osv-scanner-mcp 0.19.0 → 0.20.0

package/README.md

@@ -295,7 +295,7 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
 ```
 
 - **Always check `coverage`.** If `complete` is `false`, some dependencies were not scanned, so zero findings does not mean the project is safe
-  - `lockfile_missing`: manifests without a lockfile (`package.json`, `pyproject.toml`, `Pipfile`, `setup.py`, `build.gradle`, `Cargo.toml`, and so on). Not recorded if a lockfile of the same ecosystem is in the same directory. If there is only a lockfile in a parent directory, the manifest is not recorded only when `package-lock.json` (v2 or later) is confirmed to contain that directory (npm workspaces), or when `Cargo.lock` contains a local crate with the `[package] name` of the `Cargo.toml` and the directory is a member of the workspace according to `members` / `exclude` of the `Cargo.toml` next to `Cargo.lock` (Cargo workspaces; `members` globs with `*` and `?` are supported). A crate with the same name that cannot be confirmed as a member, such as a path dependency outside the workspace, is recorded as `unconfirmed`. Library crates often do not commit `Cargo.lock`, so their `Cargo.toml` is recorded here; generate one with `cargo generate-lockfile`. Otherwise it is recorded with `status: "missing"`, or `status: "unconfirmed"` for formats that cannot be checked (yarn.lock, Python lockfiles, and so on). Generate the lockfile as described in `hint` (in a trusted environment) and scan again
+  - `lockfile_missing`: manifests without a lockfile (`package.json`, `pyproject.toml`, `Pipfile`, `setup.py`, `build.gradle`, `Cargo.toml`, and so on). Not recorded if a lockfile of the same ecosystem is in the same directory. If there is only a lockfile in a parent directory, the manifest is not recorded only when `package-lock.json` (v2 or later) is confirmed to contain that directory (npm workspaces), when `pnpm-lock.yaml` (formats 5.3/5.4/6.0/9.0) contains its exact normalized importer path (pnpm workspaces; source checkout), when Yarn workspace membership and captured declarations can be confirmed (see below; source checkout), or when `Cargo.lock` contains a local crate with the `[package] name` of the `Cargo.toml` and the directory is a member of the workspace according to `members` / `exclude` of the `Cargo.toml` next to `Cargo.lock` (Cargo workspaces; `members` globs with `*` and `?` are supported). A crate with the same name that cannot be confirmed as a member, such as a path dependency outside the workspace, is recorded as `unconfirmed`. Library crates often do not commit `Cargo.lock`, so their `Cargo.toml` is recorded here; generate one with `cargo generate-lockfile`. Otherwise it is recorded with `status: "missing"`, or `status: "unconfirmed"` for formats that cannot be checked (unsupported Yarn layouts, Python lockfiles, and so on). Generate the lockfile as described in `hint` (in a trusted environment) and scan again
   - `unpinned_requirements`: lines in `requirements.txt` that do not pin a version. `kind` is `unpinned` (no version), `range` (`>`, `<`, `!=`, `==1.*`, combined ranges, and so on), or `lower_bound` (`>=`, `~=`). OSV-Scanner does not scan `unpinned` and `range` lines, and scans `lower_bound` lines at the lower bound (those packages are marked `version_is_lower_bound: true` and may differ from the installed version)
   - `unscannable_requirements`: lines that are not scanned, with the reason: `-e`, `name @ URL`, paths, includes that were not expanded (outside the project directory, missing, URLs, or over the limits), constraint files (`-c`, not applied), and options or version specifiers that cannot be interpreted. Lines that cannot be interpreted are recorded here instead of being ignored
   - `local_crates` (only when a `Cargo.lock` was scanned): the number of crates without a source in `Cargo.lock` (workspace members and path dependencies). They are your own code and are not scanned; they do not make `complete` false. A third-party crate vendored as a path dependency is not scanned either (as with `cargo audit`)
@@ -311,9 +311,21 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
   - `requirements.txt`: dependencies written in the file are direct; dependencies resolved through deps.dev are transitive
   - `pom.xml`: OSV-Scanner reports the dependencies declared in `pom.xml` (and its parent POMs) and the transitive dependencies resolved through deps.dev as separate results (`source.type` `lockfile` / `unknown`), and this split is used (so parent POMs, profiles, properties, and dependency management are interpreted exactly as OSV-Scanner does). `introduced_by` / `declared_in` are not available. This relies on undocumented OSV-Scanner output, so anything unexpected is reported as `unknown`
   - `Cargo.lock`: crates.io dependencies immediately required by a local/workspace/path crate are direct; crates.io dependencies reachable through them (including git and alternate-registry origins) are transitive. `introduced_by` names the first direct dependency on each path. References are resolved by exact name, version, and source where provided; ambiguous references are not guessed. Replacements are followed. `declared_in` lists project-relative Cargo.toml paths only when every declaring crate has a unique matching manifest. Otherwise `declaring_crates` names the unmapped declaring crates (up to 10, with the rest in `declaring_crates_omitted`). Dev/build/target-specific distinctions are unavailable. Traversal over 2,000,000 edges returns `unknown`
-  - .NET: `Direct` / `Transitive` in `packages.lock.json`; the dependencies of `project.frameworks` in `project.assets.json`; the dependencies of the project library in `*.deps.json`; and every reference read from a project file are direct. `packages.config` does not say, so it is `unknown`. `introduced_by` and `declared_in` are not available yet
+  - .NET: `Direct` / `Transitive` in `packages.lock.json`; the dependencies of `project.frameworks` in `project.assets.json`; the dependencies of the project library in `*.deps.json`; and every reference read from a project file are direct. `packages.config` does not say, so it is `unknown`. Origin/declaration enrichment is available in the source checkout as described below.
   - Composer (source checkout): the companion root's `require` / `require-dev` are direct, and locked `require` reachability establishes transitive dependencies. `declared_in` names the companion for direct dependencies; `introduced_by` lists transitively requiring direct roots. See [Composer support](#composer-support) for ambiguity and work limits.
-  - Other formats (`gradle.lockfile`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, and `pdm.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
+  - `pnpm-lock.yaml` (source checkout): lockfile formats 5.3, 5.4, 6.0 and 9.0 are supported. Importer `dependencies`, `devDependencies` and `optionalDependencies` are direct, with the lockfile's declaring importer `package.json` paths in `declared_in`. Locked dependency and optional-dependency edges establish `introduced_by` and transitive reachability. Workspace importers, npm aliases, scoped packages, multiple origins and peer-context-specific snapshots are supported. A package that is both direct and transitively required remains direct and also lists its origins. Local/Git references, unresolved identities and unreachable packages do not establish relationships; links and source files are never followed. Declaration paths reflect the lockfile, not independently verified current manifests. Workspace coverage (source checkout) uses the exact normalized importer path relative to an ancestor pnpm-lock.yaml: included children are covered, absent importers are `missing`, and unsupported/malformed/ambiguous or analysis-limited importer metadata is `unconfirmed`. Empty importer maps and Unicode/space paths are supported. Importer presence does not prove freshness or agreement with current package.json dependencies. Only lockfiles found inside the selected scan directory are considered. Coverage and vulnerability scanning use the same captured lockfile bytes (16 MiB per file, 64 MiB total); unreadable or oversized inputs are skipped with a reason. Importer parsing/indexing shares a 2,000,000-operation budget per detection, separate from relationship analysis. The lockfile is read from YAML's syntax tree in linear time (only strings, maps, and sequences; a 28,000-package lockfile takes about a second). Unsupported/malformed YAML, duplicate keys, anchors, aliases, tags, multi-document files, conservative nesting/line limits, inputs above 16 MiB, or more than 2,000,000 relationship operations per scan (shared by all pnpm lockfiles) leave relationships unknown; scanning continues. The existing shared relationship input byte limit and 10-origin output limit apply.
+  - `yarn.lock` (source checkout): Classic v1 and Berry metadata versions 4/5/6/8 support direct/transitive relations, `introduced_by` and `declared_in`. Classic uses captured root/workspace `package.json` declarations; Berry uses exact locked descriptors and `workspace:` entries. Dependencies and optional dependencies are followed; peers are not independently guessed or installed. Multiple selectors, scoped/npm aliases, cycles, multiple roots and direct/transitive overlap are supported. Local/Git/patch/portal/virtual identities that cannot establish a registry release remain unknown and are never followed to source files.
+  - Other formats (`gradle.lockfile`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, and `pdm.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
+
+**Yarn workspace coverage (source checkout):** Classic does not contain workspace importer records, so a captured private root's `workspaces` array (or `workspaces.packages`) must include the child and its captured dependency descriptors must resolve in the lockfile or to a uniquely named configured local workspace satisfying the requested SemVer range. Berry matches exact normalized `workspace:` resolution paths and checks captured dependency declarations against the locked workspace. Classic children need a nonempty name and usable version; manifests without them are not workspace members. Wildcards do not consume dot-prefixed path segments unless the pattern explicitly starts that segment with a dot. `*`, `?`, whole-segment `**`, exclusion patterns, one trailing `/` (as Yarn strips it), and Unicode/space paths are supported; other empty segments are unconfirmed; brace/extglob/character-class patterns remain unconfirmed. Independent children are missing; unreadable declarations, unresolved/ambiguous entries and analysis limits are unconfirmed. Coverage confirmation does not prove lockfile freshness or platform compatibility.
+
+Yarn lockfiles and manifests are captured once within the selected scan boundary; coverage, relation metadata and scanning use those same inputs. Yarn is never run during a scan, and links, configuration plugins and source paths are not evaluated. Lockfiles are limited to 16 MiB each / 64 MiB total; captured package manifests to 4 MiB each / 64 MiB total with bounded JSON parsing. YAML nesting/line limits apply. Parsing and workspace coverage share one 2,000,000-operation budget per scan, and relationship analysis has a separate 2,000,000-operation budget, so exceeding the relationship limit leaves relations unknown without making confirmed coverage unconfirmed. Unsupported metadata leaves relations unknown and membership unconfirmed; unreadable/oversized lockfiles are skipped with a reason. A selected lockfile alone does not cause child manifests or files outside the selected scan directory to be searched. Berry declaration paths may come from locked workspace entries when companions were not captured.
+
+**NuGet origins and declarations (source checkout):** `introduced_by` follows dependency edges from direct NuGet packages in each locked TFM or assets/deps target separately, then merges origins only for the same package/version in the report. Case-insensitive IDs and equivalent normalized versions match. `packages.lock.json` and assets targets contain a resolved solution, so edges resolve a unique installed name within that target; dependency constraints are not solved again. `deps.json` edges additionally require an exact normalized version match. Multiple origins and cycles are supported; a root does not introduce itself. Duplicate/ambiguous names and unmatched target frameworks are not guessed. Local project nodes can be traversed but are not guessed as direct package origins and remain excluded from OSV input. `introduced_by` retains the existing 10-name limit and omitted count.
+
+`declared_in` is added to direct packages only when the captured source is uniquely associated with a `.csproj`/`.fsproj`/`.vbproj` and that captured project contains an unambiguous, unconditional `PackageReference` for the ID. A missing/property/range/floating version can still identify the reference when the restore result confirms its direct package; version resolution continues to come from restore metadata. Conditional, removed, updated, or duplicated references are not guessed. The field names the reference's project file, not the storage location of its centrally managed version. Direct-only project scans also expose this path and preserve lower-bound/coverage warnings. A standalone selected lockfile/assets file without captured project evidence, an ambiguous shared lockfile, `packages.config`, and a deployed `deps.json` do not imply a project declaration path. Paths embedded in restore/build outputs are not followed to read source files.
+
+Graphs and declarations use already captured, size-limited inputs, without running restore or MSBuild or forwarding graph metadata to OSV. A shared 2,000,000-operation relationship budget bounds indexing/traversal/declaration work across the scan. Exhaustion omits uncertain metadata and adds a NuGet warning; existing vulnerability scanning and direct/transitive classification continue. Neither dependency reachability nor declaration matching proves freshness, constraint satisfaction, or TFM/RID compatibility. Update hints in both tools name a confirmed declaring project or the direct package origins where available.
 - `dependency_groups` is the raw dependency group reported by OSV-Scanner (for example `dev`). It is missing or inaccurate for some lockfile formats (absent for pnpm, `optional` for pdm, and so on), so treat it as informational
 - Upgrade recommendations (`suggest_fix`) are available for Maven, npm, PyPI, Go, Rust (crates.io), PHP (Packagist), and .NET (NuGet; source checkout).
 
@@ -493,7 +505,7 @@ For npm, Go, PyPI, and Rust, the "same release line" is the range a caret (`^`)
 - Rust uses SemVer (`SEMVER` ranges) and Cargo caret compatibility: 0.x minor updates and 0.0.x patch updates are `cross_major`. `unmaintained` and `notice` advisories, and `unsound` advisories without a newer fixed version, remain in `per_cve_detail` with `tier: "informational"`, their kind, and `recommended_status`, but are not fix targets or counted as unfixed. An `unsound` advisory with a newer fixed version is a version-specific defect, so it is a fix target like a vulnerability (its tier is computed normally and it keeps `informational: "unsound"`). Packages with no fix target left return `verification: "informational_only"` without an upgrade. Unmaintained crates may need replacement; use `explain_vulnerability` for notices.
 - Suggestions include an `update_hint`, tailored to whether the package is a direct or transitive dependency:
   - Maven (from `pom.xml`): for a direct dependency, update the `<dependency>` version (or the parent POM, property, or BOM that manages it); for a transitive dependency, override the version in `<dependencyManagement>` or update the direct dependency that requires it
-  - npm: for a direct dependency, update the version in the `package.json` listed in `declared_in`; for a transitive dependency, update the direct dependency named in `introduced_by`, or set the version with `overrides` in the root `package.json` (effective only in the root project)
+  - npm (including pnpm): for a direct dependency, update the version in the `package.json` listed in `declared_in`; for a transitive dependency, update the direct dependency named in `introduced_by`, or use your package manager's root override configuration. Regenerate the lockfile and rescan.
   - Composer: for direct dependencies, update the constraint in `declared_in`; for transitive dependencies, update the direct roots in `introduced_by` or their constraints, then regenerate the lockfile with dependency updates allowed, scripts and plugins disabled. PHP and dependency compatibility still require verification.
   - Go: `go get <module>@<version>` (also for `// indirect` modules). For a module affected by `replace`, update the version in the `replace` directive instead of `require`. Major versions 2 and later use a different module path (`/v2` and so on) and are separate packages in OSV, so fixes in a newer major line are not included as candidates. If the current version is a pseudo-version (an untagged commit), `upgrade_note` says so
   - PyPI: update the version in `requirements.txt`, `pyproject.toml`, or `Pipfile` and regenerate the lockfile; for a transitive dependency, use a pip constraints file (`-c`) or the override settings of uv or Poetry

package/dist/index.js

@@ -66,7 +66,7 @@ if (startupWarning !== null) {
     }
 }
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
-const SERVER_VERSION = "0.19.0";
+const SERVER_VERSION = "0.20.0";
 const server = new McpServer({
     name: "osv-scanner-mcp",
     version: SERVER_VERSION,
@@ -86,9 +86,9 @@ server.registerTool("scan_project", {
         "For Cargo.lock, only crates from crates.io are scanned: the project's own crates are counted in local_crates, and git or private-registry crates are listed in unscannable_crates. " +
         "For .NET, each project file is matched to its own lockfile or obj/project.assets.json; projects without one are scanned from their direct PackageReference items only (lockfile_missing status direct_only or unconfirmed), " +
         "a PackageReference Version=\"x\" is looked up at its lower bound (version_is_lower_bound), and references with properties, ranges without a lower bound, floating versions, conditions, or Update/Remove are not looked up (unresolved_package_references). " +
-        "The project's own projects are counted in local_projects. Names of packages from private NuGet feeds are also sent to api.osv.dev; see nuget_warnings. " +
+        "The project's own projects are counted in local_projects. NuGet introduced_by follows target-scoped restore/build dependency graphs; declared_in names a uniquely associated, captured project with an unambiguous unconditional PackageReference. Ambiguous declarations, standalone build files, or analysis limits omit uncertain metadata. Graph paths are not followed and restore/MSBuild are not run. Names of packages from private NuGet feeds are also sent to api.osv.dev; see nuget_warnings. " +
         "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
-        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, go.mod, requirements.txt, pom.xml, Cargo.lock, .NET files and Composer; unknown where the format or captured metadata cannot establish it). " +
+        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, pnpm-lock.yaml formats 5.3/5.4/6.0/9.0, Yarn Classic/Berry, go.mod, requirements.txt, pom.xml, Cargo.lock, .NET files and Composer; unknown where the format or captured metadata cannot establish it). pnpm uses locked importer declarations for declared_in and peer-context-specific dependency reachability for introduced_by; local links are not followed and unsupported/limited analysis remains unknown. Yarn derives origins/declarations from captured Classic manifests or Berry workspace entries; workspace coverage uses confirmed workspace membership and locked dependency descriptors, with ambiguous/unsupported cases unconfirmed. Yarn and project code are not executed. pnpm workspace coverage matches child project paths against captured ancestor lockfile importers; absent children are missing and unverifiable membership remains unconfirmed. " +
         "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. A safely captured companion composer.json defines direct require/require-dev roots; locked require edges establish introduced_by, and direct declarations use declared_in. Missing/uninterpretable companions, ambiguous providers/replacements or names, and analysis limits leave relationships unknown. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
         "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, Rust, PHP, and .NET (NuGet). Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
     inputSchema: {
@@ -121,7 +121,7 @@ server.registerTool("suggest_fix", {
         "(same_minor: same release line -> major_internal: same major version -> cross_major: major upgrade), " +
         "and the response gives the recommended version, the upgrade distance (upgrade_tier), and the fixed version per CVE. For npm, Go, PyPI, and Rust, a minor update within 0.x is also cross_major (may include breaking changes). " +
         "Dependencies scanned at a requirements.txt lower bound (>=) or a NuGet PackageReference minimum/range are marked version_is_lower_bound, and the recommendation then means raising the lower bound rather than confirming the installed version. " +
-        "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm, Cargo.lock and Composer also introduced_by and declared_in). Composer hints name the declaring manifest for direct dependencies and the introducing roots for transitive dependencies; regenerate the lockfile in a trusted environment and verify constraints. Cargo updates are conditional on parent version requirements; cross-major updates may require Cargo.toml changes. " +
+        "update_hint explains how to upgrade, depending on whether the package is a direct or transitive dependency (dependency_relation; for npm, Cargo.lock, Composer and NuGet also introduced_by and declared_in where evidence permits). NuGet hints name a confirmed declaring project or introducing direct packages; central management and SDK/runtime constraints still require verification. Composer hints name the declaring manifest for direct dependencies and the introducing roots for transitive dependencies; regenerate the lockfile in a trusted environment and verify constraints. Cargo updates are conditional on parent version requirements; cross-major updates may require Cargo.toml changes. " +
         "The recommended version is checked against api.osv.dev, and versions with known vulnerabilities that do not affect the current version are avoided (result in candidate_check). " +
         "clean excludes known unfixed advisories, known informational advisories that are not fix targets, and new Rust unmaintained/notice records; these may still apply. New unsound records are fix targets. " +
         "With has_known_vulnerabilities, failed, or skipped, the recommended version has not been confirmed safe; conflict means the data disagreed and the recommendation is withheld. " +

package/dist/osv/suggestFix.js

@@ -53,9 +53,9 @@ function updateHint(pkg) {
             }
             const shared = "If centrally managed, change PackageVersion in Directory.Packages.props. Regenerate restore/lockfiles and rescan in a trusted environment; verify target-framework compatibility and dependency constraints. This server does not run dotnet restore or MSBuild";
             if (relation === "direct")
-                return "Direct dependency. Update its PackageReference in the project file (or packages.config for older projects). " + shared;
+                return `Direct dependency. Update its PackageReference in ${pkg.declared_in?.join(", ") ?? "the project file"} (or packages.config for older projects). ` + shared;
             if (relation === "transitive")
-                return "Transitive dependency. Update the direct dependency that requires it, or explicitly reference a compatible fixed version when NuGet dependency resolution permits it. " + shared;
+                return `Transitive dependency. Update ${by ? `the direct dependencies that require it (${by})` : "the direct dependency that requires it"}, or explicitly reference a compatible fixed version when NuGet dependency resolution permits it. ` + shared;
             return "Update the dependency version in the project file or packages.config; for a transitive dependency, update its parent or explicitly reference a compatible fixed version. " + shared;
         }
         case "npm":
@@ -65,7 +65,7 @@ function updateHint(pkg) {
             }
             if (relation === "transitive") {
                 return `Transitive dependency. Update ${by ? `the direct dependency that requires it (${by})` : "the direct dependency that requires it"} to a version that requires the recommended version or later. ` +
-                    "If updating the direct dependency does not fix it, set the version with overrides in the root package.json (effective only in the root project)";
+                    "If updating the direct dependency does not fix it, use the package manager's root override configuration to select a compatible fixed version, regenerate the lockfile, and rescan";
             }
             return UPDATE_HINTS.npm;
         case "Go": {

package/dist/tools/scanProject.js

@@ -5,6 +5,7 @@
  * complete=falseの場合は「検出0件でも安全とは言えない」旨の警告を付ける。
  */
 import { writeFile } from "node:fs/promises";
+import { createPnpmWorkBudget, pnpmLockRelations } from "../utils/pnpmRelations.js";
 import path from "node:path";
 import { ScanToolError } from "../errors.js";
 import { isRemoteResolutionDisabled, runOsvScan } from "../osv/runner.js";
@@ -165,20 +166,25 @@ const MAX_INTRODUCED_BY = 10;
 export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_LOCKFILE_BYTES) {
     const lookups = new Map();
     const npmWorkBudget = createNpmLockWorkBudget();
+    // pnpmの関係の解析の作業量はスキャン全体で共有する(Composer・NuGetと同じ)
+    const pnpmWorkBudget = createPnpmWorkBudget();
     let remaining = maxTotalBytes;
-    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages, composerLookup } of copies) {
+    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages, nugetLookup, composerLookup, yarnLookup } of copies) {
         const lockDir = originalRelative === null ? "" : path.dirname(originalRelative);
         let lookup = null;
         try {
-            if (format === "package-lock.json" || format === "go.mod") {
+            if (format === "package-lock.json" || format === "pnpm-lock.yaml" || format === "go.mod") {
                 // 残りの予算を上限に、読み込みの途中で打ち切る(予算を超えるファイルは全体を読まずにunknownにする)
-                const read = await readRegularFile(copy, { maxBytes: format === "package-lock.json" ? Math.min(MAX_NPM_LOCK_BYTES, remaining) : remaining });
+                const read = await readRegularFile(copy, { maxBytes: format !== "go.mod" ? Math.min(MAX_NPM_LOCK_BYTES, remaining) : remaining });
                 if (read.ok) {
                     remaining -= read.bytes.length;
                     const text = read.bytes.toString("utf8");
-                    lookup = format === "go.mod" ? goModRelations(text) : npmLockRelations(parseNpmLock(text, npmWorkBudget));
+                    lookup = format === "go.mod" ? goModRelations(text) : format === "pnpm-lock.yaml" ? pnpmLockRelations(text, pnpmWorkBudget) : npmLockRelations(parseNpmLock(text, npmWorkBudget));
                 }
             }
+            else if (format === "yarn.lock") {
+                lookup = yarnLookup ?? null;
+            }
             else if (format === "pom.xml") {
                 lookup = pomRelations(); // ファイルは読まず、osv-scannerのsource.typeで判定する
             }
@@ -189,7 +195,7 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
                 lookup = cargoLockRelations(cargoPackages, declaringManifests);
             }
             else if (format === "packages.lock.json" && nugetPackages !== undefined) {
-                lookup = nugetRelations(nugetPackages);
+                lookup = nugetLookup ?? nugetRelations(nugetPackages);
             }
             else if (format === "composer.lock") {
                 lookup = composerLookup ?? null;
@@ -304,6 +310,16 @@ export async function scanFromSnapshot(project, options) {
                 throw new ScanToolError(skipped.every((s) => s.kind === "outside_allowed_root") ? "path_outside_allowed_root" : "no_manifest_found", `No lockfile or manifest can be scanned (${project.skippedFiles.map((s) => `${s.path}: ${s.reason}`).join(" / ")})`);
             }
         }
+        for (const copy of project.yarnCopies ?? []) {
+            const generated = await snapshot.writeGenerated(copy.content);
+            targets.push({ path: generated, format: "yarn.lock" });
+            relationSources.push({ copy: generated, format: "yarn.lock", originalRelative: copy.path, yarnLookup: copy.relations });
+        }
+        for (const copy of project.pnpmCopies ?? []) {
+            const generated = await snapshot.writeGenerated(copy.content);
+            targets.push({ path: generated, format: "pnpm-lock.yaml" });
+            relationSources.push({ copy: generated, format: "pnpm-lock.yaml", originalRelative: copy.path });
+        }
         for (const copy of project.requirementsCopies) {
             if (copy.entries.length === 0)
                 continue;
@@ -322,7 +338,7 @@ export async function scanFromSnapshot(project, options) {
         for (const copy of project.nugetCopies) {
             const generated = await snapshot.writeGenerated(nugetLockCopyContent(copy.packages));
             targets.push({ path: generated, format: "packages.lock.json" });
-            relationSources.push({ copy: generated, format: "packages.lock.json", originalRelative: copy.path, nugetPackages: copy.packages });
+            relationSources.push({ copy: generated, format: "packages.lock.json", originalRelative: copy.path, nugetPackages: copy.packages, nugetLookup: copy.relations });
         }
         for (const copy of project.composerCopies ?? []) {
             const generated = await snapshot.writeGenerated(copy.content);

package/dist/utils/manifestDetector.js

@@ -10,6 +10,8 @@
  * 検出・除外の根拠はdocs/DESIGN_TODO.md「対象エコシステム拡大 詳細設計メモ」を参照。
  */
 import { stat } from "node:fs/promises";
+import { PnpmLockCache } from "./pnpmLockCache.js";
+import { YarnLockCache } from "./yarnLockCache.js";
 import path from "node:path";
 import { ScanToolError } from "../errors.js";
 import { isManifestFormat } from "./manifestFormats.js";
@@ -234,14 +236,27 @@ async function npmLockfileRecords(cache, projectDir, lockfile, memberDir) {
     const key = path.relative(path.dirname(lockAbs), path.join(projectDir, memberDir)).split(path.sep).join("/");
     return keys.has(key);
 }
-/**
- * lockfileの無いマーカー(package.json等)を判定する。
- * - 同じディレクトリに同じエコシステムのlockfileがあれば充足
- * - 上位のlockfileだけの場合は、収録を確認できたときだけ充足(npm workspacesのpackage-lock.json)。
- *   workspace設定の無いルートのlockfileで、独立した子プロジェクトの欠落を隠さないため
- */
-async function findLockfileMissing(projectDir, markers, manifests, cargoCache) {
+/** pnpmのimporterの完全一致で収録を確認する。親や同名のpackageからは推測しない。 */
+async function pnpmLockfileRecords(cache, projectDir, lockfile, memberDir) {
+    const lockAbs = path.join(projectDir, lockfile.path);
+    const captured = await cache.get(lockAbs, projectDir);
+    if ("reason" in captured || captured.importers === null)
+        return null;
+    const key = path.relative(path.dirname(lockAbs), path.join(projectDir, memberDir)).split(path.sep).join("/");
+    return captured.importers.has(key);
+}
+async function yarnLockfileRecords(cache, projectDir, lockfile, member, packageFiles) {
+    const absolute = path.join(projectDir, lockfile.path);
+    const captured = await cache.get(absolute, projectDir, packageFiles);
+    if ("reason" in captured)
+        return null;
+    const key = path.relative(path.dirname(absolute), path.join(projectDir, member)).split(path.sep).join("/");
+    return captured.members.get(key) ?? null;
+}
+/** 同じディレクトリのlockfile、または収録を確認できた上位lockfileだけで充足とする。 */
+async function findLockfileMissing(projectDir, markers, manifests, cargoCache, pnpmCache, yarnCache) {
     const cache = new LockfileKeyCache();
+    const packageFiles = markers.filter(m => m.group === "npm").map(m => m.path);
     const missing = [];
     for (const marker of markers) {
         const markerDir = path.dirname(marker.path);
@@ -258,9 +273,13 @@ async function findLockfileMissing(projectDir, markers, manifests, cargoCache) {
         for (const candidate of candidates) {
             const result = candidate.format === "package-lock.json"
                 ? await npmLockfileRecords(cache, projectDir, candidate, markerDir)
-                : candidate.format === "Cargo.lock"
-                    ? await cargoLockfileRecords(cargoCache, projectDir, candidate, marker.path)
-                    : null;
+                : candidate.format === "pnpm-lock.yaml"
+                    ? await pnpmLockfileRecords(pnpmCache, projectDir, candidate, markerDir)
+                    : candidate.format === "yarn.lock"
+                        ? await yarnLockfileRecords(yarnCache, projectDir, candidate, marker.path, packageFiles)
+                        : candidate.format === "Cargo.lock"
+                            ? await cargoLockfileRecords(cargoCache, projectDir, candidate, marker.path)
+                            : null;
             if (result === true)
                 recorded = true;
             if (result !== false)
@@ -281,6 +300,9 @@ async function findLockfileMissing(projectDir, markers, manifests, cargoCache) {
 }
 async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFiles = emptyNugetFiles()) {
     const cargoCache = new CargoLockCache();
+    const pnpmCache = new PnpmLockCache();
+    const yarnCache = new YarnLockCache();
+    const packageFiles = markers.filter(m => m.group === "npm").map(m => m.path);
     const result = {
         projectDir,
         allowedRootReal,
@@ -289,11 +311,13 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
         requirementsCopies: [],
         cargoCopies: [],
         composerCopies: [],
+        pnpmCopies: [],
+        yarnCopies: [],
         composerWarnings: [],
         composerLocalPackages: 0,
         localCrateCount: 0,
         unscannableCrates: [],
-        lockfileMissing: await findLockfileMissing(projectDir, markers, manifests, cargoCache),
+        lockfileMissing: await findLockfileMissing(projectDir, markers, manifests, cargoCache, pnpmCache, yarnCache),
         requirementIssues: [],
         requirementReferences: [],
         lowerBounds: [],
@@ -323,7 +347,23 @@ async function finalize(projectDir, manifests, markers, allowedRootReal, nugetFi
     }
     for (const manifest of manifests) {
         const absolute = path.join(projectDir, manifest.path);
-        if (manifest.format === "composer.lock") {
+        if (manifest.format === "yarn.lock") {
+            const captured = await yarnCache.get(absolute, projectDir, packageFiles);
+            if ("reason" in captured) {
+                result.skippedFiles.push({ path: manifest.path, reason: captured.reason });
+                continue;
+            }
+            result.yarnCopies.push({ path: manifest.path, content: captured.content, relations: captured.lookup });
+        }
+        else if (manifest.format === "pnpm-lock.yaml") {
+            const captured = await pnpmCache.get(absolute, projectDir);
+            if ("reason" in captured) {
+                result.skippedFiles.push({ path: manifest.path, reason: captured.reason });
+                continue;
+            }
+            result.pnpmCopies.push({ path: manifest.path, content: captured.content });
+        }
+        else if (manifest.format === "composer.lock") {
             const read = await readRegularFile(absolute, { maxBytes: Math.min(MAX_NPM_LOCK_BYTES, composerBytes), boundary: projectDir });
             if (!read.ok) {
                 result.skippedFiles.push({ path: manifest.path, reason: capitalizeReason(read.message) });

package/dist/utils/nugetDependencyGraph.js

@@ -0,0 +1,164 @@
+import { MAX_DEPENDENCY_EDGES } from "./dependencyRelations.js";
+import { compareNugetVersions, parseNugetVersion } from "./nugetVersion.js";
+export const createNugetGraphBudget = () => ({ remaining: MAX_DEPENDENCY_EDGES });
+const record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const text = (v) => typeof v === "string" ? v : "";
+const split = (key) => { const i = key.lastIndexOf("/"); return i > 0 ? { name: key.slice(0, i), version: key.slice(i + 1) } : null; };
+const dependencyList = (v, exact = false) => {
+    if (v === undefined)
+        return [];
+    if (!record(v))
+        return null;
+    const dependencies = [];
+    for (const [name, version] of Object.entries(v)) {
+        if (typeof version !== "string")
+            return null;
+        dependencies.push({ name, ...(exact ? { version } : {}) });
+    }
+    return dependencies;
+};
+/** One graph per locked TFM/RID; range constraints are not solved again. */
+export function nugetLockGraphs(data) {
+    if (!record(data.dependencies))
+        return [];
+    return Object.values(data.dependencies).filter(record).map(framework => Object.entries(framework).flatMap(([name, raw]) => {
+        if (!record(raw) || !["Direct", "Transitive", "CentralTransitive", "Project"].includes(text(raw.type)))
+            return [];
+        return [{ name, version: text(raw.resolved), direct: raw.type === "Direct", dependencies: dependencyList(raw.dependencies) }];
+    }));
+}
+/** Graphs remain separated by target; deps.json dependencies carry exact versions. */
+export function nugetTargetGraphs(data, kind) {
+    if (!record(data.targets))
+        return [];
+    const libraries = record(data.libraries) ? data.libraries : {};
+    const project = record(data.project) ? data.project : {};
+    const frameworks = record(project.frameworks) ? project.frameworks : {};
+    const frameworkIndex = new Map();
+    for (const [key, value] of Object.entries(frameworks)) {
+        if (!record(value))
+            continue;
+        for (const alias of new Set([key.toLowerCase(), text(value.targetAlias).toLowerCase()].filter(Boolean))) {
+            frameworkIndex.set(alias, frameworkIndex.has(alias) && frameworkIndex.get(alias) !== value ? null : value);
+        }
+    }
+    const graphs = [];
+    for (const [targetName, rawTarget] of Object.entries(data.targets)) {
+        if (!record(rawTarget))
+            continue;
+        const base = targetName.split("/")[0].toLowerCase();
+        const framework = frameworkIndex.get(base);
+        const direct = new Set(kind === "assets" && framework && record(framework.dependencies) ? Object.keys(framework.dependencies).map(n => n.toLowerCase()) : []);
+        const nodes = [];
+        const projectDependencies = [];
+        for (const [key, raw] of Object.entries(rawTarget)) {
+            const id = split(key), library = record(libraries[key]) ? libraries[key] : null;
+            if (!id || !record(raw))
+                continue;
+            const type = kind === "assets" ? text(raw.type) : text(library?.type);
+            if (!["package", "runtimepack", "project", "reference"].includes(type))
+                continue;
+            const name = type === "runtimepack" && id.name.toLowerCase().startsWith("runtimepack.") ? id.name.slice("runtimepack.".length) : id.name;
+            const dependencies = dependencyList(raw.dependencies, kind === "deps");
+            if (kind === "deps" && type === "project" && dependencies) {
+                for (const dependency of dependencies)
+                    projectDependencies.push(dependency);
+            }
+            nodes.push({ name, version: id.version, lookupName: id.name, direct: (type === "package" || type === "runtimepack") && direct.has(name.toLowerCase()), dependencies });
+        }
+        if (kind === "deps") {
+            const roots = new Set();
+            for (const dep of projectDependencies) {
+                if (parseNugetVersion(dep.version))
+                    roots.add(nugetGraphKey(dep.name, dep.version));
+            }
+            for (const node of nodes) {
+                const library = libraries[`${node.lookupName}/${node.version}`];
+                const type = record(library) ? library.type : null;
+                if (type !== "package" && type !== "runtimepack")
+                    continue;
+                node.direct = parseNugetVersion(node.version) !== null && roots.has(nugetGraphKey(node.name, node.version));
+            }
+        }
+        graphs.push(nodes);
+    }
+    return graphs;
+}
+/** Exact package identity for merging target-specific reachability without crossing versions. */
+export function nugetGraphKey(name, version) {
+    const parsed = parseNugetVersion(version);
+    return JSON.stringify([name.toLowerCase(), parsed ? [parsed.parts, parsed.prerelease] : version]);
+}
+/** Metadata enrichment only. Existing direct/transitive classification remains authoritative. */
+export function nugetGraphOrigins(graphs, budget) {
+    const introduced = new Map();
+    const displayNames = new Map();
+    const tick = () => --budget.remaining >= 0;
+    for (const nodes of graphs) {
+        const names = new Map();
+        for (const node of nodes) {
+            if (!tick())
+                return null;
+            for (const name of new Set([node.name.toLowerCase(), (node.lookupName ?? node.name).toLowerCase()])) {
+                const entries = names.get(name) ?? [];
+                entries.push(node);
+                names.set(name, entries);
+            }
+        }
+        const resolve = (dep) => {
+            const entries = names.get(dep.name.toLowerCase()) ?? [];
+            if (dep.version === undefined)
+                return entries.length === 1 ? entries[0] : null;
+            let selected = null;
+            for (const entry of entries) {
+                if (!tick())
+                    return null;
+                if (parseNugetVersion(dep.version) && parseNugetVersion(entry.version) && compareNugetVersions(dep.version, entry.version) === 0) {
+                    if (selected)
+                        return null;
+                    selected = entry;
+                }
+            }
+            return selected;
+        };
+        for (const origin of nodes) {
+            if (!tick())
+                return null;
+            if (!origin.direct || !/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,99}$/.test(origin.name) || !parseNugetVersion(origin.version) || names.get(origin.name.toLowerCase())?.length !== 1)
+                continue;
+            const originKey = origin.name.toLowerCase();
+            if (!displayNames.has(originKey))
+                displayNames.set(originKey, origin.name);
+            const visited = new Set([origin]);
+            const queue = [origin];
+            while (queue.length) {
+                if (!tick())
+                    return null;
+                for (const dep of queue.pop().dependencies ?? []) {
+                    if (!tick())
+                        return null;
+                    const target = resolve(dep);
+                    if (budget.remaining < 0)
+                        return null;
+                    if (!target || visited.has(target))
+                        continue;
+                    visited.add(target);
+                    queue.push(target);
+                    const key = nugetGraphKey(target.name, target.version);
+                    const sources = introduced.get(key) ?? new Set();
+                    sources.add(displayNames.get(originKey));
+                    introduced.set(key, sources);
+                }
+            }
+        }
+    }
+    return introduced;
+}
+export function enrichNugetRelations(base, origins, declared) {
+    return (name, version, type) => {
+        const info = base?.(name, version, type) ?? { relation: "unknown" };
+        const introducedBy = origins?.get(nugetGraphKey(name, version));
+        const manifest = info.relation === "direct" ? declared.get(name.toLowerCase()) : undefined;
+        return { ...info, ...(introducedBy?.size ? { introducedBy } : {}), ...(manifest ? { declaredIn: new Set([manifest]) } : {}) };
+    };
+}

package/dist/utils/nugetFiles.js

@@ -11,6 +11,7 @@
 import { ScanToolError } from "../errors.js";
 import { createNpmLockWorkBudget, parseNpmLock } from "./npmLockCopy.js";
 import { decodeEntities } from "./pomParent.js";
+import { nugetLockGraphs, nugetTargetGraphs } from "./nugetDependencyGraph.js";
 /** NuGetの版の形式(4つ目の数・プレリリース・ビルドメタデータを含む)。これ以外は確定版とみなさない */
 const NUGET_VERSION = /^\d{1,9}(?:\.\d{1,9}){0,3}(?:-[0-9A-Za-z][0-9A-Za-z.-]{0,63})?(?:\+[0-9A-Za-z.-]{1,64})?$/;
 /** NuGetのパッケージIDに使える文字 */
@@ -94,7 +95,7 @@ export function parsePackagesLock(source, budget = createNpmLockWorkBudget()) {
                 out.unscannable.push({ name: name.slice(0, 200), version: text(entry.resolved).slice(0, 100), reason: "unknown_type" });
         }
     }
-    return { ok: true, ...out, packages: dedupe(out.packages), localProjects: localProjects.size };
+    return { ok: true, ...out, packages: dedupe(out.packages), localProjects: localProjects.size, graphs: nugetLockGraphs(data) };
 }
 const RUNTIME_PACK_PREFIX = "runtimepack.";
 /** `Name/Version`形式のライブラリのキー */
@@ -154,6 +155,7 @@ export function parseProjectAssets(source, budget = createNpmLockWorkBudget()) {
         // Windowsのパスも区切る
         projectFileName: projectPath === "" ? null : projectPath.split(/[\\/]/).pop() || null,
         projectName: text(restore.projectName) || null,
+        graphs: nugetTargetGraphs(data, "assets"),
     };
 }
 /**
@@ -211,7 +213,7 @@ export function parseDepsJson(source, budget = createNpmLockWorkBudget()) {
             out.unscannable.push({ name: id.name, version: id.version, reason: "unknown_type" });
         }
     }
-    return { ok: true, ...out, packages: dedupe(out.packages) };
+    return { ok: true, ...out, packages: dedupe(out.packages), graphs: nugetTargetGraphs(data, "deps") };
 }
 const MAX_XML_ELEMENTS = 200_000;
 const MAX_XML_DEPTH = 64;

package/dist/utils/nugetProject.js

@@ -14,7 +14,8 @@ import path from "node:path";
 import { ScanToolError } from "../errors.js";
 import { capitalizeReason, readRegularFile } from "./safeRead.js";
 import { createNpmLockWorkBudget } from "./npmLockCopy.js";
-import { analyzeProjectFile, hasNonNugetOrgSource, packageReferenceNames, parseDepsJson, parsePackagesConfig, parsePackagesLock, parseProjectAssets, parseXml, } from "./nugetFiles.js";
+import { analyzeProjectFile, hasNonNugetOrgSource, packageReferenceNames, parseDepsJson, parsePackagesConfig, parsePackagesLock, parseProjectAssets, parseXml, nugetRelations, } from "./nugetFiles.js";
+import { createNugetGraphBudget, enrichNugetRelations, nugetGraphOrigins } from "./nugetDependencyGraph.js";
 export const NUGET_LOCKFILE = /^packages(?:\.(.+))?\.lock\.json$/i;
 export const NUGET_PACKAGES_CONFIG = /^packages(?:\.(.+))?\.config$/i;
 export const NUGET_DEPS_JSON = /^.+\.deps\.json$/i;
@@ -137,6 +138,12 @@ export async function analyzeNuget(projectDir, files) {
     let lowerBounds = false;
     let directOnly = false;
     const staleAssets = [];
+    const sourceOwners = new Map();
+    const recordOwner = (file, owner) => {
+        const owners = sourceOwners.get(file) ?? new Set();
+        owners.add(owner);
+        sourceOwners.set(file, owners);
+    };
     const addCopy = (file, format, outcome) => {
         let packages = outcome.packages;
         if (packages.length > packageBudget) {
@@ -153,7 +160,7 @@ export async function analyzeNuget(projectDir, files) {
         result.unscannable.push(...outcome.unscannable.map((u) => ({ file, ...u })));
         result.manifests.push({ path: file, format });
         if (packages.length > 0)
-            result.copies.push({ path: file, format, packages });
+            result.copies.push({ path: file, format, packages, graphs: outcome.graphs });
     };
     const parseFile = async (file, maxBytes, parse) => {
         const read = await reader.read(file, maxBytes);
@@ -239,8 +246,10 @@ export async function analyzeNuget(projectDir, files) {
                 continue;
             addCopy(file, format, parsed);
             const owner = ownerOf(file, pattern, projectsByDir, customLockPath, chargeAssociation);
-            if (owner !== null)
+            if (owner !== null) {
                 covered.add(owner);
+                recordOwner(file, owner);
+            }
             else if (format === "packages.lock.json")
                 unownedLockDirs.add(path.dirname(file));
         }
@@ -275,6 +284,7 @@ export async function analyzeNuget(projectDir, files) {
                 : assets.projectName !== null && assets.projectName.toLowerCase() === projectBaseName(project);
             if (matches) {
                 assetsAddCopy(assetsFile, assets);
+                recordOwner(assetsFile, project);
                 covered.add(project);
                 const [assetsStat, projectStat] = await Promise.all([
                     stat(path.join(projectDir, assetsFile)).catch(() => null),
@@ -303,7 +313,53 @@ export async function analyzeNuget(projectDir, files) {
         if (analysis.references.some((r) => r.lowerBound))
             lowerBounds = true;
         addCopy(project, "PackageReference", { ok: true, packages: analysis.references, localProjects: 0, unscannable: [] });
+        recordOwner(project, project);
+    }
+    const graphBudget = createNugetGraphBudget();
+    let limitedGraphs = 0;
+    const declarationCache = new Map();
+    for (const copy of result.copies) {
+        const declared = new Map();
+        const owners = sourceOwners.get(copy.path);
+        if (owners?.size === 1 && graphBudget.remaining > 0) {
+            const owner = [...owners][0];
+            const analysis = projectAnalyses.get(owner);
+            let names = declarationCache.get(owner);
+            if (!names && analysis?.ok) {
+                names = new Set();
+                for (const ref of analysis.references) {
+                    if (--graphBudget.remaining < 0)
+                        break;
+                    names.add(ref.name.toLowerCase());
+                }
+                for (const ref of analysis.unresolved) {
+                    if (--graphBudget.remaining < 0)
+                        break;
+                    if (["property", "range", "floating", "central_package_management"].includes(ref.reason) && /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,99}$/.test(ref.name))
+                        names.add(ref.name.toLowerCase());
+                }
+                if (graphBudget.remaining < 0)
+                    names.clear();
+                declarationCache.set(owner, names);
+            }
+            if (names)
+                for (const pkg of copy.packages) {
+                    if (--graphBudget.remaining < 0) {
+                        declared.clear();
+                        break;
+                    }
+                    if (pkg.relation === "direct" && names.has(pkg.name.toLowerCase()))
+                        declared.set(pkg.name.toLowerCase(), path.relative(path.dirname(copy.path), owner));
+                }
+        }
+        const origins = nugetGraphOrigins(copy.graphs ?? [], graphBudget);
+        if (origins === null || graphBudget.remaining < 0)
+            limitedGraphs++;
+        copy.relations = enrichNugetRelations(nugetRelations(copy.packages), origins, declared);
+        delete copy.graphs;
     }
+    if (limitedGraphs > 0)
+        result.warnings.push(`NuGet relationship analysis reached its per-scan work limit for ${limitedGraphs} source(s); introduced_by/declared_in may be unavailable. Package vulnerability scanning still ran`);
     if (staleAssets.length > 0) {
         // プロジェクトごとに1件ずつ並べると応答が際限なく大きくなるため、1件にまとめる
         const listed = staleAssets.slice(0, MAX_STALE_LISTED).join(", ");