osv-scanner-mcp 0.12.1 → 0.14.0

package/README.md

@@ -7,19 +7,19 @@
 
 An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-scanner). Ask an MCP client such as Claude to "check this project for vulnerabilities", and it returns the known vulnerabilities (CVE / GHSA) in your dependencies as a report sorted by severity, together with recommended upgrades.
 
-> **Status**: [Published on npm](https://www.npmjs.com/package/osv-scanner-mcp) (`npx -y osv-scanner-mcp`). Supports lockfiles and manifests for Java (Maven / Gradle), JavaScript (npm / yarn / pnpm / bun), Python (Poetry / uv / Pipenv / PDM / requirements.txt), Go, and Rust (`Cargo.lock`), with upgrade recommendations for all but Rust (planned). Setup instructions are provided for Claude Code, Claude Desktop, Codex CLI, Antigravity, and VS Code (GitHub Copilot).
+> **Status**: [Published on npm](https://www.npmjs.com/package/osv-scanner-mcp) (`npx -y osv-scanner-mcp`). Supports lockfiles and manifests for Java (Maven / Gradle), JavaScript (npm / yarn / pnpm / bun), Python (Poetry / uv / Pipenv / PDM / requirements.txt), Go, and Rust (`Cargo.lock`), with upgrade recommendations for Maven, npm, PyPI, Go, and crates.io. Setup instructions are provided for Claude Code, Claude Desktop, Codex CLI, Antigravity, and VS Code (GitHub Copilot).
 
 ## Features
 
 - **One-shot multi-language scan**: Pass a project path to `scan_project`, and it detects and scans the Java, JavaScript, Python, Go, and Rust lockfiles in the project together. Dependencies that could not be scanned (for example, a manifest without a lockfile or an unpinned requirement) are reported up front in `coverage`
-- **Upgrade recommendations**: `suggest_fix` recommends, for each vulnerable package, the upgrade closest to the current release line that fixes all its known vulnerabilities, for Maven, npm, PyPI, and Go. The recommended version is also checked against the OSV database so that it does not introduce other known vulnerabilities
+- **Upgrade recommendations**: `suggest_fix` recommends, for each vulnerable package, the upgrade closest to the current release line that addresses its fix targets, for Maven, npm, PyPI, Go, and Rust (crates.io). Known unfixed and informational advisories remain visible. The recommended version is also checked against the OSV database for additional fix-target vulnerabilities
 - **Rust without false positives**: For `Cargo.lock`, only crates from crates.io are scanned. Your own workspace crates, git dependencies, and crates from private registries are not looked up as crates.io crates (OSV-Scanner alone would match them by name, and send their names to the OSV API). RustSec notices about unmaintained or unsound crates are labeled `informational` and counted apart from vulnerabilities
 - **Direct and transitive dependencies**: Packages are marked as direct or transitive dependencies (from `package-lock.json`, `go.mod`, `requirements.txt`, and `pom.xml`), and update hints are tailored accordingly, for example by naming the direct dependency that pulls in a transitive one
 - **Java project scan**: `scan_java_project` scans only the Java (Maven / Gradle) manifests and returns a formatted report
 - **JAR/WAR scan**: `scan_java_artifact` detects known vulnerabilities from the metadata inside JAR/WAR archives, for projects without a lockfile or with only shaded/fat JARs (best-effort identification, stated explicitly in `coverage`)
 - **SBOM scan**: `scan_sbom` checks the dependencies recorded in a CycloneDX/SPDX JSON SBOM. It states explicitly that the SBOM's completeness and its match with the actual artifacts are not verified
 - **Severity-sorted reports**: Vulnerabilities are grouped by package and sorted by CVSS score, with five severity labels (critical / high / medium / low / unknown) and summary counts
-- **Fixed versions**: Each vulnerability includes `fixed_versions`, sorted correctly by Maven version precedence (including non-semver forms such as `2.17.1-RELEASE`), Semantic Versioning precedence for npm and Go, and PEP 440 for PyPI
+- **Fixed versions**: Each vulnerability includes `fixed_versions`, sorted correctly by Maven version precedence (including non-semver forms such as `2.17.1-RELEASE`), Semantic Versioning precedence for npm, Go, and Rust, and PEP 440 for PyPI
 - **Security first**: No shell execution, a fixed argument allowlist, path normalization and boundary checks, scanning private copies instead of the original files, and timeouts and output size limits are built in
 
 ## Requirements
@@ -29,6 +29,7 @@ An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-sc
   - A manually installed binary (on `PATH` or set with `OSV_SCANNER_PATH`) is used first
   - Set `OSV_MCP_AUTO_DOWNLOAD=0` to disable the automatic download
   - Set `OSV_MCP_PREFER_DOWNLOAD=1` to always use the verified downloaded binary instead of one on `PATH` (recommended for production)
+  - The pinned version is osv-scanner 2.7.0. Its binary is cached in `~/.cache/osv-scanner-mcp/v2.7.0/`; directories of earlier versions (such as `v2.4.0/`) are no longer used and can be deleted
 - Scans, `suggest_fix`, and `explain_vulnerability` access the network. Vulnerabilities are looked up in the OSV database (`api.osv.dev`), and **scanning `pom.xml` or `requirements.txt` also connects to deps.dev (`api.deps.dev`) to resolve transitive dependencies**. See [Network destinations and privacy](#network-destinations-and-privacy) for details and how to turn this off
 
 ## Setup
@@ -176,13 +177,13 @@ As an additional layer of defense, you can limit what the server can read and wr
 
 ### Network destinations and privacy
 
-Destinations confirmed with osv-scanner v2.4.0 (2026-10-07):
+Destinations confirmed with osv-scanner v2.4.0 (2026-10-07) and v2.7.0, the pinned version (2026-10-15):
 
 | Operation | Destinations | Information sent |
 |---|---|---|
 | Scanning `pom.xml` (`scan_project` / `scan_java_project` / `suggest_fix`) | `api.osv.dev`, **`api.deps.dev`** | Package names and versions. To resolve transitive dependencies, the names and versions of the dependencies declared in `pom.xml` (including internal packages) are sent to deps.dev |
 | Scanning `requirements.txt` (`scan_project` / `suggest_fix`) | `api.osv.dev`, **`api.deps.dev`** | As with `pom.xml`, the names and versions of the listed dependencies are sent to deps.dev to resolve transitive dependencies. Package indexes given with `--index-url` and similar options are not contacted |
-| Scanning lockfiles (`gradle.lockfile`, npm lockfiles such as `package-lock.json`, Python lockfiles such as `poetry.lock`, `go.mod`, `Cargo.lock`) | `api.osv.dev` | Package names and versions (lockfiles already list every dependency, so nothing is resolved remotely). For `Cargo.lock`, only crates from crates.io are sent: the names of your own crates, git dependencies, and private-registry crates are not sent (confirmed 2026-10-11) |
+| Scanning lockfiles (`gradle.lockfile`, npm lockfiles such as `package-lock.json`, Python lockfiles such as `poetry.lock`, `go.mod`, `Cargo.lock`) | `api.osv.dev` | Package names and versions (lockfiles already list every dependency, so nothing is resolved remotely). For `Cargo.lock`, only crates from crates.io are sent: the names of your own crates, git dependencies, and private-registry crates are not sent (confirmed 2026-10-11). **Git dependencies in npm lockfiles** (`package-lock.json`, `yarn.lock`, and so on) are looked up by their repository URL (ecosystem `GIT`) and commit, so the host name and path of a private git repository (for example `https://git.example.com/team/repo`) are sent (since osv-scanner 2.6.0) |
 | `scan_java_artifact` / `scan_sbom` | `api.osv.dev` | Names and versions of the identified packages |
 | `suggest_fix` checking recommended versions | `api.osv.dev` | The names of packages with a recommendation (already sent during the scan) and the candidate versions (published fixed versions). Disable with `OSV_MCP_NO_CANDIDATE_CHECK=1` |
 | `explain_vulnerability` | `api.osv.dev` | The vulnerability ID |
@@ -219,7 +220,11 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
 
 **`requirements.txt` files are not passed to OSV-Scanner as they are.** The server parses them, rewrites only the dependency lines it can interpret into simple forms such as `name==version`, and scans a private temporary copy (deleted after the scan). OSV-Scanner interprets include directives on its own (it even treats `- r ../x.txt`, with a space, as an include and reads files outside the scan scope), so the copy never contains include directives or options. Includes (`-r` / `--requirement`) are expanded by the server, and only when the included file is inside the project directory.
 
-**`Cargo.lock` files are not passed to OSV-Scanner as they are either.** OSV-Scanner (v2.4.0) ignores where each package comes from and looks every package up as a crates.io crate, so a workspace crate, a git fork, or a private-registry crate with the same name and version as a vulnerable crates.io crate is reported as vulnerable, and its name is sent to the OSV API. The server parses `Cargo.lock` and scans a private copy that lists only the packages whose source is crates.io (`registry+https://github.com/rust-lang/crates.io-index` or `sparse+https://index.crates.io/`), like `cargo audit`. Packages replaced with `[replace]` are not scanned, because they are not used (the replacement is classified by its own source). The parser accepts only what Cargo writes; if a `Cargo.lock` contains anything else, the whole file is excluded and listed in `skipped_files` instead of being scanned partially. Cargo is never run.
+**`Cargo.lock` files are not passed to OSV-Scanner as they are either.** OSV-Scanner (v2.4.0 and v2.7.0) ignores where each package comes from and looks every package up as a crates.io crate, so a workspace crate, a git fork, or a private-registry crate with the same name and version as a vulnerable crates.io crate is reported as vulnerable, and its name is sent to the OSV API. The server parses `Cargo.lock` and scans a private copy that lists only the packages whose source is crates.io (`registry+https://github.com/rust-lang/crates.io-index` or `sparse+https://index.crates.io/`), like `cargo audit`. Packages replaced with `[replace]` are not scanned, because they are not used (the replacement is classified by its own source). The parser accepts only what Cargo writes; if a `Cargo.lock` contains anything else, the whole file is excluded and listed in `skipped_files` instead of being scanned partially. Cargo is never run.
+
+**`package-lock.json` copies get a `resolved` URL where it is missing.** osv-scanner 2.7.0 treats entries without `resolved` as local packages and does not look them up, which would silently skip bundled dependencies (`inBundle`) and registry packages in lockfiles generated with npm's `omit-lockfile-registry-resolved=true`. The private copy that is scanned gets a public-registry URL for those entries (entries under `node_modules/` that are not links and have a plain version, and aliases such as `npm:lodash@4.17.20` in lockfile version 1), so they are looked up as before; the original file is not changed.
+
+**npm JSON limits:** Normalization of `package-lock.json` and `npm-shrinkwrap.json` is limited to 16 MiB per file and 64 MiB per scan, for both input and output. Before parsing, JSON nesting is limited to 128 levels and structural markers (containers, commas, and colons outside strings) to 1,000,000 per file and 2,000,000 per analysis phase. Changed copies use compact JSON, with their size checked before serialization. A lockfile that exceeds these limits is scanned as it is, without filling in `resolved` (OSV-Scanner parses large lockfiles itself; the limits only bound this server's own parsing and rewriting), and it is listed in `coverage.skipped_files` with the reason, so `complete` is `false`: entries without `resolved` in it may not have been looked up. Workspace membership and dependency-relation lookups use the same structural checks and remain unconfirmed or unknown when limits are reached.
 
 **Reading the output**
 
@@ -262,14 +267,15 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
   - Each list holds up to 200 entries; the number of omitted entries is returned in `omitted_items`
 - `ecosystem_breakdown` includes ecosystems with zero findings, to show that they were scanned
 - **Informational advisories (Rust)**: RustSec also publishes notices that are not vulnerabilities: `unmaintained` (the crate is no longer maintained), `unsound` (a soundness bug), and `notice`. Most have no fixed version. When every advisory in a group is such a notice (every related ID, including aliases, must have its details available and be a notice of a known kind; otherwise it is treated as a vulnerability), the vulnerability has `informational` set to its kind, is listed after the vulnerabilities of the package, and is counted in `informational_count` (and in `ecosystem_breakdown`) instead of `vulnerability_count`, `severity_breakdown`, and `vulnerable_package_count`. If another database (such as GitHub's) lists the same issue as a vulnerability, it stays a vulnerability. `informational_count` appears only when there is at least one
-- `dependency_relation` shows whether a package is a direct (`direct`) or transitive (`transitive`) dependency. OSV-Scanner does not report this, so the server determines it by parsing the scanned copies:
+- `dependency_relation` shows whether a package is a direct (`direct`) or transitive (`transitive`) dependency. OSV-Scanner does not report this, so the server determines it from validated manifest data and scanned copies:
   - `package-lock.json` (v2 or later): dependencies of the root and workspace `package.json` files, resolved with Node's lookup rules (nested `node_modules` first, then parent directories), are direct; everything reachable from them is transitive. Direct dependencies list the `package.json` files that declare them in `declared_in`; transitive dependencies list the direct dependencies that require them in `introduced_by` (up to 10, with the rest counted in `introduced_by_omitted`). A version that is both a direct dependency and required by another dependency is `direct` and also has `introduced_by`
   - `go.mod`: `require` lines without `// indirect` are direct. Modules affected by a `replace` directive are marked `replaced_in_go_mod: true` (OSV-Scanner reports the replacement module and version)
   - `requirements.txt`: dependencies written in the file are direct; dependencies resolved through deps.dev are transitive
   - `pom.xml`: OSV-Scanner reports the dependencies declared in `pom.xml` (and its parent POMs) and the transitive dependencies resolved through deps.dev as separate results (`source.type` `lockfile` / `unknown`), and this split is used (so parent POMs, profiles, properties, and dependency management are interpreted exactly as OSV-Scanner does). `introduced_by` / `declared_in` are not available. This relies on undocumented OSV-Scanner output, so anything unexpected is reported as `unknown`
-  - Other formats (`gradle.lockfile`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, `pdm.lock`, and `Cargo.lock` for now), lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
+  - `Cargo.lock`: crates.io dependencies immediately required by a local/workspace/path crate are direct; crates.io dependencies reachable through them (including git and alternate-registry origins) are transitive. `introduced_by` names the first direct dependency on each path. References are resolved by exact name, version, and source where provided; ambiguous references are not guessed. Replacements are followed. `declared_in` lists project-relative Cargo.toml paths only when every declaring crate has a unique matching manifest. Otherwise `declaring_crates` names the unmapped declaring crates (up to 10, with the rest in `declaring_crates_omitted`). Dev/build/target-specific distinctions are unavailable. Traversal over 2,000,000 edges returns `unknown`
+  - Other formats (`gradle.lockfile`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, and `pdm.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
 - `dependency_groups` is the raw dependency group reported by OSV-Scanner (for example `dev`). It is missing or inaccurate for some lockfile formats (absent for pnpm, `optional` for pdm, and so on), so treat it as informational
-- Upgrade recommendations (`suggest_fix`) are available for Java, JavaScript, Python, and Go. Rust packages are returned with `verification: "unsupported_ecosystem"` for now
+- Upgrade recommendations (`suggest_fix`) are available for Maven, npm, PyPI, Go, and Rust (crates.io)
 
 ### `scan_java_project`
 
@@ -334,7 +340,7 @@ If an existing parent POM cannot be read (larger than 10 MiB, not a regular file
 ```
 
 - `packages` is sorted by the most severe vulnerability, and each `vulnerabilities` list by severity (unknown last)
-- `fixed_versions` lists the fixed versions recorded in OSV, in ascending order: by Maven precedence for Maven, Semantic Versioning precedence for npm and Go (values that are not valid SemVer come last), and PEP 440 for PyPI (in the order listed by OSV up to v0.5.0); other ecosystems keep the order listed by OSV (the order is not guaranteed). Several release lines may be mixed (for example a 2.12 backport and the 2.15 line). Pre-releases (`5.0.0-beta.3`) and Go pseudo-versions (`0.0.0-20180925071336-cf3bd585ca2a`) may be included. An empty array means that OSV lists no fixed version. Up to v0.4.1, this was always empty for packages outside Maven
+- `fixed_versions` lists the fixed versions recorded in OSV, in ascending order: by Maven precedence for Maven, Semantic Versioning precedence for npm, Go, and Rust (values that are not valid SemVer come last), and PEP 440 for PyPI (in the order listed by OSV up to v0.5.0); other ecosystems keep the order listed by OSV (the order is not guaranteed). Several release lines may be mixed (for example a 2.12 backport and the 2.15 line). Pre-releases (`5.0.0-beta.3`) and Go pseudo-versions (`0.0.0-20180925071336-cf3bd585ca2a`) may be included. An empty array means that OSV lists no fixed version. Up to v0.4.1, this was always empty for packages outside Maven
 - Vulnerabilities without a severity score are reported as `null` / `"unknown"`
 
 ### `scan_java_artifact`
@@ -350,7 +356,7 @@ A directory search includes `target` and `build`, and excludes `.git`, `node_mod
 The search is limited to a depth of 8, 100 archives, and 10,000 entries. If the search cannot complete within the limits, `artifact_search_limit_exceeded` is returned instead of silently truncating the results; narrow the target and try again.
 `OSV_MCP_ALLOWED_ROOT` applies as well.
 
-OSV-Scanner 2.4.0's `java/archive` plugin is used, and nested JARs are also analyzed by the scanner. No Java code is executed and no build is run.
+OSV-Scanner's `java/archive` plugin is used, and nested JARs are also analyzed by the scanner. No Java code is executed and no build is run.
 Identification relies on metadata inside the archives, so dependencies whose metadata was removed, and dependencies inside shaded/minimized JARs, may be missed.
 
 **Reading the output:**
@@ -391,7 +397,7 @@ Invalid JSON returns `invalid_sbom`, an unsupported format `unsupported_sbom_for
 
 ### `suggest_fix`
 
-Runs the same detection and scan as `scan_project` and recommends an **upgrade version** for each vulnerable package. Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), and Go. Instead of simply taking the highest fixed version, it picks the fixed version closest to the current release line, falling back through three tiers:
+Runs the same detection and scan as `scan_project` and recommends an **upgrade version** for each vulnerable package. Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, and Rust (crates.io). Instead of simply taking the highest fixed version, it picks the fixed version closest to the current release line, falling back through three tiers:
 
 | Tier | Meaning |
 |---|---|
@@ -399,7 +405,7 @@ Runs the same detection and scan as `scan_project` and recommends an **upgrade v
 | `major_internal` | A fixed version within the same major version (a minor upgrade) |
 | `cross_major` | A major upgrade is needed (may include breaking changes) |
 
-For npm, Go, and PyPI, the "same release line" is the range npm's caret (`^`) treats as compatible (PyPI has no common compatibility rule, but some 0.x packages make breaking changes in minor releases, so the same rule is used; a change of epoch is also `cross_major`). From 1.0.0 the line is major.minor, as for Maven. For 0.x, only the same `0.minor` is the same line, so a minor update (`0.3` → `0.4`) is `cross_major`, and for 0.0.x every update is `cross_major` (SemVer does not guarantee compatibility for 0.x updates).
+For npm, Go, PyPI, and Rust, the "same release line" is the range a caret (`^`) treats as compatible (PyPI has no common compatibility rule, but some 0.x packages make breaking changes in minor releases, so the same rule is used; a change of epoch is also `cross_major`). From 1.0.0 the line is major.minor, as for Maven. For 0.x, only the same `0.minor` is the same line, so a minor update (`0.3` → `0.4`) is `cross_major`, and for 0.0.x every update is `cross_major` (SemVer does not guarantee compatibility for 0.x updates).
 
 **Input**: the same as `scan_project` (`project_path`)
 
@@ -438,14 +444,16 @@ For npm, Go, and PyPI, the "same release line" is the range npm's caret (`^`) tr
 - Pre-releases (`5.0.0-beta.3`, `15.6.0-canary.61`, Go pseudo-versions, PyPI `rc` and `dev` versions; post-releases count as stable) are recommended only when no stable candidate fixes every vulnerability, and are marked `recommended_is_prerelease: true`. A stable version in a higher tier is preferred over a pre-release in a lower tier.
 - When a version is recommended, `verification` is `verified`, and each CVE's `recommended_status` is `affected` / `not_affected` / `unknown` (`not_evaluated` when the recommendation is withheld). `per_cve_detail.fixed_in` is the candidate for that CVE alone; see `recommended_status` for the final recommendation.
 - CVEs with no fixed version newer than the current one get `tier: "unfixed"` and are left out of the recommendation (the data may be incomplete). They are still evaluated against the recommended version, and the result is shown. If every CVE is unfixed, `recommended_upgrade` is `null` as well. A CVE whose fixed version is listed but cannot be parsed as a version (such as `13.0`, which is not SemVer) gets `tier: "unparseable_fix"`; it is not treated as unfixed but stays in the set to be fixed, so the recommendation is withheld (`no_verified_candidate`).
+- Rust uses SemVer (`SEMVER` ranges) and Cargo caret compatibility: 0.x minor updates and 0.0.x patch updates are `cross_major`. `unmaintained` and `notice` advisories, and `unsound` advisories without a newer fixed version, remain in `per_cve_detail` with `tier: "informational"`, their kind, and `recommended_status`, but are not fix targets or counted as unfixed. An `unsound` advisory with a newer fixed version is a version-specific defect, so it is a fix target like a vulnerability (its tier is computed normally and it keeps `informational: "unsound"`). Packages with no fix target left return `verification: "informational_only"` without an upgrade. Unmaintained crates may need replacement; use `explain_vulnerability` for notices.
 - Suggestions include an `update_hint`, tailored to whether the package is a direct or transitive dependency:
   - Maven (from `pom.xml`): for a direct dependency, update the `<dependency>` version (or the parent POM, property, or BOM that manages it); for a transitive dependency, override the version in `<dependencyManagement>` or update the direct dependency that requires it
   - npm: for a direct dependency, update the version in the `package.json` listed in `declared_in`; for a transitive dependency, update the direct dependency named in `introduced_by`, or set the version with `overrides` in the root `package.json` (effective only in the root project)
   - Go: `go get <module>@<version>` (also for `// indirect` modules). For a module affected by `replace`, update the version in the `replace` directive instead of `require`. Major versions 2 and later use a different module path (`/v2` and so on) and are separate packages in OSV, so fixes in a newer major line are not included as candidates. If the current version is a pseudo-version (an untagged commit), `upgrade_note` says so
   - PyPI: update the version in `requirements.txt`, `pyproject.toml`, or `Pipfile` and regenerate the lockfile; for a transitive dependency, use a pip constraints file (`-c`) or the override settings of uv or Poetry
+  - Rust: where version requirements permit it, `cargo update -p <crate>@<current> --precise <recommended>` updates the lockfile. Otherwise change the direct requirement in the declaring Cargo.toml or update the parent dependency in `introduced_by`. Cross-major upgrades may break compatibility, including 0.x updates. Pre-releases may require explicit `=<version>` requirements and must be allowed by transitive parents. Build metadata is omitted from `--precise`. `[patch.crates-io]` changes a source, not the allowed version range; backports must satisfy parent requirements. Check yanked versions, MSRV, and compiler compatibility. Cargo is never executed by the server
   - When the relation is `unknown` or `mixed`, both cases are described (no hint is given for Maven packages from `gradle.lockfile`)
 - **Checking recommended versions against OSV**: Recommendations are verified only against the vulnerabilities found in the scan (those affecting the current version), so a recommended version could be affected by newer vulnerabilities (for example, cryptography 3.2's candidate 49.0.0 is affected by two vulnerabilities introduced in 44.0.0 and fixed in 50.0.0). The server therefore queries `api.osv.dev` about the recommended version, and if it is affected, adds those vulnerabilities to the set to be fixed and chooses again with their fixed versions as candidates (50.0.0 in this example, with the reason in `upgrade_note`). The result is reported in `candidate_check`:
-  - `clean`: OSV reports no additional known vulnerabilities for the recommended version beyond those already shown in the scan. Known `unfixed` vulnerabilities may still affect it; check `per_cve_detail[].recommended_status`
+  - `clean`: OSV reports no additional fix-target vulnerabilities after excluding known `unfixed` advisories, known informational advisories that are not fix targets, and new Rust `unmaintained` / `notice` records. These advisories may still apply; check `per_cve_detail[].recommended_status`. Newly discovered `unsound` records are added as fix targets
   - `has_known_vulnerabilities`: no candidate avoids them, so the recommended version has known vulnerabilities (IDs in `recommended_known_vulnerabilities`)
   - `conflict`: OSV reports that a candidate is affected by a vulnerability the scan had evaluated as not affecting it (the range data disagree), and no other candidate is available, so the recommendation is withheld (`recommended_upgrade: null`, `verification: "no_verified_candidate"`)
   - `failed`: the query failed or returned a malformed response (the recommendation, verified against the scanned vulnerabilities, is still returned)
@@ -557,7 +565,7 @@ Design notes and open items are in [docs/DESIGN_TODO.md](docs/DESIGN_TODO.md) (i
 - [x] Running under Node's permission model
 - [x] English tool descriptions and messages
 - [x] `scan_project` for Rust (`Cargo.lock`, crates.io crates only) and RustSec informational advisories
-- [ ] `suggest_fix` and direct/transitive dependencies for Rust
+- [x] `suggest_fix` and direct/transitive dependencies for Rust
 - [ ] Direct and transitive dependencies for `gradle.lockfile` and the YAML/TOML lockfiles
 
 ## License

package/dist/index.js

@@ -61,7 +61,7 @@ if (startupWarning !== null) {
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
 const server = new McpServer({
     name: "osv-scanner-mcp",
-    version: "0.12.1",
+    version: "0.14.0",
 });
 server.registerTool("scan_project", {
     title: "Scan project dependencies for vulnerabilities (Java / JavaScript / Python / Go / Rust)",
@@ -70,10 +70,11 @@ server.registerTool("scan_project", {
         "Python (poetry.lock / uv.lock / Pipfile.lock / pdm.lock / requirements.txt), Go (go.mod), Rust (Cargo.lock). " +
         "Package managers and builds are never run. " +
         "Always check coverage at the top of the response: it lists manifests without a lockfile, requirements lines without a pinned version, and excluded files. " +
+        "Git dependencies in npm lockfiles are looked up by repository URL, so private git host names and paths are sent to api.osv.dev. " +
         "For Cargo.lock, only crates from crates.io are scanned: the project's own crates are counted in local_crates, and git or private-registry crates are listed in unscannable_crates. " +
         "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
         "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, and pom.xml; unknown otherwise). " +
-        "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, and Go (not yet for Rust).",
+        "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, and Rust. Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
     inputSchema: {
         project_path: z
             .string()
@@ -97,17 +98,18 @@ server.registerTool("scan_java_project", {
 server.registerTool("suggest_fix", {
     title: "Recommend upgrades that fix vulnerabilities",
     description: "Scans the project with the same detection as scan_project and recommends an upgrade version for each vulnerable package. " +
-        "Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), and Go. " +
+        "Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, and Rust (crates.io). " +
         "The fixed version closest to the current release line is chosen with a three-tier fallback " +
         "(same_minor: same release line -> major_internal: same major version -> cross_major: major upgrade), " +
-        "and the response gives the recommended version, the upgrade distance (upgrade_tier), and the fixed version per CVE. For npm, Go, and PyPI, a minor update within 0.x is also cross_major (may include breaking changes). " +
+        "and the response gives the recommended version, the upgrade distance (upgrade_tier), and the fixed version per CVE. For npm, Go, PyPI, and Rust, a minor update within 0.x is also cross_major (may include breaking changes). " +
         "Dependencies scanned at a requirements.txt lower bound (>=) are marked version_is_lower_bound, and the recommendation then means raising the lower bound. " +
-        "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm also introduced_by and declared_in). " +
+        "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm and Cargo.lock also introduced_by and declared_in). Cargo updates are conditional on parent version requirements; cross-major updates may require Cargo.toml changes. " +
         "The recommended version is checked against api.osv.dev, and versions with known vulnerabilities that do not affect the current version are avoided (result in candidate_check). " +
-        "clean means no additional known vulnerabilities beyond those shown in the scan; unfixed vulnerabilities may still affect the recommended version. " +
+        "clean excludes known unfixed advisories, known informational advisories that are not fix targets, and new Rust unmaintained/notice records; these may still apply. New unsound records are fix targets. " +
         "With has_known_vulnerabilities, failed, or skipped, the recommended version has not been confirmed safe; conflict means the data disagreed and the recommendation is withheld. " +
         "Candidates are checked against the affected ranges of every vulnerability to fix, and the recommendation is withheld when the data are insufficient. Pre-releases are recommended only when no stable version fixes everything, and are marked recommended_is_prerelease. " +
         "CVEs with no fixed version newer than the current one are reported separately as unfixed, together with their status at the recommended version. " +
+        "Rust unmaintained/notice advisories and unsound advisories without a newer fixed version have tier informational and are not fix targets; unsound advisories with a fixed version are fixed like vulnerabilities. Packages with no fix target left have verification informational_only and no recommendation. " +
         "Always check coverage in the response (if complete is false, some dependencies are not included in the suggestions). " +
         "If dependency_resolution.warning is present, vulnerabilities in transitive dependencies are not included.",
     inputSchema: {

package/dist/osv/binaryDownloader.js

@@ -21,20 +21,22 @@ import { readResponseBytes } from "../utils/readResponseBytes.js";
  * 範囲外の読み込みを防ぐ検証はこの版の挙動に合わせているため、更新時は
  * docs/DESIGN_TODO.md「B5」の監査と、requirements.txt・親POMの解釈の実機確認をやり直すこと。
  * pom.xmlの直接/推移的依存の判定(dependencyRelations.tsのpomRelations)も、この版が同じpom.xmlを
- * source.type "lockfile"(宣言された依存)と"unknown"(deps.devで解決された推移的依存)に分けて報告する挙動に依存するため再確認すること
+ * source.type "lockfile"(宣言された依存)と"unknown"(deps.devで解決された推移的依存)に分けて報告する挙動に依存するため再確認すること。
+ * 2.7.0への更新時の確認結果はdocs/DESIGN_TODO.md「osv-scannerのピン留め更新(2.4.0 → 2.7.0)」(2026-10-15)
  */
-export const PINNED_OSV_SCANNER_VERSION = "2.4.0";
+export const PINNED_OSV_SCANNER_VERSION = "2.7.0";
 /**
- * v2.4.0公式リリースのSHA256(osv-scanner_SHA256SUMSより転記、2026-07-04取得)。
- * https://github.com/google/osv-scanner/releases/tag/v2.4.0
+ * v2.7.0公式リリースのSHA256(2026-10-15取得)。osv-scanner_SHA256SUMSとGitHub APIのリリース資産のdigestの
+ * 両方で一致を確認し、darwin_arm64はダウンロードした実体のハッシュとも照合した。
+ * https://github.com/google/osv-scanner/releases/tag/v2.7.0
  */
 const ASSET_CHECKSUMS = {
-    "osv-scanner_darwin_amd64": "088119325156321c34c456ac3703d6013538fd71cbac82b891ab34db491e4d66",
-    "osv-scanner_darwin_arm64": "9ca3185ad63e9ab54f7cb90f46a7362be02d80e37f0123d095a54355ea202f5d",
-    "osv-scanner_linux_amd64": "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0",
-    "osv-scanner_linux_arm64": "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9",
-    "osv-scanner_windows_amd64.exe": "0cdd113610126d5dfd5e12ad0e0b4f3e879291ff19bb43b0c52ed2f2c2df1a37",
-    "osv-scanner_windows_arm64.exe": "1ce89d7d8ef083634648ef0f193fe1254f36f46f4bdc93d61178adacc2e60da0",
+    "osv-scanner_darwin_amd64": "e82c5df7ab0a42dff29a1cd0660711447b56b4c0483ff66ad8634df10fd81a45",
+    "osv-scanner_darwin_arm64": "d4926ef8da134332543be276dff157e4c170f99ad91fc48e89448a8816bdf70b",
+    "osv-scanner_linux_amd64": "160c6253e2922e9e0a6a9771c5c4c40a4b3c6090b34a3cdd5e80c96cc2e4218b",
+    "osv-scanner_linux_arm64": "4061ef4c021ed3c47f203b818f337e351336cc5cd67c0274fc36bd1dfc728dd7",
+    "osv-scanner_windows_amd64.exe": "9964ed64ec9a387391eb4cc006ad5c531154821aef29b793e02c448de4686438",
+    "osv-scanner_windows_arm64.exe": "3e630381c1f1fd3c9c4d447e6ff2ef6c737083371722773db8337eead0f97962",
 };
 const DOWNLOAD_TIMEOUT_MS = 300_000;
 /** バイナリは実測50〜55MB。余裕を持たせつつ暴走は防ぐ */

package/dist/osv/candidateCheck.js

@@ -15,7 +15,7 @@ import { asString, asStrings } from "../utils/unknownJson.js";
 import { sanitizeExternalText } from "../utils/externalText.js";
 import { extractAffectedVersions } from "./affectedVersions.js";
 import { queryOsvPackageVersion } from "./osvApi.js";
-import { extractFixedVersions } from "./scanReport.js";
+import { extractFixedVersions, recordInformationalKind } from "./scanReport.js";
 import { suggestUpgradeForPackage } from "./suggestFix.js";
 export const NO_CANDIDATE_CHECK_ENV = "OSV_MCP_NO_CANDIDATE_CHECK";
 /** 環境変数で無効化されているか(1/true/yes) */
@@ -43,7 +43,7 @@ class QueryBudget {
 }
 async function checkPackage(pkg, initial, budget, options) {
     const known = new Set(pkg.vulnerabilities.flatMap((v) => [v.id, ...v.aliases]));
-    const unfixed = new Set(initial.per_cve_detail.filter((v) => v.tier === "unfixed").map((v) => v.id));
+    const unfixed = new Set(initial.per_cve_detail.filter((v) => v.tier === "unfixed" || v.tier === "informational").map((v) => v.id));
     const ignoredKnown = new Set(pkg.vulnerabilities.filter((v) => unfixed.has(v.id)).flatMap((v) => [v.id, ...v.aliases]));
     // 別名が修正対象とも重なる場合は、その対象の判定を優先する。
     for (const vuln of pkg.vulnerabilities) {
@@ -74,7 +74,10 @@ async function checkPackage(pkg, initial, budget, options) {
         // 新しく照会で見つかった対象はknownへ追加されるが、ignoredKnownには入れない。
         records = records.filter((record) => {
             const matched = recordIds(record).filter((id) => known.has(id));
-            return matched.length === 0 || matched.some((id) => !ignoredKnown.has(id));
+            if (matched.length > 0)
+                return matched.some((id) => !ignoredKnown.has(id));
+            const kind = pkg.ecosystem === "crates.io" ? recordInformationalKind(record, pkg.name, pkg.ecosystem) : null;
+            return kind !== "unmaintained" && kind !== "notice";
         });
         if (records.length === 0)
             return { suggestion, status: "clean", rejected };

package/dist/osv/runner.js

@@ -12,7 +12,7 @@
  * - タイムアウトと出力サイズ上限を設ける(ハング・巨大出力によるDoS対策)
  * - サーバーの終了時に実行中のプロセスを残さない(processCleanup.tsに登録し、終了時にSIGKILL)
  *
- * 終了コード(2.4.0で実機確認):
+ * 終了コード(2.4.0・2.7.0で実機確認):
  *   0 = スキャン成功・脆弱性なし / 1 = スキャン成功・脆弱性あり / 128 = 対象パッケージなし
  */
 import { spawn } from "node:child_process";
@@ -56,7 +56,7 @@ export function isRemoteResolutionDisabled(options = {}) {
 /**
  * OSV-Scannerに渡す固定引数。ここに無いオプションは一切使わない(ホワイトリスト)
  *
- * pom.xml/requirements.txtの推移的依存はapi.deps.devで解決される(2.4.0で実機確認)。
+ * pom.xml/requirements.txtの推移的依存はapi.deps.devで解決される(2.4.0・2.7.0で実機確認)。
  * `--data-source native` はスキャン対象pom.xmlの<repositories>に書かれた任意のURLへ
  * 接続するため使わない。既定値の変更に備えてdeps.devを明示する。
  */
@@ -71,6 +71,10 @@ export function buildProjectTargetArgs(targets) {
         return ["--lockfile", `${target.format}:${target.path}`];
     });
 }
+/**
+ * `--experimental-`のフラグは2.7.0で非推奨(stderrに警告。新名は`--x-`)だが、新名は2.4.0では未定義でexit 127になる。
+ * OSV_SCANNER_PATH・PATH上の古い版でも動くよう、両方の版で使える旧名を使う(2026-10-15 実機確認)
+ */
 const FIXED_ARTIFACT_ARGS = [
     "scan", "source", "--format", "json", "--all-packages", "--no-ignore",
     "--experimental-no-default-plugins", "--experimental-plugins", "java/archive",

package/dist/osv/suggestFix.js

@@ -79,8 +79,54 @@ function updateHint(pkg) {
             return UPDATE_HINTS[pkg.ecosystem];
     }
 }
-function hintFields(pkg) {
-    const hint = updateHint(pkg);
+/** OSV由来の版・crate名を案内のコマンドに埋め込めるか(外部データのため文字の範囲を限定する) */
+const SAFE_VERSION = /^[0-9A-Za-z.+-]{1,64}$/;
+const SAFE_CRATE_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/**
+ * crates.ioの更新方法(docs/DESIGN_TODO.md「suggest_fixのRust対応」の表)。直接/推移的依存とTierで分ける。
+ * 推奨がない場合はコマンドを示さず、方向だけを示す
+ */
+function cargoUpdateHint(pkg, recommended, tier) {
+    const manifest = pkg.declared_in?.join(", ") ?? (pkg.declaring_crates?.length
+        ? `the Cargo.toml of ${pkg.declaring_crates.join(", ")}` : "the declaring Cargo.toml");
+    const parent = pkg.introduced_by?.join(", ") ?? "the direct dependency that requires this crate";
+    if (recommended === null) {
+        const direct = `No verified upgrade is recommended (see upgrade_note and per_cve_detail). Any fix requires a version allowed by the requirement in ${manifest}.`;
+        const transitive = `No verified upgrade is recommended (see upgrade_note and per_cve_detail). Any fix must be allowed by the requirements of ${parent}.`;
+        return pkg.dependency_relation === "direct" ? `Direct dependency. ${direct}`
+            : pkg.dependency_relation === "transitive" ? `Transitive dependency. ${transitive}`
+                : `For a direct dependency: ${direct} For a transitive dependency: ${transitive}`;
+    }
+    const embeddable = SAFE_VERSION.test(recommended) && SAFE_VERSION.test(pkg.version) && SAFE_CRATE_NAME.test(pkg.name);
+    // OSVの修正版はビルドメタデータを含むことがある。cargoは`--precise`・`=`の要求でメタデータなしの版を受け付ける(cargo 1.98で確認)
+    const precise = recommended.split("+")[0];
+    const target = embeddable ? recommended : "the recommended version";
+    const command = embeddable
+        ? `cargo update -p ${pkg.name}@${pkg.version} --precise ${precise}`
+        : "cargo update with an appropriate -p package specification and --precise version";
+    const direct = tier === "cross_major"
+        ? `Change the requirement in ${manifest} to allow ${target}; this may include breaking changes (in 0.x, even a minor update).`
+        : `If the requirement in ${manifest} allows ${target} (the default caret requirement does), run ${command}; only Cargo.lock changes. ` +
+            `If the requirement pins the version (= or ~), change it in ${manifest}.`;
+    const transitive = tier === "cross_major"
+        ? `Update ${parent} to a version whose requirements permit ${target}. ` +
+            "[patch.crates-io] does not override version requirements: use it only for a fix (such as a backport) from another source that still satisfies the requirements of the crates that depend on it."
+        : `If the requirements of ${parent} allow ${target}, run ${command}; only Cargo.lock changes. If cargo reports that the requirements cannot be satisfied, update ${parent}.`;
+    let hint = pkg.dependency_relation === "direct" ? `Direct dependency. ${direct}`
+        : pkg.dependency_relation === "transitive" ? `Transitive dependency. ${transitive}`
+            : `For a direct dependency: ${direct} For a transitive dependency: ${transitive}`;
+    if (pkg.dependency_relation === "direct" && pkg.introduced_by?.length)
+        hint += ` It is also required by ${parent}, whose requirements must allow ${target} as well.`;
+    if (versionSchemeFor("crates.io").isPrerelease(recommended)) {
+        hint += ` ${target} is a pre-release: Cargo requirements match a pre-release only when they name one, so cargo update --precise alone may fail. ` +
+            (embeddable ? `For a direct dependency, set the requirement to "=${precise}"` : "For a direct dependency, set the requirement to the exact pre-release version") +
+            "; for a transitive dependency, the crate that requires it must allow it.";
+    }
+    hint += " Before updating, check that the version is not yanked and that it supports your Rust version (MSRV).";
+    return hint;
+}
+function hintFields(pkg, recommended = null, tier = null) {
+    const hint = pkg.ecosystem === "crates.io" ? cargoUpdateHint(pkg, recommended, tier) : updateHint(pkg);
     return hint === undefined ? {} : { update_hint: hint };
 }
 /** スキャン結果に付いた直接/推移的依存の項目を提案にも写す(無ければ何も出さない) */
@@ -90,6 +136,8 @@ function relationFields(pkg) {
         ...(pkg.introduced_by !== undefined ? { introduced_by: pkg.introduced_by } : {}),
         ...(pkg.introduced_by_omitted !== undefined ? { introduced_by_omitted: pkg.introduced_by_omitted } : {}),
         ...(pkg.declared_in !== undefined ? { declared_in: pkg.declared_in } : {}),
+        ...(pkg.declaring_crates !== undefined ? { declaring_crates: pkg.declaring_crates } : {}),
+        ...(pkg.declaring_crates_omitted !== undefined ? { declaring_crates_omitted: pkg.declaring_crates_omitted } : {}),
         ...(pkg.replaced_in_go_mod ? { replaced_in_go_mod: true } : {}),
     };
 }
@@ -115,7 +163,8 @@ function notEvaluatedSuggestion(pkg, verification) {
             cve: vuln.cve,
             severity: vuln.severity,
             fixed_in: null,
-            tier: "unsupported",
+            tier: vuln.informational !== undefined ? "informational" : "unsupported",
+            ...(vuln.informational !== undefined ? { informational: vuln.informational, recommended_status: "not_evaluated" } : {}),
         })),
         verification,
     };
@@ -172,6 +221,36 @@ function buildNote(scheme, pkg, recommended, tier, fixableCount, unfixedCount) {
     }
     return note;
 }
+/**
+ * 1パッケージ分のアップグレード提案を組み立てる(同期・純粋)。
+ * contextを渡すと、照会で見つかった脆弱性も避けて候補を選び直す(contextなしの結果が従来の推奨)。
+ */
+/**
+ * 修正対象にしない情報提供のアドバイザリ。unmaintained・noticeは版を上げても解消しない(版と無関係)。
+ * unsoundは版ごとの欠陥のため、現在より新しい修正版があれば通常の脆弱性と同じく修正対象にする
+ * (v0.13.0の実装中に判明: 修正版のあるunsoundを外すと、lru 0.6.0に0.7.1(RUSTSEC-2026-0253の0.18.2未満)を推奨した)
+ */
+function isExcludedInformational(vuln, scheme, current) {
+    if (vuln.informational === undefined)
+        return false;
+    if (vuln.informational !== "unsound")
+        return true;
+    return rankCandidates(scheme, current, vuln.fixed_versions).length === 0 && vuln.fixed_versions.every((v) => scheme.isValid(v));
+}
+function informationalNote(pkg, excluded) {
+    const notes = [];
+    const kinds = (pick) => new Set(pkg.vulnerabilities.filter((v, i) => v.informational !== undefined && pick(excluded[i])).map((v) => v.informational));
+    const out = kinds((e) => e);
+    if (out.has("unmaintained"))
+        notes.push("Unmaintained advisories are not resolved by upgrading; consider an alternative crate.");
+    if (out.has("unsound"))
+        notes.push("Unsound advisories without a fixed version remain; check recommended_status.");
+    if (out.has("notice"))
+        notes.push("For notices, use explain_vulnerability for details.");
+    if (kinds((e) => !e).has("unsound"))
+        notes.push("Unsound advisories with a fixed version are included in the fix.");
+    return notes.join(" ");
+}
 /**
  * 1パッケージ分のアップグレード提案を組み立てる(同期・純粋)。
  * contextを渡すと、照会で見つかった脆弱性も避けて候補を選び直す(contextなしの結果が従来の推奨)。
@@ -182,7 +261,23 @@ export function suggestUpgradeForPackage(pkg, context = {}) {
         return notEvaluatedSuggestion(pkg, "unsupported_ecosystem");
     if (!scheme.isValid(pkg.version))
         return { ...notEvaluatedSuggestion(pkg, "unparseable_version"), ...hintFields(pkg) };
-    const details = pkg.vulnerabilities.map((vuln) => {
+    const excluded = pkg.vulnerabilities.map((vuln) => isExcludedInformational(vuln, scheme, pkg.version));
+    const informationalNotes = informationalNote(pkg, excluded);
+    if (pkg.vulnerabilities.length > 0 && excluded.every((e) => e)) {
+        return {
+            package: pkg.name, current_version: pkg.version, ecosystem: pkg.ecosystem, ...relationFields(pkg),
+            recommended_upgrade: null, upgrade_tier: null, upgrade_note: informationalNotes,
+            per_cve_detail: pkg.vulnerabilities.map((v) => ({ id: v.id, cve: v.cve, severity: v.severity,
+                fixed_in: null, tier: "informational", informational: v.informational, recommended_status: "not_evaluated" })),
+            verification: "informational_only",
+        };
+    }
+    const details = pkg.vulnerabilities.map((vuln, i) => {
+        if (excluded[i])
+            return {
+                id: vuln.id, cve: vuln.cve, severity: vuln.severity, fixed_in: null,
+                tier: "informational", informational: vuln.informational,
+            };
         const fix = rankCandidates(scheme, pkg.version, vuln.fixed_versions)[0];
         return {
             id: vuln.id,
@@ -191,14 +286,16 @@ export function suggestUpgradeForPackage(pkg, context = {}) {
             fixed_in: fix ?? null,
             tier: fix !== undefined ? scheme.classify(pkg.version, fix)
                 : vuln.fixed_versions.some((v) => !scheme.isValid(v)) ? "unparseable_fix" : "unfixed",
+            // 修正対象にした情報提供(修正版のあるunsound)も種類を示す
+            ...(vuln.informational !== undefined ? { informational: vuln.informational } : {}),
         };
     });
     const unfixedCount = details.filter((d) => d.tier === "unfixed").length;
     const unparseableCount = details.filter((d) => d.tier === "unparseable_fix").length;
-    const fixableCount = details.length - unfixedCount;
+    const fixableCount = details.filter((d) => d.tier !== "unfixed" && d.tier !== "informational").length;
     // 解釈できない修正版のCVEも修正対象に残す。その影響範囲は情報不足のため、どの候補も検証できず推奨を保留する
     const targets = [
-        ...pkg.vulnerabilities.filter((_, i) => details[i].tier !== "unfixed"),
+        ...pkg.vulnerabilities.filter((_, i) => details[i].tier !== "unfixed" && details[i].tier !== "informational"),
         ...(context.extraTargets ?? []),
     ];
     const candidates = rankCandidates(scheme, pkg.version, targets.flatMap((v) => v.fixed_versions));
@@ -217,11 +314,11 @@ export function suggestUpgradeForPackage(pkg, context = {}) {
         recommended_upgrade: recommended,
         upgrade_tier: upgradeTier,
         ...(recommended !== null && scheme.isPrerelease(recommended) ? { recommended_is_prerelease: true } : {}),
-        upgrade_note: recommended === null && fixableCount > 0
+        upgrade_note: (recommended === null && fixableCount > 0
             ? "No known fixed version could be confirmed to be outside the affected ranges of every CVE to fix. The recommendation is also withheld when the data are insufficient or use unsupported range types." +
                 (unparseableCount > 0 ? ` ${unparseableCount} CVEs list fixed versions that cannot be parsed as versions (tier: unparseable_fix), so the recommendation is withheld.` : "")
-            : buildNote(scheme, pkg, recommended, upgradeTier, fixableCount, unfixedCount),
-        ...hintFields(pkg),
+            : buildNote(scheme, pkg, recommended, upgradeTier, fixableCount, unfixedCount)) + (informationalNotes ? ` ${informationalNotes}` : ""),
+        ...hintFields(pkg, recommended, upgradeTier),
         ...(pkg.version_is_lower_bound ? { version_is_lower_bound: true } : {}),
         per_cve_detail: details,
         verification: recommended === null ? "no_verified_candidate" : "verified",

package/dist/osv/versionScheme.js

@@ -3,6 +3,7 @@
  *
  * - Maven: Mavenの優先順位(mavenVersion.ts)。範囲はECOSYSTEM型
  * - npm・Go: SemVer 2.0.0の優先順位(semverVersion.ts)。範囲はSEMVER型とECOSYSTEM型
+ * - crates.io: SemVerの優先順位とCargoキャレット互換。範囲はSEMVER型
  * - PyPI: PEP 440の優先順位(pep440Version.ts)。範囲はECOSYSTEM型。名前はPEP 503で正規化して照合する
  * - その他: 比較器なし。範囲はECOSYSTEM型
  *
@@ -11,7 +12,7 @@
 import { compareMavenVersions, mavenVersionSeries } from "../utils/mavenVersion.js";
 import { compareParsedPep440, parsePep440 } from "../utils/pep440Version.js";
 import { compareParsedSemver, parseSemver } from "../utils/semverVersion.js";
-const SEMVER_ECOSYSTEMS = new Set(["npm", "Go"]);
+const SEMVER_ECOSYSTEMS = new Set(["npm", "Go", "crates.io"]);
 const MAVEN_SCHEME = {
     isValid: () => true,
     compare: compareMavenVersions,
@@ -126,6 +127,8 @@ export function samePackageName(a, b, ecosystem) {
 export function versionRangeTypes(ecosystem) {
     if (ecosystem === "Maven")
         return new Set(["ECOSYSTEM"]);
+    if (ecosystem === "crates.io")
+        return new Set(["SEMVER"]);
     if (SEMVER_ECOSYSTEMS.has(ecosystem))
         return new Set(["SEMVER", "ECOSYSTEM"]);
     return new Set(["ECOSYSTEM"]);