osv-scanner-mcp 0.18.0 → 0.19.0

package/README.md

@@ -27,7 +27,11 @@ An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-sc
 
 ## Composer support
 
-Pass a project directory, `composer.lock`, or `composer.json` to `scan_project` or `suggest_fix`. The lockfile records both direct and transitive dependencies; their relationship is currently reported as `unknown`. A `composer.json` without a lockfile in the same directory is reported as missing/unconfirmed in `coverage.lockfile_missing` (a project with no scannable files returns `no_manifest_found`). An ancestor's lockfile does not establish coverage for an independent child project. `vendor` directories are not traversed.
+Pass a project directory, `composer.lock`, or `composer.json` to `scan_project` or `suggest_fix`. Direct/transitive dependency analysis (source checkout) uses the companion `composer.json` in the lockfile's own directory. A `composer.json` without a lockfile in the same directory is reported as missing/unconfirmed in `coverage.lockfile_missing` (a project with no scannable files returns `no_manifest_found`). An ancestor's lockfile does not establish coverage for an independent child project. `vendor` directories are not traversed.
+
+The companion's `require` and `require-dev` are direct dependencies. Packages reachable through the locked packages' `require` are transitive; a dependency's own `require-dev`, `suggest`, and `conflict` are not dependency edges. Direct dependencies include their project-relative `composer.json` in `declared_in`. `introduced_by` names each direct root that transitively requires a package (up to 10, with the remainder in `introduced_by_omitted`). A direct dependency also required by another root remains direct and includes that root in `introduced_by`; cycles do not introduce a package through itself. Transitive dependencies do not have `declared_in`, since the root does not declare them directly.
+
+This is name-based graph traversal of the lockfile, not a Composer constraint solver or freshness check. Duplicate installed names, virtual requirements, and references affected by `provide`/`replace` are not guessed; unreachable packages remain `unknown`. Local path and skipped branch entries may connect roots to scanned packages, but their names/metadata are still excluded from scanner input. No path-repository URL or nested package's composer.json is followed. Missing, malformed, symlinked, oversized, or otherwise unreadable companion manifests leave relationships unknown, with a `composer_warnings` note; locked release packages continue to be scanned. The companion is captured safely once (4 MiB per file), shares the Composer 64 MiB input/JSON structure budgets, and traversal/indexing share a 2,000,000-operation budget across all Composer lockfiles. Relationship uncertainty does not itself make dependency scan coverage incomplete.
 
 The server reads each lockfile safely and scans a private sanitized copy containing only package names and release versions. Repository URLs, dist/source commit references, scripts, and credentials are not passed to OSV-Scanner. Both production and development packages are included. JSON is limited to 16 MiB per lockfile and 64 MiB per scan, with structural work limits. Invalid JSON is excluded; invalid entries and unsupported versions are omitted and reported in `skipped_files`, making `coverage.complete` false.
 
@@ -308,6 +312,7 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
   - `pom.xml`: OSV-Scanner reports the dependencies declared in `pom.xml` (and its parent POMs) and the transitive dependencies resolved through deps.dev as separate results (`source.type` `lockfile` / `unknown`), and this split is used (so parent POMs, profiles, properties, and dependency management are interpreted exactly as OSV-Scanner does). `introduced_by` / `declared_in` are not available. This relies on undocumented OSV-Scanner output, so anything unexpected is reported as `unknown`
   - `Cargo.lock`: crates.io dependencies immediately required by a local/workspace/path crate are direct; crates.io dependencies reachable through them (including git and alternate-registry origins) are transitive. `introduced_by` names the first direct dependency on each path. References are resolved by exact name, version, and source where provided; ambiguous references are not guessed. Replacements are followed. `declared_in` lists project-relative Cargo.toml paths only when every declaring crate has a unique matching manifest. Otherwise `declaring_crates` names the unmapped declaring crates (up to 10, with the rest in `declaring_crates_omitted`). Dev/build/target-specific distinctions are unavailable. Traversal over 2,000,000 edges returns `unknown`
   - .NET: `Direct` / `Transitive` in `packages.lock.json`; the dependencies of `project.frameworks` in `project.assets.json`; the dependencies of the project library in `*.deps.json`; and every reference read from a project file are direct. `packages.config` does not say, so it is `unknown`. `introduced_by` and `declared_in` are not available yet
+  - Composer (source checkout): the companion root's `require` / `require-dev` are direct, and locked `require` reachability establishes transitive dependencies. `declared_in` names the companion for direct dependencies; `introduced_by` lists transitively requiring direct roots. See [Composer support](#composer-support) for ambiguity and work limits.
   - Other formats (`gradle.lockfile`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, and `pdm.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
 - `dependency_groups` is the raw dependency group reported by OSV-Scanner (for example `dev`). It is missing or inaccurate for some lockfile formats (absent for pnpm, `optional` for pdm, and so on), so treat it as informational
 - Upgrade recommendations (`suggest_fix`) are available for Maven, npm, PyPI, Go, Rust (crates.io), PHP (Packagist), and .NET (NuGet; source checkout).
@@ -489,6 +494,7 @@ For npm, Go, PyPI, and Rust, the "same release line" is the range a caret (`^`)
 - Suggestions include an `update_hint`, tailored to whether the package is a direct or transitive dependency:
   - Maven (from `pom.xml`): for a direct dependency, update the `<dependency>` version (or the parent POM, property, or BOM that manages it); for a transitive dependency, override the version in `<dependencyManagement>` or update the direct dependency that requires it
   - npm: for a direct dependency, update the version in the `package.json` listed in `declared_in`; for a transitive dependency, update the direct dependency named in `introduced_by`, or set the version with `overrides` in the root `package.json` (effective only in the root project)
+  - Composer: for direct dependencies, update the constraint in `declared_in`; for transitive dependencies, update the direct roots in `introduced_by` or their constraints, then regenerate the lockfile with dependency updates allowed, scripts and plugins disabled. PHP and dependency compatibility still require verification.
   - Go: `go get <module>@<version>` (also for `// indirect` modules). For a module affected by `replace`, update the version in the `replace` directive instead of `require`. Major versions 2 and later use a different module path (`/v2` and so on) and are separate packages in OSV, so fixes in a newer major line are not included as candidates. If the current version is a pseudo-version (an untagged commit), `upgrade_note` says so
   - PyPI: update the version in `requirements.txt`, `pyproject.toml`, or `Pipfile` and regenerate the lockfile; for a transitive dependency, use a pip constraints file (`-c`) or the override settings of uv or Poetry
   - Rust: where version requirements permit it, `cargo update -p <crate>@<current> --precise <recommended>` updates the lockfile. Otherwise change the direct requirement in the declaring Cargo.toml or update the parent dependency in `introduced_by`. Cross-major upgrades may break compatibility, including 0.x updates. Pre-releases may require explicit `=<version>` requirements and must be allowed by transitive parents. Build metadata is omitted from `--precise`. `[patch.crates-io]` changes a source, not the allowed version range; backports must satisfy parent requirements. Check yanked versions, MSRV, and compiler compatibility. Cargo is never executed by the server

package/dist/index.js

@@ -66,7 +66,7 @@ if (startupWarning !== null) {
     }
 }
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
-const SERVER_VERSION = "0.18.0";
+const SERVER_VERSION = "0.19.0";
 const server = new McpServer({
     name: "osv-scanner-mcp",
     version: SERVER_VERSION,
@@ -88,8 +88,8 @@ server.registerTool("scan_project", {
         "a PackageReference Version=\"x\" is looked up at its lower bound (version_is_lower_bound), and references with properties, ranges without a lower bound, floating versions, conditions, or Update/Remove are not looked up (unresolved_package_references). " +
         "The project's own projects are counted in local_projects. Names of packages from private NuGet feeds are also sent to api.osv.dev; see nuget_warnings. " +
         "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
-        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, and pom.xml; unknown otherwise). " +
-        "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
+        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, pom.xml, Cargo.lock, .NET files and Composer; unknown where the format or captured metadata cannot establish it). " +
+        "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. A safely captured companion composer.json defines direct require/require-dev roots; locked require edges establish introduced_by, and direct declarations use declared_in. Missing/uninterpretable companions, ambiguous providers/replacements or names, and analysis limits leave relationships unknown. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
         "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, Rust, PHP, and .NET (NuGet). Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
     inputSchema: {
         project_path: z
@@ -121,7 +121,7 @@ server.registerTool("suggest_fix", {
         "(same_minor: same release line -> major_internal: same major version -> cross_major: major upgrade), " +
         "and the response gives the recommended version, the upgrade distance (upgrade_tier), and the fixed version per CVE. For npm, Go, PyPI, and Rust, a minor update within 0.x is also cross_major (may include breaking changes). " +
         "Dependencies scanned at a requirements.txt lower bound (>=) or a NuGet PackageReference minimum/range are marked version_is_lower_bound, and the recommendation then means raising the lower bound rather than confirming the installed version. " +
-        "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm and Cargo.lock also introduced_by and declared_in). Cargo updates are conditional on parent version requirements; cross-major updates may require Cargo.toml changes. " +
+        "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm, Cargo.lock and Composer also introduced_by and declared_in). Composer hints name the declaring manifest for direct dependencies and the introducing roots for transitive dependencies; regenerate the lockfile in a trusted environment and verify constraints. Cargo updates are conditional on parent version requirements; cross-major updates may require Cargo.toml changes. " +
         "The recommended version is checked against api.osv.dev, and versions with known vulnerabilities that do not affect the current version are avoided (result in candidate_check). " +
         "clean excludes known unfixed advisories, known informational advisories that are not fix targets, and new Rust unmaintained/notice records; these may still apply. New unsound records are fix targets. " +
         "With has_known_vulnerabilities, failed, or skipped, the recommended version has not been confirmed safe; conflict means the data disagreed and the recommendation is withheld. " +

package/dist/osv/suggestFix.js

@@ -38,6 +38,15 @@ function updateHint(pkg) {
     const relation = pkg.dependency_relation;
     const by = pkg.introduced_by?.join(", ");
     switch (pkg.ecosystem) {
+        case "Packagist": {
+            if (relation === "direct")
+                return `Direct dependency. Update its constraint in ${pkg.declared_in?.join(", ") ?? "composer.json"}` +
+                    (by ? `. It is also required transitively by ${by}, whose constraints may need updating` : "") +
+                    ". Regenerate composer.lock in a trusted environment with Composer scripts and plugins disabled; check PHP, extension and dependency constraints. Composer is not executed by this server";
+            if (relation === "transitive")
+                return `Transitive dependency. Update ${by ? `the direct dependencies that require it (${by})` : "the direct dependency that requires it"} or adjust their constraints, then regenerate composer.lock with --with-all-dependencies --no-scripts --no-plugins in a trusted environment. Check PHP and extension requirements. Composer is not executed by this server`;
+            return UPDATE_HINTS.Packagist;
+        }
         case "NuGet": {
             if (/^Microsoft\.(?:NETCore|AspNetCore|WindowsDesktop)\.App\.Runtime\./i.test(pkg.name)) {
                 return "Runtime pack. Update the .NET SDK/runtime or target framework that supplies this pack and regenerate restore/build outputs; do not add an explicit PackageReference merely to change the runtime pack. Check framework/RID compatibility and rescan. This server does not run dotnet restore or MSBuild";

package/dist/tools/scanProject.js

@@ -166,7 +166,7 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
     const lookups = new Map();
     const npmWorkBudget = createNpmLockWorkBudget();
     let remaining = maxTotalBytes;
-    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages } of copies) {
+    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages, composerLookup } of copies) {
         const lockDir = originalRelative === null ? "" : path.dirname(originalRelative);
         let lookup = null;
         try {
@@ -191,6 +191,9 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
             else if (format === "packages.lock.json" && nugetPackages !== undefined) {
                 lookup = nugetRelations(nugetPackages);
             }
+            else if (format === "composer.lock") {
+                lookup = composerLookup ?? null;
+            }
         }
         catch {
             lookup = null; // 解析できないファイルはunknown(スキャン自体は続ける)
@@ -324,7 +327,7 @@ export async function scanFromSnapshot(project, options) {
         for (const copy of project.composerCopies ?? []) {
             const generated = await snapshot.writeGenerated(copy.content);
             targets.push({ path: generated, format: "composer.lock" });
-            relationSources.push({ copy: generated, format: "composer.lock", originalRelative: copy.path });
+            relationSources.push({ copy: generated, format: "composer.lock", originalRelative: copy.path, composerLookup: copy.relations });
         }
         if (targets.length === 0)
             return parseOsvScanOutput({ results: [] });

package/dist/utils/composerLock.js

@@ -1,5 +1,6 @@
 import { parseNpmLock } from "./npmLockCopy.js";
 import { parseComposerVersion } from "./composerVersion.js";
+import { composerLinkNames, composerPackageName } from "./composerRelations.js";
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Only names and release versions reach OSV; repository URLs, scripts, and commit IDs are never forwarded. */
 export function composerLockCopy(text, budget) {
@@ -9,6 +10,7 @@ export function composerLockCopy(text, budget) {
     }
     const issues = [];
     const warnings = [];
+    const relationPackages = [];
     let uncertainOrigin = 0;
     // dist.type=pathは自分のコード(monorepoのパッケージ)。Rustのlocal_crates・.NETのlocal_projectsと同じく数だけ返し、範囲の欠けにしない
     let localPackages = 0;
@@ -17,11 +19,16 @@ export function composerLockCopy(text, budget) {
         const packages = [];
         let skipped = 0;
         for (const raw of (data[group] ?? [])) {
+            if (record(raw) && composerPackageName(raw.name)) {
+                const provides = composerLinkNames(raw.provide), replaces = composerLinkNames(raw.replace);
+                relationPackages.push({ name: raw.name, version: typeof raw.version === "string" ? raw.version : "",
+                    requires: composerLinkNames(raw.require), aliases: provides === null || replaces === null ? null : [...provides, ...replaces] });
+            }
             if (record(raw) && record(raw.dist) && raw.dist.type === "path") {
                 localPackages++;
                 continue;
             }
-            if (!record(raw) || typeof raw.name !== "string" || !/^[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/.test(raw.name) || raw.name.length > 200 ||
+            if (!record(raw) || !composerPackageName(raw.name) ||
                 typeof raw.version !== "string" || parseComposerVersion(raw.version) === null) {
                 skipped++;
                 continue;
@@ -36,5 +43,5 @@ export function composerLockCopy(text, budget) {
     }
     if (uncertainOrigin > 0)
         warnings.push(`${uncertainOrigin} Composer package entries lack the standard Packagist notification URL. Their names and versions are sent to api.osv.dev as Packagist packages; private or forked packages may produce false positives. The notification URL is only a heuristic and does not prove origin`);
-    return { content: JSON.stringify(output), issues, warnings, packageCount: output.packages.length + output["packages-dev"].length, localPackages };
+    return { content: JSON.stringify(output), issues, warnings, packageCount: output.packages.length + output["packages-dev"].length, localPackages, relationPackages };
 }

package/dist/utils/composerRelations.js

@@ -0,0 +1,96 @@
+import { MAX_DEPENDENCY_EDGES } from "./dependencyRelations.js";
+import { parseNpmLock } from "./npmLockCopy.js";
+export const createComposerRelationBudget = () => ({ remaining: MAX_DEPENDENCY_EDGES });
+const record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+export const composerPackageName = (v) => typeof v === "string" && v.length <= 200 && /^[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/.test(v);
+/** Platform requirements such as php, ext-json and lib-* are not package edges. */
+export function composerLinkNames(value) {
+    if (value === undefined)
+        return [];
+    if (!record(value))
+        return null;
+    const names = [];
+    for (const [name, constraint] of Object.entries(value)) {
+        if (typeof constraint !== "string")
+            return null;
+        const looksLikePackage = name.includes("/");
+        if (composerPackageName(name))
+            names.push(name);
+        else if (looksLikePackage)
+            return null;
+    }
+    return names;
+}
+/** Analyze only the captured companion manifest, never another root or a path repository's URL. */
+export function composerRootRequirements(text, budget) {
+    const root = parseNpmLock(text, budget);
+    if (!record(root))
+        return null;
+    const production = composerLinkNames(root.require), dev = composerLinkNames(root["require-dev"]);
+    return production === null || dev === null ? null : [...new Set([...production, ...dev])];
+}
+/** Name-based reachability of the locked solution, not a Composer constraint solver.
+ * require-dev is root-only; suggest/conflict/replace/provide are not dependency edges.
+ * Provider/replacement ambiguity and duplicate installed names are never guessed.
+ */
+export function composerRelations(packages, roots, budget = createComposerRelationBudget()) {
+    const charge = () => --budget.remaining >= 0;
+    const byName = new Map();
+    const aliased = new Set();
+    for (const pkg of packages) {
+        if (!charge() || pkg.aliases === null)
+            return null;
+        byName.set(pkg.name, byName.has(pkg.name) ? null : pkg);
+        for (const alias of pkg.aliases) {
+            if (!charge())
+                return null;
+            if (alias !== pkg.name)
+                aliased.add(alias);
+        }
+    }
+    const resolve = (name) => aliased.has(name) ? null : byName.get(name) ?? null;
+    const direct = new Set();
+    for (const name of roots) {
+        if (!charge())
+            return null;
+        if (resolve(name))
+            direct.add(name);
+    }
+    const introduced = new Map();
+    for (const origin of direct) {
+        const visited = new Set([origin]);
+        const queue = [origin];
+        while (queue.length > 0) {
+            if (!charge())
+                return null;
+            const current = resolve(queue.pop());
+            for (const name of current?.requires ?? []) {
+                if (!charge())
+                    return null;
+                const target = resolve(name);
+                if (!target || visited.has(name))
+                    continue;
+                visited.add(name);
+                queue.push(name);
+                let sources = introduced.get(name);
+                if (!sources)
+                    introduced.set(name, sources = new Set());
+                sources.add(origin);
+            }
+        }
+    }
+    const results = new Map();
+    for (const [name, pkg] of byName) {
+        if (!charge())
+            return null;
+        if (!pkg || aliased.has(name))
+            continue;
+        const sources = introduced.get(name);
+        results.set(JSON.stringify([name, pkg.version]), {
+            relation: direct.has(name) ? "direct" : sources ? "transitive" : "unknown",
+            ...(direct.has(name) ? { declaredIn: new Set(["composer.json"]) } : {}),
+            ...(sources ? { introducedBy: sources } : {}),
+        });
+    }
+    return (name, version) => results.get(JSON.stringify([name, version])) ?? { relation: "unknown" };
+}

package/dist/utils/manifestDetector.js

@@ -20,6 +20,7 @@ import { analyzeRequirementsFile, createRequirementsReadContext, } from "./requi
 import { cargoTomlPackageName, cargoWorkspace, workspaceIncludes, createGlobWorkBudget, classifyCargoPackages, createCargoLockParseBudget, parseCargoLock, UNSCANNABLE_CRATE_REASONS, } from "./cargoLock.js";
 import { analyzeNuget, collectNugetFile, emptyNugetFiles, NUGET_DEPS_JSON, NUGET_LOCKFILE, NUGET_PACKAGES_CONFIG, NUGET_PROJECT_ASSETS, NUGET_PROJECT_FILE, } from "./nugetProject.js";
 import { composerLockCopy } from "./composerLock.js";
+import { composerRelations, composerRootRequirements, createComposerRelationBudget } from "./composerRelations.js";
 /** ファイル名→(エコシステム, 解析形式)。npm-shrinkwrap.jsonはpackage-lock.json形式で解析する */
 const LOCKFILES = new Map([
     ["pom.xml", { ecosystem: "Maven", format: "pom.xml" }],
@@ -306,6 +307,7 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
     };
     const readContext = createRequirementsReadContext();
     const composerBudget = createNpmLockWorkBudget();
+    const composerRelationBudget = createComposerRelationBudget();
     let composerBytes = MAX_NPM_LOCK_TOTAL_BYTES;
     // A null value permanently marks a crate name with multiple declaration paths.
     const cargoManifests = new Map();
@@ -330,8 +332,24 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
             composerBytes -= read.bytes.length;
             try {
                 const parsed = composerLockCopy(read.bytes.toString("utf8"), composerBudget);
-                if (parsed.packageCount > 0)
-                    result.composerCopies.push({ path: manifest.path, content: parsed.content });
+                if (parsed.packageCount > 0) {
+                    let relations = null;
+                    const companion = await readRegularFile(path.join(path.dirname(absolute), "composer.json"), {
+                        maxBytes: Math.min(4 * 1024 * 1024, composerBytes), boundary: projectDir,
+                    });
+                    if (companion.ok) {
+                        composerBytes -= companion.bytes.length;
+                        try {
+                            const roots = composerRootRequirements(companion.bytes.toString("utf8"), composerBudget);
+                            if (roots !== null)
+                                relations = composerRelations(parsed.relationPackages, roots, composerRelationBudget);
+                        }
+                        catch { /* A companion failure affects relationships, not the scanned lockfile. */ }
+                    }
+                    if (relations === null)
+                        result.composerWarnings.push(`${manifest.path}: Dependency relationships are unknown because its companion composer.json is unavailable/uninterpretable or the dependency analysis limit was reached; locked release packages are still scanned`);
+                    result.composerCopies.push({ path: manifest.path, content: parsed.content, relations });
+                }
                 result.skippedFiles.push(...parsed.issues.map((reason) => ({ path: manifest.path, reason })));
                 result.composerWarnings.push(...parsed.warnings.map((warning) => `${manifest.path}: ${warning}`));
                 result.composerLocalPackages += parsed.localPackages;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osv-scanner-mcp",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "MCP server that wraps Google's OSV-Scanner to scan Java, JavaScript, Python, Go, Rust, .NET, and PHP dependencies for known vulnerabilities and recommend fixes",
   "type": "module",
   "license": "Apache-2.0",