbortSignal.timeout(5000),
-                });
-                if (vulnResponse.ok) {
-                    const vulnData = await vulnResponse.json();
-                    fullVulns.push(vulnData);
-                }
+        const data = await response.json();
+        for (let i = 0; i < chunk.length; i++) {
+            const key = `${chunk[i].name}@${chunk[i].version}`;
+            const batchVulns = data.results[i]?.vulns || [];
+            if (batchVulns.length === 0) {
+                results.set(key, []);
+                continue;
             }
-            catch {
-                // If individual fetch fails, use minimal info
-                fullVulns.push({ id: bv.id, summary: "Details unavailable" });
+            const fullVulns = [];
+            for (const bv of batchVulns) {
+                try {
+                    const vulnResponse = await fetch(`https://api.osv.dev/v1/vulns/${bv.id}`, {
+                        signal: AbortSignal.timeout(5000),
+                    });
+                    if (vulnResponse.ok) {
+                        const vulnData = await vulnResponse.json();
+                        fullVulns.push(vulnData);
+                    }
+                }
+                catch {
+                    fullVulns.push({ id: bv.id, summary: "Details unavailable" });
+                }
             }
+            results.set(key, fullVulns);
         }
-        results.set(key, fullVulns);
     }
     return results;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.0.52",
+  "version": "3.0.53",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 365 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",