osv-scanner-mcp 0.12.0 → 0.12.1

package/README.md

@@ -445,7 +445,7 @@ For npm, Go, and PyPI, the "same release line" is the range npm's caret (`^`) tr
   - PyPI: update the version in `requirements.txt`, `pyproject.toml`, or `Pipfile` and regenerate the lockfile; for a transitive dependency, use a pip constraints file (`-c`) or the override settings of uv or Poetry
   - When the relation is `unknown` or `mixed`, both cases are described (no hint is given for Maven packages from `gradle.lockfile`)
 - **Checking recommended versions against OSV**: Recommendations are verified only against the vulnerabilities found in the scan (those affecting the current version), so a recommended version could be affected by newer vulnerabilities (for example, cryptography 3.2's candidate 49.0.0 is affected by two vulnerabilities introduced in 44.0.0 and fixed in 50.0.0). The server therefore queries `api.osv.dev` about the recommended version, and if it is affected, adds those vulnerabilities to the set to be fixed and chooses again with their fixed versions as candidates (50.0.0 in this example, with the reason in `upgrade_note`). The result is reported in `candidate_check`:
-  - `clean`: OSV reports no known vulnerabilities for the recommended version
+  - `clean`: OSV reports no additional known vulnerabilities for the recommended version beyond those already shown in the scan. Known `unfixed` vulnerabilities may still affect it; check `per_cve_detail[].recommended_status`
   - `has_known_vulnerabilities`: no candidate avoids them, so the recommended version has known vulnerabilities (IDs in `recommended_known_vulnerabilities`)
   - `conflict`: OSV reports that a candidate is affected by a vulnerability the scan had evaluated as not affecting it (the range data disagree), and no other candidate is available, so the recommendation is withheld (`recommended_upgrade: null`, `verification: "no_verified_candidate"`)
   - `failed`: the query failed or returned a malformed response (the recommendation, verified against the scanned vulnerabilities, is still returned)

package/dist/index.js

@@ -61,7 +61,7 @@ if (startupWarning !== null) {
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
 const server = new McpServer({
     name: "osv-scanner-mcp",
-    version: "0.12.0",
+    version: "0.12.1",
 });
 server.registerTool("scan_project", {
     title: "Scan project dependencies for vulnerabilities (Java / JavaScript / Python / Go / Rust)",
@@ -103,8 +103,9 @@ server.registerTool("suggest_fix", {
         "and the response gives the recommended version, the upgrade distance (upgrade_tier), and the fixed version per CVE. For npm, Go, and PyPI, a minor update within 0.x is also cross_major (may include breaking changes). " +
         "Dependencies scanned at a requirements.txt lower bound (>=) are marked version_is_lower_bound, and the recommendation then means raising the lower bound. " +
         "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm also introduced_by and declared_in). " +
-        "The recommended version is checked against api.osv.dev, and versions with known vulnerabilities that do not affect the current version are avoided (result in candidate_check; " +
-        "with has_known_vulnerabilities, failed, or skipped, the recommended version has not been confirmed safe; conflict means the data disagreed and the recommendation is withheld). " +
+        "The recommended version is checked against api.osv.dev, and versions with known vulnerabilities that do not affect the current version are avoided (result in candidate_check). " +
+        "clean means no additional known vulnerabilities beyond those shown in the scan; unfixed vulnerabilities may still affect the recommended version. " +
+        "With has_known_vulnerabilities, failed, or skipped, the recommended version has not been confirmed safe; conflict means the data disagreed and the recommendation is withheld. " +
         "Candidates are checked against the affected ranges of every vulnerability to fix, and the recommendation is withheld when the data are insufficient. Pre-releases are recommended only when no stable version fixes everything, and are marked recommended_is_prerelease. " +
         "CVEs with no fixed version newer than the current one are reported separately as unfixed, together with their status at the recommended version. " +
         "Always check coverage in the response (if complete is false, some dependencies are not included in the suggestions). " +

package/dist/osv/candidateCheck.js

@@ -43,6 +43,14 @@ class QueryBudget {
 }
 async function checkPackage(pkg, initial, budget, options) {
     const known = new Set(pkg.vulnerabilities.flatMap((v) => [v.id, ...v.aliases]));
+    const unfixed = new Set(initial.per_cve_detail.filter((v) => v.tier === "unfixed").map((v) => v.id));
+    const ignoredKnown = new Set(pkg.vulnerabilities.filter((v) => unfixed.has(v.id)).flatMap((v) => [v.id, ...v.aliases]));
+    // 別名が修正対象とも重なる場合は、その対象の判定を優先する。
+    for (const vuln of pkg.vulnerabilities) {
+        if (!unfixed.has(vuln.id))
+            for (const id of [vuln.id, ...vuln.aliases])
+                ignoredKnown.delete(id);
+    }
     const extraTargets = [];
     const excluded = new Set();
     const rejected = [];
@@ -62,9 +70,15 @@ async function checkPackage(pkg, initial, budget, options) {
                 return { suggestion, status: "failed", rejected };
             throw error;
         }
+        // 修正版なしの既知の脆弱性は修正対象ではなく、推奨先でもaffectedであることと矛盾しない。
+        // 新しく照会で見つかった対象はknownへ追加されるが、ignoredKnownには入れない。
+        records = records.filter((record) => {
+            const matched = recordIds(record).filter((id) => known.has(id));
+            return matched.length === 0 || matched.some((id) => !ignoredKnown.has(id));
+        });
         if (records.length === 0)
             return { suggestion, status: "clean", rejected };
-        // 新しい脆弱性は修正対象に加え、修正版を候補に加える。スキャンで既に知っている脆弱性なのに該当と返った場合は、
+        // 新しい脆弱性は修正対象に加え、修正版を候補に加える。既知の修正対象の脆弱性に該当と返った場合は、
         // 手元の範囲情報とOSVの判定が食い違っているため、その候補を除外する(安全側)
         let conflict = false;
         for (const record of records) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osv-scanner-mcp",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "MCP server that wraps Google's OSV-Scanner to scan Java projects for known vulnerabilities",
   "type": "module",
   "license": "Apache-2.0",