osv-scanner-mcp 0.13.0 → 0.14.0

package/README.md

@@ -29,6 +29,7 @@ An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-sc
   - A manually installed binary (on `PATH` or set with `OSV_SCANNER_PATH`) is used first
   - Set `OSV_MCP_AUTO_DOWNLOAD=0` to disable the automatic download
   - Set `OSV_MCP_PREFER_DOWNLOAD=1` to always use the verified downloaded binary instead of one on `PATH` (recommended for production)
+  - The pinned version is osv-scanner 2.7.0. Its binary is cached in `~/.cache/osv-scanner-mcp/v2.7.0/`; directories of earlier versions (such as `v2.4.0/`) are no longer used and can be deleted
 - Scans, `suggest_fix`, and `explain_vulnerability` access the network. Vulnerabilities are looked up in the OSV database (`api.osv.dev`), and **scanning `pom.xml` or `requirements.txt` also connects to deps.dev (`api.deps.dev`) to resolve transitive dependencies**. See [Network destinations and privacy](#network-destinations-and-privacy) for details and how to turn this off
 
 ## Setup
@@ -176,13 +177,13 @@ As an additional layer of defense, you can limit what the server can read and wr
 
 ### Network destinations and privacy
 
-Destinations confirmed with osv-scanner v2.4.0 (2026-10-07):
+Destinations confirmed with osv-scanner v2.4.0 (2026-10-07) and v2.7.0, the pinned version (2026-10-15):
 
 | Operation | Destinations | Information sent |
 |---|---|---|
 | Scanning `pom.xml` (`scan_project` / `scan_java_project` / `suggest_fix`) | `api.osv.dev`, **`api.deps.dev`** | Package names and versions. To resolve transitive dependencies, the names and versions of the dependencies declared in `pom.xml` (including internal packages) are sent to deps.dev |
 | Scanning `requirements.txt` (`scan_project` / `suggest_fix`) | `api.osv.dev`, **`api.deps.dev`** | As with `pom.xml`, the names and versions of the listed dependencies are sent to deps.dev to resolve transitive dependencies. Package indexes given with `--index-url` and similar options are not contacted |
-| Scanning lockfiles (`gradle.lockfile`, npm lockfiles such as `package-lock.json`, Python lockfiles such as `poetry.lock`, `go.mod`, `Cargo.lock`) | `api.osv.dev` | Package names and versions (lockfiles already list every dependency, so nothing is resolved remotely). For `Cargo.lock`, only crates from crates.io are sent: the names of your own crates, git dependencies, and private-registry crates are not sent (confirmed 2026-10-11) |
+| Scanning lockfiles (`gradle.lockfile`, npm lockfiles such as `package-lock.json`, Python lockfiles such as `poetry.lock`, `go.mod`, `Cargo.lock`) | `api.osv.dev` | Package names and versions (lockfiles already list every dependency, so nothing is resolved remotely). For `Cargo.lock`, only crates from crates.io are sent: the names of your own crates, git dependencies, and private-registry crates are not sent (confirmed 2026-10-11). **Git dependencies in npm lockfiles** (`package-lock.json`, `yarn.lock`, and so on) are looked up by their repository URL (ecosystem `GIT`) and commit, so the host name and path of a private git repository (for example `https://git.example.com/team/repo`) are sent (since osv-scanner 2.6.0) |
 | `scan_java_artifact` / `scan_sbom` | `api.osv.dev` | Names and versions of the identified packages |
 | `suggest_fix` checking recommended versions | `api.osv.dev` | The names of packages with a recommendation (already sent during the scan) and the candidate versions (published fixed versions). Disable with `OSV_MCP_NO_CANDIDATE_CHECK=1` |
 | `explain_vulnerability` | `api.osv.dev` | The vulnerability ID |
@@ -219,7 +220,11 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
 
 **`requirements.txt` files are not passed to OSV-Scanner as they are.** The server parses them, rewrites only the dependency lines it can interpret into simple forms such as `name==version`, and scans a private temporary copy (deleted after the scan). OSV-Scanner interprets include directives on its own (it even treats `- r ../x.txt`, with a space, as an include and reads files outside the scan scope), so the copy never contains include directives or options. Includes (`-r` / `--requirement`) are expanded by the server, and only when the included file is inside the project directory.
 
-**`Cargo.lock` files are not passed to OSV-Scanner as they are either.** OSV-Scanner (v2.4.0) ignores where each package comes from and looks every package up as a crates.io crate, so a workspace crate, a git fork, or a private-registry crate with the same name and version as a vulnerable crates.io crate is reported as vulnerable, and its name is sent to the OSV API. The server parses `Cargo.lock` and scans a private copy that lists only the packages whose source is crates.io (`registry+https://github.com/rust-lang/crates.io-index` or `sparse+https://index.crates.io/`), like `cargo audit`. Packages replaced with `[replace]` are not scanned, because they are not used (the replacement is classified by its own source). The parser accepts only what Cargo writes; if a `Cargo.lock` contains anything else, the whole file is excluded and listed in `skipped_files` instead of being scanned partially. Cargo is never run.
+**`Cargo.lock` files are not passed to OSV-Scanner as they are either.** OSV-Scanner (v2.4.0 and v2.7.0) ignores where each package comes from and looks every package up as a crates.io crate, so a workspace crate, a git fork, or a private-registry crate with the same name and version as a vulnerable crates.io crate is reported as vulnerable, and its name is sent to the OSV API. The server parses `Cargo.lock` and scans a private copy that lists only the packages whose source is crates.io (`registry+https://github.com/rust-lang/crates.io-index` or `sparse+https://index.crates.io/`), like `cargo audit`. Packages replaced with `[replace]` are not scanned, because they are not used (the replacement is classified by its own source). The parser accepts only what Cargo writes; if a `Cargo.lock` contains anything else, the whole file is excluded and listed in `skipped_files` instead of being scanned partially. Cargo is never run.
+
+**`package-lock.json` copies get a `resolved` URL where it is missing.** osv-scanner 2.7.0 treats entries without `resolved` as local packages and does not look them up, which would silently skip bundled dependencies (`inBundle`) and registry packages in lockfiles generated with npm's `omit-lockfile-registry-resolved=true`. The private copy that is scanned gets a public-registry URL for those entries (entries under `node_modules/` that are not links and have a plain version, and aliases such as `npm:lodash@4.17.20` in lockfile version 1), so they are looked up as before; the original file is not changed.
+
+**npm JSON limits:** Normalization of `package-lock.json` and `npm-shrinkwrap.json` is limited to 16 MiB per file and 64 MiB per scan, for both input and output. Before parsing, JSON nesting is limited to 128 levels and structural markers (containers, commas, and colons outside strings) to 1,000,000 per file and 2,000,000 per analysis phase. Changed copies use compact JSON, with their size checked before serialization. A lockfile that exceeds these limits is scanned as it is, without filling in `resolved` (OSV-Scanner parses large lockfiles itself; the limits only bound this server's own parsing and rewriting), and it is listed in `coverage.skipped_files` with the reason, so `complete` is `false`: entries without `resolved` in it may not have been looked up. Workspace membership and dependency-relation lookups use the same structural checks and remain unconfirmed or unknown when limits are reached.
 
 **Reading the output**
 
@@ -351,7 +356,7 @@ A directory search includes `target` and `build`, and excludes `.git`, `node_mod
 The search is limited to a depth of 8, 100 archives, and 10,000 entries. If the search cannot complete within the limits, `artifact_search_limit_exceeded` is returned instead of silently truncating the results; narrow the target and try again.
 `OSV_MCP_ALLOWED_ROOT` applies as well.
 
-OSV-Scanner 2.4.0's `java/archive` plugin is used, and nested JARs are also analyzed by the scanner. No Java code is executed and no build is run.
+OSV-Scanner's `java/archive` plugin is used, and nested JARs are also analyzed by the scanner. No Java code is executed and no build is run.
 Identification relies on metadata inside the archives, so dependencies whose metadata was removed, and dependencies inside shaded/minimized JARs, may be missed.
 
 **Reading the output:**

package/dist/index.js

@@ -61,7 +61,7 @@ if (startupWarning !== null) {
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
 const server = new McpServer({
     name: "osv-scanner-mcp",
-    version: "0.13.0",
+    version: "0.14.0",
 });
 server.registerTool("scan_project", {
     title: "Scan project dependencies for vulnerabilities (Java / JavaScript / Python / Go / Rust)",
@@ -70,6 +70,7 @@ server.registerTool("scan_project", {
         "Python (poetry.lock / uv.lock / Pipfile.lock / pdm.lock / requirements.txt), Go (go.mod), Rust (Cargo.lock). " +
         "Package managers and builds are never run. " +
         "Always check coverage at the top of the response: it lists manifests without a lockfile, requirements lines without a pinned version, and excluded files. " +
+        "Git dependencies in npm lockfiles are looked up by repository URL, so private git host names and paths are sent to api.osv.dev. " +
         "For Cargo.lock, only crates from crates.io are scanned: the project's own crates are counted in local_crates, and git or private-registry crates are listed in unscannable_crates. " +
         "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
         "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, and pom.xml; unknown otherwise). " +

package/dist/osv/binaryDownloader.js

@@ -21,20 +21,22 @@ import { readResponseBytes } from "../utils/readResponseBytes.js";
  * 範囲外の読み込みを防ぐ検証はこの版の挙動に合わせているため、更新時は
  * docs/DESIGN_TODO.md「B5」の監査と、requirements.txt・親POMの解釈の実機確認をやり直すこと。
  * pom.xmlの直接/推移的依存の判定(dependencyRelations.tsのpomRelations)も、この版が同じpom.xmlを
- * source.type "lockfile"(宣言された依存)と"unknown"(deps.devで解決された推移的依存)に分けて報告する挙動に依存するため再確認すること
+ * source.type "lockfile"(宣言された依存)と"unknown"(deps.devで解決された推移的依存)に分けて報告する挙動に依存するため再確認すること。
+ * 2.7.0への更新時の確認結果はdocs/DESIGN_TODO.md「osv-scannerのピン留め更新(2.4.0 → 2.7.0)」(2026-10-15)
  */
-export const PINNED_OSV_SCANNER_VERSION = "2.4.0";
+export const PINNED_OSV_SCANNER_VERSION = "2.7.0";
 /**
- * v2.4.0公式リリースのSHA256(osv-scanner_SHA256SUMSより転記、2026-07-04取得)。
- * https://github.com/google/osv-scanner/releases/tag/v2.4.0
+ * v2.7.0公式リリースのSHA256(2026-10-15取得)。osv-scanner_SHA256SUMSとGitHub APIのリリース資産のdigestの
+ * 両方で一致を確認し、darwin_arm64はダウンロードした実体のハッシュとも照合した。
+ * https://github.com/google/osv-scanner/releases/tag/v2.7.0
  */
 const ASSET_CHECKSUMS = {
-    "osv-scanner_darwin_amd64": "088119325156321c34c456ac3703d6013538fd71cbac82b891ab34db491e4d66",
-    "osv-scanner_darwin_arm64": "9ca3185ad63e9ab54f7cb90f46a7362be02d80e37f0123d095a54355ea202f5d",
-    "osv-scanner_linux_amd64": "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0",
-    "osv-scanner_linux_arm64": "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9",
-    "osv-scanner_windows_amd64.exe": "0cdd113610126d5dfd5e12ad0e0b4f3e879291ff19bb43b0c52ed2f2c2df1a37",
-    "osv-scanner_windows_arm64.exe": "1ce89d7d8ef083634648ef0f193fe1254f36f46f4bdc93d61178adacc2e60da0",
+    "osv-scanner_darwin_amd64": "e82c5df7ab0a42dff29a1cd0660711447b56b4c0483ff66ad8634df10fd81a45",
+    "osv-scanner_darwin_arm64": "d4926ef8da134332543be276dff157e4c170f99ad91fc48e89448a8816bdf70b",
+    "osv-scanner_linux_amd64": "160c6253e2922e9e0a6a9771c5c4c40a4b3c6090b34a3cdd5e80c96cc2e4218b",
+    "osv-scanner_linux_arm64": "4061ef4c021ed3c47f203b818f337e351336cc5cd67c0274fc36bd1dfc728dd7",
+    "osv-scanner_windows_amd64.exe": "9964ed64ec9a387391eb4cc006ad5c531154821aef29b793e02c448de4686438",
+    "osv-scanner_windows_arm64.exe": "3e630381c1f1fd3c9c4d447e6ff2ef6c737083371722773db8337eead0f97962",
 };
 const DOWNLOAD_TIMEOUT_MS = 300_000;
 /** バイナリは実測50〜55MB。余裕を持たせつつ暴走は防ぐ */

package/dist/osv/runner.js

@@ -12,7 +12,7 @@
  * - タイムアウトと出力サイズ上限を設ける(ハング・巨大出力によるDoS対策)
  * - サーバーの終了時に実行中のプロセスを残さない(processCleanup.tsに登録し、終了時にSIGKILL)
  *
- * 終了コード(2.4.0で実機確認):
+ * 終了コード(2.4.0・2.7.0で実機確認):
  *   0 = スキャン成功・脆弱性なし / 1 = スキャン成功・脆弱性あり / 128 = 対象パッケージなし
  */
 import { spawn } from "node:child_process";
@@ -56,7 +56,7 @@ export function isRemoteResolutionDisabled(options = {}) {
 /**
  * OSV-Scannerに渡す固定引数。ここに無いオプションは一切使わない(ホワイトリスト)
  *
- * pom.xml/requirements.txtの推移的依存はapi.deps.devで解決される(2.4.0で実機確認)。
+ * pom.xml/requirements.txtの推移的依存はapi.deps.devで解決される(2.4.0・2.7.0で実機確認)。
  * `--data-source native` はスキャン対象pom.xmlの<repositories>に書かれた任意のURLへ
  * 接続するため使わない。既定値の変更に備えてdeps.devを明示する。
  */
@@ -71,6 +71,10 @@ export function buildProjectTargetArgs(targets) {
         return ["--lockfile", `${target.format}:${target.path}`];
     });
 }
+/**
+ * `--experimental-`のフラグは2.7.0で非推奨(stderrに警告。新名は`--x-`)だが、新名は2.4.0では未定義でexit 127になる。
+ * OSV_SCANNER_PATH・PATH上の古い版でも動くよう、両方の版で使える旧名を使う(2026-10-15 実機確認)
+ */
 const FIXED_ARTIFACT_ARGS = [
     "scan", "source", "--format", "json", "--all-packages", "--no-ignore",
     "--experimental-no-default-plugins", "--experimental-plugins", "java/archive",

package/dist/tools/scanProject.js

@@ -4,6 +4,7 @@
  * 誤要約対策(JAR実体スキャンと同じ原則): スキャンできなかった依存を示すcoverageを件数より前に置き、
  * complete=falseの場合は「検出0件でも安全とは言えない」旨の警告を付ける。
  */
+import { writeFile } from "node:fs/promises";
 import path from "node:path";
 import { ScanToolError } from "../errors.js";
 import { isRemoteResolutionDisabled, runOsvScan } from "../osv/runner.js";
@@ -13,6 +14,7 @@ import { cargoLockCopyContent } from "../utils/cargoLock.js";
 import { sanitizeExternalText } from "../utils/externalText.js";
 import { readRegularFile } from "../utils/safeRead.js";
 import { detectProject } from "../utils/manifestDetector.js";
+import { createNpmLockWorkBudget, fillMissingResolved, MAX_NPM_LOCK_BYTES, MAX_NPM_LOCK_TOTAL_BYTES, parseNpmLock } from "../utils/npmLockCopy.js";
 import { normalizePypiName } from "../utils/requirementsFile.js";
 import { ScanSnapshot, snapshotManifests } from "../utils/scanSnapshot.js";
 import { dependencyResolution, withScopeNotes } from "./scanJavaProject.js";
@@ -112,7 +114,7 @@ export function markLowerBounds(project, packages) {
  * 検証済みの正規化行だけを書いたコピー。コピーできず外したファイルはskippedFilesに記録する。
  * スナップショットは成功・失敗とも削除する。suggest_fixも同じスキャンを使う。
  */
-/** 直接/推移的依存の判定で読むpackage-lock.json・go.modの合計サイズの上限(LockfileKeyCacheと同じ) */
+/** 直接/推移的依存の判定で読むpackage-lock.json・go.modの合計サイズの上限 */
 const MAX_RELATION_LOCKFILE_BYTES = 256 * 1024 * 1024;
 const MAX_INTRODUCED_BY = 10;
 /**
@@ -121,6 +123,7 @@ const MAX_INTRODUCED_BY = 10;
  */
 export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_LOCKFILE_BYTES) {
     const lookups = new Map();
+    const npmWorkBudget = createNpmLockWorkBudget();
     let remaining = maxTotalBytes;
     for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests } of copies) {
         const lockDir = originalRelative === null ? "" : path.dirname(originalRelative);
@@ -128,11 +131,11 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
         try {
             if (format === "package-lock.json" || format === "go.mod") {
                 // 残りの予算を上限に、読み込みの途中で打ち切る(予算を超えるファイルは全体を読まずにunknownにする)
-                const read = await readRegularFile(copy, { maxBytes: remaining });
+                const read = await readRegularFile(copy, { maxBytes: format === "package-lock.json" ? Math.min(MAX_NPM_LOCK_BYTES, remaining) : remaining });
                 if (read.ok) {
                     remaining -= read.bytes.length;
                     const text = read.bytes.toString("utf8");
-                    lookup = format === "go.mod" ? goModRelations(text) : npmLockRelations(JSON.parse(text));
+                    lookup = format === "go.mod" ? goModRelations(text) : npmLockRelations(parseNpmLock(text, npmWorkBudget));
                 }
             }
             else if (format === "pom.xml") {
@@ -188,6 +191,41 @@ function annotateRelations(packages, lookups) {
         };
     });
 }
+export const NPM_LOCK_NOT_NORMALIZED = "Scanned without filling in missing `resolved` fields, because the lockfile exceeds the normalization limits " +
+    `(${MAX_NPM_LOCK_BYTES / 1024 / 1024} MiB per file; ${MAX_NPM_LOCK_TOTAL_BYTES / 1024 / 1024} MiB and a JSON structure budget per scan). ` +
+    "Entries without `resolved` (such as bundled dependencies) may not have been looked up";
+/**
+ * コピーにresolvedを補う。構文エラーの場合はそのまま渡す。
+ * 資源の上限を超えた場合もスキャン全体は止めず、コピーをそのまま渡して理由を返す
+ * (osv-scannerは大きなlockfileも解析できる。上限は本サーバー自身の解析・再出力を抑えるためのもの)
+ */
+async function fillResolvedInCopy(copyPath, budget) {
+    const read = await readRegularFile(copyPath, { maxBytes: Math.min(MAX_NPM_LOCK_BYTES, budget.input) });
+    if (!read.ok) {
+        if (read.failure === "too_large")
+            return NPM_LOCK_NOT_NORMALIZED;
+        throw new ScanToolError("scan_failed", "The npm lockfile copy cannot be read safely");
+    }
+    budget.input -= read.bytes.length;
+    const text = read.bytes.toString("utf8");
+    let filled;
+    try {
+        filled = fillMissingResolved(text, Math.min(MAX_NPM_LOCK_BYTES, budget.output), budget.work);
+    }
+    catch (error) {
+        if (error instanceof ScanToolError && error.kind === "scan_input_too_large")
+            return NPM_LOCK_NOT_NORMALIZED;
+        throw error;
+    }
+    if (!filled?.changed)
+        return null; // 書き換えないコピーは出力の上限に数えない
+    const outputBytes = Buffer.byteLength(filled.content, "utf8");
+    if (outputBytes > budget.output)
+        return NPM_LOCK_NOT_NORMALIZED;
+    budget.output -= outputBytes;
+    await writeFile(copyPath, filled.content, { mode: 0o600 });
+    return null;
+}
 export async function scanFromSnapshot(project, options) {
     const snapshot = await ScanSnapshot.create();
     try {
@@ -198,6 +236,16 @@ export async function scanFromSnapshot(project, options) {
         // コピーと元のファイルの対応(snapshotManifestsは外したもの以外を入力の順に返す)
         const skippedOriginals = new Set(skipped.map((s) => s.path));
         const scannedOriginals = project.targets.filter((t) => !skippedOriginals.has(t.path));
+        // osv-scanner 2.7.0はresolvedの無いnpmのエントリを照会しないため、コピーで補う(npmLockCopy.ts)。
+        // 上限を超えたlockfileはそのままスキャンし、補えなかったことをcoverageに出す(complete=falseになる)
+        const npmBudget = { input: MAX_NPM_LOCK_TOTAL_BYTES, output: MAX_NPM_LOCK_TOTAL_BYTES, work: createNpmLockWorkBudget() };
+        for (const [i, copy] of targets.entries()) {
+            if (copy.format !== "package-lock.json")
+                continue;
+            const reason = await fillResolvedInCopy(copy.path, npmBudget);
+            if (reason !== null)
+                project.skippedFiles.push({ path: path.relative(project.projectDir, scannedOriginals[i].path), reason });
+        }
         const relationSources = targets.map((copy, i) => ({ copy: copy.path, format: copy.format, originalRelative: path.relative(project.projectDir, scannedOriginals[i].path) }));
         // 親POMを再現できずにスキャンしたpom.xmlも、欠落の可能性としてcoverageに出す(complete=falseになる)
         project.skippedFiles.push(...incomplete.map((s) => ({ path: path.relative(project.projectDir, s.path), reason: s.reason })));

package/dist/utils/cargoLock.js

@@ -1,7 +1,7 @@
 /**
  * Cargo.lockの解析と、osv-scannerに渡すコピーの内容の生成(cargoは実行しない)。
  *
- * osv-scanner v2.4.0はCargo.lockの`source`を見ずに全パッケージをcrates.ioとして照会する(2026-10-11 実機確認)。
+ * osv-scanner v2.4.0・v2.7.0はCargo.lockの`source`を見ずに全パッケージをcrates.ioとして照会する(2026-10-11 実機確認)。
  * workspaceのメンバー・pathの依存・gitの依存・別レジストリの依存も、同名・同版のcrates.ioのアドバイザリが付き(誤検知)、
  * 社内crateの名前がapi.osv.devへ送られる。そこで元のファイルは渡さず、ここで解析したcrates.io由来の
  * パッケージだけを書いたコピーをスキャンする(docs/DESIGN_TODO.md「Rust(crates.io)対応」)。
@@ -16,6 +16,18 @@ const CRATES_IO_SOURCES = new Set([
 ]);
 /** 1つのCargo.lockで受け付けるパッケージ数の上限 */
 const MAX_PACKAGES = 50_000;
+const MAX_LOCK_STRING_CHARS = 65_536;
+export function createCargoLockParseBudget() {
+    return { remainingLines: 1_000_000, remainingDependencies: 200_000, remainingStringChars: 16 * 1024 * 1024 };
+}
+function takeDependency(budget) {
+    if (budget.remainingDependencies <= 0) {
+        budget.exceeded = "the dependency entry limit was exceeded";
+        return false;
+    }
+    budget.remainingDependencies--;
+    return true;
+}
 /** crateの名前(cargoの制約より緩め。英数字・`-`・`_`) */
 const CRATE_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 /** 版(SemVerの文字の範囲) */
@@ -34,20 +46,43 @@ const BARE_KEY = /^([A-Za-z0-9_-]+)\s*=\s*(.*)$/;
  * TOMLの基本文字列(`"..."`)を先頭から1つ読む。読めなければnull。
  * cargoが書くエスケープ(`\"` `\\` `\n` `\t` `\uXXXX` `\UXXXXXXXX`等)だけを受け付ける
  */
-function readBasicString(text, start) {
+function readBasicString(text, start, budget) {
     if (text[start] !== '"')
         return null;
-    let value = "";
+    const parts = [];
+    let segmentStart = start + 1;
+    let length = 0;
+    const takeChars = (count) => {
+        if (budget === undefined)
+            return true;
+        if (length + count > MAX_LOCK_STRING_CHARS) {
+            budget.exceeded = "the string length limit was exceeded";
+            return false;
+        }
+        if (count > budget.remainingStringChars) {
+            budget.exceeded = "the total string character limit was exceeded";
+            return false;
+        }
+        length += count;
+        budget.remainingStringChars -= count;
+        return true;
+    };
     for (let i = start + 1; i < text.length; i++) {
         const ch = text[i];
-        if (ch === '"')
-            return { value, end: i + 1 };
+        if (ch === '"') {
+            parts.push(text.slice(segmentStart, i));
+            return { value: parts.join(""), end: i + 1 };
+        }
         if (ch === "\\") {
+            parts.push(text.slice(segmentStart, i));
             const next = text[i + 1];
             const simple = { '"': '"', "\\": "\\", n: "\n", t: "\t", r: "\r", b: "\b", f: "\f" };
             if (next !== undefined && next in simple) {
-                value += simple[next];
+                if (!takeChars(1))
+                    return null;
+                parts.push(simple[next]);
                 i++;
+                segmentStart = i + 1;
                 continue;
             }
             const width = next === "u" ? 4 : next === "U" ? 8 : 0;
@@ -57,13 +92,18 @@ function readBasicString(text, start) {
             const codePoint = Number.parseInt(hex, 16);
             if (codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff))
                 return null;
-            value += String.fromCodePoint(codePoint);
+            const decoded = String.fromCodePoint(codePoint);
+            if (!takeChars(decoded.length))
+                return null;
+            parts.push(decoded);
             i += 1 + width;
+            segmentStart = i + 1;
             continue;
         }
         if (ch.charCodeAt(0) < 0x20 && ch !== "\t")
             return null;
-        value += ch;
+        if (!takeChars(1))
+            return null;
     }
     return null;
 }
@@ -72,8 +112,8 @@ function restIsBlank(rest) {
     return /^\s*(?:#.*)?$/.test(rest);
 }
 /** 1行全体が文字列1つ(と任意の末尾カンマ・コメント)の場合にその値を返す */
-function lineString(text, allowComma) {
-    const parsed = readBasicString(text, 0);
+function lineString(text, allowComma, budget) {
+    const parsed = readBasicString(text, 0, budget);
     if (parsed === null)
         return null;
     let rest = text.slice(parsed.end);
@@ -82,7 +122,7 @@ function lineString(text, allowComma) {
     return restIsBlank(rest) ? parsed.value : null;
 }
 /** `["a", "b"]`形式(1行の配列)の要素。読めなければnull */
-function inlineStringArray(text) {
+function inlineStringArray(text, budget) {
     if (!text.startsWith("["))
         return null;
     const items = [];
@@ -92,7 +132,9 @@ function inlineStringArray(text) {
             i++;
         if (text[i] === "]")
             return restIsBlank(text.slice(i + 1)) ? items : null;
-        const parsed = readBasicString(text, i);
+        if (!takeDependency(budget))
+            return null;
+        const parsed = readBasicString(text, i, budget);
         if (parsed === null)
             return null;
         items.push(parsed.value);
@@ -110,15 +152,17 @@ function inlineStringArray(text) {
  * 受け付ける行: 空行・コメント、先頭の`version = 整数`、`[[package]]`、`[[patch.unused]]`(読み飛ばす)、
  * `[metadata]`(v1のchecksum。読み飛ばす)、`キー = "文字列"`、`dependencies = [` 〜 `]`の各要素
  */
-export function parseCargoLock(text) {
+export function parseCargoLock(text, budget = createCargoLockParseBudget()) {
     const packages = [];
     let current = null;
     let state = "top";
     let sawTable = false;
     const fail = (line, what) => ({
         ok: false,
-        reason: `Cargo.lock could not be interpreted with certainty (${what} at line ${line}), so the file was excluded from the scan`,
+        reason: `Cargo.lock could not be interpreted with certainty (${budget.exceeded ?? what} at line ${line}), so the file was excluded from the scan`,
     });
+    if (budget.exceeded !== undefined)
+        return fail(1, budget.exceeded);
     const finish = (line) => {
         if (current === null)
             return null;
@@ -135,10 +179,18 @@ export function parseCargoLock(text) {
         packages.push({ name, version, source: source ?? null, dependencies, ...(replace !== undefined ? { replace } : {}) });
         return null;
     };
-    const lines = text.replace(/^/, "").split(/\r?\n/);
-    for (let index = 0; index < lines.length; index++) {
-        const lineNo = index + 1;
-        const line = lines[index].trim();
+    let lineNo = 0;
+    // Do not materialize a line array: even blank lines can amplify a small input.
+    for (let start = 0; start <= text.length;) {
+        lineNo++;
+        if (budget.remainingLines <= 0) {
+            budget.exceeded = "the line limit was exceeded";
+            return fail(lineNo, budget.exceeded);
+        }
+        budget.remainingLines--;
+        const end = text.indexOf("\n", start);
+        const line = text.slice(start, end === -1 ? text.length : end).trim();
+        start = end === -1 ? text.length + 1 : end + 1;
         if (state === "dependencies") {
             if (line === "" || line.startsWith("#"))
                 continue;
@@ -146,7 +198,9 @@ export function parseCargoLock(text) {
                 state = "package";
                 continue;
             }
-            const item = lineString(line, true);
+            if (!takeDependency(budget))
+                return fail(lineNo, budget.exceeded);
+            const item = lineString(line, true, budget);
             if (item === null)
                 return fail(lineNo, "an unexpected dependency entry");
             current.dependencies.push(item);
@@ -183,9 +237,9 @@ export function parseCargoLock(text) {
             return fail(lineNo, "an unexpected table");
         if (state === "metadata") {
             // v1: "checksum 名前 版 (source)" = "ハッシュ"
-            const key = readBasicString(line, 0);
+            const key = readBasicString(line, 0, budget);
             const valueMatch = key === null ? null : /^\s*=\s*(.*)$/.exec(line.slice(key.end));
-            if (valueMatch === null || lineString(valueMatch[1], false) === null)
+            if (valueMatch === null || lineString(valueMatch[1], false, budget) === null)
                 return fail(lineNo, "an unexpected metadata entry");
             continue;
         }
@@ -205,14 +259,15 @@ export function parseCargoLock(text) {
                 state = "dependencies";
                 continue;
             }
-            const items = inlineStringArray(valueText);
+            const items = inlineStringArray(valueText, budget);
             if (items === null)
                 return fail(lineNo, "an unexpected dependencies value");
             if (state === "package")
-                current.dependencies.push(...items);
+                for (const item of items)
+                    current.dependencies.push(item);
             continue;
         }
-        const value = lineString(valueText, false);
+        const value = lineString(valueText, false, budget);
         if (value === null)
             return fail(lineNo, `an unexpected value for ${key}`);
         if (state === "package") {
@@ -225,16 +280,24 @@ export function parseCargoLock(text) {
         }
     }
     if (state === "dependencies")
-        return fail(lines.length, "an unterminated dependencies array");
-    const failed = finish(lines.length);
+        return fail(lineNo, "an unterminated dependencies array");
+    const failed = finish(lineNo);
     if (failed)
         return failed;
+    // Count exact identities once; counts distinguish a separate duplicate from self-only replacement.
+    const packageCounts = new Map();
+    for (const pkg of packages) {
+        const id = JSON.stringify([pkg.name, pkg.version, pkg.source]);
+        packageCounts.set(id, (packageCounts.get(id) ?? 0) + 1);
+    }
     // 置換先が解釈でき、別のパッケージとして記載されていることを確かめる(置換元は使われないためスキャンしない)
     for (const pkg of packages) {
         if (pkg.replace === undefined)
             continue;
         const target = parsePackageId(pkg.replace);
-        const found = target !== null && packages.some((other) => other !== pkg && other.name === target.name && other.version === target.version && other.source === target.source);
+        const found = target !== null &&
+            (packageCounts.get(JSON.stringify([target.name, target.version, target.source])) ?? 0) >
+                (pkg.name === target.name && pkg.version === target.version && pkg.source === target.source ? 1 : 0);
         if (!found) {
             return {
                 ok: false,
@@ -484,50 +547,142 @@ function normalizeWorkspacePath(value) {
 function isPathPrefix(prefix, target) {
     return prefix === "" || target === prefix || target.startsWith(`${prefix}/`);
 }
-/** `*`・`?`だけのglobの一致。それ以外のglob(`**`・`[...]`・`{...}`)はnull(判定できない) */
-function globMatches(pattern, target) {
+/** 1回の所属の判定(1つのメンバー)で使えるglobの照合の計算量(DPの表のセル数) */
+const MAX_WORKSPACE_GLOB_WORK = 1_000_000;
+/**
+ * 1回の検出全体で使えるglobの照合の計算量。メンバーのCargo.tomlごとに上限を戻すと、同名のcrateを名乗る
+ * Cargo.tomlを大量に置いたリポジトリで計算量が積み上がる(2,000件で4.6秒の同期処理を確認、2026-10-22)ため、
+ * 検出全体でも上限を設ける。使い切った後の判定はnull(未確認)
+ */
+export const MAX_WORKSPACE_GLOB_TOTAL_WORK = 10_000_000;
+export function createGlobWorkBudget(total = MAX_WORKSPACE_GLOB_TOTAL_WORK) {
+    return { remaining: total };
+}
+/** `*`・`?`だけのglobの一致。それ以外のglob、計算量の上限超過はnull(判定できない) */
+function globMatches(pattern, target, budget) {
+    const preparationWork = pattern.length + target.length + 1;
+    if (preparationWork > budget.remaining) {
+        // Do not leave an unchargeable remainder that permits unlimited pattern visits.
+        budget.remaining = 0;
+        return null;
+    }
+    budget.remaining -= preparationWork;
     const patternParts = pattern.split("/");
     const targetParts = target === "" ? [] : target.split("/");
     if (patternParts.some((part) => part.includes("**") || /[[\]{}]/.test(part)))
         return null;
     if (patternParts.length !== targetParts.length)
         return false;
-    return patternParts.every((part, i) => {
-        const regex = new RegExp(`^${part.replace(/[.+^$()|\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")}$`);
-        return regex.test(targetParts[i]);
-    });
+    for (let i = 0; i < patternParts.length; i++) {
+        const part = patternParts[i];
+        const value = targetParts[i];
+        if (!part.includes("*") && !part.includes("?")) {
+            if (part !== value)
+                return false;
+            continue;
+        }
+        // Reserve all DP cells before allocating; the budget is shared by every member pattern.
+        const work = (part.length + 1) * (value.length + 1);
+        if (work > budget.remaining)
+            return null;
+        budget.remaining -= work;
+        let previous = new Uint8Array(value.length + 1);
+        let current = new Uint8Array(value.length + 1);
+        previous[0] = 1;
+        for (let p = 0; p < part.length; p++) {
+            const token = part[p];
+            current[0] = token === "*" ? previous[0] : 0;
+            for (let t = 1; t <= value.length; t++) {
+                current[t] = token === "*"
+                    ? previous[t] | current[t - 1]
+                    : (token === "?" || token === value[t - 1]) ? previous[t - 1] : 0;
+            }
+            [previous, current] = [current, previous];
+        }
+        if (previous[value.length] === 0)
+            return false;
+    }
+    return true;
+}
+const compiledWorkspaces = new WeakMap();
+function compileWorkspace(workspace) {
+    const cached = compiledWorkspaces.get(workspace);
+    if (cached !== undefined)
+        return cached;
+    const compiled = {
+        literalMembers: new Set(), globMembers: [], explicitMembers: new Set(), invalidMember: false, excludes: new Set(), invalidExclude: false,
+    };
+    for (const member of workspace.members) {
+        const pattern = normalizeWorkspacePath(member);
+        if (pattern === null) {
+            compiled.invalidMember = true;
+            continue;
+        }
+        compiled.explicitMembers.add(pattern);
+        if (/[*?[\]{}]/.test(pattern))
+            compiled.globMembers.push(pattern);
+        else
+            compiled.literalMembers.add(pattern);
+    }
+    for (const ex of workspace.exclude) {
+        const prefix = normalizeWorkspacePath(ex);
+        if (prefix === null)
+            compiled.invalidExclude = true;
+        else
+            compiled.excludes.add(prefix);
+    }
+    compiledWorkspaces.set(workspace, compiled);
+    return compiled;
+}
+/** targetとその祖先(ルート""を含む)。前方一致の判定を集合の参照にするため */
+function selfAndAncestors(target) {
+    const parts = target === "" ? [] : target.split("/");
+    const result = [""];
+    for (let i = 1; i <= parts.length; i++)
+        result.push(parts.slice(0, i).join("/"));
+    return result;
 }
 /**
  * memberDir(workspaceのルートからの相対パス)が`members`に含まれ、`exclude`で除かれていないか。
  * Cargoの規則(2026-10-11 cargo 1.98で確認): `members`はglobで展開し、`exclude`はパスの前方一致で除く。
  * ただし`members`に(globでなく)文字どおり書かれたパスの配下は`exclude`より優先する。
- * true=所属 / false=所属しない / null=判定できない(解釈できないパス・glob)
+ * true=所属 / false=所属しない / null=判定できない(解釈できないパス・glob・計算量の上限超過)。
+ * totalを渡すと、globの照合の計算量を呼び出しをまたいで共有する(検出全体の上限)
  */
-export function workspaceIncludes(workspace, memberDir) {
+export function workspaceIncludes(workspace, memberDir, total) {
     const target = normalizeWorkspacePath(memberDir);
     if (target === null)
         return null;
-    let undecided = false;
-    let matched = false;
-    for (const member of workspace.members) {
-        const pattern = normalizeWorkspacePath(member);
-        const result = pattern === null ? null : globMatches(pattern, target);
-        if (result === null)
-            undecided = true;
-        else if (result)
-            matched = true;
+    const compiled = compileWorkspace(workspace);
+    let matched = compiled.literalMembers.has(target);
+    let undecided = compiled.invalidMember;
+    if (!matched && compiled.globMembers.length > 0) {
+        // 1回の判定の上限と、検出全体の残りの小さいほう。使った分は検出全体の残りからも引く
+        const budget = { remaining: Math.min(MAX_WORKSPACE_GLOB_WORK, total?.remaining ?? MAX_WORKSPACE_GLOB_WORK) };
+        const start = budget.remaining;
+        for (const pattern of compiled.globMembers) {
+            // 上限を使い切ったら残りのパターンは見ない(パターン数×メンバー数の空回りを避ける)
+            if (budget.remaining <= 0) {
+                undecided = true;
+                break;
+            }
+            const result = globMatches(pattern, target, budget);
+            if (result === null)
+                undecided = true;
+            else if (result) {
+                matched = true;
+                break;
+            }
+        }
+        if (total !== undefined)
+            total.remaining -= start - budget.remaining;
     }
     if (!matched)
         return undecided ? null : false;
-    const explicit = workspace.members.some((member) => {
-        const literal = normalizeWorkspacePath(member);
-        return literal !== null && isPathPrefix(literal, target);
-    });
-    const excluded = workspace.exclude.some((ex) => {
-        const prefix = normalizeWorkspacePath(ex);
-        return prefix !== null && isPathPrefix(prefix, target);
-    });
-    if (workspace.exclude.some((ex) => normalizeWorkspacePath(ex) === null))
+    if (compiled.invalidExclude)
         return null;
+    const ancestors = selfAndAncestors(target);
+    const explicit = ancestors.some((prefix) => compiled.explicitMembers.has(prefix));
+    const excluded = ancestors.some((prefix) => compiled.excludes.has(prefix));
     return !(excluded && !explicit);
 }

package/dist/utils/dependencyRelations.js

@@ -269,7 +269,7 @@ function stripV(version) {
  */
 export function goModRelations(text) {
     const requires = new Map();
-    const replaces = [];
+    const replaces = new Map();
     let block = null;
     for (const raw of text.split(/\r?\n/)) {
         const { body, indirect } = splitGoComment(raw);
@@ -303,12 +303,20 @@ export function goModRelations(text) {
         else if (directive === "replace") {
             const arrow = fields.indexOf("=>");
             if ((arrow === 1 || arrow === 2) && fields[arrow + 1] !== undefined) {
-                replaces.push({
+                const replace = {
                     from: fields[0],
                     fromVersion: arrow === 2 ? stripV(fields[1]) : null,
                     to: fields[arrow + 1],
                     toVersion: fields[arrow + 2] !== undefined ? stripV(fields[arrow + 2]) : null,
-                });
+                };
+                let versions = replaces.get(replace.from);
+                if (versions === undefined) {
+                    versions = new Map();
+                    replaces.set(replace.from, versions);
+                }
+                // Match the former find calls: retain the first declaration for each version.
+                if (!versions.has(replace.fromVersion))
+                    versions.set(replace.fromVersion, replace);
             }
         }
     }
@@ -323,8 +331,8 @@ export function goModRelations(text) {
     };
     for (const [modulePath, { relation, version }] of requires) {
         setRelation(modulePath, relation);
-        const replace = replaces.find((r) => r.from === modulePath && r.fromVersion === version) ??
-            replaces.find((r) => r.from === modulePath && r.fromVersion === null);
+        const versions = replaces.get(modulePath);
+        const replace = versions?.get(version) ?? versions?.get(null);
         if (replace === undefined)
             continue;
         if (replace.toVersion === null) {
@@ -344,7 +352,7 @@ export function goModRelations(text) {
 }
 /**
  * pom.xmlの依存の関係を、osv-scannerの`source.type`で判定する(pom.xmlは自前で解析しない)。
- * osv-scanner 2.4.0は同じpom.xmlを、宣言された依存(親POM・プロファイル・プロパティ・依存管理をosv-scannerが解釈したもの)を
+ * osv-scanner 2.4.0・2.7.0は同じpom.xmlを、宣言された依存(親POM・プロファイル・プロパティ・依存管理をosv-scannerが解釈したもの)を
  * `type: "lockfile"`、deps.devで解決された推移的依存を`type: "unknown"`の結果に分けて報告する(実データで確認)。
  * 文書化された仕様ではないため、想定外のtypeはunknownにする(osv-scannerのピン留め更新時に再確認する)。
  */

package/dist/utils/manifestDetector.js

@@ -13,8 +13,9 @@ import path from "node:path";
 import { ScanToolError } from "../errors.js";
 import { assertInsideAllowedRoot, resolveExistingPath, walkProjectFiles, } from "./projectWalk.js";
 import { capitalizeReason, readRegularFile } from "./safeRead.js";
+import { createNpmLockWorkBudget, MAX_NPM_LOCK_BYTES, MAX_NPM_LOCK_TOTAL_BYTES, parseNpmLock } from "./npmLockCopy.js";
 import { analyzeRequirementsFile, createRequirementsReadContext, } from "./requirementsFile.js";
-import { cargoTomlPackageName, cargoWorkspace, workspaceIncludes, classifyCargoPackages, parseCargoLock, UNSCANNABLE_CRATE_REASONS, } from "./cargoLock.js";
+import { cargoTomlPackageName, cargoWorkspace, workspaceIncludes, createGlobWorkBudget, classifyCargoPackages, createCargoLockParseBudget, parseCargoLock, UNSCANNABLE_CRATE_REASONS, } from "./cargoLock.js";
 /** ファイル名→(エコシステム, 解析形式)。npm-shrinkwrap.jsonはpackage-lock.json形式で解析する */
 const LOCKFILES = new Map([
     ["pom.xml", { ecosystem: "Maven", format: "pom.xml" }],
@@ -79,8 +80,7 @@ function satisfiesGroup(manifest, group) {
 function isSameOrDescendant(dir, ancestor) {
     return ancestor === "." || dir === ancestor || dir.startsWith(`${ancestor}${path.sep}`);
 }
-/** workspaceの収録確認で読むlockfile1件の上限と、1回の検出での合計の上限 */
-const MAX_LOCKFILE_BYTES = 64 * 1024 * 1024;
+/** Cargo.lockの読み込み合計の上限(npm JSONにはnpmLockCopy.tsの上限を使う) */
 const MAX_LOCKFILE_TOTAL_BYTES = 256 * 1024 * 1024;
 /**
  * workspaceの収録確認用に、package-lock.jsonの`packages`のキー一覧を1回だけ読む。
@@ -89,8 +89,9 @@ const MAX_LOCKFILE_TOTAL_BYTES = 256 * 1024 * 1024;
  */
 export class LockfileKeyCache {
     keys = new Map();
+    workBudget = createNpmLockWorkBudget();
     remaining;
-    constructor(maxTotalBytes = MAX_LOCKFILE_TOTAL_BYTES) {
+    constructor(maxTotalBytes = MAX_NPM_LOCK_TOTAL_BYTES) {
         this.remaining = maxTotalBytes;
     }
     /** 収録済みのキー。null=確認できない(v1形式・読めない・大きすぎる・上限超過) */
@@ -99,11 +100,11 @@ export class LockfileKeyCache {
             return this.keys.get(lockAbs);
         let keys = null;
         if (this.remaining > 0) {
-            const read = await readRegularFile(lockAbs, { maxBytes: Math.min(MAX_LOCKFILE_BYTES, this.remaining), boundary: projectDir });
+            const read = await readRegularFile(lockAbs, { maxBytes: Math.min(MAX_NPM_LOCK_BYTES, this.remaining), boundary: projectDir });
             if (read.ok) {
                 this.remaining -= read.bytes.length;
                 try {
-                    const packages = JSON.parse(read.bytes.toString("utf8")).packages;
+                    const packages = parseNpmLock(read.bytes.toString("utf8"), this.workBudget).packages;
                     if (typeof packages === "object" && packages !== null)
                         keys = new Set(Object.keys(packages));
                 }
@@ -125,6 +126,7 @@ const MAX_CARGO_TOML_BYTES = 1024 * 1024;
  */
 export class CargoLockCache {
     results = new Map();
+    parseBudget = createCargoLockParseBudget();
     remaining;
     tomls = new Map();
     remainingToml = MAX_LOCKFILE_TOTAL_BYTES;
@@ -157,7 +159,7 @@ export class CargoLockCache {
             }
             else {
                 this.remaining -= read.bytes.length;
-                const parsed = parseCargoLock(read.bytes.toString("utf8"));
+                const parsed = parseCargoLock(read.bytes.toString("utf8"), this.parseBudget);
                 result = parsed.ok ? classifyCargoPackages(parsed.packages) : { reason: parsed.reason };
             }
         }
@@ -165,6 +167,8 @@ export class CargoLockCache {
         return result;
     }
     workspaces = new Map();
+    /** workspaceの所属の判定のglobの照合の計算量(1回の検出全体で共有する) */
+    globBudget = createGlobWorkBudget();
     /** Cargo.lockと同じディレクトリのCargo.tomlの`[workspace]`(1回だけ読む)。無い・読めない場合はnull */
     async workspace(lockAbs, projectDir) {
         if (this.workspaces.has(lockAbs))
@@ -198,7 +202,7 @@ async function cargoLockfileRecords(cache, projectDir, lockfile, memberToml) {
     if (workspace === null)
         return null;
     const memberDir = path.relative(path.dirname(lockAbs), path.join(projectDir, path.dirname(memberToml))).split(path.sep).join("/");
-    return workspaceIncludes(workspace, memberDir) === true ? true : null;
+    return workspaceIncludes(workspace, memberDir, cache.globBudget) === true ? true : null;
 }
 /**
  * package-lock.json(v2以降)の`packages`に、memberDirのエントリがあるか。
@@ -275,6 +279,7 @@ async function finalize(projectDir, manifests, markers, allowedRootReal) {
         skippedFiles: [],
     };
     const readContext = createRequirementsReadContext();
+    // A null value permanently marks a crate name with multiple declaration paths.
     const cargoManifests = new Map();
     const cargoMarkers = new Set([
         ...markers.filter((m) => m.path.endsWith("Cargo.toml")).map((m) => m.path),
@@ -284,7 +289,7 @@ async function finalize(projectDir, manifests, markers, allowedRootReal) {
         const text = await cargoCache.toml(path.join(projectDir, marker), projectDir);
         const name = text === null ? null : cargoTomlPackageName(text);
         if (name !== null)
-            cargoManifests.set(name, [...(cargoManifests.get(name) ?? []), marker]);
+            cargoManifests.set(name, cargoManifests.has(name) ? null : marker);
     }
     for (const manifest of manifests) {
         const absolute = path.join(projectDir, manifest.path);
@@ -306,9 +311,12 @@ async function finalize(projectDir, manifests, markers, allowedRootReal) {
                 continue;
             }
             const declaringManifests = new Map();
-            for (const [name, paths] of cargoManifests) {
-                if (paths.length === 1)
-                    declaringManifests.set(name, path.relative(path.dirname(manifest.path), paths[0]));
+            // declared_inに使うのは、このCargo.lockのローカルのcrate(依存元)の名前だけ。プロジェクトの全crate名を
+            // Cargo.lockごとにたどると、Cargo.lockの数×crate名の数の処理・メモリになる(900件×2万件で約24秒)
+            for (const name of lock.localCrates) {
+                const marker = cargoManifests.get(name);
+                if (typeof marker === "string")
+                    declaringManifests.set(name, path.relative(path.dirname(manifest.path), marker));
             }
             result.cargoCopies.push({ path: manifest.path, packages: lock.cratesIo, allPackages: lock.allPackages, declaringManifests });
             result.localCrateCount += lock.localCrates.length;

package/dist/utils/manifestFormats.js

@@ -1,5 +1,5 @@
 /**
- * osv-scannerに`--lockfile <形式>:<絶対パス>`で個別に渡せる解析形式(2.4.0で実機確認)。
+ * osv-scannerに`--lockfile <形式>:<絶対パス>`で個別に渡せる解析形式(2.4.0・2.7.0で実機確認)。
  * ここに無い形式はosv-scannerに渡さない。npm-shrinkwrap.jsonは"package-lock.json"形式で解析する。
  * Cargo.lockは元のファイルを渡さず、crates.io由来のパッケージだけを書いたコピーを渡す(cargoLock.ts)。
  */

package/dist/utils/npmLockCopy.js

@@ -0,0 +1,183 @@
+/**
+ * package-lock.json(npm-shrinkwrap.jsonを含む)のスナップショットのコピーで、`resolved`の無いエントリに
+ * 公開レジストリの形のURLを補う(docs/DESIGN_TODO.md「osv-scannerのピン留め更新」)。
+ *
+ * osv-scanner 2.7.0(osv-scalibrの`DeterminePackageSource`)は、`resolved`が無いエントリをローカルのパッケージとみなして
+ * 照会しない(2026-10-15 実機確認)。バンドルされた依存(`inBundle` / v1の`bundled`)や、npmの
+ * `omit-lockfile-registry-resolved=true`で生成したlockfileのレジストリのパッケージが黙って照会されなくなる(偽陰性)。
+ * 2.4.0は照会していたため、補うことで同じ範囲を照会させる(送る名前は2.4.0と同じ)。
+ *
+ * 対象外(ローカルのパッケージ): `link: true`、キーが`node_modules/`を含まないエントリ(ローカルのディレクトリ・workspace)、
+ * 版が`file:`・`git+...`・`user/repo`等の参照のもの(v1の別名`npm:<名前>@<版>`は実際の名前と版で補う)。`resolved`があるもの(`file:`のtarballを含む)は変えない。
+ */
+import { ScanToolError } from "../errors.js";
+export const MAX_NPM_LOCK_BYTES = 16 * 1024 * 1024;
+export const MAX_NPM_LOCK_TOTAL_BYTES = 64 * 1024 * 1024;
+const MAX_JSON_DEPTH = 128;
+const MAX_JSON_STRUCTURE = 1_000_000;
+const REGISTRY = "https://registry.npmjs.org";
+export function createNpmLockWorkBudget() {
+    return { remaining: 2_000_000 };
+}
+function limitExceeded(limit) {
+    throw new ScanToolError("scan_input_too_large", `The npm lockfile exceeds the ${limit}. Narrow the target or use a smaller lockfile`);
+}
+/** Bound allocation before JSON.parse; JSON syntax itself is still validated by the native parser. */
+export function parseNpmLock(text, budget = createNpmLockWorkBudget()) {
+    if (text.length > MAX_NPM_LOCK_BYTES || Buffer.byteLength(text, "utf8") > MAX_NPM_LOCK_BYTES) {
+        limitExceeded(`input byte limit (${MAX_NPM_LOCK_BYTES} bytes)`);
+    }
+    let quoted = false;
+    let escaped = false;
+    let depth = 0;
+    let structure = 0;
+    for (let i = 0; i < text.length; i++) {
+        const char = text[i];
+        if (quoted) {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === '"')
+                quoted = false;
+            continue;
+        }
+        if (char === '"')
+            quoted = true;
+        else if (char === "{" || char === "[") {
+            if (++depth > MAX_JSON_DEPTH)
+                limitExceeded(`JSON depth limit (${MAX_JSON_DEPTH})`);
+            structure++;
+        }
+        else if (char === "}" || char === "]")
+            depth--;
+        else if (char === "," || char === ":")
+            structure++;
+        if (structure > MAX_JSON_STRUCTURE)
+            limitExceeded(`JSON structure limit (${MAX_JSON_STRUCTURE})`);
+        if (structure > budget.remaining)
+            limitExceeded("scan-wide JSON structure limit");
+    }
+    budget.remaining -= structure;
+    return JSON.parse(text);
+}
+/** Measure compact output before materializing it, including JSON escaping and number formatting. */
+function stringifyNpmLock(lock, maxBytes) {
+    let remaining = maxBytes;
+    const reserve = (bytes) => {
+        remaining -= bytes;
+        if (remaining < 0)
+            limitExceeded(`output byte limit (${maxBytes} bytes)`);
+    };
+    const measure = (value) => {
+        if (typeof value === "object" && value !== null) {
+            reserve(2);
+            const array = Array.isArray(value);
+            const record = value;
+            let first = true;
+            for (const key of Object.keys(value)) {
+                if (!first)
+                    reserve(1);
+                first = false;
+                if (!array) {
+                    reserve(key.length);
+                    reserve(Buffer.byteLength(JSON.stringify(key), "utf8") - key.length + 1);
+                }
+                measure(record[key]);
+            }
+        }
+        else {
+            if (typeof value === "string" && value.length > remaining)
+                limitExceeded(`output byte limit (${maxBytes} bytes)`);
+            reserve(Buffer.byteLength(JSON.stringify(value), "utf8"));
+        }
+    };
+    measure(lock);
+    return JSON.stringify(lock);
+}
+/** 照会させてよい版(参照でない、ふつうの版の文字) */
+const PLAIN_VERSION = /^[0-9A-Za-z.+-]{1,256}$/;
+const IN_NODE_MODULES = /(?:^|\/)node_modules\//;
+/** v1の別名の依存の版(`npm:<実際の名前>@<版>`。スコープ付きの名前を含む) */
+const NPM_ALIAS = /^npm:((?:@[^/@\s]+\/)?[^/@\s]+)@(.+)$/;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function lacksResolved(entry) {
+    return entry.resolved === undefined || entry.resolved === "";
+}
+function registryUrl(name, version) {
+    const base = name.split("/").pop();
+    return `${REGISTRY}/${name}/-/${base}-${version}.tgz`;
+}
+/** v2以降の`packages`: キーの最後の`node_modules/`より後ろがパッケージ名(別名では`name`が実際の名前) */
+function fillPackages(packages) {
+    let filled = 0;
+    for (const [key, entry] of Object.entries(packages)) {
+        if (!isRecord(entry) || !IN_NODE_MODULES.test(key) || entry.link === true || !lacksResolved(entry))
+            continue;
+        const version = entry.version;
+        if (typeof version !== "string" || !PLAIN_VERSION.test(version))
+            continue;
+        const name = typeof entry.name === "string" ? entry.name : key.slice(key.lastIndexOf("node_modules/") + "node_modules/".length);
+        if (name === "")
+            continue;
+        entry.resolved = registryUrl(name, version);
+        filled++;
+    }
+    return filled;
+}
+/**
+ * v1の依存の実際の名前と版。別名(`"version": "npm:lodash@4.17.20"`)は実際の名前と版を取り出す
+ * (osv-scannerもこの表記を実際の名前と版として照会する。2026-10-15 実機確認)。参照(`file:`・git等)はnull
+ */
+function registryPackage(name, version) {
+    if (PLAIN_VERSION.test(version))
+        return { name, version };
+    const alias = NPM_ALIAS.exec(version);
+    if (alias !== null && PLAIN_VERSION.test(alias[2]))
+        return { name: alias[1], version: alias[2] };
+    return null;
+}
+/** v1の`dependencies`(入れ子) */
+function fillDependencies(dependencies, depth) {
+    if (depth > 256)
+        return 0;
+    let filled = 0;
+    for (const [name, entry] of Object.entries(dependencies)) {
+        if (!isRecord(entry))
+            continue;
+        const version = entry.version;
+        const target = typeof version === "string" ? registryPackage(name, version) : null;
+        if (lacksResolved(entry) && target !== null) {
+            entry.resolved = registryUrl(target.name, target.version);
+            filled++;
+        }
+        if (isRecord(entry.dependencies))
+            filled += fillDependencies(entry.dependencies, depth + 1);
+    }
+    return filled;
+}
+/**
+ * `resolved`を補ったlockfileの内容。補うエントリが無ければ`changed: false`(コピーを書き換えない)。
+ * JSONとして解析できなければnull(呼び出し側はコピーをそのまま渡す)。資源上限超過は型付きエラーで停止する。
+ */
+export function fillMissingResolved(text, maxOutputBytes = MAX_NPM_LOCK_BYTES, budget = createNpmLockWorkBudget()) {
+    let lock;
+    try {
+        lock = parseNpmLock(text, budget);
+    }
+    catch (error) {
+        if (error instanceof ScanToolError)
+            throw error;
+        return null;
+    }
+    if (!isRecord(lock))
+        return null;
+    let filled = 0;
+    if (isRecord(lock.packages))
+        filled += fillPackages(lock.packages);
+    if (isRecord(lock.dependencies))
+        filled += fillDependencies(lock.dependencies, 0);
+    return filled === 0 ? { changed: false, content: text, filled } : { changed: true, content: stringifyNpmLock(lock, maxOutputBytes), filled };
+}

package/dist/utils/pomParent.js

@@ -1,14 +1,16 @@
 /**
  * pom.xmlの親POM(`<parent><relativePath>`)の参照の解釈。連鎖のコピーと検証はscanSnapshot.tsが行う。
  *
- * osv-scanner v2.4.0の実機確認(2026-10-07):
+ * osv-scanner v2.4.0の実機確認(2026-10-07。範囲外の親POMを読む挙動はv2.7.0でも同じ、2026-10-15):
  * - `<relativePath>`の指す親POMを読み、その依存を結果に含める(`--no-resolve`でも同じ)。親の親もたどる
  * - `<relativePath>`省略時はMavenの既定値`../pom.xml`を参照する。ディレクトリを指す場合はその中のpom.xml
- * - `<relativePath/>`(空)はローカルを参照しない。親のGAVが一致しない場合も読まない
+ * - 親のGAVが一致しない場合は読まない
+ * - `<relativePath/>`・`<relativePath></relativePath>`・空白だけの値も、既定値`../pom.xml`を参照する(v2.4.0・v2.7.0で実機確認、2026-10-22)。
+ *   Mavenでは空は「ローカルを参照しない」だが、osv-scannerは既定値と同じに扱う。以前は空を「参照しない」と解釈して親をコピーせず、
+ *   スナップショットでは親から継承する依存が黙って欠け、許可ルートの検証も行われなかった
  *
- * スナップショット方式では、osv-scannerが読めるのはコピーしたファイルだけのため、ここでの解釈が
- * osv-scannerとずれても範囲外は読まれない(最悪でも親が見つからない)。解釈できない場合の除外は、
- * 親から引き継ぐ依存を黙って欠落させないためのもの。
+ * コピーしたPOMにも相対参照は残るため、解釈できない参照は除外し、コピー後の連鎖も検証する。
+ * 警告だけで続行すると、osv-scannerがスナップショット外の元ファイルを読む可能性がある。
  */
 const DEFAULT_RELATIVE_PATH = "../pom.xml";
 const NAMED_ENTITIES = { lt: "<", gt: ">", amp: "&", apos: "'", quot: '"' };
@@ -31,7 +33,7 @@ function decodeEntities(text) {
     return unknown ? undefined : decoded;
 }
 /**
- * 親POMのrelativePath。null=親なし / ""=ローカルを参照しない / undefined=解釈できない(除外する)
+ * 親POMのrelativePath。null=親なし / undefined=解釈できない(除外する)。空・空白だけの値は既定値`../pom.xml`(osv-scannerと同じ)
  *
  * osv-scannerのXMLデコーダー(Go)の挙動に合わせる(2026-10-07 実機確認):
  * - 要素は名前空間・接頭辞に関係なくローカル名で照合する(`<m:parent>`も親として読む)。大文字小文字は区別する
@@ -135,7 +137,8 @@ export function parentRelativePath(source) {
     // (JSとGoで扱いが異なる)で参照先がずれうるため、解釈できないものとして除外する
     if (/[\p{Cc}\p{Cf}\u0085]|(?! )\p{Z}/u.test(trimmed))
         return undefined;
-    return trimmed;
+    // 空・空白だけの値は、osv-scannerでは省略時と同じく既定値を参照する
+    return trimmed === "" ? DEFAULT_RELATIVE_PATH : trimmed;
 }
 /** UTF-8として厳密に読む。不正なバイト列・NULを含む場合はnull(Goと同じ解釈を保証できない) */
 export function decodePomBytes(bytes) {

package/dist/utils/requirementsFile.js

@@ -7,7 +7,7 @@
  * `名前==版` 等の単純な形に正規化して返し、呼び出し側がそれを専用コピーに書いてスキャンする。
  * コピーには取り込み・オプションを一切含めないため、osv-scannerがたどれる参照は存在しない。
  *
- * osv-scanner v2.4.0の実機確認(2026-10-07):
+ * osv-scanner v2.4.0の実機確認(2026-10-07。v2.7.0でも同じ、2026-10-15):
  * - `==` / `===` はその版をスキャンする。`>=X` / `~=X` は下限Xを使用中の版とみなす
  * - `>` `<` `!=` `==1.*` 範囲の組み合わせ・版なしは空の版になり、結果から消える
  * - `-r` はたどるが、`--requirement` / `-c` はたどらない
@@ -144,8 +144,17 @@ async function include(file, line, content, target, projectDir, depth, out, cont
 }
 /** 1回のスキャンで読むrequirements.txt(取り込み先を含む)の合計の上限 */
 const DEFAULT_TOTAL_BYTES = 64 * 1024 * 1024;
-export function createRequirementsReadContext(maxTotalBytes = DEFAULT_TOTAL_BYTES) {
-    return { remainingBytes: maxTotalBytes, texts: new Map() };
+const DEFAULT_EXPANDED_BYTES = 64 * 1024 * 1024;
+const DEFAULT_LOGICAL_LINES = 100_000;
+const EXPANSION_BYTE_LIMIT = "Not analyzed because the scan-wide requirements expansion byte limit was reached";
+const LOGICAL_LINE_LIMIT = "Not analyzed because the scan-wide requirements logical-line limit was reached";
+export function createRequirementsReadContext(maxTotalBytes = DEFAULT_TOTAL_BYTES, limits = {}) {
+    return {
+        remainingBytes: maxTotalBytes,
+        remainingExpandedBytes: limits.maxExpandedBytes ?? DEFAULT_EXPANDED_BYTES,
+        remainingLogicalLines: limits.maxLogicalLines ?? DEFAULT_LOGICAL_LINES,
+        texts: new Map(),
+    };
 }
 /** 安全に読む(FIFOで止まらず、差し替え・範囲外を検出する)。同じファイルは1回だけ読む */
 async function readText(file, projectDir, context) {
@@ -173,13 +182,23 @@ async function readText(file, projectDir, context) {
     context.texts.set(file, text);
     return { ok: true, text };
 }
-/** ファイルを解析してoutに追加する。読めない・大きすぎる場合は理由を返す */
+/** ファイルを解析してoutに追加する。読めない・上限超過の場合は理由を返す */
 async function analyze(file, projectDir, depth, out, context) {
+    if (context.remainingLogicalLines <= 0)
+        return LOGICAL_LINE_LIMIT;
     out.visited.add(file);
     const read = await readText(file, projectDir, context);
     if (!read.ok)
         return read.reason;
+    // Cached text costs expansion work and output space again for each requirements root.
+    const expandedBytes = Buffer.byteLength(read.text, "utf8");
+    if (expandedBytes > context.remainingExpandedBytes)
+        return EXPANSION_BYTE_LIMIT;
+    context.remainingExpandedBytes -= expandedBytes;
     for (const { line, content } of logicalLines(read.text)) {
+        if (context.remainingLogicalLines <= 0)
+            return LOGICAL_LINE_LIMIT;
+        context.remainingLogicalLines--;
         const requirementInclude = INCLUDE_REQUIREMENT.exec(content);
         if (requirementInclude) {
             await include(file, line, content, requirementInclude[1], projectDir, depth, out, context);
@@ -204,7 +223,7 @@ async function analyze(file, projectDir, depth, out, context) {
     return null;
 }
 /**
- * requirements.txtを解析する。元ファイル自体が読めない・大きすぎる場合だけ`ok: false`。
+ * requirements.txtを解析する。元ファイルを読めない・大きすぎる・解析の共有上限を超えた場合は`ok: false`。
  * @param file 検出済みの絶対パス
  * @param projectDir 取り込みを展開する範囲(解決済みの絶対パス)
  */

package/dist/utils/scanSnapshot.js

@@ -27,6 +27,7 @@ export class ScanSnapshot {
     maxTotalBytes;
     untrack;
     copied = new Map();
+    copiedPaths = new Set();
     parentCache = new Map();
     /** 再現した配置のルートごとのディレクトリ → 元のルート("/"等) */
     mirroredRoots = new Map();
@@ -91,8 +92,13 @@ export class ScanSnapshot {
         }
         this.used += result.bytes;
         this.copied.set(absolute, dest);
+        this.copiedPaths.add(dest);
         return { ok: true, path: dest };
     }
+    /** Only completed private copies can be followed during the final parent-chain check. */
+    hasCopy(copyPath) {
+        return this.copiedPaths.has(copyPath);
+    }
     /** 本サーバーが生成した内容(requirements.txtの正規化コピー等)を書く */
     async writeGenerated(content) {
         const dir = path.join(this.dir, "generated");
@@ -116,10 +122,10 @@ export class ScanSnapshot {
     }
 }
 const UNPARSEABLE = "The parent POM reference cannot be interpreted with certainty (duplicate parent elements, CDATA, DOCTYPE, property references, an encoding other than UTF-8, and so on), " +
-    "so it could not be confirmed to be inside the allowed root and the file was excluded from the scan";
+    "so its parent chain could not be confirmed to stay inside the snapshot and the file was excluded from the scan";
 /**
  * pom.xmlと親POMの連鎖をスナップショットへコピーする。
- * 許可ルート設定時、連鎖が許可ルートの外・スナップショットの外を参照するか、解釈できない場合は除外理由を返す。
+ * 連鎖がスナップショットの外を参照するか解釈できない場合は除外する。許可ルート設定時は元の参照先も制限する。
  * 存在する親POMを再現できなかった場合(サイズ超過・通常のファイルでない等)はスキャンを続けるが、
  * 親から継承する依存が欠ける可能性があるためincompleteに理由を返す(黙って成功扱いにしない)。
  */
@@ -129,7 +135,6 @@ async function snapshotPom(snapshot, pomPath, context) {
         return { ok: false, reason: capitalizeReason(copied.message), kind: "unreadable" };
     const first = { ok: true, path: copied.path };
     const partial = (reason) => ({ ...first, incomplete: reason });
-    const restricted = context.allowedRootReal !== undefined;
     let current = pomPath;
     let currentCopy = first.path;
     for (let depth = 0; depth < MAX_PARENT_DEPTH; depth++) {
@@ -137,17 +142,13 @@ async function snapshotPom(snapshot, pomPath, context) {
         if (relativePath === null || relativePath === "")
             return first;
         if (relativePath === undefined) {
-            return restricted
-                ? { ok: false, reason: UNPARSEABLE, kind: "unreadable" }
-                : partial("The parent POM reference cannot be interpreted with certainty, so the file was scanned without its parent POM. Dependencies inherited from the parent may be missing from the results");
+            return { ok: false, reason: UNPARSEABLE, kind: "unreadable" };
         }
         // Goのfilepath.Joinと同じ規則で結合する(絶対パスも連結し、..はルートで止まる)
         const inCopy = path.join(path.dirname(currentCopy), relativePath);
         if (!isInsideDir(snapshot.treeRoot, inCopy)) {
             // ..を重ねるとスナップショットの外(本物のファイルシステム)に届くため、コピーではなく元のファイルが読まれる
-            return restricted
-                ? { ok: false, reason: `The parent POM reference (relativePath: ${relativePath}) leads outside the scan scope, so the file was excluded from the scan`, kind: "outside_allowed_root" }
-                : first;
+            return { ok: false, reason: `The parent POM reference (relativePath: ${relativePath}) leads outside the scan scope, so the file was excluded from the scan`, kind: escapeKind(context) };
         }
         let candidate = path.join(path.dirname(current), relativePath);
         try {
@@ -180,9 +181,35 @@ async function snapshotPom(snapshot, pomPath, context) {
         current = candidate;
         currentCopy = parent.path;
     }
-    return restricted
-        ? { ok: false, reason: `The parent POM chain exceeds the limit (${MAX_PARENT_DEPTH} levels)`, kind: "unreadable" }
-        : partial(`The parent POM chain exceeds the limit (${MAX_PARENT_DEPTH} levels), so parents beyond it were not included in the scan`);
+    return { ok: false, reason: `The parent POM chain exceeds the limit (${MAX_PARENT_DEPTH} levels)`, kind: "unreadable" };
+}
+/**
+ * スナップショットの外に出る参照の除外の種類。許可ルート未設定時は「許可ルートの外」ではないため、
+ * 全件が除外されたときのエラーをpath_outside_allowed_rootではなくno_manifest_foundにする
+ */
+function escapeKind(context) {
+    return context.allowedRootReal !== undefined ? "outside_allowed_root" : "unreadable";
+}
+/** Check the final scanner-visible graph, independently of the now-mutable source files. */
+async function validateCopiedPom(snapshot, copyPath, context) {
+    let current = copyPath;
+    for (let depth = 0; depth < MAX_PARENT_DEPTH; depth++) {
+        const relativePath = await snapshot.parentOf(current);
+        if (relativePath === null || relativePath === "")
+            return null;
+        if (relativePath === undefined)
+            return { reason: UNPARSEABLE, kind: "unreadable" };
+        let parent = path.join(path.dirname(current), relativePath);
+        if (!isInsideDir(snapshot.treeRoot, parent)) {
+            return { reason: "The copied parent POM chain leads outside the scan scope, so the file was excluded from the scan", kind: escapeKind(context) };
+        }
+        if (!snapshot.hasCopy(parent))
+            parent = path.join(parent, "pom.xml");
+        if (!snapshot.hasCopy(parent))
+            return null;
+        current = parent;
+    }
+    return { reason: `The parent POM chain exceeds the limit (${MAX_PARENT_DEPTH} levels)`, kind: "unreadable" };
 }
 /**
  * 検出済みのマニフェストをスナップショットへコピーし、osv-scannerに渡す対象(コピー)を返す。
@@ -190,6 +217,7 @@ async function snapshotPom(snapshot, pomPath, context) {
  */
 export async function snapshotManifests(snapshot, targets, context) {
     const copies = [];
+    const copiedPoms = [];
     const skipped = [];
     const incomplete = [];
     for (const target of targets) {
@@ -197,6 +225,7 @@ export async function snapshotManifests(snapshot, targets, context) {
             const result = await snapshotPom(snapshot, target.path, context);
             if (result.ok) {
                 copies.push({ path: result.path, format: target.format });
+                copiedPoms.push({ original: target.path, copy: result.path });
                 if (result.incomplete !== undefined)
                     incomplete.push({ path: target.path, reason: result.incomplete });
             }
@@ -211,5 +240,20 @@ export async function snapshotManifests(snapshot, targets, context) {
         else
             skipped.push({ path: target.path, reason: capitalizeReason(result.message), kind: "unreadable" });
     }
-    return { targets: copies, skipped, incomplete };
+    // A later target may populate a parent path that was absent during an earlier check.
+    const rejectedCopies = new Set();
+    const rejectedOriginals = new Set();
+    for (const { original, copy } of copiedPoms) {
+        const failure = await validateCopiedPom(snapshot, copy, context);
+        if (failure === null)
+            continue;
+        skipped.push({ path: original, ...failure });
+        rejectedCopies.add(copy);
+        rejectedOriginals.add(original);
+    }
+    return {
+        targets: copies.filter((target) => !rejectedCopies.has(target.path)),
+        skipped,
+        incomplete: incomplete.filter((item) => !rejectedOriginals.has(item.path)),
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osv-scanner-mcp",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "MCP server that wraps Google's OSV-Scanner to scan Java projects for known vulnerabilities",
   "type": "module",
   "license": "Apache-2.0",