osv-scanner-mcp 0.18.0 → 0.20.0

package/README.md

@@ -27,7 +27,11 @@ An MCP server that wraps Google's [OSV-Scanner](https://github.com/google/osv-sc
 
 ## Composer support
 
-Pass a project directory, `composer.lock`, or `composer.json` to `scan_project` or `suggest_fix`. The lockfile records both direct and transitive dependencies; their relationship is currently reported as `unknown`. A `composer.json` without a lockfile in the same directory is reported as missing/unconfirmed in `coverage.lockfile_missing` (a project with no scannable files returns `no_manifest_found`). An ancestor's lockfile does not establish coverage for an independent child project. `vendor` directories are not traversed.
+Pass a project directory, `composer.lock`, or `composer.json` to `scan_project` or `suggest_fix`. Direct/transitive dependency analysis (source checkout) uses the companion `composer.json` in the lockfile's own directory. A `composer.json` without a lockfile in the same directory is reported as missing/unconfirmed in `coverage.lockfile_missing` (a project with no scannable files returns `no_manifest_found`). An ancestor's lockfile does not establish coverage for an independent child project. `vendor` directories are not traversed.
+
+The companion's `require` and `require-dev` are direct dependencies. Packages reachable through the locked packages' `require` are transitive; a dependency's own `require-dev`, `suggest`, and `conflict` are not dependency edges. Direct dependencies include their project-relative `composer.json` in `declared_in`. `introduced_by` names each direct root that transitively requires a package (up to 10, with the remainder in `introduced_by_omitted`). A direct dependency also required by another root remains direct and includes that root in `introduced_by`; cycles do not introduce a package through itself. Transitive dependencies do not have `declared_in`, since the root does not declare them directly.
+
+This is name-based graph traversal of the lockfile, not a Composer constraint solver or freshness check. Duplicate installed names, virtual requirements, and references affected by `provide`/`replace` are not guessed; unreachable packages remain `unknown`. Local path and skipped branch entries may connect roots to scanned packages, but their names/metadata are still excluded from scanner input. No path-repository URL or nested package's composer.json is followed. Missing, malformed, symlinked, oversized, or otherwise unreadable companion manifests leave relationships unknown, with a `composer_warnings` note; locked release packages continue to be scanned. The companion is captured safely once (4 MiB per file), shares the Composer 64 MiB input/JSON structure budgets, and traversal/indexing share a 2,000,000-operation budget across all Composer lockfiles. Relationship uncertainty does not itself make dependency scan coverage incomplete.
 
 The server reads each lockfile safely and scans a private sanitized copy containing only package names and release versions. Repository URLs, dist/source commit references, scripts, and credentials are not passed to OSV-Scanner. Both production and development packages are included. JSON is limited to 16 MiB per lockfile and 64 MiB per scan, with structural work limits. Invalid JSON is excluded; invalid entries and unsupported versions are omitted and reported in `skipped_files`, making `coverage.complete` false.
 
@@ -291,7 +295,7 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
 ```
 
 - **Always check `coverage`.** If `complete` is `false`, some dependencies were not scanned, so zero findings does not mean the project is safe
-  - `lockfile_missing`: manifests without a lockfile (`package.json`, `pyproject.toml`, `Pipfile`, `setup.py`, `build.gradle`, `Cargo.toml`, and so on). Not recorded if a lockfile of the same ecosystem is in the same directory. If there is only a lockfile in a parent directory, the manifest is not recorded only when `package-lock.json` (v2 or later) is confirmed to contain that directory (npm workspaces), or when `Cargo.lock` contains a local crate with the `[package] name` of the `Cargo.toml` and the directory is a member of the workspace according to `members` / `exclude` of the `Cargo.toml` next to `Cargo.lock` (Cargo workspaces; `members` globs with `*` and `?` are supported). A crate with the same name that cannot be confirmed as a member, such as a path dependency outside the workspace, is recorded as `unconfirmed`. Library crates often do not commit `Cargo.lock`, so their `Cargo.toml` is recorded here; generate one with `cargo generate-lockfile`. Otherwise it is recorded with `status: "missing"`, or `status: "unconfirmed"` for formats that cannot be checked (yarn.lock, Python lockfiles, and so on). Generate the lockfile as described in `hint` (in a trusted environment) and scan again
+  - `lockfile_missing`: manifests without a lockfile (`package.json`, `pyproject.toml`, `Pipfile`, `setup.py`, `build.gradle`, `Cargo.toml`, and so on). Not recorded if a lockfile of the same ecosystem is in the same directory. If there is only a lockfile in a parent directory, the manifest is not recorded only when `package-lock.json` (v2 or later) is confirmed to contain that directory (npm workspaces), when `pnpm-lock.yaml` (formats 5.3/5.4/6.0/9.0) contains its exact normalized importer path (pnpm workspaces; source checkout), when Yarn workspace membership and captured declarations can be confirmed (see below; source checkout), or when `Cargo.lock` contains a local crate with the `[package] name` of the `Cargo.toml` and the directory is a member of the workspace according to `members` / `exclude` of the `Cargo.toml` next to `Cargo.lock` (Cargo workspaces; `members` globs with `*` and `?` are supported). A crate with the same name that cannot be confirmed as a member, such as a path dependency outside the workspace, is recorded as `unconfirmed`. Library crates often do not commit `Cargo.lock`, so their `Cargo.toml` is recorded here; generate one with `cargo generate-lockfile`. Otherwise it is recorded with `status: "missing"`, or `status: "unconfirmed"` for formats that cannot be checked (unsupported Yarn layouts, Python lockfiles, and so on). Generate the lockfile as described in `hint` (in a trusted environment) and scan again
   - `unpinned_requirements`: lines in `requirements.txt` that do not pin a version. `kind` is `unpinned` (no version), `range` (`>`, `<`, `!=`, `==1.*`, combined ranges, and so on), or `lower_bound` (`>=`, `~=`). OSV-Scanner does not scan `unpinned` and `range` lines, and scans `lower_bound` lines at the lower bound (those packages are marked `version_is_lower_bound: true` and may differ from the installed version)
   - `unscannable_requirements`: lines that are not scanned, with the reason: `-e`, `name @ URL`, paths, includes that were not expanded (outside the project directory, missing, URLs, or over the limits), constraint files (`-c`, not applied), and options or version specifiers that cannot be interpreted. Lines that cannot be interpreted are recorded here instead of being ignored
   - `local_crates` (only when a `Cargo.lock` was scanned): the number of crates without a source in `Cargo.lock` (workspace members and path dependencies). They are your own code and are not scanned; they do not make `complete` false. A third-party crate vendored as a path dependency is not scanned either (as with `cargo audit`)
@@ -307,8 +311,21 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
   - `requirements.txt`: dependencies written in the file are direct; dependencies resolved through deps.dev are transitive
   - `pom.xml`: OSV-Scanner reports the dependencies declared in `pom.xml` (and its parent POMs) and the transitive dependencies resolved through deps.dev as separate results (`source.type` `lockfile` / `unknown`), and this split is used (so parent POMs, profiles, properties, and dependency management are interpreted exactly as OSV-Scanner does). `introduced_by` / `declared_in` are not available. This relies on undocumented OSV-Scanner output, so anything unexpected is reported as `unknown`
   - `Cargo.lock`: crates.io dependencies immediately required by a local/workspace/path crate are direct; crates.io dependencies reachable through them (including git and alternate-registry origins) are transitive. `introduced_by` names the first direct dependency on each path. References are resolved by exact name, version, and source where provided; ambiguous references are not guessed. Replacements are followed. `declared_in` lists project-relative Cargo.toml paths only when every declaring crate has a unique matching manifest. Otherwise `declaring_crates` names the unmapped declaring crates (up to 10, with the rest in `declaring_crates_omitted`). Dev/build/target-specific distinctions are unavailable. Traversal over 2,000,000 edges returns `unknown`
-  - .NET: `Direct` / `Transitive` in `packages.lock.json`; the dependencies of `project.frameworks` in `project.assets.json`; the dependencies of the project library in `*.deps.json`; and every reference read from a project file are direct. `packages.config` does not say, so it is `unknown`. `introduced_by` and `declared_in` are not available yet
-  - Other formats (`gradle.lockfile`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, and `pdm.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
+  - .NET: `Direct` / `Transitive` in `packages.lock.json`; the dependencies of `project.frameworks` in `project.assets.json`; the dependencies of the project library in `*.deps.json`; and every reference read from a project file are direct. `packages.config` does not say, so it is `unknown`. Origin/declaration enrichment is available in the source checkout as described below.
+  - Composer (source checkout): the companion root's `require` / `require-dev` are direct, and locked `require` reachability establishes transitive dependencies. `declared_in` names the companion for direct dependencies; `introduced_by` lists transitively requiring direct roots. See [Composer support](#composer-support) for ambiguity and work limits.
+  - `pnpm-lock.yaml` (source checkout): lockfile formats 5.3, 5.4, 6.0 and 9.0 are supported. Importer `dependencies`, `devDependencies` and `optionalDependencies` are direct, with the lockfile's declaring importer `package.json` paths in `declared_in`. Locked dependency and optional-dependency edges establish `introduced_by` and transitive reachability. Workspace importers, npm aliases, scoped packages, multiple origins and peer-context-specific snapshots are supported. A package that is both direct and transitively required remains direct and also lists its origins. Local/Git references, unresolved identities and unreachable packages do not establish relationships; links and source files are never followed. Declaration paths reflect the lockfile, not independently verified current manifests. Workspace coverage (source checkout) uses the exact normalized importer path relative to an ancestor pnpm-lock.yaml: included children are covered, absent importers are `missing`, and unsupported/malformed/ambiguous or analysis-limited importer metadata is `unconfirmed`. Empty importer maps and Unicode/space paths are supported. Importer presence does not prove freshness or agreement with current package.json dependencies. Only lockfiles found inside the selected scan directory are considered. Coverage and vulnerability scanning use the same captured lockfile bytes (16 MiB per file, 64 MiB total); unreadable or oversized inputs are skipped with a reason. Importer parsing/indexing shares a 2,000,000-operation budget per detection, separate from relationship analysis. The lockfile is read from YAML's syntax tree in linear time (only strings, maps, and sequences; a 28,000-package lockfile takes about a second). Unsupported/malformed YAML, duplicate keys, anchors, aliases, tags, multi-document files, conservative nesting/line limits, inputs above 16 MiB, or more than 2,000,000 relationship operations per scan (shared by all pnpm lockfiles) leave relationships unknown; scanning continues. The existing shared relationship input byte limit and 10-origin output limit apply.
+  - `yarn.lock` (source checkout): Classic v1 and Berry metadata versions 4/5/6/8 support direct/transitive relations, `introduced_by` and `declared_in`. Classic uses captured root/workspace `package.json` declarations; Berry uses exact locked descriptors and `workspace:` entries. Dependencies and optional dependencies are followed; peers are not independently guessed or installed. Multiple selectors, scoped/npm aliases, cycles, multiple roots and direct/transitive overlap are supported. Local/Git/patch/portal/virtual identities that cannot establish a registry release remain unknown and are never followed to source files.
+  - Other formats (`gradle.lockfile`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, and `pdm.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
+
+**Yarn workspace coverage (source checkout):** Classic does not contain workspace importer records, so a captured private root's `workspaces` array (or `workspaces.packages`) must include the child and its captured dependency descriptors must resolve in the lockfile or to a uniquely named configured local workspace satisfying the requested SemVer range. Berry matches exact normalized `workspace:` resolution paths and checks captured dependency declarations against the locked workspace. Classic children need a nonempty name and usable version; manifests without them are not workspace members. Wildcards do not consume dot-prefixed path segments unless the pattern explicitly starts that segment with a dot. `*`, `?`, whole-segment `**`, exclusion patterns, one trailing `/` (as Yarn strips it), and Unicode/space paths are supported; other empty segments are unconfirmed; brace/extglob/character-class patterns remain unconfirmed. Independent children are missing; unreadable declarations, unresolved/ambiguous entries and analysis limits are unconfirmed. Coverage confirmation does not prove lockfile freshness or platform compatibility.
+
+Yarn lockfiles and manifests are captured once within the selected scan boundary; coverage, relation metadata and scanning use those same inputs. Yarn is never run during a scan, and links, configuration plugins and source paths are not evaluated. Lockfiles are limited to 16 MiB each / 64 MiB total; captured package manifests to 4 MiB each / 64 MiB total with bounded JSON parsing. YAML nesting/line limits apply. Parsing and workspace coverage share one 2,000,000-operation budget per scan, and relationship analysis has a separate 2,000,000-operation budget, so exceeding the relationship limit leaves relations unknown without making confirmed coverage unconfirmed. Unsupported metadata leaves relations unknown and membership unconfirmed; unreadable/oversized lockfiles are skipped with a reason. A selected lockfile alone does not cause child manifests or files outside the selected scan directory to be searched. Berry declaration paths may come from locked workspace entries when companions were not captured.
+
+**NuGet origins and declarations (source checkout):** `introduced_by` follows dependency edges from direct NuGet packages in each locked TFM or assets/deps target separately, then merges origins only for the same package/version in the report. Case-insensitive IDs and equivalent normalized versions match. `packages.lock.json` and assets targets contain a resolved solution, so edges resolve a unique installed name within that target; dependency constraints are not solved again. `deps.json` edges additionally require an exact normalized version match. Multiple origins and cycles are supported; a root does not introduce itself. Duplicate/ambiguous names and unmatched target frameworks are not guessed. Local project nodes can be traversed but are not guessed as direct package origins and remain excluded from OSV input. `introduced_by` retains the existing 10-name limit and omitted count.
+
+`declared_in` is added to direct packages only when the captured source is uniquely associated with a `.csproj`/`.fsproj`/`.vbproj` and that captured project contains an unambiguous, unconditional `PackageReference` for the ID. A missing/property/range/floating version can still identify the reference when the restore result confirms its direct package; version resolution continues to come from restore metadata. Conditional, removed, updated, or duplicated references are not guessed. The field names the reference's project file, not the storage location of its centrally managed version. Direct-only project scans also expose this path and preserve lower-bound/coverage warnings. A standalone selected lockfile/assets file without captured project evidence, an ambiguous shared lockfile, `packages.config`, and a deployed `deps.json` do not imply a project declaration path. Paths embedded in restore/build outputs are not followed to read source files.
+
+Graphs and declarations use already captured, size-limited inputs, without running restore or MSBuild or forwarding graph metadata to OSV. A shared 2,000,000-operation relationship budget bounds indexing/traversal/declaration work across the scan. Exhaustion omits uncertain metadata and adds a NuGet warning; existing vulnerability scanning and direct/transitive classification continue. Neither dependency reachability nor declaration matching proves freshness, constraint satisfaction, or TFM/RID compatibility. Update hints in both tools name a confirmed declaring project or the direct package origins where available.
 - `dependency_groups` is the raw dependency group reported by OSV-Scanner (for example `dev`). It is missing or inaccurate for some lockfile formats (absent for pnpm, `optional` for pdm, and so on), so treat it as informational
 - Upgrade recommendations (`suggest_fix`) are available for Maven, npm, PyPI, Go, Rust (crates.io), PHP (Packagist), and .NET (NuGet; source checkout).
 
@@ -488,7 +505,8 @@ For npm, Go, PyPI, and Rust, the "same release line" is the range a caret (`^`)
 - Rust uses SemVer (`SEMVER` ranges) and Cargo caret compatibility: 0.x minor updates and 0.0.x patch updates are `cross_major`. `unmaintained` and `notice` advisories, and `unsound` advisories without a newer fixed version, remain in `per_cve_detail` with `tier: "informational"`, their kind, and `recommended_status`, but are not fix targets or counted as unfixed. An `unsound` advisory with a newer fixed version is a version-specific defect, so it is a fix target like a vulnerability (its tier is computed normally and it keeps `informational: "unsound"`). Packages with no fix target left return `verification: "informational_only"` without an upgrade. Unmaintained crates may need replacement; use `explain_vulnerability` for notices.
 - Suggestions include an `update_hint`, tailored to whether the package is a direct or transitive dependency:
   - Maven (from `pom.xml`): for a direct dependency, update the `<dependency>` version (or the parent POM, property, or BOM that manages it); for a transitive dependency, override the version in `<dependencyManagement>` or update the direct dependency that requires it
-  - npm: for a direct dependency, update the version in the `package.json` listed in `declared_in`; for a transitive dependency, update the direct dependency named in `introduced_by`, or set the version with `overrides` in the root `package.json` (effective only in the root project)
+  - npm (including pnpm): for a direct dependency, update the version in the `package.json` listed in `declared_in`; for a transitive dependency, update the direct dependency named in `introduced_by`, or use your package manager's root override configuration. Regenerate the lockfile and rescan.
+  - Composer: for direct dependencies, update the constraint in `declared_in`; for transitive dependencies, update the direct roots in `introduced_by` or their constraints, then regenerate the lockfile with dependency updates allowed, scripts and plugins disabled. PHP and dependency compatibility still require verification.
   - Go: `go get <module>@<version>` (also for `// indirect` modules). For a module affected by `replace`, update the version in the `replace` directive instead of `require`. Major versions 2 and later use a different module path (`/v2` and so on) and are separate packages in OSV, so fixes in a newer major line are not included as candidates. If the current version is a pseudo-version (an untagged commit), `upgrade_note` says so
   - PyPI: update the version in `requirements.txt`, `pyproject.toml`, or `Pipfile` and regenerate the lockfile; for a transitive dependency, use a pip constraints file (`-c`) or the override settings of uv or Poetry
   - Rust: where version requirements permit it, `cargo update -p <crate>@<current> --precise <recommended>` updates the lockfile. Otherwise change the direct requirement in the declaring Cargo.toml or update the parent dependency in `introduced_by`. Cross-major upgrades may break compatibility, including 0.x updates. Pre-releases may require explicit `=<version>` requirements and must be allowed by transitive parents. Build metadata is omitted from `--precise`. `[patch.crates-io]` changes a source, not the allowed version range; backports must satisfy parent requirements. Check yanked versions, MSRV, and compiler compatibility. Cargo is never executed by the server

package/dist/index.js

@@ -66,7 +66,7 @@ if (startupWarning !== null) {
     }
 }
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
-const SERVER_VERSION = "0.18.0";
+const SERVER_VERSION = "0.20.0";
 const server = new McpServer({
     name: "osv-scanner-mcp",
     version: SERVER_VERSION,
@@ -86,10 +86,10 @@ server.registerTool("scan_project", {
         "For Cargo.lock, only crates from crates.io are scanned: the project's own crates are counted in local_crates, and git or private-registry crates are listed in unscannable_crates. " +
         "For .NET, each project file is matched to its own lockfile or obj/project.assets.json; projects without one are scanned from their direct PackageReference items only (lockfile_missing status direct_only or unconfirmed), " +
         "a PackageReference Version=\"x\" is looked up at its lower bound (version_is_lower_bound), and references with properties, ranges without a lower bound, floating versions, conditions, or Update/Remove are not looked up (unresolved_package_references). " +
-        "The project's own projects are counted in local_projects. Names of packages from private NuGet feeds are also sent to api.osv.dev; see nuget_warnings. " +
+        "The project's own projects are counted in local_projects. NuGet introduced_by follows target-scoped restore/build dependency graphs; declared_in names a uniquely associated, captured project with an unambiguous unconditional PackageReference. Ambiguous declarations, standalone build files, or analysis limits omit uncertain metadata. Graph paths are not followed and restore/MSBuild are not run. Names of packages from private NuGet feeds are also sent to api.osv.dev; see nuget_warnings. " +
         "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
-        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, and pom.xml; unknown otherwise). " +
-        "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
+        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, pnpm-lock.yaml formats 5.3/5.4/6.0/9.0, Yarn Classic/Berry, go.mod, requirements.txt, pom.xml, Cargo.lock, .NET files and Composer; unknown where the format or captured metadata cannot establish it). pnpm uses locked importer declarations for declared_in and peer-context-specific dependency reachability for introduced_by; local links are not followed and unsupported/limited analysis remains unknown. Yarn derives origins/declarations from captured Classic manifests or Berry workspace entries; workspace coverage uses confirmed workspace membership and locked dependency descriptors, with ambiguous/unsupported cases unconfirmed. Yarn and project code are not executed. pnpm workspace coverage matches child project paths against captured ancestor lockfile importers; absent children are missing and unverifiable membership remains unconfirmed. " +
+        "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. A safely captured companion composer.json defines direct require/require-dev roots; locked require edges establish introduced_by, and direct declarations use declared_in. Missing/uninterpretable companions, ambiguous providers/replacements or names, and analysis limits leave relationships unknown. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
         "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, Rust, PHP, and .NET (NuGet). Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
     inputSchema: {
         project_path: z
@@ -121,7 +121,7 @@ server.registerTool("suggest_fix", {
         "(same_minor: same release line -> major_internal: same major version -> cross_major: major upgrade), " +
         "and the response gives the recommended version, the upgrade distance (upgrade_tier), and the fixed version per CVE. For npm, Go, PyPI, and Rust, a minor update within 0.x is also cross_major (may include breaking changes). " +
         "Dependencies scanned at a requirements.txt lower bound (>=) or a NuGet PackageReference minimum/range are marked version_is_lower_bound, and the recommendation then means raising the lower bound rather than confirming the installed version. " +
-        "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm and Cargo.lock also introduced_by and declared_in). Cargo updates are conditional on parent version requirements; cross-major updates may require Cargo.toml changes. " +
+        "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm, Cargo.lock, Composer and NuGet also introduced_by and declared_in where evidence permits). NuGet hints name a confirmed declaring project or introducing direct packages; central management and SDK/runtime constraints still require verification. Composer hints name the declaring manifest for direct dependencies and the introducing roots for transitive dependencies; regenerate the lockfile in a trusted environment and verify constraints. Cargo updates are conditional on parent version requirements; cross-major updates may require Cargo.toml changes. " +
         "The recommended version is checked against api.osv.dev, and versions with known vulnerabilities that do not affect the current version are avoided (result in candidate_check). " +
         "clean excludes known unfixed advisories, known informational advisories that are not fix targets, and new Rust unmaintained/notice records; these may still apply. New unsound records are fix targets. " +
         "With has_known_vulnerabilities, failed, or skipped, the recommended version has not been confirmed safe; conflict means the data disagreed and the recommendation is withheld. " +

package/dist/osv/suggestFix.js

@@ -38,15 +38,24 @@ function updateHint(pkg) {
     const relation = pkg.dependency_relation;
     const by = pkg.introduced_by?.join(", ");
     switch (pkg.ecosystem) {
+        case "Packagist": {
+            if (relation === "direct")
+                return `Direct dependency. Update its constraint in ${pkg.declared_in?.join(", ") ?? "composer.json"}` +
+                    (by ? `. It is also required transitively by ${by}, whose constraints may need updating` : "") +
+                    ". Regenerate composer.lock in a trusted environment with Composer scripts and plugins disabled; check PHP, extension and dependency constraints. Composer is not executed by this server";
+            if (relation === "transitive")
+                return `Transitive dependency. Update ${by ? `the direct dependencies that require it (${by})` : "the direct dependency that requires it"} or adjust their constraints, then regenerate composer.lock with --with-all-dependencies --no-scripts --no-plugins in a trusted environment. Check PHP and extension requirements. Composer is not executed by this server`;
+            return UPDATE_HINTS.Packagist;
+        }
         case "NuGet": {
             if (/^Microsoft\.(?:NETCore|AspNetCore|WindowsDesktop)\.App\.Runtime\./i.test(pkg.name)) {
                 return "Runtime pack. Update the .NET SDK/runtime or target framework that supplies this pack and regenerate restore/build outputs; do not add an explicit PackageReference merely to change the runtime pack. Check framework/RID compatibility and rescan. This server does not run dotnet restore or MSBuild";
             }
             const shared = "If centrally managed, change PackageVersion in Directory.Packages.props. Regenerate restore/lockfiles and rescan in a trusted environment; verify target-framework compatibility and dependency constraints. This server does not run dotnet restore or MSBuild";
             if (relation === "direct")
-                return "Direct dependency. Update its PackageReference in the project file (or packages.config for older projects). " + shared;
+                return `Direct dependency. Update its PackageReference in ${pkg.declared_in?.join(", ") ?? "the project file"} (or packages.config for older projects). ` + shared;
             if (relation === "transitive")
-                return "Transitive dependency. Update the direct dependency that requires it, or explicitly reference a compatible fixed version when NuGet dependency resolution permits it. " + shared;
+                return `Transitive dependency. Update ${by ? `the direct dependencies that require it (${by})` : "the direct dependency that requires it"}, or explicitly reference a compatible fixed version when NuGet dependency resolution permits it. ` + shared;
             return "Update the dependency version in the project file or packages.config; for a transitive dependency, update its parent or explicitly reference a compatible fixed version. " + shared;
         }
         case "npm":
@@ -56,7 +65,7 @@ function updateHint(pkg) {
             }
             if (relation === "transitive") {
                 return `Transitive dependency. Update ${by ? `the direct dependency that requires it (${by})` : "the direct dependency that requires it"} to a version that requires the recommended version or later. ` +
-                    "If updating the direct dependency does not fix it, set the version with overrides in the root package.json (effective only in the root project)";
+                    "If updating the direct dependency does not fix it, use the package manager's root override configuration to select a compatible fixed version, regenerate the lockfile, and rescan";
             }
             return UPDATE_HINTS.npm;
         case "Go": {

package/dist/tools/scanProject.js

@@ -5,6 +5,7 @@
  * complete=falseの場合は「検出0件でも安全とは言えない」旨の警告を付ける。
  */
 import { writeFile } from "node:fs/promises";
+import { createPnpmWorkBudget, pnpmLockRelations } from "../utils/pnpmRelations.js";
 import path from "node:path";
 import { ScanToolError } from "../errors.js";
 import { isRemoteResolutionDisabled, runOsvScan } from "../osv/runner.js";
@@ -165,20 +166,25 @@ const MAX_INTRODUCED_BY = 10;
 export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_LOCKFILE_BYTES) {
     const lookups = new Map();
     const npmWorkBudget = createNpmLockWorkBudget();
+    // pnpmの関係の解析の作業量はスキャン全体で共有する(Composer・NuGetと同じ)
+    const pnpmWorkBudget = createPnpmWorkBudget();
     let remaining = maxTotalBytes;
-    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages } of copies) {
+    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages, nugetLookup, composerLookup, yarnLookup } of copies) {
         const lockDir = originalRelative === null ? "" : path.dirname(originalRelative);
         let lookup = null;
         try {
-            if (format === "package-lock.json" || format === "go.mod") {
+            if (format === "package-lock.json" || format === "pnpm-lock.yaml" || format === "go.mod") {
                 // 残りの予算を上限に、読み込みの途中で打ち切る(予算を超えるファイルは全体を読まずにunknownにする)
-                const read = await readRegularFile(copy, { maxBytes: format === "package-lock.json" ? Math.min(MAX_NPM_LOCK_BYTES, remaining) : remaining });
+                const read = await readRegularFile(copy, { maxBytes: format !== "go.mod" ? Math.min(MAX_NPM_LOCK_BYTES, remaining) : remaining });
                 if (read.ok) {
                     remaining -= read.bytes.length;
                     const text = read.bytes.toString("utf8");
-                    lookup = format === "go.mod" ? goModRelations(text) : npmLockRelations(parseNpmLock(text, npmWorkBudget));
+                    lookup = format === "go.mod" ? goModRelations(text) : format === "pnpm-lock.yaml" ? pnpmLockRelations(text, pnpmWorkBudget) : npmLockRelations(parseNpmLock(text, npmWorkBudget));
                 }
             }
+            else if (format === "yarn.lock") {
+                lookup = yarnLookup ?? null;
+            }
             else if (format === "pom.xml") {
                 lookup = pomRelations(); // ファイルは読まず、osv-scannerのsource.typeで判定する
             }
@@ -189,7 +195,10 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
                 lookup = cargoLockRelations(cargoPackages, declaringManifests);
             }
             else if (format === "packages.lock.json" && nugetPackages !== undefined) {
-                lookup = nugetRelations(nugetPackages);
+                lookup = nugetLookup ?? nugetRelations(nugetPackages);
+            }
+            else if (format === "composer.lock") {
+                lookup = composerLookup ?? null;
             }
         }
         catch {
@@ -301,6 +310,16 @@ export async function scanFromSnapshot(project, options) {
                 throw new ScanToolError(skipped.every((s) => s.kind === "outside_allowed_root") ? "path_outside_allowed_root" : "no_manifest_found", `No lockfile or manifest can be scanned (${project.skippedFiles.map((s) => `${s.path}: ${s.reason}`).join(" / ")})`);
             }
         }
+        for (const copy of project.yarnCopies ?? []) {
+            const generated = await snapshot.writeGenerated(copy.content);
+            targets.push({ path: generated, format: "yarn.lock" });
+            relationSources.push({ copy: generated, format: "yarn.lock", originalRelative: copy.path, yarnLookup: copy.relations });
+        }
+        for (const copy of project.pnpmCopies ?? []) {
+            const generated = await snapshot.writeGenerated(copy.content);
+            targets.push({ path: generated, format: "pnpm-lock.yaml" });
+            relationSources.push({ copy: generated, format: "pnpm-lock.yaml", originalRelative: copy.path });
+        }
         for (const copy of project.requirementsCopies) {
             if (copy.entries.length === 0)
                 continue;
@@ -319,12 +338,12 @@ export async function scanFromSnapshot(project, options) {
         for (const copy of project.nugetCopies) {
             const generated = await snapshot.writeGenerated(nugetLockCopyContent(copy.packages));
             targets.push({ path: generated, format: "packages.lock.json" });
-            relationSources.push({ copy: generated, format: "packages.lock.json", originalRelative: copy.path, nugetPackages: copy.packages });
+            relationSources.push({ copy: generated, format: "packages.lock.json", originalRelative: copy.path, nugetPackages: copy.packages, nugetLookup: copy.relations });
         }
         for (const copy of project.composerCopies ?? []) {
             const generated = await snapshot.writeGenerated(copy.content);
             targets.push({ path: generated, format: "composer.lock" });
-            relationSources.push({ copy: generated, format: "composer.lock", originalRelative: copy.path });
+            relationSources.push({ copy: generated, format: "composer.lock", originalRelative: copy.path, composerLookup: copy.relations });
         }
         if (targets.length === 0)
             return parseOsvScanOutput({ results: [] });

package/dist/utils/composerLock.js

@@ -1,5 +1,6 @@
 import { parseNpmLock } from "./npmLockCopy.js";
 import { parseComposerVersion } from "./composerVersion.js";
+import { composerLinkNames, composerPackageName } from "./composerRelations.js";
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Only names and release versions reach OSV; repository URLs, scripts, and commit IDs are never forwarded. */
 export function composerLockCopy(text, budget) {
@@ -9,6 +10,7 @@ export function composerLockCopy(text, budget) {
     }
     const issues = [];
     const warnings = [];
+    const relationPackages = [];
     let uncertainOrigin = 0;
     // dist.type=pathは自分のコード(monorepoのパッケージ)。Rustのlocal_crates・.NETのlocal_projectsと同じく数だけ返し、範囲の欠けにしない
     let localPackages = 0;
@@ -17,11 +19,16 @@ export function composerLockCopy(text, budget) {
         const packages = [];
         let skipped = 0;
         for (const raw of (data[group] ?? [])) {
+            if (record(raw) && composerPackageName(raw.name)) {
+                const provides = composerLinkNames(raw.provide), replaces = composerLinkNames(raw.replace);
+                relationPackages.push({ name: raw.name, version: typeof raw.version === "string" ? raw.version : "",
+                    requires: composerLinkNames(raw.require), aliases: provides === null || replaces === null ? null : [...provides, ...replaces] });
+            }
             if (record(raw) && record(raw.dist) && raw.dist.type === "path") {
                 localPackages++;
                 continue;
             }
-            if (!record(raw) || typeof raw.name !== "string" || !/^[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/.test(raw.name) || raw.name.length > 200 ||
+            if (!record(raw) || !composerPackageName(raw.name) ||
                 typeof raw.version !== "string" || parseComposerVersion(raw.version) === null) {
                 skipped++;
                 continue;
@@ -36,5 +43,5 @@ export function composerLockCopy(text, budget) {
     }
     if (uncertainOrigin > 0)
         warnings.push(`${uncertainOrigin} Composer package entries lack the standard Packagist notification URL. Their names and versions are sent to api.osv.dev as Packagist packages; private or forked packages may produce false positives. The notification URL is only a heuristic and does not prove origin`);
-    return { content: JSON.stringify(output), issues, warnings, packageCount: output.packages.length + output["packages-dev"].length, localPackages };
+    return { content: JSON.stringify(output), issues, warnings, packageCount: output.packages.length + output["packages-dev"].length, localPackages, relationPackages };
 }

package/dist/utils/composerRelations.js

@@ -0,0 +1,96 @@
+import { MAX_DEPENDENCY_EDGES } from "./dependencyRelations.js";
+import { parseNpmLock } from "./npmLockCopy.js";
+export const createComposerRelationBudget = () => ({ remaining: MAX_DEPENDENCY_EDGES });
+const record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+export const composerPackageName = (v) => typeof v === "string" && v.length <= 200 && /^[a-z0-9][a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*$/.test(v);
+/** Platform requirements such as php, ext-json and lib-* are not package edges. */
+export function composerLinkNames(value) {
+    if (value === undefined)
+        return [];
+    if (!record(value))
+        return null;
+    const names = [];
+    for (const [name, constraint] of Object.entries(value)) {
+        if (typeof constraint !== "string")
+            return null;
+        const looksLikePackage = name.includes("/");
+        if (composerPackageName(name))
+            names.push(name);
+        else if (looksLikePackage)
+            return null;
+    }
+    return names;
+}
+/** Analyze only the captured companion manifest, never another root or a path repository's URL. */
+export function composerRootRequirements(text, budget) {
+    const root = parseNpmLock(text, budget);
+    if (!record(root))
+        return null;
+    const production = composerLinkNames(root.require), dev = composerLinkNames(root["require-dev"]);
+    return production === null || dev === null ? null : [...new Set([...production, ...dev])];
+}
+/** Name-based reachability of the locked solution, not a Composer constraint solver.
+ * require-dev is root-only; suggest/conflict/replace/provide are not dependency edges.
+ * Provider/replacement ambiguity and duplicate installed names are never guessed.
+ */
+export function composerRelations(packages, roots, budget = createComposerRelationBudget()) {
+    const charge = () => --budget.remaining >= 0;
+    const byName = new Map();
+    const aliased = new Set();
+    for (const pkg of packages) {
+        if (!charge() || pkg.aliases === null)
+            return null;
+        byName.set(pkg.name, byName.has(pkg.name) ? null : pkg);
+        for (const alias of pkg.aliases) {
+            if (!charge())
+                return null;
+            if (alias !== pkg.name)
+                aliased.add(alias);
+        }
+    }
+    const resolve = (name) => aliased.has(name) ? null : byName.get(name) ?? null;
+    const direct = new Set();
+    for (const name of roots) {
+        if (!charge())
+            return null;
+        if (resolve(name))
+            direct.add(name);
+    }
+    const introduced = new Map();
+    for (const origin of direct) {
+        const visited = new Set([origin]);
+        const queue = [origin];
+        while (queue.length > 0) {
+            if (!charge())
+                return null;
+            const current = resolve(queue.pop());
+            for (const name of current?.requires ?? []) {
+                if (!charge())
+                    return null;
+                const target = resolve(name);
+                if (!target || visited.has(name))
+                    continue;
+                visited.add(name);
+                queue.push(name);
+                let sources = introduced.get(name);
+                if (!sources)
+                    introduced.set(name, sources = new Set());
+                sources.add(origin);
+            }
+        }
+    }
+    const results = new Map();
+    for (const [name, pkg] of byName) {
+        if (!charge())
+            return null;
+        if (!pkg || aliased.has(name))
+            continue;
+        const sources = introduced.get(name);
+        results.set(JSON.stringify([name, pkg.version]), {
+            relation: direct.has(name) ? "direct" : sources ? "transitive" : "unknown",
+            ...(direct.has(name) ? { declaredIn: new Set(["composer.json"]) } : {}),
+            ...(sources ? { introducedBy: sources } : {}),
+        });
+    }
+    return (name, version) => results.get(JSON.stringify([name, version])) ?? { relation: "unknown" };
+}

package/dist/utils/manifestDetector.js

@@ -10,6 +10,8 @@
  * 検出・除外の根拠はdocs/DESIGN_TODO.md「対象エコシステム拡大 詳細設計メモ」を参照。
  */
 import { stat } from "node:fs/promises";
+import { PnpmLockCache } from "./pnpmLockCache.js";
+import { YarnLockCache } from "./yarnLockCache.js";
 import path from "node:path";
 import { ScanToolError } from "../errors.js";
 import { isManifestFormat } from "./manifestFormats.js";
@@ -20,6 +22,7 @@ import { analyzeRequirementsFile, createRequirementsReadContext, } from "./requi
 import { cargoTomlPackageName, cargoWorkspace, workspaceIncludes, createGlobWorkBudget, classifyCargoPackages, createCargoLockParseBudget, parseCargoLock, UNSCANNABLE_CRATE_REASONS, } from "./cargoLock.js";
 import { analyzeNuget, collectNugetFile, emptyNugetFiles, NUGET_DEPS_JSON, NUGET_LOCKFILE, NUGET_PACKAGES_CONFIG, NUGET_PROJECT_ASSETS, NUGET_PROJECT_FILE, } from "./nugetProject.js";
 import { composerLockCopy } from "./composerLock.js";
+import { composerRelations, composerRootRequirements, createComposerRelationBudget } from "./composerRelations.js";
 /** ファイル名→(エコシステム, 解析形式)。npm-shrinkwrap.jsonはpackage-lock.json形式で解析する */
 const LOCKFILES = new Map([
     ["pom.xml", { ecosystem: "Maven", format: "pom.xml" }],
@@ -233,14 +236,27 @@ async function npmLockfileRecords(cache, projectDir, lockfile, memberDir) {
     const key = path.relative(path.dirname(lockAbs), path.join(projectDir, memberDir)).split(path.sep).join("/");
     return keys.has(key);
 }
-/**
- * lockfileの無いマーカー(package.json等)を判定する。
- * - 同じディレクトリに同じエコシステムのlockfileがあれば充足
- * - 上位のlockfileだけの場合は、収録を確認できたときだけ充足(npm workspacesのpackage-lock.json)。
- *   workspace設定の無いルートのlockfileで、独立した子プロジェクトの欠落を隠さないため
- */
-async function findLockfileMissing(projectDir, markers, manifests, cargoCache) {
+/** pnpmのimporterの完全一致で収録を確認する。親や同名のpackageからは推測しない。 */
+async function pnpmLockfileRecords(cache, projectDir, lockfile, memberDir) {
+    const lockAbs = path.join(projectDir, lockfile.path);
+    const captured = await cache.get(lockAbs, projectDir);
+    if ("reason" in captured || captured.importers === null)
+        return null;
+    const key = path.relative(path.dirname(lockAbs), path.join(projectDir, memberDir)).split(path.sep).join("/");
+    return captured.importers.has(key);
+}
+async function yarnLockfileRecords(cache, projectDir, lockfile, member, packageFiles) {
+    const absolute = path.join(projectDir, lockfile.path);
+    const captured = await cache.get(absolute, projectDir, packageFiles);
+    if ("reason" in captured)
+        return null;
+    const key = path.relative(path.dirname(absolute), path.join(projectDir, member)).split(path.sep).join("/");
+    return captured.members.get(key) ?? null;
+}
+/** 同じディレクトリのlockfile、または収録を確認できた上位lockfileだけで充足とする。 */
+async function findLockfileMissing(projectDir, markers, manifests, cargoCache, pnpmCache, yarnCache) {
     const cache = new LockfileKeyCache();
+    const packageFiles = markers.filter(m => m.group === "npm").map(m => m.path);
     const missing = [];
     for (const marker of markers) {
         const markerDir = path.dirname(marker.path);
@@ -257,9 +273,13 @@ async function findLockfileMissing(projectDir, markers, manifests, cargoCache) {
         for (const candidate of candidates) {
             const result = candidate.format === "package-lock.json"
                 ? await npmLockfileRecords(cache, projectDir, candidate, markerDir)
-                : candidate.format === "Cargo.lock"
-                    ? await cargoLockfileRecords(cargoCache, projectDir, candidate, marker.path)
-                    : null;
+                : candidate.format === "pnpm-lock.yaml"
+                    ? await pnpmLockfileRecords(pnpmCache, projectDir, candidate, markerDir)
+                    : candidate.format === "yarn.lock"
+                        ? await yarnLockfileRecords(yarnCache, projectDir, candidate, marker.path, packageFiles)
+                        : candidate.format === "Cargo.lock"
+                            ? await cargoLockfileRecords(cargoCache, projectDir, candidate, marker.path)
+                            : null;
             if (result === true)
                 recorded = true;
             if (result !== false)
@@ -280,6 +300,9 @@ async function findLockfileMissing(projectDir, markers, manifests, cargoCache) {
 }
 async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFiles = emptyNugetFiles()) {
     const cargoCache = new CargoLockCache();
+    const pnpmCache = new PnpmLockCache();
+    const yarnCache = new YarnLockCache();
+    const packageFiles = markers.filter(m => m.group === "npm").map(m => m.path);
     const result = {
         projectDir,
         allowedRootReal,
@@ -288,11 +311,13 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
         requirementsCopies: [],
         cargoCopies: [],
         composerCopies: [],
+        pnpmCopies: [],
+        yarnCopies: [],
         composerWarnings: [],
         composerLocalPackages: 0,
         localCrateCount: 0,
         unscannableCrates: [],
-        lockfileMissing: await findLockfileMissing(projectDir, markers, manifests, cargoCache),
+        lockfileMissing: await findLockfileMissing(projectDir, markers, manifests, cargoCache, pnpmCache, yarnCache),
         requirementIssues: [],
         requirementReferences: [],
         lowerBounds: [],
@@ -306,6 +331,7 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
     };
     const readContext = createRequirementsReadContext();
     const composerBudget = createNpmLockWorkBudget();
+    const composerRelationBudget = createComposerRelationBudget();
     let composerBytes = MAX_NPM_LOCK_TOTAL_BYTES;
     // A null value permanently marks a crate name with multiple declaration paths.
     const cargoManifests = new Map();
@@ -321,7 +347,23 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
     }
     for (const manifest of manifests) {
         const absolute = path.join(projectDir, manifest.path);
-        if (manifest.format === "composer.lock") {
+        if (manifest.format === "yarn.lock") {
+            const captured = await yarnCache.get(absolute, projectDir, packageFiles);
+            if ("reason" in captured) {
+                result.skippedFiles.push({ path: manifest.path, reason: captured.reason });
+                continue;
+            }
+            result.yarnCopies.push({ path: manifest.path, content: captured.content, relations: captured.lookup });
+        }
+        else if (manifest.format === "pnpm-lock.yaml") {
+            const captured = await pnpmCache.get(absolute, projectDir);
+            if ("reason" in captured) {
+                result.skippedFiles.push({ path: manifest.path, reason: captured.reason });
+                continue;
+            }
+            result.pnpmCopies.push({ path: manifest.path, content: captured.content });
+        }
+        else if (manifest.format === "composer.lock") {
             const read = await readRegularFile(absolute, { maxBytes: Math.min(MAX_NPM_LOCK_BYTES, composerBytes), boundary: projectDir });
             if (!read.ok) {
                 result.skippedFiles.push({ path: manifest.path, reason: capitalizeReason(read.message) });
@@ -330,8 +372,24 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
             composerBytes -= read.bytes.length;
             try {
                 const parsed = composerLockCopy(read.bytes.toString("utf8"), composerBudget);
-                if (parsed.packageCount > 0)
-                    result.composerCopies.push({ path: manifest.path, content: parsed.content });
+                if (parsed.packageCount > 0) {
+                    let relations = null;
+                    const companion = await readRegularFile(path.join(path.dirname(absolute), "composer.json"), {
+                        maxBytes: Math.min(4 * 1024 * 1024, composerBytes), boundary: projectDir,
+                    });
+                    if (companion.ok) {
+                        composerBytes -= companion.bytes.length;
+                        try {
+                            const roots = composerRootRequirements(companion.bytes.toString("utf8"), composerBudget);
+                            if (roots !== null)
+                                relations = composerRelations(parsed.relationPackages, roots, composerRelationBudget);
+                        }
+                        catch { /* A companion failure affects relationships, not the scanned lockfile. */ }
+                    }
+                    if (relations === null)
+                        result.composerWarnings.push(`${manifest.path}: Dependency relationships are unknown because its companion composer.json is unavailable/uninterpretable or the dependency analysis limit was reached; locked release packages are still scanned`);
+                    result.composerCopies.push({ path: manifest.path, content: parsed.content, relations });
+                }
                 result.skippedFiles.push(...parsed.issues.map((reason) => ({ path: manifest.path, reason })));
                 result.composerWarnings.push(...parsed.warnings.map((warning) => `${manifest.path}: ${warning}`));
                 result.composerLocalPackages += parsed.localPackages;