osv-scanner-mcp 0.15.0 → 0.17.0

package/README.md

@@ -7,22 +7,36 @@
 
 An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-scanner). Ask an MCP client such as Claude to "check this project for vulnerabilities", and it returns the known vulnerabilities (CVE / GHSA) in your dependencies as a report sorted by severity, together with recommended upgrades.
 
-> **Status**: [Published on npm](https://www.npmjs.com/package/osv-scanner-mcp) (`npx -y osv-scanner-mcp`). Supports lockfiles and manifests for Java (Maven / Gradle), JavaScript (npm / yarn / pnpm / bun), Python (Poetry / uv / Pipenv / PDM / requirements.txt), Go, and Rust (`Cargo.lock`), with upgrade recommendations for Maven, npm, PyPI, Go, and crates.io. Setup instructions are provided for Claude Code, Claude Desktop, Codex CLI, Antigravity, and VS Code (GitHub Copilot).
+> **Status**: [Published on npm](https://www.npmjs.com/package/osv-scanner-mcp) (`npx -y osv-scanner-mcp`). Supports lockfiles and manifests for Java (Maven / Gradle), JavaScript (npm / yarn / pnpm / bun), Python (Poetry / uv / Pipenv / PDM / requirements.txt), Go, Rust (`Cargo.lock`), and .NET (NuGet: `packages.lock.json`, `obj/project.assets.json`, `packages.config`, `*.deps.json`, and project files), and PHP (Composer: `composer.lock`), with upgrade recommendations for Maven, npm, PyPI, Go, crates.io, and Packagist. Setup instructions are provided for Claude Code, Claude Desktop, Codex CLI, Antigravity, and VS Code (GitHub Copilot).
 
 ## Features
 
-- **One-shot multi-language scan**: Pass a project path to `scan_project`, and it detects and scans the Java, JavaScript, Python, Go, and Rust lockfiles in the project together. Dependencies that could not be scanned (for example, a manifest without a lockfile or an unpinned requirement) are reported up front in `coverage`
-- **Upgrade recommendations**: `suggest_fix` recommends, for each vulnerable package, the upgrade closest to the current release line that addresses its fix targets, for Maven, npm, PyPI, Go, and Rust (crates.io). Known unfixed and informational advisories remain visible. The recommended version is also checked against the OSV database for additional fix-target vulnerabilities
+- **PHP / Composer (source checkout)**: `scan_project` scans `composer.lock`, including both `packages` and `packages-dev`, as Packagist packages. `suggest_fix` recommends release versions and checks candidates against OSV. Composer and PHP code are never executed. See [Composer support](#composer-support).
+- **One-shot multi-language scan**: Pass a project path to `scan_project`, and it detects and scans the Java, JavaScript, Python, Go, Rust, .NET, and PHP lockfiles in the project together. Dependencies that could not be scanned (for example, a manifest without a lockfile or an unpinned requirement) are reported up front in `coverage`
+- **Upgrade recommendations**: `suggest_fix` recommends, for each vulnerable package, the upgrade closest to the current release line that addresses its fix targets, for Maven, npm, PyPI, Go, Rust (crates.io), and PHP (Packagist). Known unfixed and informational advisories remain visible. The recommended version is also checked against the OSV database for additional fix-target vulnerabilities
 - **Rust without false positives**: For `Cargo.lock`, only crates from crates.io are scanned. Your own workspace crates, git dependencies, and crates from private registries are not looked up as crates.io crates (OSV-Scanner alone would match them by name, and send their names to the OSV API). RustSec notices about unmaintained or unsound crates are labeled `informational` and counted apart from vulnerabilities
-- **Direct and transitive dependencies**: Packages are marked as direct or transitive dependencies (from `package-lock.json`, `go.mod`, `requirements.txt`, and `pom.xml`), and update hints are tailored accordingly, for example by naming the direct dependency that pulls in a transitive one
+- **.NET without guessing versions**: Each project file is matched to its own lockfile or `obj/project.assets.json`. Without one, only its direct `PackageReference` items are scanned, and a `Version="x"` (which means x or higher) is reported as a lower bound. References whose version cannot be known without running MSBuild (properties, conditions, floating versions, `Update` / `Remove`) are listed instead of being looked up: OSV treats an unparsable version as older than every release and would report every vulnerability for it
+- **Direct and transitive dependencies**: Packages are marked as direct or transitive dependencies (from `package-lock.json`, `go.mod`, `requirements.txt`, `pom.xml`, `Cargo.lock`, and the .NET files), and update hints are tailored accordingly, for example by naming the direct dependency that pulls in a transitive one
 - **Java project scan**: `scan_java_project` scans only the Java (Maven / Gradle) manifests and returns a formatted report
 - **JAR/WAR scan**: `scan_java_artifact` detects known vulnerabilities from the metadata inside JAR/WAR archives, for projects without a lockfile or with only shaded/fat JARs (best-effort identification, stated explicitly in `coverage`)
 - **SBOM scan**: `scan_sbom` checks the dependencies recorded in a CycloneDX/SPDX JSON SBOM. It states explicitly that the SBOM's completeness and its match with the actual artifacts are not verified
 - **Scan history (opt-in)**: With `OSV_MCP_HISTORY=1`, each scan is recorded locally, and `scan_history` lists past runs and shows what changed since the previous run (new and resolved vulnerabilities, version changes, coverage changes)
 - **Severity-sorted reports**: Vulnerabilities are grouped by package and sorted by CVSS score, with five severity labels (critical / high / medium / low / unknown) and summary counts
-- **Fixed versions**: Each vulnerability includes `fixed_versions`, sorted correctly by Maven version precedence (including non-semver forms such as `2.17.1-RELEASE`), Semantic Versioning precedence for npm, Go, and Rust, and PEP 440 for PyPI
+- **Fixed versions**: Each vulnerability includes `fixed_versions`, sorted correctly by Maven version precedence (including non-semver forms such as `2.17.1-RELEASE`), Semantic Versioning precedence for npm, Go, and Rust, PEP 440 for PyPI, and Composer ordering for Packagist
 - **Security first**: No shell execution, a fixed argument allowlist, path normalization and boundary checks, scanning private copies instead of the original files, and timeouts and output size limits are built in
 
+## Composer support
+
+Pass a project directory, `composer.lock`, or `composer.json` to `scan_project` or `suggest_fix`. The lockfile records both direct and transitive dependencies; their relationship is currently reported as `unknown`. A `composer.json` without a lockfile in the same directory is reported as missing/unconfirmed in `coverage.lockfile_missing` (a project with no scannable files returns `no_manifest_found`). An ancestor's lockfile does not establish coverage for an independent child project. `vendor` directories are not traversed.
+
+The server reads each lockfile safely and scans a private sanitized copy containing only package names and release versions. Repository URLs, dist/source commit references, scripts, and credentials are not passed to OSV-Scanner. Both production and development packages are included. JSON is limited to 16 MiB per lockfile and 64 MiB per scan, with structural work limits. Invalid JSON is excluded; invalid entries and unsupported versions are omitted and reported in `skipped_files`, making `coverage.complete` false.
+
+Composer version comparison supports classical numeric releases with one to four components, an optional `v` prefix, and alpha/beta/RC/stable/patch suffixes (including their short forms). Branch/dev versions, aliases, and other formats such as date-based tags are not evaluated. An advisory with unsupported version boundaries cannot establish a verified fix. Upgrade tiers follow the existing cautious 0.x rules; they do not guarantee compatibility with your constraints or PHP runtime. Update the applicable constraints in `composer.json` and regenerate the lockfile in a trusted environment; check PHP and extension requirements first. The server does not run Composer or change project files.
+
+Packages with `dist.type: "path"` are local code: they are excluded before building scanner input, so neither their names nor versions are sent to OSV. They are your own code, so they are counted in `coverage.local_composer_packages` (like `local_crates` and `local_projects`) and do not make `coverage.complete` false; their own dependencies are listed in `composer.lock` and scanned. This applies to both production and development dependencies, even when a local package uses the same name and release version as a public package.
+
+**Privacy:** other private Composer package names and versions are also sent to `api.osv.dev`. A lockfile alone cannot establish whether a non-path package comes from public Packagist; same-name private packages and VCS forks can produce false positives. `coverage.composer_warnings` warns when scanned entries lack the standard `notification-url` (`https://packagist.org/downloads/`); this is a heuristic, not proof of origin. `coverage.complete` describes inspected dependency entries, not the lockfile's freshness or its match with `composer.json`, and does not verify the PHP runtime or extensions.
+
 ## Requirements
 
 - Node.js >= 20.19 (development: Node.js 26.12.1, as specified in `.node-version`)
@@ -162,6 +176,7 @@ As an additional layer of defense, you can limit what the server can read and wr
         "--allow-fs-write=/private/var/folders/xx/yyyy/T",
         "--allow-fs-read=/opt/homebrew/bin/osv-scanner",
         "--allow-child-process",
+        "--allow-addons",
         "/path/to/OSV-Scanner-MCP/dist/index.js"
       ],
       "env": {
@@ -178,6 +193,7 @@ As an additional layer of defense, you can limit what the server can read and wr
 - If you use the automatic download, also allow reading and writing the cache (`$XDG_CACHE_HOME/osv-scanner-mcp`, by default `~/.cache/osv-scanner-mcp`). Otherwise, set `OSV_SCANNER_PATH`
 - If you enable the scan history (`OSV_MCP_HISTORY=1`), also allow reading and writing the history directory (`OSV_MCP_HISTORY_DIR`, or the default under `~/.local/state`). The server warns at startup if it is not allowed
 - `--allow-child-process` is required to run osv-scanner. **osv-scanner runs as a child process and is not restricted by the permission model** (Node itself warns that this flag weakens the permission model). The impact is limited because osv-scanner only receives verified private copies, but use an OS-level mechanism such as a container if you need stronger isolation
+- On macOS and Windows, `--allow-addons` is also required for the trusted Koffi native binding used to verify the path of an open file handle. Native code is outside Node's permission sandbox. On Linux, use `--allow-fs-read=/proc/self/fd` instead; `/proc` must be mounted. If the OS cannot verify the opened object, boundary-protected reads fail closed. Keep OS-level isolation when scanning in a stronger sandbox.
 - If a required permission is missing, the server prints a warning to stderr at startup, and scans return `permission_denied` (naming the missing permission and the path)
 
 ### Network destinations and privacy
@@ -188,7 +204,7 @@ Destinations confirmed with osv-scanner v2.4.0 (2026-10-07) and v2.7.0, the pinn
 |---|---|---|
 | Scanning `pom.xml` (`scan_project` / `scan_java_project` / `suggest_fix`) | `api.osv.dev`, **`api.deps.dev`** | Package names and versions. To resolve transitive dependencies, the names and versions of the dependencies declared in `pom.xml` (including internal packages) are sent to deps.dev |
 | Scanning `requirements.txt` (`scan_project` / `suggest_fix`) | `api.osv.dev`, **`api.deps.dev`** | As with `pom.xml`, the names and versions of the listed dependencies are sent to deps.dev to resolve transitive dependencies. Package indexes given with `--index-url` and similar options are not contacted |
-| Scanning lockfiles (`gradle.lockfile`, npm lockfiles such as `package-lock.json`, Python lockfiles such as `poetry.lock`, `go.mod`, `Cargo.lock`) | `api.osv.dev` | Package names and versions (lockfiles already list every dependency, so nothing is resolved remotely). For `Cargo.lock`, only crates from crates.io are sent: the names of your own crates, git dependencies, and private-registry crates are not sent (confirmed 2026-10-11). **Git dependencies in npm lockfiles** (`package-lock.json`, `yarn.lock`, and so on) are looked up by their repository URL (ecosystem `GIT`) and commit, so the host name and path of a private git repository (for example `https://git.example.com/team/repo`) are sent (since osv-scanner 2.6.0) |
+| Scanning lockfiles (`gradle.lockfile`, npm lockfiles such as `package-lock.json`, Python lockfiles such as `poetry.lock`, `go.mod`, `Cargo.lock`) | `api.osv.dev` | Package names and versions (lockfiles already list every dependency, so nothing is resolved remotely). For `Cargo.lock`, only crates from crates.io are sent: the names of your own crates, git dependencies, and private-registry crates are not sent (confirmed 2026-10-11). **For .NET, packages from private NuGet feeds are sent as well**: lockfiles do not record which feed a package came from, so they cannot be told apart (a `nuget.config` in the scanned directory that lists other sources adds a warning to `coverage.nuget_warnings`). The names of your own projects (`type: project` and so on) are not sent. **Git dependencies in npm lockfiles** (`package-lock.json`, `yarn.lock`, and so on) are looked up by their repository URL (ecosystem `GIT`) and commit, so the host name and path of a private git repository (for example `https://git.example.com/team/repo`) are sent (since osv-scanner 2.6.0) |
 | `scan_java_artifact` / `scan_sbom` | `api.osv.dev` | Names and versions of the identified packages |
 | `suggest_fix` checking recommended versions | `api.osv.dev` | The names of packages with a recommendation (already sent during the scan) and the candidate versions (published fixed versions). Disable with `OSV_MCP_NO_CANDIDATE_CHECK=1` |
 | `explain_vulnerability` | `api.osv.dev` | The vulnerability ID |
@@ -203,7 +219,7 @@ Both api.osv.dev and deps.dev are operated by Google. **In every configuration,
 
 ### `scan_project`
 
-Detects the lockfiles and manifests in a project and scans the Java / JavaScript / Python / Go / Rust dependencies together. Package managers and builds are never run.
+Detects the lockfiles and manifests in a project and scans the Java / JavaScript / Python / Go / Rust / .NET / PHP dependencies together. Package managers and builds are never run.
 
 **Input**
 
@@ -220,13 +236,25 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
 | Python (PyPI) | `poetry.lock`, `uv.lock`, `Pipfile.lock`, `pdm.lock`, `requirements.txt` (and variants such as `requirements-dev.txt`) |
 | Go | `go.mod` |
 | Rust (crates.io) | `Cargo.lock` (lockfile versions 1 to 4) |
+| .NET (NuGet) | `packages.lock.json` / `packages.<project>.lock.json`, `obj/project.assets.json`, `packages.config` / `packages.<project>.config`, `*.deps.json`, and `*.csproj` / `*.fsproj` / `*.vbproj` (direct references only, when no lockfile matches) |
+| PHP (Packagist) | `composer.lock` (`packages` and `packages-dev`; see [Composer support](#composer-support)) |
 
-`.git`, `node_modules`, `target`, `build`, `.idea`, `.vscode`, `.venv`, `venv`, `site-packages`, `__pycache__`, `.tox`, `vendor`, `.cargo`, and symbolic links are not searched. Only the detected files are passed to OSV-Scanner, each with its format given explicitly (`coverage.manifests` in the response is exactly the scan scope). The search limits are the same as for `scan_java_project`.
+`.git`, `node_modules`, `target`, `build`, `.idea`, `.vscode`, `.venv`, `venv`, `site-packages`, `__pycache__`, `.tox`, `vendor`, `.cargo`, `bin` and `obj` in a directory that contains a .NET project file (build output of that project), and symbolic links are not searched. Only the detected files are passed to OSV-Scanner, each with its format given explicitly (`coverage.manifests` in the response is exactly the scan scope). The search limits are the same as for `scan_java_project`.
 
 **`requirements.txt` files are not passed to OSV-Scanner as they are.** The server parses them, rewrites only the dependency lines it can interpret into simple forms such as `name==version`, and scans a private temporary copy (deleted after the scan). OSV-Scanner interprets include directives on its own (it even treats `- r ../x.txt`, with a space, as an include and reads files outside the scan scope), so the copy never contains include directives or options. Includes (`-r` / `--requirement`) are expanded by the server, and only when the included file is inside the project directory.
 
 **`Cargo.lock` files are not passed to OSV-Scanner as they are either.** OSV-Scanner (v2.4.0 and v2.7.0) ignores where each package comes from and looks every package up as a crates.io crate, so a workspace crate, a git fork, or a private-registry crate with the same name and version as a vulnerable crates.io crate is reported as vulnerable, and its name is sent to the OSV API. The server parses `Cargo.lock` and scans a private copy that lists only the packages whose source is crates.io (`registry+https://github.com/rust-lang/crates.io-index` or `sparse+https://index.crates.io/`), like `cargo audit`. Packages replaced with `[replace]` are not scanned, because they are not used (the replacement is classified by its own source). The parser accepts only what Cargo writes; if a `Cargo.lock` contains anything else, the whole file is excluded and listed in `skipped_files` instead of being scanned partially. Cargo is never run.
 
+**.NET files are not passed to OSV-Scanner as they are either.** OSV-Scanner (v2.7.0) looks the project's own projects in `*.deps.json` up as NuGet packages, and passes `.csproj` versions such as `$(Version)` or `[1.0,2.0)` to OSV as they are; OSV treats a version it cannot parse as older than every release, so every known vulnerability of the package is reported (confirmed 2026-10-23). The server parses every .NET file and scans a private copy in `packages.lock.json` format that lists only the packages it can look up. Neither `dotnet restore` nor MSBuild is run, and project files are never evaluated.
+
+- **Matching per project file.** For each `*.csproj` / `*.fsproj` / `*.vbproj`, the first source confirmed to belong to it is used: `packages.<project>.lock.json`; `packages.lock.json` only when the directory has a single project file; neither, when the project sets `NuGetLockFilePath`; `packages.<project>.config` or `packages.config` under the same rule; then `obj/project.assets.json`, only when its `project.restore.projectPath` names this project file (projects in one directory share `obj`). A lockfile that cannot be matched to a project is still scanned, but no project counts as covered by it
+- **Projects without a matching source** (including projects with no `PackageReference` of their own, since `Directory.Build.props` or the SDK can add references) are scanned from their direct `PackageReference` items only, and listed in `lockfile_missing` with `status: "direct_only"` (or `"unconfirmed"` when a lockfile exists but cannot be matched). Transitive dependencies are not scanned, so `complete` is `false`. Enable `RestorePackagesWithLockFile` to scan them
+- **`PackageReference` versions.** `[x]` is looked up as x. `x`, `[x,)`, and `[x,y)` mean x or higher (NuGet prefers the lowest available version, which may be above x), so they are looked up at x and the packages are marked `version_is_lower_bound: true`. A lower bound that is excluded or missing, `$(...)`, `*`, and a missing version (central package management) are not looked up
+- **References that might not apply are not looked up**: a `Condition` on the reference, its `ItemGroup`, or its `Version`; references inside `Choose` or `Target`; names that also have `Update` or `Remove` in the file, or in a `Directory.Build.props` / `Directory.Build.targets` in the scanned directory; names included more than once; and `VersionOverride`. They are listed in `unresolved_package_references` with the reason
+- **Runtime packs** of self-contained apps in `*.deps.json` are looked up under their package names (the SDK writes them as `runtimepack.<name>`, which OSV does not match)
+- **Not looked up from restore results**: entries of an unknown type, and versions that are not plain NuGet versions (listed in `unscannable_nuget_packages`). Your own projects are counted in `local_projects`
+- XML (project files, `packages.config`, `nuget.config`) is read by a small parser that rejects `DOCTYPE`, entity declarations, and CDATA. JSON files use the same structural checks as the npm lockfiles (16 MiB per file). Up to 200,000 packages and 1,000 .NET files are looked up per scan; files beyond the limit are listed in `skipped_files`. A character reference that is not a valid character (such as `&#x110000;`) makes the file uninterpretable instead of failing the scan
+
 **`package-lock.json` copies get a `resolved` URL where it is missing.** osv-scanner 2.7.0 treats entries without `resolved` as local packages and does not look them up, which would silently skip bundled dependencies (`inBundle`) and registry packages in lockfiles generated with npm's `omit-lockfile-registry-resolved=true`. The private copy that is scanned gets a public-registry URL for those entries (entries under `node_modules/` that are not links and have a plain version, and aliases such as `npm:lodash@4.17.20` in lockfile version 1), so they are looked up as before; the original file is not changed.
 
 **npm JSON limits:** Normalization of `package-lock.json` and `npm-shrinkwrap.json` is limited to 16 MiB per file and 64 MiB per scan, for both input and output. Before parsing, JSON nesting is limited to 128 levels and structural markers (containers, commas, and colons outside strings) to 1,000,000 per file and 2,000,000 per analysis phase. Changed copies use compact JSON, with their size checked before serialization. A lockfile that exceeds these limits is scanned as it is, without filling in `resolved` (OSV-Scanner parses large lockfiles itself; the limits only bound this server's own parsing and rewriting), and it is listed in `coverage.skipped_files` with the reason, so `complete` is `false`: entries without `resolved` in it may not have been looked up. Workspace membership and dependency-relation lookups use the same structural checks and remain unconfirmed or unknown when limits are reached.
@@ -268,6 +296,7 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
   - `unscannable_requirements`: lines that are not scanned, with the reason: `-e`, `name @ URL`, paths, includes that were not expanded (outside the project directory, missing, URLs, or over the limits), constraint files (`-c`, not applied), and options or version specifiers that cannot be interpreted. Lines that cannot be interpreted are recorded here instead of being ignored
   - `local_crates` (only when a `Cargo.lock` was scanned): the number of crates without a source in `Cargo.lock` (workspace members and path dependencies). They are your own code and are not scanned; they do not make `complete` false. A third-party crate vendored as a path dependency is not scanned either (as with `cargo audit`)
   - `unscannable_crates` (only when a `Cargo.lock` was scanned): git dependencies (their versions do not correspond to crates.io releases) and crates from registries other than crates.io (a crate with the same name on crates.io may be a different crate). They are not scanned, so `complete` is false. Source URLs are not included in the response
+  - `local_projects`, `unscannable_nuget_packages`, `unresolved_package_references`, `nuget_warnings` (only when a .NET file was found): see the .NET notes above. `nuget_warnings` notes lower bounds, a possibly stale `project.assets.json` (more than a minute older than its project file; smaller differences are ignored because a clone writes files in any order), references that cannot be checked from project files alone (SDK-implicit references and `Directory.Build.*` outside the scanned directory), and package sources other than nuget.org. Entries in `unscannable_nuget_packages` and `unresolved_package_references` make `complete` false
   - `skipped_files`: files excluded from the scan, with the reason (a `Cargo.lock` that cannot be interpreted with certainty, a `requirements.txt` that cannot be read or is larger than 1 MiB, or a `pom.xml` whose parent POM chain references a file outside the allowed root). A `pom.xml` scanned without its parent POM, because the parent could not be read, is also listed here with the reason (see [Parent POMs](#parent-poms))
   - Each list holds up to 200 entries; the number of omitted entries is returned in `omitted_items`
 - `ecosystem_breakdown` includes ecosystems with zero findings, to show that they were scanned
@@ -278,9 +307,10 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
   - `requirements.txt`: dependencies written in the file are direct; dependencies resolved through deps.dev are transitive
   - `pom.xml`: OSV-Scanner reports the dependencies declared in `pom.xml` (and its parent POMs) and the transitive dependencies resolved through deps.dev as separate results (`source.type` `lockfile` / `unknown`), and this split is used (so parent POMs, profiles, properties, and dependency management are interpreted exactly as OSV-Scanner does). `introduced_by` / `declared_in` are not available. This relies on undocumented OSV-Scanner output, so anything unexpected is reported as `unknown`
   - `Cargo.lock`: crates.io dependencies immediately required by a local/workspace/path crate are direct; crates.io dependencies reachable through them (including git and alternate-registry origins) are transitive. `introduced_by` names the first direct dependency on each path. References are resolved by exact name, version, and source where provided; ambiguous references are not guessed. Replacements are followed. `declared_in` lists project-relative Cargo.toml paths only when every declaring crate has a unique matching manifest. Otherwise `declaring_crates` names the unmapped declaring crates (up to 10, with the rest in `declaring_crates_omitted`). Dev/build/target-specific distinctions are unavailable. Traversal over 2,000,000 edges returns `unknown`
+  - .NET: `Direct` / `Transitive` in `packages.lock.json`; the dependencies of `project.frameworks` in `project.assets.json`; the dependencies of the project library in `*.deps.json`; and every reference read from a project file are direct. `packages.config` does not say, so it is `unknown`. `introduced_by` and `declared_in` are not available yet
   - Other formats (`gradle.lockfile`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, and `pdm.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
 - `dependency_groups` is the raw dependency group reported by OSV-Scanner (for example `dev`). It is missing or inaccurate for some lockfile formats (absent for pnpm, `optional` for pdm, and so on), so treat it as informational
-- Upgrade recommendations (`suggest_fix`) are available for Maven, npm, PyPI, Go, and Rust (crates.io)
+- Upgrade recommendations (`suggest_fix`) are available for Maven, npm, PyPI, Go, Rust (crates.io), and PHP (Packagist). NuGet packages are returned with `verification: "unsupported_ecosystem"` for now
 
 ### `scan_java_project`
 
@@ -345,7 +375,7 @@ If an existing parent POM cannot be read (larger than 10 MiB, not a regular file
 ```
 
 - `packages` is sorted by the most severe vulnerability, and each `vulnerabilities` list by severity (unknown last)
-- `fixed_versions` lists the fixed versions recorded in OSV, in ascending order: by Maven precedence for Maven, Semantic Versioning precedence for npm, Go, and Rust (values that are not valid SemVer come last), and PEP 440 for PyPI (in the order listed by OSV up to v0.5.0); other ecosystems keep the order listed by OSV (the order is not guaranteed). Several release lines may be mixed (for example a 2.12 backport and the 2.15 line). Pre-releases (`5.0.0-beta.3`) and Go pseudo-versions (`0.0.0-20180925071336-cf3bd585ca2a`) may be included. An empty array means that OSV lists no fixed version. Up to v0.4.1, this was always empty for packages outside Maven
+- `fixed_versions` lists the fixed versions recorded in OSV, in ascending order: by Maven precedence for Maven, Semantic Versioning precedence for npm, Go, and Rust (values that are not valid SemVer come last), PEP 440 for PyPI (in the order listed by OSV up to v0.5.0), and Composer ordering for Packagist (since v0.17.0); other ecosystems keep the order listed by OSV (the order is not guaranteed). Several release lines may be mixed (for example a 2.12 backport and the 2.15 line). Pre-releases (`5.0.0-beta.3`) and Go pseudo-versions (`0.0.0-20180925071336-cf3bd585ca2a`) may be included. An empty array means that OSV lists no fixed version. Up to v0.4.1, this was always empty for packages outside Maven
 - Vulnerabilities without a severity score are reported as `null` / `"unknown"`
 
 ### `scan_java_artifact`
@@ -402,7 +432,7 @@ Invalid JSON returns `invalid_sbom`, an unsupported format `unsupported_sbom_for
 
 ### `suggest_fix`
 
-Runs the same detection and scan as `scan_project` and recommends an **upgrade version** for each vulnerable package. Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, and Rust (crates.io). Instead of simply taking the highest fixed version, it picks the fixed version closest to the current release line, falling back through three tiers:
+Runs the same detection and scan as `scan_project` and recommends an **upgrade version** for each vulnerable package. Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, Rust (crates.io), and PHP (Packagist / Composer). Instead of simply taking the highest fixed version, it picks the fixed version closest to the current release line, falling back through three tiers:
 
 | Tier | Meaning |
 |---|---|
@@ -575,7 +605,7 @@ The following measures keep the vulnerability scanner itself from becoming an at
 - **Supply chain**: The automatic download is limited to the official GitHub Releases and a pinned version, and is verified against **a SHA256 checksum embedded in the package** (the SHA256SUMS file from the release is not trusted, so tampering on the release side is detected). The binary is not made executable until it passes verification, and cached binaries are verified again on every use. `OSV_MCP_PREFER_DOWNLOAD=1` avoids unverified binaries on `PATH`
 - **Command injection**: Commands are run with `spawn` and an argument array, never through a shell. OSV-Scanner receives only a fixed list of arguments, plus verified absolute paths
 - **Snapshots (no gap between checking and reading)**: OSV-Scanner never receives the original files. Lockfiles, `pom.xml` (including the parent POM chain), and JAR/WARs are read safely once, copied into a private temporary directory (accessible only by the owner, deleted afterwards), and the copies are both checked and scanned. Replacing the original files or directories after the check has no effect on the results. Parent POMs are copied into the temporary directory at their original relative positions, so OSV-Scanner can follow relative paths but only finds the verified copies (references that climb out of the temporary directory with repeated `..` are excluded). Reads refuse a symbolic link at the final path component and anything that is not a regular file (so named pipes cannot stall the server), and afterwards the path is resolved again to confirm that it is still inside the boundary and is the same file that was opened. The copies are limited to 2 GiB in total (`scan_input_too_large`). When the server is terminated (SIGTERM/SIGINT/SIGHUP, or stdin closing), the temporary directories are deleted and running OSV-Scanner processes are stopped. Directories left behind by an uncatchable termination such as SIGKILL are deleted at a later startup (only directories whose names exactly match this server's prefixes, owned by the current user, not symbolic links, and unmodified for 24 hours or more)
-- **Path traversal**: Input paths are resolved with `realpath` (following symbolic links) before the boundary check. Manifest searches do not follow symbolic links. OSV-Scanner never receives a directory, only the detected manifests, each with its format given explicitly (given a directory, OSV-Scanner also reads `requirements.txt` files there and follows their `-r ../x.txt` includes outside the scan scope). `requirements.txt` files are not passed as they are: only the dependency lines the server could interpret are normalized and written to a private copy without any include directives, so even if OSV-Scanner's interpretation of includes differs from the server's, files outside the scope are never read. `Cargo.lock` files are likewise replaced by a copy the server writes, listing only crates.io packages A `pom.xml` whose parent POM chain references a file outside `OSV_MCP_ALLOWED_ROOT` is excluded ([Parent POMs](#parent-poms))
+- **Path traversal**: Input paths are resolved with `realpath` (following symbolic links) before the boundary check. Manifest searches do not follow symbolic links. OSV-Scanner never receives a directory, only the detected manifests, each with its format given explicitly (given a directory, OSV-Scanner also reads `requirements.txt` files there and follows their `-r ../x.txt` includes outside the scan scope). `requirements.txt` files are not passed as they are: only the dependency lines the server could interpret are normalized and written to a private copy without any include directives, so even if OSV-Scanner's interpretation of includes differs from the server's, files outside the scope are never read. `Cargo.lock` files are likewise replaced by a copy the server writes, listing only crates.io packages, and every .NET file by a `packages.lock.json` copy listing only packages with a known version. A `pom.xml` whose parent POM chain references a file outside `OSV_MCP_ALLOWED_ROOT` is excluded ([Parent POMs](#parent-poms))
 - **Denial of service**: Timeouts and limits on stdout and on the stderr excerpt. Scanner output is parsed defensively and malformed output does not throw. The number of concurrent scans is limited (2 by default) so that parallel requests cannot start unlimited processes. The server's own analysis reads each file once and reuses the result (lockfiles for npm workspace membership, `Cargo.lock` files, shared `requirements.txt` includes, parent POMs), with a limit on the total amount read. Responses do not include the internal affected-range data, which keeps large scans to a fraction of their former size
 - **Fail-closed mode**: `OSV_MCP_REQUIRE_ALLOWED_ROOT=1` refuses to start the server when no allowed root is set
 - **Restricted permissions (optional)**: The server works under Node's permission model, reports denied access as `permission_denied`, and warns about missing permissions at startup ([Running with restricted permissions](#running-with-restricted-permissions))
@@ -613,6 +643,9 @@ Design notes and open items are in [docs/DESIGN_TODO.md](docs/DESIGN_TODO.md) (i
 - [x] `scan_project` for Rust (`Cargo.lock`, crates.io crates only) and RustSec informational advisories
 - [x] `suggest_fix` and direct/transitive dependencies for Rust
 - [x] Scan history and changes between runs (`scan_history`, opt-in)
+- [x] `scan_project` for .NET (NuGet), with per-project matching and lower bounds for project files
+- [x] `scan_project` and `suggest_fix` for PHP (Composer `composer.lock`)
+- [ ] `suggest_fix` for .NET (NuGet)
 - [ ] Direct and transitive dependencies for `gradle.lockfile` and the YAML/TOML lockfiles
 
 ## License

package/dist/history/historyRecord.js

@@ -103,7 +103,10 @@ function severityOf(severity) {
         return null;
     return Object.fromEntries(Object.entries(severity).filter(([, v]) => count(v) !== null).slice(0, MAX_SEVERITY_KEYS).map(([k, v]) => [k.slice(0, 32), count(v)]));
 }
-const GAP_FIELDS = ["lockfile_missing", "unpinned_requirements", "unscannable_requirements", "unscannable_crates", "skipped_files", "unidentified_jars", "unidentified_packages"];
+const GAP_FIELDS = [
+    "lockfile_missing", "unpinned_requirements", "unscannable_requirements", "unscannable_crates", "unscannable_nuget_packages",
+    "unresolved_package_references", "skipped_files", "unidentified_jars", "unidentified_packages",
+];
 function gapsOf(payload) {
     const coverage = asRecord(payload.coverage);
     const gaps = {};

package/dist/index.js

@@ -66,7 +66,7 @@ if (startupWarning !== null) {
     }
 }
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
-const SERVER_VERSION = "0.15.0";
+const SERVER_VERSION = "0.17.0";
 const server = new McpServer({
     name: "osv-scanner-mcp",
     version: SERVER_VERSION,
@@ -75,17 +75,22 @@ const historyConfig = historyConfigFromEnv();
 /** スキャンのツールを実行履歴に記録する(OSV_MCP_HISTORYが無効なら何もしない) */
 const recorded = (tool, input, run) => withHistory(tool, input, run, { config: historyConfig, serverVersion: SERVER_VERSION, allowedRootSet: allowedRootFromEnv() !== undefined });
 server.registerTool("scan_project", {
-    title: "Scan project dependencies for vulnerabilities (Java / JavaScript / Python / Go / Rust)",
+    title: "Scan project dependencies for vulnerabilities (Java / JavaScript / Python / Go / Rust / .NET / PHP)",
     description: "Detects the lockfiles and manifests in a project and scans the dependencies for known vulnerabilities (CVE/GHSA). " +
         "Supported: Java (pom.xml / gradle.lockfile), JavaScript (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml / bun.lock), " +
-        "Python (poetry.lock / uv.lock / Pipfile.lock / pdm.lock / requirements.txt), Go (go.mod), Rust (Cargo.lock). " +
+        "Python (poetry.lock / uv.lock / Pipfile.lock / pdm.lock / requirements.txt), Go (go.mod), Rust (Cargo.lock), PHP (composer.lock, including packages-dev), " +
+        ".NET (packages.lock.json / obj/project.assets.json / packages.config / *.deps.json, and the direct PackageReference items of .csproj / .fsproj / .vbproj files without them). " +
         "Package managers and builds are never run. " +
         "Always check coverage at the top of the response: it lists manifests without a lockfile, requirements lines without a pinned version, and excluded files. " +
         "Git dependencies in npm lockfiles are looked up by repository URL, so private git host names and paths are sent to api.osv.dev. " +
         "For Cargo.lock, only crates from crates.io are scanned: the project's own crates are counted in local_crates, and git or private-registry crates are listed in unscannable_crates. " +
+        "For .NET, each project file is matched to its own lockfile or obj/project.assets.json; projects without one are scanned from their direct PackageReference items only (lockfile_missing status direct_only or unconfirmed), " +
+        "a PackageReference Version=\"x\" is looked up at its lower bound (version_is_lower_bound), and references with properties, ranges without a lower bound, floating versions, conditions, or Update/Remove are not looked up (unresolved_package_references). " +
+        "The project's own projects are counted in local_projects. Names of packages from private NuGet feeds are also sent to api.osv.dev; see nuget_warnings. " +
         "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
         "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, and pom.xml; unknown otherwise). " +
-        "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, and Rust. Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
+        "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
+        "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, Rust, and PHP (not yet for .NET). Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
     inputSchema: {
         project_path: z
             .string()
@@ -109,7 +114,8 @@ server.registerTool("scan_java_project", {
 server.registerTool("suggest_fix", {
     title: "Recommend upgrades that fix vulnerabilities",
     description: "Scans the project with the same detection as scan_project and recommends an upgrade version for each vulnerable package. " +
-        "Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, and Rust (crates.io). " +
+        "Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, Rust (crates.io), and PHP (Packagist / Composer). " +
+        "Composer recommendations support classical numeric release versions with up to four components and alpha/beta/RC/patch suffixes; dev branches, aliases, and unsupported version formats are not evaluated. Check PHP/extension constraints and application compatibility before upgrading. " +
         "The fixed version closest to the current release line is chosen with a three-tier fallback " +
         "(same_minor: same release line -> major_internal: same major version -> cross_major: major upgrade), " +
         "and the response gives the recommended version, the upgrade distance (upgrade_tier), and the fixed version per CVE. For npm, Go, PyPI, and Rust, a minor update within 0.x is also cross_major (may include breaking changes). " +

package/dist/osv/binaryManager.js

@@ -1,7 +1,7 @@
 /**
  * OSV-Scannerバイナリの解決(docs/DESIGN_TODO.md 方式C)。
- * MVPでは自動ダウンロードは行わず、「存在チェック → なければ案内メッセージ」で対応する。
- * 探索順: 環境変数 OSV_SCANNER_PATH → PATH上の osv-scanner
+ * 探索順: 環境変数 OSV_SCANNER_PATH → PATH上の osv-scanner → ピン留めした版の自動ダウンロード
+ * (チェックサム検証付き。binaryDownloader.ts)。詳細はresolveOsvScannerBinaryを参照
  */
 import { access, constants, stat } from "node:fs/promises";
 import { isAccessDenied, permissionDeniedError } from "../utils/projectWalk.js";

package/dist/osv/suggestFix.js

@@ -20,6 +20,7 @@ import { candidateStatus } from "./affectedVersions.js";
 import { versionSchemeFor } from "./versionScheme.js";
 const TIER_ORDER = ["same_minor", "major_internal", "cross_major"];
 const UPDATE_HINTS = {
+    Packagist: "Update the applicable constraints in composer.json, then regenerate composer.lock in a trusted environment with composer update vendor/package --with-all-dependencies --no-scripts --no-plugins. For a transitive dependency, update the package that requires it or adjust its constraints. Check PHP and extension requirements and application compatibility before updating; Composer is not executed by this server",
     npm: "For a direct dependency, update the version in package.json. For a transitive dependency, update the direct dependency that requires it, " +
         "or set the version with overrides in the root package.json (effective only in the root project)",
     Go: "Update with go get <module>@<version> (a transitive dependency is added to the require block of go.mod and updated as well). " +

package/dist/osv/versionScheme.js

@@ -12,6 +12,7 @@
 import { compareMavenVersions, mavenVersionSeries } from "../utils/mavenVersion.js";
 import { compareParsedPep440, parsePep440 } from "../utils/pep440Version.js";
 import { compareParsedSemver, parseSemver } from "../utils/semverVersion.js";
+import { compareComposerVersions, parseComposerVersion } from "../utils/composerVersion.js";
 const SEMVER_ECOSYSTEMS = new Set(["npm", "Go", "crates.io"]);
 const MAVEN_SCHEME = {
     isValid: () => true,
@@ -103,8 +104,26 @@ const PEP440_SCHEME = {
         return major === 0n && minor === 0n ? `${epoch}0.0.${patch}` : `${epoch}${major}.${minor}`;
     },
 };
+/** Composer: classical release ordering, with conservative 0.x upgrade tiers. */
+const COMPOSER_SCHEME = {
+    isValid: (v) => parseComposerVersion(v) !== null,
+    compare: compareComposerVersions,
+    isPrerelease: (v) => (parseComposerVersion(v)?.stability ?? 3) < 3,
+    classify(current, candidate) {
+        const a = parseComposerVersion(current), b = parseComposerVersion(candidate);
+        if (!a || !b)
+            return "cross_major";
+        return classifyCaret({ major: a.parts[0], minor: a.parts[1], patch: a.parts[2] }, { major: b.parts[0], minor: b.parts[1], patch: b.parts[2] });
+    },
+    seriesLabel(v) {
+        const parsed = parseComposerVersion(v);
+        return parsed ? `${parsed.parts[0]}.${parsed.parts[1]}` : null;
+    },
+};
 /** 修正版の推奨に対応するエコシステムの操作。未対応ならnull */
 export function versionSchemeFor(ecosystem) {
+    if (ecosystem === "Packagist")
+        return COMPOSER_SCHEME;
     if (ecosystem === "Maven")
         return MAVEN_SCHEME;
     if (SEMVER_ECOSYSTEMS.has(ecosystem))

package/dist/tools/scanProject.js

@@ -1,5 +1,5 @@
 /**
- * `scan_project`ツールのハンドラ: Java / JavaScript / Python / Go / Rustのlockfileをまとめてスキャンする。
+ * `scan_project`ツールのハンドラ: Java / JavaScript / Python / Go / Rust / .NETのlockfileをまとめてスキャンする。
  *
  * 誤要約対策(JAR実体スキャンと同じ原則): スキャンできなかった依存を示すcoverageを件数より前に置き、
  * complete=falseの場合は「検出0件でも安全とは言えない」旨の警告を付ける。
@@ -11,6 +11,7 @@ import { isRemoteResolutionDisabled, runOsvScan } from "../osv/runner.js";
 import { hasVulnerability, packageSources, parseOsvScanOutput } from "../osv/scanReport.js";
 import { combineRelations, cargoLockRelations, goModRelations, npmLockRelations, pomRelations, requirementsRelations, } from "../utils/dependencyRelations.js";
 import { cargoLockCopyContent } from "../utils/cargoLock.js";
+import { nugetKey, nugetLockCopyContent, nugetRelations } from "../utils/nugetFiles.js";
 import { sanitizeExternalText } from "../utils/externalText.js";
 import { readRegularFile } from "../utils/safeRead.js";
 import { detectProject } from "../utils/manifestDetector.js";
@@ -24,7 +25,8 @@ export const TRANSITIVE_OMITTED_WARNING = "Because OSV_MCP_NO_REMOTE_RESOLUTION
     "but vulnerabilities in the transitive dependencies of the dependencies listed directly in pom.xml or requirements.txt are not included. " +
     "Zero findings does not confirm that the transitive dependencies are safe";
 const INCOMPLETE_WARNING = "Some dependencies were not scanned, or were scanned at an assumed version " +
-    "(see lockfile_missing / unpinned_requirements / unscannable_requirements / unscannable_crates / skipped_files). " +
+    "(see lockfile_missing / unpinned_requirements / unscannable_requirements / unscannable_crates / " +
+    "unscannable_nuget_packages / unresolved_package_references / skipped_files). " +
     "Zero findings does not confirm that those dependencies are safe";
 /** coverageの各一覧の上限(巨大なrequirements.txtで応答を膨らませない) */
 const MAX_COVERAGE_ITEMS = 200;
@@ -38,12 +40,17 @@ export function buildCoverage(project) {
     const unscannable = capped(project.requirementReferences);
     const skipped = capped(project.skippedFiles);
     const crates = capped(project.unscannableCrates);
+    const nugetUnscannable = capped(project.unscannableNugetPackages);
+    const nugetUnresolved = capped(project.unresolvedPackageReferences);
     const complete = project.lockfileMissing.length === 0 &&
         project.requirementIssues.length === 0 &&
         project.requirementReferences.length === 0 &&
         project.unscannableCrates.length === 0 &&
+        project.unscannableNugetPackages.length === 0 &&
+        project.unresolvedPackageReferences.length === 0 &&
         project.skippedFiles.length === 0;
-    const omitted = lockfileMissing.omitted + unpinned.omitted + unscannable.omitted + crates.omitted + skipped.omitted;
+    const omitted = lockfileMissing.omitted + unpinned.omitted + unscannable.omitted + crates.omitted + skipped.omitted +
+        nugetUnscannable.omitted + nugetUnresolved.omitted;
     const hasCargo = project.manifests.some((m) => m.format === "Cargo.lock");
     return {
         complete,
@@ -80,7 +87,29 @@ export function buildCoverage(project) {
                 })),
             }
             : {}),
+        // .NET: 従来のエコシステムの応答を変えないよう、.NETのファイルを検出した場合だけ付ける
+        ...(project.hasNuget
+            ? {
+                local_projects: project.localProjectCount,
+                unscannable_nuget_packages: nugetUnscannable.items.map((p) => ({
+                    file: sanitizeExternalText(p.file),
+                    name: sanitizeExternalText(p.name),
+                    version: sanitizeExternalText(p.version),
+                    reason: p.reason,
+                })),
+                unresolved_package_references: nugetUnresolved.items.map((r) => ({
+                    file: sanitizeExternalText(r.file),
+                    name: sanitizeExternalText(r.name),
+                    specifier: sanitizeExternalText(r.specifier),
+                    reason: r.reason,
+                })),
+                ...(project.nugetWarnings.length > 0 ? { nuget_warnings: project.nugetWarnings.map(sanitizeExternalText) } : {}),
+            }
+            : {}),
         skipped_files: skipped.items.map((s) => ({ path: sanitizeExternalText(s.path), reason: sanitizeExternalText(s.reason) })),
+        // Composer: 自分のコード(dist.type=path)は数だけ示し、completeには影響させない(local_crates・local_projectsと同じ)
+        ...(project.manifests.some((m) => m.format === "composer.lock") ? { local_composer_packages: project.composerLocalPackages ?? 0 } : {}),
+        ...((project.composerWarnings?.length ?? 0) > 0 ? { composer_warnings: project.composerWarnings.slice(0, MAX_COVERAGE_ITEMS).map(sanitizeExternalText) } : {}),
         ...(omitted > 0 ? { omitted_items: omitted } : {}),
     };
 }
@@ -101,12 +130,24 @@ function ecosystemBreakdown(project, packages) {
     }
     return breakdown;
 }
-/** `>=X` / `~=X` の行は、osv-scannerが下限Xを使用中の版とみなしてスキャンしている */
+/**
+ * `>=X` / `~=X` の行(requirements.txt)と、`.csproj`の`Version="X"`(X以上)は、下限Xを使用中の版とみなしてスキャンしている。
+ * .NETは同じ名前・版を確定版として照会したファイルもあれば、下限とは示さない
+ */
 export function markLowerBounds(project, packages) {
-    return packages.map((pkg) => pkg.ecosystem === "PyPI" &&
-        project.lowerBounds.some((lb) => lb.name === normalizePypiName(pkg.name) && lb.version === pkg.version)
-        ? { ...pkg, version_is_lower_bound: true }
-        : pkg);
+    const nugetExact = new Set();
+    const nugetLower = new Set();
+    for (const copy of project.nugetCopies) {
+        for (const pkg of copy.packages)
+            (pkg.lowerBound ? nugetLower : nugetExact).add(JSON.stringify([nugetKey(pkg.name), pkg.version]));
+    }
+    return packages.map((pkg) => {
+        const nugetId = JSON.stringify([nugetKey(pkg.name), pkg.version]);
+        const lower = pkg.ecosystem === "PyPI"
+            ? project.lowerBounds.some((lb) => lb.name === normalizePypiName(pkg.name) && lb.version === pkg.version)
+            : pkg.ecosystem === "NuGet" && nugetLower.has(nugetId) && !nugetExact.has(nugetId);
+        return lower ? { ...pkg, version_is_lower_bound: true } : pkg;
+    });
 }
 /**
  * 元のファイルはosv-scannerに渡さず、スナップショット(scanSnapshot.ts)のコピーをスキャンする。
@@ -125,7 +166,7 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
     const lookups = new Map();
     const npmWorkBudget = createNpmLockWorkBudget();
     let remaining = maxTotalBytes;
-    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests } of copies) {
+    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages } of copies) {
         const lockDir = originalRelative === null ? "" : path.dirname(originalRelative);
         let lookup = null;
         try {
@@ -147,6 +188,9 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
             else if (format === "Cargo.lock" && cargoPackages !== undefined) {
                 lookup = cargoLockRelations(cargoPackages, declaringManifests);
             }
+            else if (format === "packages.lock.json" && nugetPackages !== undefined) {
+                lookup = nugetRelations(nugetPackages);
+            }
         }
         catch {
             lookup = null; // 解析できないファイルはunknown(スキャン自体は続ける)
@@ -272,6 +316,16 @@ export async function scanFromSnapshot(project, options) {
             relationSources.push({ copy: generated, format: "Cargo.lock", originalRelative: copy.path,
                 cargoPackages: copy.allPackages, declaringManifests: copy.declaringManifests });
         }
+        for (const copy of project.nugetCopies) {
+            const generated = await snapshot.writeGenerated(nugetLockCopyContent(copy.packages));
+            targets.push({ path: generated, format: "packages.lock.json" });
+            relationSources.push({ copy: generated, format: "packages.lock.json", originalRelative: copy.path, nugetPackages: copy.packages });
+        }
+        for (const copy of project.composerCopies ?? []) {
+            const generated = await snapshot.writeGenerated(copy.content);
+            targets.push({ path: generated, format: "composer.lock" });
+            relationSources.push({ copy: generated, format: "composer.lock", originalRelative: copy.path });
+        }
         if (targets.length === 0)
             return parseOsvScanOutput({ results: [] });
         const report = await withScopeNotes(project.skippedFiles, () => snapshot.guard(() => runOsvScan(targets, options)));

package/dist/utils/composerLock.js

@@ -0,0 +1,40 @@
+import { parseNpmLock } from "./npmLockCopy.js";
+import { parseComposerVersion } from "./composerVersion.js";
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Only names and release versions reach OSV; repository URLs, scripts, and commit IDs are never forwarded. */
+export function composerLockCopy(text, budget) {
+    const data = parseNpmLock(text, budget);
+    if (!record(data) || !Array.isArray(data.packages) || (data["packages-dev"] !== undefined && !Array.isArray(data["packages-dev"]))) {
+        throw new Error("composer.lock must contain a packages array and an optional packages-dev array");
+    }
+    const issues = [];
+    const warnings = [];
+    let uncertainOrigin = 0;
+    // dist.type=pathは自分のコード(monorepoのパッケージ)。Rustのlocal_crates・.NETのlocal_projectsと同じく数だけ返し、範囲の欠けにしない
+    let localPackages = 0;
+    const output = {};
+    for (const group of ["packages", "packages-dev"]) {
+        const packages = [];
+        let skipped = 0;
+        for (const raw of (data[group] ?? [])) {
+            if (record(raw) && record(raw.dist) && raw.dist.type === "path") {
+                localPackages++;
+                continue;
+            }
+            if (!record(raw) || typeof raw.name !== "string" || !/^[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/.test(raw.name) || raw.name.length > 200 ||
+                typeof raw.version !== "string" || parseComposerVersion(raw.version) === null) {
+                skipped++;
+                continue;
+            }
+            packages.push({ name: raw.name, version: raw.version });
+            if (raw["notification-url"] !== "https://packagist.org/downloads/")
+                uncertainOrigin++;
+        }
+        output[group] = packages;
+        if (skipped > 0)
+            issues.push(`${skipped} entries in ${group} were not scanned: invalid package names or non-release versions (branches, aliases, and dev versions are not evaluated)`);
+    }
+    if (uncertainOrigin > 0)
+        warnings.push(`${uncertainOrigin} Composer package entries lack the standard Packagist notification URL. Their names and versions are sent to api.osv.dev as Packagist packages; private or forked packages may produce false positives. The notification URL is only a heuristic and does not prove origin`);
+    return { content: JSON.stringify(output), issues, warnings, packageCount: output.packages.length + output["packages-dev"].length, localPackages };
+}

package/dist/utils/composerVersion.js

@@ -0,0 +1,36 @@
+const STABILITY = { alpha: 0, a: 0, beta: 1, b: 1, rc: 2, stable: 3, patch: 4, pl: 4, p: 4 };
+export function parseComposerVersion(version) {
+    if (version.length > 256)
+        return null;
+    const match = /^v?(\d{1,5}(?:\.\d+){0,3})(?:[._-]?(alpha|a|beta|b|RC|stable|patch|pl|p)((?:[.-]?\d+(?:[.-]\d+)*)?))?(?:\+[0-9A-Za-z.-]+)?$/i.exec(version);
+    if (!match)
+        return null;
+    const parts = match[1].split(".").map(BigInt);
+    while (parts.length < 4)
+        parts.push(0n);
+    return {
+        parts,
+        stability: match[2] === undefined ? 3 : STABILITY[match[2].toLowerCase()],
+        suffix: match[2]?.toLowerCase() === "stable" ? [] : (match[3] ?? "").replace(/^[.-]/, "").split(/[.-]/).filter(Boolean).map(BigInt),
+    };
+}
+export function compareComposerVersions(a, b) {
+    const x = parseComposerVersion(a), y = parseComposerVersion(b);
+    if (x === null || y === null)
+        return 0;
+    for (let i = 0; i < 4; i++) {
+        if (x.parts[i] !== y.parts[i])
+            return x.parts[i] < y.parts[i] ? -1 : 1;
+    }
+    if (x.stability !== y.stability)
+        return x.stability < y.stability ? -1 : 1;
+    for (let i = 0; i < Math.max(x.suffix.length, y.suffix.length); i++) {
+        // PHP version_compare treats even an extra zero component as greater.
+        if (i >= x.suffix.length || i >= y.suffix.length)
+            return i >= x.suffix.length ? -1 : 1;
+        const left = x.suffix[i], right = y.suffix[i];
+        if (left !== right)
+            return left < right ? -1 : 1;
+    }
+    return 0;
+}