osv-scanner-mcp 0.17.0 → 0.19.0

package/README.md

@@ -7,13 +7,13 @@
 
 An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-scanner). Ask an MCP client such as Claude to "check this project for vulnerabilities", and it returns the known vulnerabilities (CVE / GHSA) in your dependencies as a report sorted by severity, together with recommended upgrades.
 
-> **Status**: [Published on npm](https://www.npmjs.com/package/osv-scanner-mcp) (`npx -y osv-scanner-mcp`). Supports lockfiles and manifests for Java (Maven / Gradle), JavaScript (npm / yarn / pnpm / bun), Python (Poetry / uv / Pipenv / PDM / requirements.txt), Go, Rust (`Cargo.lock`), and .NET (NuGet: `packages.lock.json`, `obj/project.assets.json`, `packages.config`, `*.deps.json`, and project files), and PHP (Composer: `composer.lock`), with upgrade recommendations for Maven, npm, PyPI, Go, crates.io, and Packagist. Setup instructions are provided for Claude Code, Claude Desktop, Codex CLI, Antigravity, and VS Code (GitHub Copilot).
+> **Status**: [Published on npm](https://www.npmjs.com/package/osv-scanner-mcp) (`npx -y osv-scanner-mcp`). Supports lockfiles and manifests for Java (Maven / Gradle), JavaScript (npm / yarn / pnpm / bun), Python (Poetry / uv / Pipenv / PDM / requirements.txt), Go, Rust (`Cargo.lock`), and .NET (NuGet: `packages.lock.json`, `obj/project.assets.json`, `packages.config`, `*.deps.json`, and project files), and PHP (Composer: `composer.lock`), with upgrade recommendations for Maven, npm, PyPI, Go, crates.io, Packagist, and NuGet. Setup instructions are provided for Claude Code, Claude Desktop, Codex CLI, Antigravity, and VS Code (GitHub Copilot).
 
 ## Features
 
 - **PHP / Composer (source checkout)**: `scan_project` scans `composer.lock`, including both `packages` and `packages-dev`, as Packagist packages. `suggest_fix` recommends release versions and checks candidates against OSV. Composer and PHP code are never executed. See [Composer support](#composer-support).
 - **One-shot multi-language scan**: Pass a project path to `scan_project`, and it detects and scans the Java, JavaScript, Python, Go, Rust, .NET, and PHP lockfiles in the project together. Dependencies that could not be scanned (for example, a manifest without a lockfile or an unpinned requirement) are reported up front in `coverage`
-- **Upgrade recommendations**: `suggest_fix` recommends, for each vulnerable package, the upgrade closest to the current release line that addresses its fix targets, for Maven, npm, PyPI, Go, Rust (crates.io), and PHP (Packagist). Known unfixed and informational advisories remain visible. The recommended version is also checked against the OSV database for additional fix-target vulnerabilities
+- **Upgrade recommendations**: `suggest_fix` recommends, for each vulnerable package, the upgrade closest to the current release line that addresses its fix targets, for Maven, npm, PyPI, Go, Rust (crates.io), PHP (Packagist), and .NET (NuGet). Known unfixed and informational advisories remain visible. The recommended version is also checked against the OSV database for additional fix-target vulnerabilities
 - **Rust without false positives**: For `Cargo.lock`, only crates from crates.io are scanned. Your own workspace crates, git dependencies, and crates from private registries are not looked up as crates.io crates (OSV-Scanner alone would match them by name, and send their names to the OSV API). RustSec notices about unmaintained or unsound crates are labeled `informational` and counted apart from vulnerabilities
 - **.NET without guessing versions**: Each project file is matched to its own lockfile or `obj/project.assets.json`. Without one, only its direct `PackageReference` items are scanned, and a `Version="x"` (which means x or higher) is reported as a lower bound. References whose version cannot be known without running MSBuild (properties, conditions, floating versions, `Update` / `Remove`) are listed instead of being looked up: OSV treats an unparsable version as older than every release and would report every vulnerability for it
 - **Direct and transitive dependencies**: Packages are marked as direct or transitive dependencies (from `package-lock.json`, `go.mod`, `requirements.txt`, `pom.xml`, `Cargo.lock`, and the .NET files), and update hints are tailored accordingly, for example by naming the direct dependency that pulls in a transitive one
@@ -22,12 +22,16 @@ An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-sc
 - **SBOM scan**: `scan_sbom` checks the dependencies recorded in a CycloneDX/SPDX JSON SBOM. It states explicitly that the SBOM's completeness and its match with the actual artifacts are not verified
 - **Scan history (opt-in)**: With `OSV_MCP_HISTORY=1`, each scan is recorded locally, and `scan_history` lists past runs and shows what changed since the previous run (new and resolved vulnerabilities, version changes, coverage changes)
 - **Severity-sorted reports**: Vulnerabilities are grouped by package and sorted by CVSS score, with five severity labels (critical / high / medium / low / unknown) and summary counts
-- **Fixed versions**: Each vulnerability includes `fixed_versions`, sorted correctly by Maven version precedence (including non-semver forms such as `2.17.1-RELEASE`), Semantic Versioning precedence for npm, Go, and Rust, PEP 440 for PyPI, and Composer ordering for Packagist
+- **Fixed versions**: Each vulnerability includes `fixed_versions`, sorted correctly by Maven version precedence (including non-semver forms such as `2.17.1-RELEASE`), Semantic Versioning precedence for npm, Go, and Rust, PEP 440 for PyPI, Composer ordering for Packagist, and NuGet ordering for NuGet
 - **Security first**: No shell execution, a fixed argument allowlist, path normalization and boundary checks, scanning private copies instead of the original files, and timeouts and output size limits are built in
 
 ## Composer support
 
-Pass a project directory, `composer.lock`, or `composer.json` to `scan_project` or `suggest_fix`. The lockfile records both direct and transitive dependencies; their relationship is currently reported as `unknown`. A `composer.json` without a lockfile in the same directory is reported as missing/unconfirmed in `coverage.lockfile_missing` (a project with no scannable files returns `no_manifest_found`). An ancestor's lockfile does not establish coverage for an independent child project. `vendor` directories are not traversed.
+Pass a project directory, `composer.lock`, or `composer.json` to `scan_project` or `suggest_fix`. Direct/transitive dependency analysis (source checkout) uses the companion `composer.json` in the lockfile's own directory. A `composer.json` without a lockfile in the same directory is reported as missing/unconfirmed in `coverage.lockfile_missing` (a project with no scannable files returns `no_manifest_found`). An ancestor's lockfile does not establish coverage for an independent child project. `vendor` directories are not traversed.
+
+The companion's `require` and `require-dev` are direct dependencies. Packages reachable through the locked packages' `require` are transitive; a dependency's own `require-dev`, `suggest`, and `conflict` are not dependency edges. Direct dependencies include their project-relative `composer.json` in `declared_in`. `introduced_by` names each direct root that transitively requires a package (up to 10, with the remainder in `introduced_by_omitted`). A direct dependency also required by another root remains direct and includes that root in `introduced_by`; cycles do not introduce a package through itself. Transitive dependencies do not have `declared_in`, since the root does not declare them directly.
+
+This is name-based graph traversal of the lockfile, not a Composer constraint solver or freshness check. Duplicate installed names, virtual requirements, and references affected by `provide`/`replace` are not guessed; unreachable packages remain `unknown`. Local path and skipped branch entries may connect roots to scanned packages, but their names/metadata are still excluded from scanner input. No path-repository URL or nested package's composer.json is followed. Missing, malformed, symlinked, oversized, or otherwise unreadable companion manifests leave relationships unknown, with a `composer_warnings` note; locked release packages continue to be scanned. The companion is captured safely once (4 MiB per file), shares the Composer 64 MiB input/JSON structure budgets, and traversal/indexing share a 2,000,000-operation budget across all Composer lockfiles. Relationship uncertainty does not itself make dependency scan coverage incomplete.
 
 The server reads each lockfile safely and scans a private sanitized copy containing only package names and release versions. Repository URLs, dist/source commit references, scripts, and credentials are not passed to OSV-Scanner. Both production and development packages are included. JSON is limited to 16 MiB per lockfile and 64 MiB per scan, with structural work limits. Invalid JSON is excluded; invalid entries and unsupported versions are omitted and reported in `skipped_files`, making `coverage.complete` false.
 
@@ -308,9 +312,16 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
   - `pom.xml`: OSV-Scanner reports the dependencies declared in `pom.xml` (and its parent POMs) and the transitive dependencies resolved through deps.dev as separate results (`source.type` `lockfile` / `unknown`), and this split is used (so parent POMs, profiles, properties, and dependency management are interpreted exactly as OSV-Scanner does). `introduced_by` / `declared_in` are not available. This relies on undocumented OSV-Scanner output, so anything unexpected is reported as `unknown`
   - `Cargo.lock`: crates.io dependencies immediately required by a local/workspace/path crate are direct; crates.io dependencies reachable through them (including git and alternate-registry origins) are transitive. `introduced_by` names the first direct dependency on each path. References are resolved by exact name, version, and source where provided; ambiguous references are not guessed. Replacements are followed. `declared_in` lists project-relative Cargo.toml paths only when every declaring crate has a unique matching manifest. Otherwise `declaring_crates` names the unmapped declaring crates (up to 10, with the rest in `declaring_crates_omitted`). Dev/build/target-specific distinctions are unavailable. Traversal over 2,000,000 edges returns `unknown`
   - .NET: `Direct` / `Transitive` in `packages.lock.json`; the dependencies of `project.frameworks` in `project.assets.json`; the dependencies of the project library in `*.deps.json`; and every reference read from a project file are direct. `packages.config` does not say, so it is `unknown`. `introduced_by` and `declared_in` are not available yet
+  - Composer (source checkout): the companion root's `require` / `require-dev` are direct, and locked `require` reachability establishes transitive dependencies. `declared_in` names the companion for direct dependencies; `introduced_by` lists transitively requiring direct roots. See [Composer support](#composer-support) for ambiguity and work limits.
   - Other formats (`gradle.lockfile`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, and `pdm.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
 - `dependency_groups` is the raw dependency group reported by OSV-Scanner (for example `dev`). It is missing or inaccurate for some lockfile formats (absent for pnpm, `optional` for pdm, and so on), so treat it as informational
-- Upgrade recommendations (`suggest_fix`) are available for Maven, npm, PyPI, Go, Rust (crates.io), and PHP (Packagist). NuGet packages are returned with `verification: "unsupported_ecosystem"` for now
+- Upgrade recommendations (`suggest_fix`) are available for Maven, npm, PyPI, Go, Rust (crates.io), PHP (Packagist), and .NET (NuGet; source checkout).
+
+**NuGet recommendations (source checkout).** `suggest_fix` compares NuGet release versions with one to four numeric components (missing components become zero), including legacy revisions such as `1.2.3.4`. Numeric components must fit a nonnegative 32-bit integer; unsupported formats withhold a recommendation. Prerelease identifiers compare numerically when they fit signed 32-bit integers, and otherwise by ASCII case-insensitive lexical order, matching NuGet VersionRelease; numeric prerelease identifiers with leading zeroes are rejected. Build metadata does not affect ordering. Package IDs match case-insensitively. Recommendations use OSV `ECOSYSTEM` affected ranges and are rechecked against OSV; unsupported or incomplete ranges cannot establish a verified fix. Stable candidates are preferred; prerelease-only fixes are labeled. The existing cautious 0.x upgrade tiers apply.
+
+For direct dependencies, update the `PackageReference` (or `packages.config` in older projects); with central management, update `PackageVersion` in `Directory.Packages.props`. For transitive dependencies, update the parent dependency or explicitly reference a compatible fixed version if NuGet resolution allows it. Runtime packs (`Microsoft.NETCore.App.Runtime.*`, `Microsoft.AspNetCore.App.Runtime.*`, `Microsoft.WindowsDesktop.App.Runtime.*`) generally require an SDK/runtime or target-framework update rather than a new explicit package reference. Check target-framework/RID compatibility and all version constraints, regenerate restore/lockfiles, and rescan. These are suggestions, not edits; `dotnet restore` and MSBuild are not run.
+
+`PackageReference Version="x"` or an inclusive minimum range is scanned at its lower bound, not at a confirmed restored version. Its recommendation retains `version_is_lower_bound: true`, and the note means raising that bound. Coverage still records missing restore/lockfiles and unresolved references. Neither a verified affected-range check nor `candidate_check: "clean"` proves framework compatibility, availability on a private feed, or absence of unknown vulnerabilities.
 
 ### `scan_java_project`
 
@@ -375,7 +386,7 @@ If an existing parent POM cannot be read (larger than 10 MiB, not a regular file
 ```
 
 - `packages` is sorted by the most severe vulnerability, and each `vulnerabilities` list by severity (unknown last)
-- `fixed_versions` lists the fixed versions recorded in OSV, in ascending order: by Maven precedence for Maven, Semantic Versioning precedence for npm, Go, and Rust (values that are not valid SemVer come last), PEP 440 for PyPI (in the order listed by OSV up to v0.5.0), and Composer ordering for Packagist (since v0.17.0); other ecosystems keep the order listed by OSV (the order is not guaranteed). Several release lines may be mixed (for example a 2.12 backport and the 2.15 line). Pre-releases (`5.0.0-beta.3`) and Go pseudo-versions (`0.0.0-20180925071336-cf3bd585ca2a`) may be included. An empty array means that OSV lists no fixed version. Up to v0.4.1, this was always empty for packages outside Maven
+- `fixed_versions` lists the fixed versions recorded in OSV, in ascending order: by Maven precedence for Maven, Semantic Versioning precedence for npm, Go, and Rust (values that are not valid SemVer come last), PEP 440 for PyPI (in the order listed by OSV up to v0.5.0), Composer ordering for Packagist (since v0.17.0), and NuGet ordering for NuGet (since v0.18.0); other ecosystems keep the order listed by OSV (the order is not guaranteed). Several release lines may be mixed (for example a 2.12 backport and the 2.15 line). Pre-releases (`5.0.0-beta.3`) and Go pseudo-versions (`0.0.0-20180925071336-cf3bd585ca2a`) may be included. An empty array means that OSV lists no fixed version. Up to v0.4.1, this was always empty for packages outside Maven
 - Vulnerabilities without a severity score are reported as `null` / `"unknown"`
 
 ### `scan_java_artifact`
@@ -432,7 +443,7 @@ Invalid JSON returns `invalid_sbom`, an unsupported format `unsupported_sbom_for
 
 ### `suggest_fix`
 
-Runs the same detection and scan as `scan_project` and recommends an **upgrade version** for each vulnerable package. Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, Rust (crates.io), and PHP (Packagist / Composer). Instead of simply taking the highest fixed version, it picks the fixed version closest to the current release line, falling back through three tiers:
+Runs the same detection and scan as `scan_project` and recommends an **upgrade version** for each vulnerable package. Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, Rust (crates.io), PHP (Packagist / Composer), and .NET (NuGet; source checkout). Instead of simply taking the highest fixed version, it picks the fixed version closest to the current release line, falling back through three tiers:
 
 | Tier | Meaning |
 |---|---|
@@ -483,6 +494,7 @@ For npm, Go, PyPI, and Rust, the "same release line" is the range a caret (`^`)
 - Suggestions include an `update_hint`, tailored to whether the package is a direct or transitive dependency:
   - Maven (from `pom.xml`): for a direct dependency, update the `<dependency>` version (or the parent POM, property, or BOM that manages it); for a transitive dependency, override the version in `<dependencyManagement>` or update the direct dependency that requires it
   - npm: for a direct dependency, update the version in the `package.json` listed in `declared_in`; for a transitive dependency, update the direct dependency named in `introduced_by`, or set the version with `overrides` in the root `package.json` (effective only in the root project)
+  - Composer: for direct dependencies, update the constraint in `declared_in`; for transitive dependencies, update the direct roots in `introduced_by` or their constraints, then regenerate the lockfile with dependency updates allowed, scripts and plugins disabled. PHP and dependency compatibility still require verification.
   - Go: `go get <module>@<version>` (also for `// indirect` modules). For a module affected by `replace`, update the version in the `replace` directive instead of `require`. Major versions 2 and later use a different module path (`/v2` and so on) and are separate packages in OSV, so fixes in a newer major line are not included as candidates. If the current version is a pseudo-version (an untagged commit), `upgrade_note` says so
   - PyPI: update the version in `requirements.txt`, `pyproject.toml`, or `Pipfile` and regenerate the lockfile; for a transitive dependency, use a pip constraints file (`-c`) or the override settings of uv or Poetry
   - Rust: where version requirements permit it, `cargo update -p <crate>@<current> --precise <recommended>` updates the lockfile. Otherwise change the direct requirement in the declaring Cargo.toml or update the parent dependency in `introduced_by`. Cross-major upgrades may break compatibility, including 0.x updates. Pre-releases may require explicit `=<version>` requirements and must be allowed by transitive parents. Build metadata is omitted from `--precise`. `[patch.crates-io]` changes a source, not the allowed version range; backports must satisfy parent requirements. Check yanked versions, MSRV, and compiler compatibility. Cargo is never executed by the server
@@ -645,7 +657,7 @@ Design notes and open items are in [docs/DESIGN_TODO.md](docs/DESIGN_TODO.md) (i
 - [x] Scan history and changes between runs (`scan_history`, opt-in)
 - [x] `scan_project` for .NET (NuGet), with per-project matching and lower bounds for project files
 - [x] `scan_project` and `suggest_fix` for PHP (Composer `composer.lock`)
-- [ ] `suggest_fix` for .NET (NuGet)
+- [x] `suggest_fix` for .NET (NuGet; source checkout)
 - [ ] Direct and transitive dependencies for `gradle.lockfile` and the YAML/TOML lockfiles
 
 ## License

package/dist/index.js

@@ -66,7 +66,7 @@ if (startupWarning !== null) {
     }
 }
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
-const SERVER_VERSION = "0.17.0";
+const SERVER_VERSION = "0.19.0";
 const server = new McpServer({
     name: "osv-scanner-mcp",
     version: SERVER_VERSION,
@@ -88,9 +88,9 @@ server.registerTool("scan_project", {
         "a PackageReference Version=\"x\" is looked up at its lower bound (version_is_lower_bound), and references with properties, ranges without a lower bound, floating versions, conditions, or Update/Remove are not looked up (unresolved_package_references). " +
         "The project's own projects are counted in local_projects. Names of packages from private NuGet feeds are also sent to api.osv.dev; see nuget_warnings. " +
         "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
-        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, and pom.xml; unknown otherwise). " +
-        "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
-        "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, Rust, and PHP (not yet for .NET). Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
+        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, pom.xml, Cargo.lock, .NET files and Composer; unknown where the format or captured metadata cannot establish it). " +
+        "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. A safely captured companion composer.json defines direct require/require-dev roots; locked require edges establish introduced_by, and direct declarations use declared_in. Missing/uninterpretable companions, ambiguous providers/replacements or names, and analysis limits leave relationships unknown. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
+        "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, Rust, PHP, and .NET (NuGet). Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
     inputSchema: {
         project_path: z
             .string()
@@ -114,13 +114,14 @@ server.registerTool("scan_java_project", {
 server.registerTool("suggest_fix", {
     title: "Recommend upgrades that fix vulnerabilities",
     description: "Scans the project with the same detection as scan_project and recommends an upgrade version for each vulnerable package. " +
-        "Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, Rust (crates.io), and PHP (Packagist / Composer). " +
+        "Recommendations are available for Java (Maven / Gradle), JavaScript (npm), Python (PyPI), Go, Rust (crates.io), PHP (Packagist / Composer), and .NET (NuGet). " +
+        "NuGet versions support up to four numeric components, case-insensitive prerelease labels, and ignored build metadata. Updates must satisfy target-framework and dependency constraints; runtime packs generally require SDK/runtime or target-framework updates. No dotnet restore or MSBuild is run. " +
         "Composer recommendations support classical numeric release versions with up to four components and alpha/beta/RC/patch suffixes; dev branches, aliases, and unsupported version formats are not evaluated. Check PHP/extension constraints and application compatibility before upgrading. " +
         "The fixed version closest to the current release line is chosen with a three-tier fallback " +
         "(same_minor: same release line -> major_internal: same major version -> cross_major: major upgrade), " +
         "and the response gives the recommended version, the upgrade distance (upgrade_tier), and the fixed version per CVE. For npm, Go, PyPI, and Rust, a minor update within 0.x is also cross_major (may include breaking changes). " +
-        "Dependencies scanned at a requirements.txt lower bound (>=) are marked version_is_lower_bound, and the recommendation then means raising the lower bound. " +
-        "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm and Cargo.lock also introduced_by and declared_in). Cargo updates are conditional on parent version requirements; cross-major updates may require Cargo.toml changes. " +
+        "Dependencies scanned at a requirements.txt lower bound (>=) or a NuGet PackageReference minimum/range are marked version_is_lower_bound, and the recommendation then means raising the lower bound rather than confirming the installed version. " +
+        "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm, Cargo.lock and Composer also introduced_by and declared_in). Composer hints name the declaring manifest for direct dependencies and the introducing roots for transitive dependencies; regenerate the lockfile in a trusted environment and verify constraints. Cargo updates are conditional on parent version requirements; cross-major updates may require Cargo.toml changes. " +
         "The recommended version is checked against api.osv.dev, and versions with known vulnerabilities that do not affect the current version are avoided (result in candidate_check). " +
         "clean excludes known unfixed advisories, known informational advisories that are not fix targets, and new Rust unmaintained/notice records; these may still apply. New unsound records are fix targets. " +
         "With has_known_vulnerabilities, failed, or skipped, the recommended version has not been confirmed safe; conflict means the data disagreed and the recommendation is withheld. " +

package/dist/osv/suggestFix.js

@@ -38,6 +38,26 @@ function updateHint(pkg) {
     const relation = pkg.dependency_relation;
     const by = pkg.introduced_by?.join(", ");
     switch (pkg.ecosystem) {
+        case "Packagist": {
+            if (relation === "direct")
+                return `Direct dependency. Update its constraint in ${pkg.declared_in?.join(", ") ?? "composer.json"}` +
+                    (by ? `. It is also required transitively by ${by}, whose constraints may need updating` : "") +
+                    ". Regenerate composer.lock in a trusted environment with Composer scripts and plugins disabled; check PHP, extension and dependency constraints. Composer is not executed by this server";
+            if (relation === "transitive")
+                return `Transitive dependency. Update ${by ? `the direct dependencies that require it (${by})` : "the direct dependency that requires it"} or adjust their constraints, then regenerate composer.lock with --with-all-dependencies --no-scripts --no-plugins in a trusted environment. Check PHP and extension requirements. Composer is not executed by this server`;
+            return UPDATE_HINTS.Packagist;
+        }
+        case "NuGet": {
+            if (/^Microsoft\.(?:NETCore|AspNetCore|WindowsDesktop)\.App\.Runtime\./i.test(pkg.name)) {
+                return "Runtime pack. Update the .NET SDK/runtime or target framework that supplies this pack and regenerate restore/build outputs; do not add an explicit PackageReference merely to change the runtime pack. Check framework/RID compatibility and rescan. This server does not run dotnet restore or MSBuild";
+            }
+            const shared = "If centrally managed, change PackageVersion in Directory.Packages.props. Regenerate restore/lockfiles and rescan in a trusted environment; verify target-framework compatibility and dependency constraints. This server does not run dotnet restore or MSBuild";
+            if (relation === "direct")
+                return "Direct dependency. Update its PackageReference in the project file (or packages.config for older projects). " + shared;
+            if (relation === "transitive")
+                return "Transitive dependency. Update the direct dependency that requires it, or explicitly reference a compatible fixed version when NuGet dependency resolution permits it. " + shared;
+            return "Update the dependency version in the project file or packages.config; for a transitive dependency, update its parent or explicitly reference a compatible fixed version. " + shared;
+        }
         case "npm":
             if (relation === "direct") {
                 return `Direct dependency. Update the version in ${pkg.declared_in?.join(", ") ?? "package.json"}` +
@@ -133,6 +153,7 @@ function hintFields(pkg, recommended = null, tier = null) {
 /** スキャン結果に付いた直接/推移的依存の項目を提案にも写す(無ければ何も出さない) */
 function relationFields(pkg) {
     return {
+        ...(pkg.version_is_lower_bound ? { version_is_lower_bound: true } : {}),
         ...(pkg.dependency_relation !== undefined ? { dependency_relation: pkg.dependency_relation } : {}),
         ...(pkg.introduced_by !== undefined ? { introduced_by: pkg.introduced_by } : {}),
         ...(pkg.introduced_by_omitted !== undefined ? { introduced_by_omitted: pkg.introduced_by_omitted } : {}),
@@ -213,15 +234,19 @@ function buildNote(scheme, pkg, recommended, tier, fixableCount, unfixedCount) {
         if (unfixedCount > 0)
             note += `. The remaining ${unfixedCount} CVEs have no fixed version newer than the current one and are excluded from the fix. Check recommended_status`;
     }
-    if (pkg.version_is_lower_bound) {
-        note += `. The current version (${pkg.version}) is the lower bound in requirements.txt (>= or ~=) and may differ from the installed version. ` +
-            "The recommendation means raising the lower bound to at least that version";
-    }
+    note += lowerBoundNote(pkg);
     if (pkg.ecosystem === "Go" && GO_PSEUDO_VERSION.test(pkg.version)) {
         note += ". The current version is a pseudo-version (an untagged commit)";
     }
     return note;
 }
+function lowerBoundNote(pkg) {
+    if (!pkg.version_is_lower_bound)
+        return "";
+    const source = pkg.ecosystem === "NuGet" ? "PackageReference (NuGet minimum/range)" : "requirements.txt (>= or ~=)";
+    return `. The current version (${pkg.version}) is the lower bound in ${source} and may differ from the installed version. ` +
+        "Any recommendation means raising the lower bound to at least that version";
+}
 /**
  * 1パッケージ分のアップグレード提案を組み立てる(同期・純粋)。
  * contextを渡すと、照会で見つかった脆弱性も避けて候補を選び直す(contextなしの結果が従来の推奨)。
@@ -318,9 +343,9 @@ export function suggestUpgradeForPackage(pkg, context = {}) {
         upgrade_note: (recommended === null && fixableCount > 0
             ? "No known fixed version could be confirmed to be outside the affected ranges of every CVE to fix. The recommendation is also withheld when the data are insufficient or use unsupported range types." +
                 (unparseableCount > 0 ? ` ${unparseableCount} CVEs list fixed versions that cannot be parsed as versions (tier: unparseable_fix), so the recommendation is withheld.` : "")
-            : buildNote(scheme, pkg, recommended, upgradeTier, fixableCount, unfixedCount)) + (informationalNotes ? ` ${informationalNotes}` : ""),
+            : buildNote(scheme, pkg, recommended, upgradeTier, fixableCount, unfixedCount)) +
+            (recommended === null && fixableCount > 0 ? lowerBoundNote(pkg) : "") + (informationalNotes ? ` ${informationalNotes}` : ""),
         ...hintFields(pkg, recommended, upgradeTier),
-        ...(pkg.version_is_lower_bound ? { version_is_lower_bound: true } : {}),
         per_cve_detail: details,
         verification: recommended === null ? "no_verified_candidate" : "verified",
     };

package/dist/osv/versionScheme.js

@@ -13,6 +13,7 @@ import { compareMavenVersions, mavenVersionSeries } from "../utils/mavenVersion.
 import { compareParsedPep440, parsePep440 } from "../utils/pep440Version.js";
 import { compareParsedSemver, parseSemver } from "../utils/semverVersion.js";
 import { compareComposerVersions, parseComposerVersion } from "../utils/composerVersion.js";
+import { compareNugetVersions, parseNugetVersion } from "../utils/nugetVersion.js";
 const SEMVER_ECOSYSTEMS = new Set(["npm", "Go", "crates.io"]);
 const MAVEN_SCHEME = {
     isValid: () => true,
@@ -120,8 +121,27 @@ const COMPOSER_SCHEME = {
         return parsed ? `${parsed.parts[0]}.${parsed.parts[1]}` : null;
     },
 };
+/** NuGet VersionRelease ordering; prerelease names and package IDs ignore ASCII case. */
+const NUGET_SCHEME = {
+    isValid: (v) => parseNugetVersion(v) !== null,
+    compare: compareNugetVersions,
+    isPrerelease: (v) => (parseNugetVersion(v)?.prerelease.length ?? 0) > 0,
+    classify(current, candidate) {
+        const a = parseNugetVersion(current), b = parseNugetVersion(candidate);
+        if (!a || !b)
+            return "cross_major";
+        return classifyCaret({ major: a.parts[0], minor: a.parts[1], patch: a.parts[2] }, { major: b.parts[0], minor: b.parts[1], patch: b.parts[2] });
+    },
+    seriesLabel(v) {
+        const parsed = parseNugetVersion(v);
+        return parsed ? parsed.parts[0] === 0 && parsed.parts[1] === 0
+            ? `0.0.${parsed.parts[2]}` : `${parsed.parts[0]}.${parsed.parts[1]}` : null;
+    },
+};
 /** 修正版の推奨に対応するエコシステムの操作。未対応ならnull */
 export function versionSchemeFor(ecosystem) {
+    if (ecosystem === "NuGet")
+        return NUGET_SCHEME;
     if (ecosystem === "Packagist")
         return COMPOSER_SCHEME;
     if (ecosystem === "Maven")
@@ -137,6 +157,8 @@ export function versionSchemeFor(ecosystem) {
  * PyPIはPEP 503の正規化(小文字化、`-` `_` `.`の連続を`-`)で比較する(実データでは完全一致したが防御的に)
  */
 export function samePackageName(a, b, ecosystem) {
+    if (ecosystem === "NuGet")
+        return a.toLowerCase() === b.toLowerCase();
     if (ecosystem !== "PyPI")
         return a === b;
     const normalize = (name) => name.toLowerCase().replace(/[-_.]+/g, "-");

package/dist/tools/scanProject.js

@@ -166,7 +166,7 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
     const lookups = new Map();
     const npmWorkBudget = createNpmLockWorkBudget();
     let remaining = maxTotalBytes;
-    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages } of copies) {
+    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages, composerLookup } of copies) {
         const lockDir = originalRelative === null ? "" : path.dirname(originalRelative);
         let lookup = null;
         try {
@@ -191,6 +191,9 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
             else if (format === "packages.lock.json" && nugetPackages !== undefined) {
                 lookup = nugetRelations(nugetPackages);
             }
+            else if (format === "composer.lock") {
+                lookup = composerLookup ?? null;
+            }
         }
         catch {
             lookup = null; // 解析できないファイルはunknown(スキャン自体は続ける)
@@ -324,7 +327,7 @@ export async function scanFromSnapshot(project, options) {
         for (const copy of project.composerCopies ?? []) {
             const generated = await snapshot.writeGenerated(copy.content);
             targets.push({ path: generated, format: "composer.lock" });
-            relationSources.push({ copy: generated, format: "composer.lock", originalRelative: copy.path });
+            relationSources.push({ copy: generated, format: "composer.lock", originalRelative: copy.path, composerLookup: copy.relations });
         }
         if (targets.length === 0)
             return parseOsvScanOutput({ results: [] });

package/dist/tools/suggestFix.js

@@ -1,7 +1,7 @@
 /**
  * `suggest_fix`ツールのハンドラ。
  * scan_projectと同じ検出・スキャンを実行し、脆弱なパッケージごとの
- * 推奨アップグレードバージョン(3段階Tier)を返す。推奨はMaven・npm・Go・PyPI・crates.ioに対応し、
+ * 推奨アップグレードバージョン(3段階Tier)を返す。推奨はMaven・npm・Go・PyPI・crates.io・Packagist・NuGetに対応し、
  * それ以外はunsupported_ecosystemとして返す。
  */
 import { isRemoteResolutionDisabled } from "../osv/runner.js";

package/dist/utils/composerLock.js

@@ -1,5 +1,6 @@
 import { parseNpmLock } from "./npmLockCopy.js";
 import { parseComposerVersion } from "./composerVersion.js";
+import { composerLinkNames, composerPackageName } from "./composerRelations.js";
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Only names and release versions reach OSV; repository URLs, scripts, and commit IDs are never forwarded. */
 export function composerLockCopy(text, budget) {
@@ -9,6 +10,7 @@ export function composerLockCopy(text, budget) {
     }
     const issues = [];
     const warnings = [];
+    const relationPackages = [];
     let uncertainOrigin = 0;
     // dist.type=pathは自分のコード(monorepoのパッケージ)。Rustのlocal_crates・.NETのlocal_projectsと同じく数だけ返し、範囲の欠けにしない
     let localPackages = 0;
@@ -17,11 +19,16 @@ export function composerLockCopy(text, budget) {
         const packages = [];
         let skipped = 0;
         for (const raw of (data[group] ?? [])) {
+            if (record(raw) && composerPackageName(raw.name)) {
+                const provides = composerLinkNames(raw.provide), replaces = composerLinkNames(raw.replace);
+                relationPackages.push({ name: raw.name, version: typeof raw.version === "string" ? raw.version : "",
+                    requires: composerLinkNames(raw.require), aliases: provides === null || replaces === null ? null : [...provides, ...replaces] });
+            }
             if (record(raw) && record(raw.dist) && raw.dist.type === "path") {
                 localPackages++;
                 continue;
             }
-            if (!record(raw) || typeof raw.name !== "string" || !/^[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/.test(raw.name) || raw.name.length > 200 ||
+            if (!record(raw) || !composerPackageName(raw.name) ||
                 typeof raw.version !== "string" || parseComposerVersion(raw.version) === null) {
                 skipped++;
                 continue;
@@ -36,5 +43,5 @@ export function composerLockCopy(text, budget) {
     }
     if (uncertainOrigin > 0)
         warnings.push(`${uncertainOrigin} Composer package entries lack the standard Packagist notification URL. Their names and versions are sent to api.osv.dev as Packagist packages; private or forked packages may produce false positives. The notification URL is only a heuristic and does not prove origin`);
-    return { content: JSON.stringify(output), issues, warnings, packageCount: output.packages.length + output["packages-dev"].length, localPackages };
+    return { content: JSON.stringify(output), issues, warnings, packageCount: output.packages.length + output["packages-dev"].length, localPackages, relationPackages };
 }

package/dist/utils/composerRelations.js

@@ -0,0 +1,96 @@
+import { MAX_DEPENDENCY_EDGES } from "./dependencyRelations.js";
+import { parseNpmLock } from "./npmLockCopy.js";
+export const createComposerRelationBudget = () => ({ remaining: MAX_DEPENDENCY_EDGES });
+const record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+export const composerPackageName = (v) => typeof v === "string" && v.length <= 200 && /^[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/.test(v);
+/** Platform requirements such as php, ext-json and lib-* are not package edges. */
+export function composerLinkNames(value) {
+    if (value === undefined)
+        return [];
+    if (!record(value))
+        return null;
+    const names = [];
+    for (const [name, constraint] of Object.entries(value)) {
+        if (typeof constraint !== "string")
+            return null;
+        const looksLikePackage = name.includes("/");
+        if (composerPackageName(name))
+            names.push(name);
+        else if (looksLikePackage)
+            return null;
+    }
+    return names;
+}
+/** Analyze only the captured companion manifest, never another root or a path repository's URL. */
+export function composerRootRequirements(text, budget) {
+    const root = parseNpmLock(text, budget);
+    if (!record(root))
+        return null;
+    const production = composerLinkNames(root.require), dev = composerLinkNames(root["require-dev"]);
+    return production === null || dev === null ? null : [...new Set([...production, ...dev])];
+}
+/** Name-based reachability of the locked solution, not a Composer constraint solver.
+ * require-dev is root-only; suggest/conflict/replace/provide are not dependency edges.
+ * Provider/replacement ambiguity and duplicate installed names are never guessed.
+ */
+export function composerRelations(packages, roots, budget = createComposerRelationBudget()) {
+    const charge = () => --budget.remaining >= 0;
+    const byName = new Map();
+    const aliased = new Set();
+    for (const pkg of packages) {
+        if (!charge() || pkg.aliases === null)
+            return null;
+        byName.set(pkg.name, byName.has(pkg.name) ? null : pkg);
+        for (const alias of pkg.aliases) {
+            if (!charge())
+                return null;
+            if (alias !== pkg.name)
+                aliased.add(alias);
+        }
+    }
+    const resolve = (name) => aliased.has(name) ? null : byName.get(name) ?? null;
+    const direct = new Set();
+    for (const name of roots) {
+        if (!charge())
+            return null;
+        if (resolve(name))
+            direct.add(name);
+    }
+    const introduced = new Map();
+    for (const origin of direct) {
+        const visited = new Set([origin]);
+        const queue = [origin];
+        while (queue.length > 0) {
+            if (!charge())
+                return null;
+            const current = resolve(queue.pop());
+            for (const name of current?.requires ?? []) {
+                if (!charge())
+                    return null;
+                const target = resolve(name);
+                if (!target || visited.has(name))
+                    continue;
+                visited.add(name);
+                queue.push(name);
+                let sources = introduced.get(name);
+                if (!sources)
+                    introduced.set(name, sources = new Set());
+                sources.add(origin);
+            }
+        }
+    }
+    const results = new Map();
+    for (const [name, pkg] of byName) {
+        if (!charge())
+            return null;
+        if (!pkg || aliased.has(name))
+            continue;
+        const sources = introduced.get(name);
+        results.set(JSON.stringify([name, pkg.version]), {
+            relation: direct.has(name) ? "direct" : sources ? "transitive" : "unknown",
+            ...(direct.has(name) ? { declaredIn: new Set(["composer.json"]) } : {}),
+            ...(sources ? { introducedBy: sources } : {}),
+        });
+    }
+    return (name, version) => results.get(JSON.stringify([name, version])) ?? { relation: "unknown" };
+}

package/dist/utils/manifestDetector.js

@@ -20,6 +20,7 @@ import { analyzeRequirementsFile, createRequirementsReadContext, } from "./requi
 import { cargoTomlPackageName, cargoWorkspace, workspaceIncludes, createGlobWorkBudget, classifyCargoPackages, createCargoLockParseBudget, parseCargoLock, UNSCANNABLE_CRATE_REASONS, } from "./cargoLock.js";
 import { analyzeNuget, collectNugetFile, emptyNugetFiles, NUGET_DEPS_JSON, NUGET_LOCKFILE, NUGET_PACKAGES_CONFIG, NUGET_PROJECT_ASSETS, NUGET_PROJECT_FILE, } from "./nugetProject.js";
 import { composerLockCopy } from "./composerLock.js";
+import { composerRelations, composerRootRequirements, createComposerRelationBudget } from "./composerRelations.js";
 /** ファイル名→(エコシステム, 解析形式)。npm-shrinkwrap.jsonはpackage-lock.json形式で解析する */
 const LOCKFILES = new Map([
     ["pom.xml", { ecosystem: "Maven", format: "pom.xml" }],
@@ -306,6 +307,7 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
     };
     const readContext = createRequirementsReadContext();
     const composerBudget = createNpmLockWorkBudget();
+    const composerRelationBudget = createComposerRelationBudget();
     let composerBytes = MAX_NPM_LOCK_TOTAL_BYTES;
     // A null value permanently marks a crate name with multiple declaration paths.
     const cargoManifests = new Map();
@@ -330,8 +332,24 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
             composerBytes -= read.bytes.length;
             try {
                 const parsed = composerLockCopy(read.bytes.toString("utf8"), composerBudget);
-                if (parsed.packageCount > 0)
-                    result.composerCopies.push({ path: manifest.path, content: parsed.content });
+                if (parsed.packageCount > 0) {
+                    let relations = null;
+                    const companion = await readRegularFile(path.join(path.dirname(absolute), "composer.json"), {
+                        maxBytes: Math.min(4 * 1024 * 1024, composerBytes), boundary: projectDir,
+                    });
+                    if (companion.ok) {
+                        composerBytes -= companion.bytes.length;
+                        try {
+                            const roots = composerRootRequirements(companion.bytes.toString("utf8"), composerBudget);
+                            if (roots !== null)
+                                relations = composerRelations(parsed.relationPackages, roots, composerRelationBudget);
+                        }
+                        catch { /* A companion failure affects relationships, not the scanned lockfile. */ }
+                    }
+                    if (relations === null)
+                        result.composerWarnings.push(`${manifest.path}: Dependency relationships are unknown because its companion composer.json is unavailable/uninterpretable or the dependency analysis limit was reached; locked release packages are still scanned`);
+                    result.composerCopies.push({ path: manifest.path, content: parsed.content, relations });
+                }
                 result.skippedFiles.push(...parsed.issues.map((reason) => ({ path: manifest.path, reason })));
                 result.composerWarnings.push(...parsed.warnings.map((warning) => `${manifest.path}: ${warning}`));
                 result.composerLocalPackages += parsed.localPackages;

package/dist/utils/nugetVersion.js

@@ -0,0 +1,41 @@
+const INT_MAX = 2_147_483_647;
+export function parseNugetVersion(version) {
+    if (version.length > 256)
+        return null;
+    const match = /^(\d{1,10}(?:\.\d{1,10}){0,3})(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(version);
+    if (!match || match[0] !== version)
+        return null;
+    const parts = match[1].split(".").map(Number);
+    if (parts.some(n => n > INT_MAX))
+        return null;
+    while (parts.length < 4)
+        parts.push(0);
+    const prerelease = match[2]?.toLowerCase().split(".") ?? [];
+    // NuGet rejects purely numeric release labels with leading zeroes.
+    if (prerelease.some(label => /^0\d+$/.test(label)))
+        return null;
+    return { parts, prerelease };
+}
+export function compareNugetVersions(a, b) {
+    const x = parseNugetVersion(a), y = parseNugetVersion(b);
+    if (!x || !y)
+        return 0;
+    for (let i = 0; i < 4; i++)
+        if (x.parts[i] !== y.parts[i])
+            return x.parts[i] < y.parts[i] ? -1 : 1;
+    if (x.prerelease.length === 0 || y.prerelease.length === 0) {
+        return x.prerelease.length === y.prerelease.length ? 0 : x.prerelease.length === 0 ? 1 : -1;
+    }
+    for (let i = 0; i < Math.min(x.prerelease.length, y.prerelease.length); i++) {
+        const left = x.prerelease[i], right = y.prerelease[i];
+        const numeric = (label) => /^-?\d+$/.test(label) && Number(label) >= -2_147_483_648 && Number(label) <= INT_MAX;
+        const leftNumeric = numeric(left);
+        const rightNumeric = numeric(right);
+        if (leftNumeric !== rightNumeric)
+            return leftNumeric ? -1 : 1;
+        const l = leftNumeric ? Number(left) : left, r = rightNumeric ? Number(right) : right;
+        if (l !== r)
+            return l < r ? -1 : 1;
+    }
+    return Math.sign(x.prerelease.length - y.prerelease.length);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osv-scanner-mcp",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "MCP server that wraps Google's OSV-Scanner to scan Java, JavaScript, Python, Go, Rust, .NET, and PHP dependencies for known vulnerabilities and recommend fixes",
   "type": "module",
   "license": "Apache-2.0",