osv-scanner-mcp 0.20.0 → 0.21.0

package/README.md

@@ -295,7 +295,7 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
 ```
 
 - **Always check `coverage`.** If `complete` is `false`, some dependencies were not scanned, so zero findings does not mean the project is safe
-  - `lockfile_missing`: manifests without a lockfile (`package.json`, `pyproject.toml`, `Pipfile`, `setup.py`, `build.gradle`, `Cargo.toml`, and so on). Not recorded if a lockfile of the same ecosystem is in the same directory. If there is only a lockfile in a parent directory, the manifest is not recorded only when `package-lock.json` (v2 or later) is confirmed to contain that directory (npm workspaces), when `pnpm-lock.yaml` (formats 5.3/5.4/6.0/9.0) contains its exact normalized importer path (pnpm workspaces; source checkout), when Yarn workspace membership and captured declarations can be confirmed (see below; source checkout), or when `Cargo.lock` contains a local crate with the `[package] name` of the `Cargo.toml` and the directory is a member of the workspace according to `members` / `exclude` of the `Cargo.toml` next to `Cargo.lock` (Cargo workspaces; `members` globs with `*` and `?` are supported). A crate with the same name that cannot be confirmed as a member, such as a path dependency outside the workspace, is recorded as `unconfirmed`. Library crates often do not commit `Cargo.lock`, so their `Cargo.toml` is recorded here; generate one with `cargo generate-lockfile`. Otherwise it is recorded with `status: "missing"`, or `status: "unconfirmed"` for formats that cannot be checked (unsupported Yarn layouts, Python lockfiles, and so on). Generate the lockfile as described in `hint` (in a trusted environment) and scan again
+  - `lockfile_missing`: manifests without a lockfile (`package.json`, `pyproject.toml`, `Pipfile`, `setup.py`, `build.gradle`, `Cargo.toml`, and so on). Not recorded if a lockfile of the same ecosystem is in the same directory. If there is only a lockfile in a parent directory, the manifest is not recorded only when `package-lock.json` (v2 or later) is confirmed to contain that directory (npm workspaces), when `pnpm-lock.yaml` (formats 5.3/5.4/6.0/9.0) contains its exact normalized importer path (pnpm workspaces; source checkout), when PDM locked local identity and captured workspace/path declarations can be confirmed (see below; source checkout), when Poetry locked path-package identity and exported child declarations can be confirmed (see below; source checkout), when uv local workspace identity and manifest membership can be confirmed (source checkout), when `bun.lock` contains its exact normalized workspace path (text formats 0/1/2; source checkout), when Yarn workspace membership and captured declarations can be confirmed (see below; source checkout), or when `Cargo.lock` contains a local crate with the `[package] name` of the `Cargo.toml` and the directory is a member of the workspace according to `members` / `exclude` of the `Cargo.toml` next to `Cargo.lock` (Cargo workspaces; `members` globs with `*` and `?` are supported). A crate with the same name that cannot be confirmed as a member, such as a path dependency outside the workspace, is recorded as `unconfirmed`. Library crates often do not commit `Cargo.lock`, so their `Cargo.toml` is recorded here; generate one with `cargo generate-lockfile`. Otherwise it is recorded with `status: "missing"`, or `status: "unconfirmed"` for formats that cannot be checked (unsupported Yarn layouts, Python lockfiles other than `uv.lock` / `poetry.lock` / `pdm.lock`, and so on). Generate the lockfile as described in `hint` (in a trusted environment) and scan again
   - `unpinned_requirements`: lines in `requirements.txt` that do not pin a version. `kind` is `unpinned` (no version), `range` (`>`, `<`, `!=`, `==1.*`, combined ranges, and so on), or `lower_bound` (`>=`, `~=`). OSV-Scanner does not scan `unpinned` and `range` lines, and scans `lower_bound` lines at the lower bound (those packages are marked `version_is_lower_bound: true` and may differ from the installed version)
   - `unscannable_requirements`: lines that are not scanned, with the reason: `-e`, `name @ URL`, paths, includes that were not expanded (outside the project directory, missing, URLs, or over the limits), constraint files (`-c`, not applied), and options or version specifiers that cannot be interpreted. Lines that cannot be interpreted are recorded here instead of being ignored
   - `local_crates` (only when a `Cargo.lock` was scanned): the number of crates without a source in `Cargo.lock` (workspace members and path dependencies). They are your own code and are not scanned; they do not make `complete` false. A third-party crate vendored as a path dependency is not scanned either (as with `cargo audit`)
@@ -313,13 +313,35 @@ Detects the lockfiles and manifests in a project and scans the Java / JavaScript
   - `Cargo.lock`: crates.io dependencies immediately required by a local/workspace/path crate are direct; crates.io dependencies reachable through them (including git and alternate-registry origins) are transitive. `introduced_by` names the first direct dependency on each path. References are resolved by exact name, version, and source where provided; ambiguous references are not guessed. Replacements are followed. `declared_in` lists project-relative Cargo.toml paths only when every declaring crate has a unique matching manifest. Otherwise `declaring_crates` names the unmapped declaring crates (up to 10, with the rest in `declaring_crates_omitted`). Dev/build/target-specific distinctions are unavailable. Traversal over 2,000,000 edges returns `unknown`
   - .NET: `Direct` / `Transitive` in `packages.lock.json`; the dependencies of `project.frameworks` in `project.assets.json`; the dependencies of the project library in `*.deps.json`; and every reference read from a project file are direct. `packages.config` does not say, so it is `unknown`. Origin/declaration enrichment is available in the source checkout as described below.
   - Composer (source checkout): the companion root's `require` / `require-dev` are direct, and locked `require` reachability establishes transitive dependencies. `declared_in` names the companion for direct dependencies; `introduced_by` lists transitively requiring direct roots. See [Composer support](#composer-support) for ambiguity and work limits.
-  - `pnpm-lock.yaml` (source checkout): lockfile formats 5.3, 5.4, 6.0 and 9.0 are supported. Importer `dependencies`, `devDependencies` and `optionalDependencies` are direct, with the lockfile's declaring importer `package.json` paths in `declared_in`. Locked dependency and optional-dependency edges establish `introduced_by` and transitive reachability. Workspace importers, npm aliases, scoped packages, multiple origins and peer-context-specific snapshots are supported. A package that is both direct and transitively required remains direct and also lists its origins. Local/Git references, unresolved identities and unreachable packages do not establish relationships; links and source files are never followed. Declaration paths reflect the lockfile, not independently verified current manifests. Workspace coverage (source checkout) uses the exact normalized importer path relative to an ancestor pnpm-lock.yaml: included children are covered, absent importers are `missing`, and unsupported/malformed/ambiguous or analysis-limited importer metadata is `unconfirmed`. Empty importer maps and Unicode/space paths are supported. Importer presence does not prove freshness or agreement with current package.json dependencies. Only lockfiles found inside the selected scan directory are considered. Coverage and vulnerability scanning use the same captured lockfile bytes (16 MiB per file, 64 MiB total); unreadable or oversized inputs are skipped with a reason. Importer parsing/indexing shares a 2,000,000-operation budget per detection, separate from relationship analysis. The lockfile is read from YAML's syntax tree in linear time (only strings, maps, and sequences; a 28,000-package lockfile takes about a second). Unsupported/malformed YAML, duplicate keys, anchors, aliases, tags, multi-document files, conservative nesting/line limits, inputs above 16 MiB, or more than 2,000,000 relationship operations per scan (shared by all pnpm lockfiles) leave relationships unknown; scanning continues. The existing shared relationship input byte limit and 10-origin output limit apply.
+  - `pnpm-lock.yaml` (source checkout): lockfile formats 5.3, 5.4, 6.0 and 9.0 are supported. Importer `dependencies`, `devDependencies` and `optionalDependencies` are direct, with the lockfile's declaring importer `package.json` paths in `declared_in`. Locked dependency and optional-dependency edges establish `introduced_by` and transitive reachability. Workspace importers, npm aliases, scoped packages, multiple origins and peer-context-specific snapshots are supported. A package that is both direct and transitively required remains direct and also lists its origins. Local/Git references, unresolved identities and unreachable packages do not establish relationships; links and source files are never followed. Declaration paths reflect the lockfile, not independently verified current manifests. Workspace coverage (source checkout) uses the exact normalized importer path relative to an ancestor pnpm-lock.yaml: included children are covered, absent importers are `missing`, and unsupported/malformed/ambiguous or analysis-limited importer metadata is `unconfirmed`. Empty importer maps and Unicode/space paths are supported. Importer presence does not prove freshness or agreement with current package.json dependencies. Only lockfiles found inside the selected scan directory are considered. Coverage and vulnerability scanning use the same captured lockfile bytes (16 MiB per file, 64 MiB total); unreadable or oversized inputs are skipped with a reason. Each lockfile is parsed with its own budget sized from its length (1,024 operations per KiB, at least 2,000,000), so files within the size limits are not rejected because other lockfiles were parsed first; importer indexing shares a 2,000,000-operation budget per detection, separate from relationship analysis. The lockfile is read from YAML's syntax tree in linear time (only strings, maps, and sequences; a 28,000-package lockfile takes about a second, a 16 MiB one about 3 seconds). Unsupported/malformed YAML, duplicate keys, anchors, aliases, tags, multi-document files, conservative nesting limits, more than 1,000,000 lines, inputs above 16 MiB, or more than 2,000,000 relationship operations per scan (shared by all pnpm lockfiles) leave relationships unknown; scanning continues. The existing shared relationship input byte limit and 10-origin output limit apply.
   - `yarn.lock` (source checkout): Classic v1 and Berry metadata versions 4/5/6/8 support direct/transitive relations, `introduced_by` and `declared_in`. Classic uses captured root/workspace `package.json` declarations; Berry uses exact locked descriptors and `workspace:` entries. Dependencies and optional dependencies are followed; peers are not independently guessed or installed. Multiple selectors, scoped/npm aliases, cycles, multiple roots and direct/transitive overlap are supported. Local/Git/patch/portal/virtual identities that cannot establish a registry release remain unknown and are never followed to source files.
-  - Other formats (`gradle.lockfile`, `bun.lock`, `poetry.lock`, `uv.lock`, `Pipfile.lock`, and `pdm.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
+  - `bun.lock` (source checkout): text formats 0/1/2 support direct/transitive relations, `introduced_by`, `declared_in` and workspace coverage. Locked workspace declarations are direct; dependencies, optional dependencies and installed peers are followed through exact package placement. Nested versions, scoped names, npm aliases, cycles and direct/transitive overlap are supported. Intentionally unresolved optional dependencies are not guessed from another installed package.
+  - `uv.lock` (source checkout): version 1, revisions 0–5 support direct/transitive relations, `introduced_by`, `declared_in` and workspace coverage. Captured local workspace packages define roots from normal, optional and development-group dependencies. Registry identities resolve only when their normalized name and any locked version/source constraints identify a unique package. Optional edges are followed only for explicitly requested extras; unknown combinations of differing markers are not joined.
+  - `poetry.lock` (source checkout): lock versions 1.1/2.0/2.1 support direct/transitive relations, `introduced_by`, `declared_in` and conservative child coverage. Captured root and confirmed local child `pyproject.toml` declarations establish direct roots; unique locked package names and unconditional string dependency edges establish transitive origins. Modern project dependencies/optional dependencies, Poetry dependency/dev/group tables and standard dependency groups are supported. Ambiguous names, conditional/optional edges requiring a solver, nonregistry releases and unreachable packages remain unknown.
+  - `pdm.lock` (source checkout): 4.0–4.4 lock schemas and 4.5.0/4.5.1 support direct/transitive relations, `introduced_by`, `declared_in` and child coverage. Captured project dependencies, optional groups, standard dependency groups (including group includes) and legacy `tool.pdm.dev-dependencies` define roots, selected by `metadata.groups` when present. Explicit extras select exact locked extras identities; ambiguous names/versions/sources are not guessed. PDM-generated editable dev declarations (`-e file:///${PROJECT_ROOT}/...#egg=name`) use the explicit egg identity and exact safe locked local path. Unsupported declarations do not discard other known roots; an unsupported runtime declaration still prevents confirming child coverage.
+  - Other formats (`gradle.lockfile` and `Pipfile.lock`), npm lockfile version 1, and entries not reachable from the project are `unknown`. If lockfiles disagree, the value is `mixed`
+
+**PDM origins and child coverage (source checkout):** native `[tool.pdm.workspace].members` patterns (exact paths, `*`, `?`, whole-segment `**`, including dot directories) are checked against exact safe locked `path` identities. Explicit reachable local path dependencies can also establish inclusion. A matching name alone does not cover a child. Captured child name/version and exported runtime/optional declarations must agree with unique locked dependency identities (specifier order is normalized; marker token types, boundaries and literal contents are preserved while ignoring whitespace outside literals and quote style; other marker or constraint differences are not solved); missing local directories are `missing`, while unreadable, unsupported, ambiguous or unverifiable declarations are `unconfirmed`. Unsupported glob syntax, child development groups and dynamic dependencies/optional-dependencies cannot establish complete child coverage. Other child markers (`setup.py`, `setup.cfg`, `Pipfile`) remain unconfirmed; same-directory locks retain the existing coverage convention. Group presence and membership do not constitute a full freshness check.
+
+`declared_in` names captured root/confirmed-child `pyproject.toml` files. PEP 503 names, PEP 440 release comparison, multiple origins, cycles, direct/transitive overlap and distinct extras identities are supported. Dependency markers are not evaluated; differing expressions on the same traversal path are not joined. No PDM, plugin, build backend or project code runs during a scan. Local/Git/URL identities are not treated as registry releases by relationship analysis; local paths are never followed to read source files. Existing OSV communication and package-origin handling are unchanged. TOML parsing is bounded and locks are captured once for metadata and scanner input (16 MiB per file, 64 MiB total). Captured companions have separate 4 MiB/file, 64 MiB total limits. Coverage and relationships have separate shared 2,000,000-operation budgets; exhausting relationship analysis preserves confirmed membership. Unsupported metadata leaves relationships unknown while vulnerability scanning continues. `pylock.toml`, custom lock filenames and full constraint/environment solving are outside this support.
+
+**Poetry origins and child coverage (source checkout):** Poetry path dependencies are used to check shared-lock monorepos. This does not assume uv-style workspace membership. A child must have an exact safe relative directory source in the ancestor lock, be reachable from captured root declarations, and match a unique locked local name/version. Its runtime/optional declarations must agree with unique locked dependency edges (matching constraint text or exact locked versions); unsupported constraints or source identities remain unconfirmed. A path dependency on another local package (including a sibling such as `../core`) agrees when the locked edge is an unconditional `{path, develop}` table resolving to that package's locked directory inside the lock directory. Child development groups are not exported by path packages and therefore make child coverage unconfirmed. Dynamic `project.dependencies` or `project.optional-dependencies` also leave child coverage unconfirmed because backend-generated declarations cannot be verified from captured TOML. An absent child directory is missing; unreadable/unsupported/ambiguous metadata is unconfirmed. Independent descendants with the same package name do not count as included. Legacy `setup.py`/`setup.cfg`/`Pipfile` children remain unconfirmed. A same-directory lock retains the existing coverage convention.
+
+Root declarations include all supported development/optional groups, because scanning covers the universal lock. Unconditional string edges are followed even when the root or an intermediate package is marked optional; conditional or optional dependency tables still remain unresolved. Names use PEP 503 normalization and versions use PEP 440 comparison. No environment, extras or constraint solver is run; lock freshness is not globally verified. Declared paths come from safely captured companions, not from following arbitrary lockfile source paths. Poetry, plugins and build backends are never executed during scanning. Lock bytes are captured once for coverage, relationships and scanner input (16 MiB/file, 64 MiB total); companions have a separate 4 MiB/file, 64 MiB total budget. TOML preflight and independent shared 2,000,000-operation coverage/relationship budgets bound metadata analysis; exceeding only the relationship budget preserves confirmed coverage. Private-index exclusion is not established by this metadata analysis.
+
+**uv origins and workspace coverage (source checkout):** local `editable`, `virtual` or `directory` paths are matched with `[manifest].members` names to confirm child workspace membership. A unique local root at `.` can be confirmed for single-project locks. A local path dependency alone does not establish workspace membership; a locked local package that is not a confirmed member (such as a path dependency), or missing or ambiguous membership evidence, remains unconfirmed, while a child absent from the lockfile is missing. Unicode/space paths and virtual projects are supported. Only `pyproject.toml` children are confirmed; legacy `setup.py`/`setup.cfg`/`Pipfile` markers remain unconfirmed against ancestor uv locks.
+
+`declared_in` reflects locked workspace `pyproject.toml` paths; current source files and lockfile freshness are not compared. Names use PEP 503 normalization; explicit dependency versions use PEP 440 comparison and source identities are kept separate. No marker, Python-version, platform or package constraint solver is run. Different marker expressions on one path are conservatively left unresolved rather than joined, and unreachable/ambiguous packages remain unknown. Workspace groups and optional declarations are included because scanning covers the universal lockfile, not a selected environment. Local paths may be graph intermediates but are never followed to read or execute source files. uv and build backends are never executed during scanning.
+
+The same safely captured bytes feed membership, relation metadata and the scanner. TOML parsing is bounded at 16 MiB per file / 64 MiB total with a conservative preflight limit of 128 container levels, 128 unquoted dots per line and a per-file structural-character budget sized from its length (1,024 per KiB, at least 2,000,000), so files within the size limits are not rejected for size alone; duplicate keys and unsupported schema are rejected for metadata analysis. Workspace indexing and graph traversal use separate shared 2,000,000-operation budgets, so relationship limits do not invalidate confirmed membership; a root declared by several members with the same extras and marker is traversed once. Unreadable/oversized files are skipped with a reason. Package origin and private index exclusion are not established by relationship analysis; existing OSV communication behavior is unchanged.
+
+**Bun origins and workspace coverage (source checkout):** the exact normalized `workspaces` path in captured `bun.lock` establishes inclusion in an ancestor lockfile, including Unicode/space paths and empty entries. An absent child is `missing`; unsupported/malformed/duplicate/ambiguous or parse-limited data is `unconfirmed`. Declaration paths reflect the lockfile, not a comparison with current `package.json` contents, and do not establish freshness or compatibility. Package paths resolve from the declaring workspace/package toward the locked root while keeping scoped names intact; unsupported local/Git/tarball identities are barriers and are never followed to source files. Bun is not executed by the server.
+
+JSONC parsing allows comments/trailing commas and rejects duplicate keys, syntax errors and nesting beyond 128 levels before constructing oversized structures. Captured lockfiles are limited to 16 MiB each / 64 MiB total. Each lockfile is parsed with its own budget sized from its length (1,024 operations per KiB, at least 2,000,000); workspace indexing and relation traversal have separate shared 2,000,000-operation budgets per scan; relation exhaustion leaves metadata unknown without changing confirmed coverage. Coverage and scanning use the same captured bytes. Unreadable/oversized files are skipped with a reason. Binary `bun.lockb` is unsupported; generate a text lockfile in a trusted environment with `bun install --save-text-lockfile --lockfile-only --ignore-scripts`. Only lockfiles inside the selected scan directory are considered.
 
 **Yarn workspace coverage (source checkout):** Classic does not contain workspace importer records, so a captured private root's `workspaces` array (or `workspaces.packages`) must include the child and its captured dependency descriptors must resolve in the lockfile or to a uniquely named configured local workspace satisfying the requested SemVer range. Berry matches exact normalized `workspace:` resolution paths and checks captured dependency declarations against the locked workspace. Classic children need a nonempty name and usable version; manifests without them are not workspace members. Wildcards do not consume dot-prefixed path segments unless the pattern explicitly starts that segment with a dot. `*`, `?`, whole-segment `**`, exclusion patterns, one trailing `/` (as Yarn strips it), and Unicode/space paths are supported; other empty segments are unconfirmed; brace/extglob/character-class patterns remain unconfirmed. Independent children are missing; unreadable declarations, unresolved/ambiguous entries and analysis limits are unconfirmed. Coverage confirmation does not prove lockfile freshness or platform compatibility.
 
-Yarn lockfiles and manifests are captured once within the selected scan boundary; coverage, relation metadata and scanning use those same inputs. Yarn is never run during a scan, and links, configuration plugins and source paths are not evaluated. Lockfiles are limited to 16 MiB each / 64 MiB total; captured package manifests to 4 MiB each / 64 MiB total with bounded JSON parsing. YAML nesting/line limits apply. Parsing and workspace coverage share one 2,000,000-operation budget per scan, and relationship analysis has a separate 2,000,000-operation budget, so exceeding the relationship limit leaves relations unknown without making confirmed coverage unconfirmed. Unsupported metadata leaves relations unknown and membership unconfirmed; unreadable/oversized lockfiles are skipped with a reason. A selected lockfile alone does not cause child manifests or files outside the selected scan directory to be searched. Berry declaration paths may come from locked workspace entries when companions were not captured.
+Yarn lockfiles and manifests are captured once within the selected scan boundary; coverage, relation metadata and scanning use those same inputs. Yarn is never run during a scan, and links, configuration plugins and source paths are not evaluated. Lockfiles are limited to 16 MiB each / 64 MiB total; captured package manifests to 4 MiB each / 64 MiB total with bounded JSON parsing. YAML nesting limits and a 1,000,000-line limit apply. Each lockfile is parsed with its own size-based budget (1,024 operations per KiB, at least 2,000,000); workspace coverage shares one 2,000,000-operation budget per scan, and relationship analysis has a separate 2,000,000-operation budget, so exceeding the relationship limit leaves relations unknown without making confirmed coverage unconfirmed. Unsupported metadata leaves relations unknown and membership unconfirmed; unreadable/oversized lockfiles are skipped with a reason. A selected lockfile alone does not cause child manifests or files outside the selected scan directory to be searched. Berry declaration paths may come from locked workspace entries when companions were not captured.
 
 **NuGet origins and declarations (source checkout):** `introduced_by` follows dependency edges from direct NuGet packages in each locked TFM or assets/deps target separately, then merges origins only for the same package/version in the report. Case-insensitive IDs and equivalent normalized versions match. `packages.lock.json` and assets targets contain a resolved solution, so edges resolve a unique installed name within that target; dependency constraints are not solved again. `deps.json` edges additionally require an exact normalized version match. Multiple origins and cycles are supported; a root does not introduce itself. Duplicate/ambiguous names and unmatched target frameworks are not guessed. Local project nodes can be traversed but are not guessed as direct package origins and remain excluded from OSV input. `introduced_by` retains the existing 10-name limit and omitted count.
 

package/dist/index.js

@@ -66,7 +66,7 @@ if (startupWarning !== null) {
     }
 }
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
-const SERVER_VERSION = "0.20.0";
+const SERVER_VERSION = "0.21.0";
 const server = new McpServer({
     name: "osv-scanner-mcp",
     version: SERVER_VERSION,
@@ -88,7 +88,7 @@ server.registerTool("scan_project", {
         "a PackageReference Version=\"x\" is looked up at its lower bound (version_is_lower_bound), and references with properties, ranges without a lower bound, floating versions, conditions, or Update/Remove are not looked up (unresolved_package_references). " +
         "The project's own projects are counted in local_projects. NuGet introduced_by follows target-scoped restore/build dependency graphs; declared_in names a uniquely associated, captured project with an unambiguous unconditional PackageReference. Ambiguous declarations, standalone build files, or analysis limits omit uncertain metadata. Graph paths are not followed and restore/MSBuild are not run. Names of packages from private NuGet feeds are also sent to api.osv.dev; see nuget_warnings. " +
         "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
-        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, pnpm-lock.yaml formats 5.3/5.4/6.0/9.0, Yarn Classic/Berry, go.mod, requirements.txt, pom.xml, Cargo.lock, .NET files and Composer; unknown where the format or captured metadata cannot establish it). pnpm uses locked importer declarations for declared_in and peer-context-specific dependency reachability for introduced_by; local links are not followed and unsupported/limited analysis remains unknown. Yarn derives origins/declarations from captured Classic manifests or Berry workspace entries; workspace coverage uses confirmed workspace membership and locked dependency descriptors, with ambiguous/unsupported cases unconfirmed. Yarn and project code are not executed. pnpm workspace coverage matches child project paths against captured ancestor lockfile importers; absent children are missing and unverifiable membership remains unconfirmed. " +
+        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, pnpm-lock.yaml formats 5.3/5.4/6.0/9.0, Yarn Classic/Berry, bun.lock text formats 0/1/2, uv.lock v1 revisions 0-5, go.mod, requirements.txt, pom.xml, Cargo.lock, .NET files and Composer; unknown where the format or captured metadata cannot establish it). pnpm uses locked importer declarations for declared_in and peer-context-specific dependency reachability for introduced_by; local links are not followed and unsupported/limited analysis remains unknown. uv uses captured workspace identities and manifest members for coverage, and unique version/source references plus requested extras for origins/declarations; ambiguous markers are not joined and uv/build backends are not executed. Bun uses captured workspace declarations and scoped package placement for origins/declarations and exact workspace paths for coverage; unresolvable identities stay unknown and Bun is never executed. Yarn derives origins/declarations from captured Classic manifests or Berry workspace entries; workspace coverage uses confirmed workspace membership and locked dependency descriptors, with ambiguous/unsupported cases unconfirmed. Yarn and project code are not executed. pnpm workspace coverage matches child project paths against captured ancestor lockfile importers; absent children are missing and unverifiable membership remains unconfirmed. " +
         "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. A safely captured companion composer.json defines direct require/require-dev roots; locked require edges establish introduced_by, and direct declarations use declared_in. Missing/uninterpretable companions, ambiguous providers/replacements or names, and analysis limits leave relationships unknown. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
         "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, Rust, PHP, and .NET (NuGet). Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
     inputSchema: {

package/dist/osv/suggestFix.js

@@ -90,10 +90,10 @@ function updateHint(pkg) {
             return undefined; // gradle.lockfile等: 判定できないため具体的な案内はしない(従来どおり)
         case "PyPI":
             if (relation === "direct") {
-                return "Direct dependency. Update the version in requirements.txt, pyproject.toml, or Pipfile, and regenerate the lockfile";
+                return `Direct dependency. Update the version in ${pkg.declared_in?.join(", ") ?? "requirements.txt, pyproject.toml, or Pipfile"}, and regenerate the lockfile`;
             }
             if (relation === "transitive") {
-                return "Transitive dependency. Update the direct dependency that requires it, or set the version with a pip constraints file (-c) or the override settings of uv, Poetry, and similar tools";
+                return `Transitive dependency. Update ${by ? `the direct dependencies that require it (${by})` : "the direct dependency that requires it"}, or set the version with a pip constraints file (-c) or the override settings of uv, Poetry, and similar tools`;
             }
             return UPDATE_HINTS.PyPI;
         default:

package/dist/tools/scanProject.js

@@ -169,7 +169,7 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
     // pnpmの関係の解析の作業量はスキャン全体で共有する(Composer・NuGetと同じ)
     const pnpmWorkBudget = createPnpmWorkBudget();
     let remaining = maxTotalBytes;
-    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages, nugetLookup, composerLookup, yarnLookup } of copies) {
+    for (const { copy, format, originalRelative, entries, cargoPackages, declaringManifests, nugetPackages, nugetLookup, composerLookup, yarnLookup, bunLookup, uvLookup, poetryLookup, pdmLookup } of copies) {
         const lockDir = originalRelative === null ? "" : path.dirname(originalRelative);
         let lookup = null;
         try {
@@ -182,6 +182,18 @@ export async function buildRelationLookups(copies, maxTotalBytes = MAX_RELATION_
                     lookup = format === "go.mod" ? goModRelations(text) : format === "pnpm-lock.yaml" ? pnpmLockRelations(text, pnpmWorkBudget) : npmLockRelations(parseNpmLock(text, npmWorkBudget));
                 }
             }
+            else if (format === "pdm.lock") {
+                lookup = pdmLookup ?? null;
+            }
+            else if (format === "poetry.lock") {
+                lookup = poetryLookup ?? null;
+            }
+            else if (format === "uv.lock") {
+                lookup = uvLookup ?? null;
+            }
+            else if (format === "bun.lock") {
+                lookup = bunLookup ?? null;
+            }
             else if (format === "yarn.lock") {
                 lookup = yarnLookup ?? null;
             }
@@ -310,6 +322,26 @@ export async function scanFromSnapshot(project, options) {
                 throw new ScanToolError(skipped.every((s) => s.kind === "outside_allowed_root") ? "path_outside_allowed_root" : "no_manifest_found", `No lockfile or manifest can be scanned (${project.skippedFiles.map((s) => `${s.path}: ${s.reason}`).join(" / ")})`);
             }
         }
+        for (const copy of project.pdmCopies ?? []) {
+            const generated = await snapshot.writeGenerated(copy.content);
+            targets.push({ path: generated, format: "pdm.lock" });
+            relationSources.push({ copy: generated, format: "pdm.lock", originalRelative: copy.path, pdmLookup: copy.relations });
+        }
+        for (const copy of project.poetryCopies ?? []) {
+            const generated = await snapshot.writeGenerated(copy.content);
+            targets.push({ path: generated, format: "poetry.lock" });
+            relationSources.push({ copy: generated, format: "poetry.lock", originalRelative: copy.path, poetryLookup: copy.relations });
+        }
+        for (const copy of project.uvCopies ?? []) {
+            const generated = await snapshot.writeGenerated(copy.content);
+            targets.push({ path: generated, format: "uv.lock" });
+            relationSources.push({ copy: generated, format: "uv.lock", originalRelative: copy.path, uvLookup: copy.relations });
+        }
+        for (const copy of project.bunCopies ?? []) {
+            const generated = await snapshot.writeGenerated(copy.content);
+            targets.push({ path: generated, format: "bun.lock" });
+            relationSources.push({ copy: generated, format: "bun.lock", originalRelative: copy.path, bunLookup: copy.relations });
+        }
         for (const copy of project.yarnCopies ?? []) {
             const generated = await snapshot.writeGenerated(copy.content);
             targets.push({ path: generated, format: "yarn.lock" });

package/dist/utils/boundedToml.js

@@ -0,0 +1,74 @@
+import { parse } from "smol-toml";
+import { createParseBudget } from "./dependencyRelations.js";
+const record = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+/** Bound TOML containers and structural work before asking the parser to allocate them. */
+export function parseBoundedToml(source) {
+    try {
+        if (Buffer.byteLength(source) > 16 * 1024 * 1024)
+            return null;
+        // Structural work is bounded per file in proportion to its size, as for the other lockfile parsers.
+        const maxStructure = createParseBudget(source).remaining;
+        let quote = "", triple = false, escaped = false, comment = false, depth = 0, structure = 0, dots = 0;
+        for (let i = 0; i < source.length; i++) {
+            const c = source[i];
+            if (comment) {
+                if (c === "\n") {
+                    comment = false;
+                    dots = 0;
+                }
+                continue;
+            }
+            if (quote) {
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (quote === '"' && c === "\\") {
+                    escaped = true;
+                    continue;
+                }
+                if (c === quote && (!triple || source.slice(i, i + 3) === quote.repeat(3))) {
+                    if (triple)
+                        i += 2;
+                    quote = "";
+                    triple = false;
+                }
+                continue;
+            }
+            if (c === "#") {
+                comment = true;
+                continue;
+            }
+            if (c === '"' || c === "'") {
+                quote = c;
+                triple = source.slice(i, i + 3) === c.repeat(3);
+                if (triple)
+                    i += 2;
+                continue;
+            }
+            if (c === "\n")
+                dots = 0;
+            if (c === "." && ++dots > 128)
+                return null;
+            if (c === "[" || c === "{") {
+                if (++depth > 128)
+                    return null;
+            }
+            else if (c === "]" || c === "}") {
+                if (--depth < 0)
+                    return null;
+            }
+            if ("[]{}=,.".includes(c) && ++structure > maxStructure)
+                return null;
+        }
+        if (depth || quote)
+            return null;
+        const value = parse(source, { unsafeKeyBehaviour: "throw" });
+        if (!record(value))
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/utils/bunLock.js

@@ -0,0 +1,249 @@
+import path from "node:path";
+import { visit } from "jsonc-parser";
+import { valid } from "semver";
+import { MAX_DEPENDENCY_EDGES } from "./dependencyRelations.js";
+export const createBunWorkBudget = () => ({ remaining: MAX_DEPENDENCY_EDGES });
+const record = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const fields = ["dependencies", "optionalDependencies", "peerDependencies"];
+const rootFields = [...fields, "devDependencies"];
+const safePath = (p) => !path.posix.isAbsolute(p) && !path.win32.isAbsolute(p) && !/^[A-Za-z]:|[\\\x00-\x1f\x7f]/.test(p) && !p.split("/").includes("..");
+const identity = (name, version) => JSON.stringify([name, version]);
+/** JSONC visitor bounds allocation before constructing values, rejects duplicate keys. */
+export function parseBunLock(source, budget = createBunWorkBudget()) {
+    try {
+        if (Buffer.byteLength(source) > 16 * 1024 * 1024)
+            return null;
+        const tick = () => { if (--budget.remaining < 0)
+            throw new Error("Bun parse limit"); };
+        const stack = [];
+        let result;
+        const add = (value) => {
+            tick();
+            const parent = stack.at(-1);
+            if (!parent) {
+                if (result !== undefined)
+                    throw new Error("multiple values");
+                result = value;
+            }
+            else if (Array.isArray(parent.value))
+                parent.value.push(value);
+            else {
+                if (parent.pending === undefined)
+                    throw new Error("missing key");
+                parent.value[parent.pending] = value;
+                parent.pending = undefined;
+            }
+        };
+        const begin = (value) => {
+            if (stack.length >= 128)
+                throw new Error("Bun nesting limit");
+            add(value);
+            stack.push({ value, keys: new Set() });
+        };
+        visit(source, {
+            onObjectBegin: () => begin(Object.create(null)),
+            onObjectProperty: name => { tick(); const parent = stack.at(-1); if (parent.keys.has(name))
+                throw new Error("duplicate key"); parent.keys.add(name); parent.pending = name; },
+            onObjectEnd: () => { tick(); stack.pop(); },
+            onArrayBegin: () => begin([]),
+            onArrayEnd: () => { tick(); stack.pop(); },
+            onLiteralValue: add,
+            onSeparator: tick,
+            onComment: tick,
+            onError: () => { throw new Error("invalid JSONC"); },
+        }, { allowTrailingComma: true, disallowComments: false });
+        if (!record(result) || ![0, 1, 2].includes(result.lockfileVersion))
+            return null;
+        if (result.configVersion !== undefined && result.configVersion !== 0 && result.configVersion !== 1)
+            return null;
+        return result;
+    }
+    catch {
+        return null;
+    }
+}
+/** Coverage is independent of relationship traversal; empty workspace entries are valid. */
+export function bunWorkspaceKeys(data, budget = createBunWorkBudget()) {
+    if (!record(data.workspaces))
+        return null;
+    const keys = new Set();
+    for (const [raw, workspace] of Object.entries(data.workspaces)) {
+        if (--budget.remaining < 0 || !safePath(raw) || !record(workspace))
+            return null;
+        const normalized = raw === "" ? "" : path.posix.normalize(raw);
+        if ((normalized === "." && raw !== "") || keys.has(normalized))
+            return null;
+        for (const field of rootFields) {
+            const deps = workspace[field];
+            if (deps !== undefined && !record(deps))
+                return null;
+            if (record(deps))
+                for (const ref of Object.values(deps)) {
+                    if (--budget.remaining < 0 || typeof ref !== "string" || ref.length === 0)
+                        return null;
+                }
+        }
+        keys.add(normalized);
+    }
+    return keys;
+}
+/** Bun package paths omit node_modules; scoped names must remain single path components. */
+function packagePath(key) {
+    const tokens = key.split("/"), parts = [];
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (token.startsWith("@")) {
+            const name = tokens[++i];
+            if (!/^@[A-Za-z0-9_.-]+$/.test(token) || !name || !/^[A-Za-z0-9_.-]+$/.test(name))
+                return null;
+            parts.push(`${token}/${name}`);
+        }
+        else {
+            if (!/^[A-Za-z0-9_][A-Za-z0-9_.-]*$/.test(token) || token === "..")
+                return null;
+            parts.push(token);
+        }
+    }
+    return parts;
+}
+/** Resolve only the locked placement; never solve a range or follow local/Git source paths. */
+export function bunLockRelations(data, budget = createBunWorkBudget()) {
+    const tick = () => { if (--budget.remaining < 0)
+        throw new Error("Bun relationship limit"); };
+    try {
+        if (!record(data.packages) || !record(data.workspaces))
+            return null;
+        const workspaces = new Map();
+        for (const [rawPath, value] of Object.entries(data.workspaces)) {
+            tick();
+            if (!record(value) || !safePath(rawPath))
+                return null;
+            const location = rawPath === "" ? "" : path.posix.normalize(rawPath);
+            if (location === "." || workspaces.has(location))
+                return null;
+            workspaces.set(location, value);
+        }
+        const nodes = new Map(), anchors = new Map();
+        for (const [key, raw] of Object.entries(data.packages)) {
+            tick();
+            const parts = packagePath(key);
+            if (!parts || !Array.isArray(raw) || typeof raw[0] !== "string")
+                return null;
+            const match = /^(@[^/]+\/[^@]+|[^@]+)@(.+)$/.exec(raw[0]);
+            if (!match)
+                return null;
+            const ref = match[2], registry = valid(ref) !== null && raw.length === 4 && typeof raw[1] === "string" && record(raw[2]) && typeof raw[3] === "string";
+            const info = registry ? raw[2] : record(raw[1]) ? raw[1] : {};
+            const node = { parts, name: match[1], version: ref, info, registry };
+            if (ref.startsWith("workspace:")) {
+                const location = ref.slice("workspace:".length);
+                if (safePath(location)) {
+                    node.workspace = location === "." ? "" : path.posix.normalize(location);
+                    anchors.set(node.workspace, anchors.has(node.workspace) ? null : parts);
+                }
+            }
+            nodes.set(key, node);
+        }
+        const resolve = (from, name, ref) => {
+            tick();
+            const nameParts = packagePath(name);
+            if (typeof ref !== "string" || ref.length === 0 || !nameParts || nameParts.length !== 1)
+                return null;
+            if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(ref) && !/^(?:npm:|workspace:|catalog:)/.test(ref))
+                return null;
+            if (ref.includes("/") && !/^(?:npm:|workspace:|catalog:)/.test(ref))
+                return null;
+            const context = [...from];
+            for (;;) {
+                tick();
+                const candidate = [...context, name].join("/");
+                if (nodes.has(candidate)) {
+                    const node = nodes.get(candidate);
+                    return ref.startsWith("workspace:") && node.workspace === undefined ? null : node;
+                } // An unsupported local identity is a barrier, not a fallback.
+                if (!context.length)
+                    return null;
+                context.pop();
+            }
+        };
+        const declared = new Map(), introduced = new Map();
+        const edges = (value, list) => {
+            const out = [];
+            const optional = record(value.optionalDependencies) ? value.optionalDependencies : {};
+            if (value.unresolved !== undefined && (!Array.isArray(value.unresolved) || !value.unresolved.every(v => typeof v === "string")))
+                throw new Error("invalid unresolved dependencies");
+            const unresolved = new Set(Array.isArray(value.unresolved) ? value.unresolved : []);
+            for (const field of list) {
+                const deps = value[field];
+                if (deps === undefined)
+                    continue;
+                if (!record(deps))
+                    throw new Error("invalid dependencies");
+                for (const [name, ref] of Object.entries(deps)) {
+                    tick();
+                    if (field !== "optionalDependencies" && Object.hasOwn(optional, name))
+                        continue;
+                    if (field === "optionalDependencies" && unresolved.has(name))
+                        continue;
+                    out.push([name, ref]);
+                }
+            }
+            return out;
+        };
+        for (const [location, value] of workspaces) {
+            tick();
+            const context = location === "" ? [] : anchors.get(location);
+            if (!context)
+                continue;
+            for (const [name, ref] of edges(value, rootFields)) {
+                const target = resolve(context, name, ref);
+                if (!target?.registry)
+                    continue;
+                const paths = declared.get(target) ?? new Set();
+                paths.add(location === "" ? "package.json" : `${location}/package.json`);
+                declared.set(target, paths);
+            }
+        }
+        for (const origin of declared.keys()) {
+            const seen = new Set([origin]), queue = [origin];
+            while (queue.length) {
+                tick();
+                const node = queue.pop();
+                for (const [name, ref] of edges(node.info, fields)) {
+                    const target = resolve(node.parts, name, ref);
+                    if (!target?.registry || seen.has(target))
+                        continue;
+                    seen.add(target);
+                    queue.push(target);
+                    const roots = introduced.get(target) ?? new Set();
+                    roots.add(origin.name);
+                    introduced.set(target, roots);
+                }
+            }
+        }
+        const merged = new Map();
+        for (const node of nodes.values()) {
+            tick();
+            if (!node.registry)
+                continue;
+            const key = identity(node.name, node.version), info = merged.get(key) ?? { declaredIn: new Set(), introducedBy: new Set() };
+            for (const p of declared.get(node) ?? []) {
+                tick();
+                info.declaredIn.add(p);
+            }
+            for (const p of introduced.get(node) ?? []) {
+                tick();
+                info.introducedBy.add(p);
+            }
+            merged.set(key, info);
+        }
+        return (name, version) => {
+            const info = merged.get(identity(name, version));
+            return info ? { relation: info.declaredIn.size ? "direct" : info.introducedBy.size ? "transitive" : "unknown",
+                ...(info.declaredIn.size ? { declaredIn: info.declaredIn } : {}), ...(info.introducedBy.size ? { introducedBy: info.introducedBy } : {}) } : { relation: "unknown" };
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/utils/bunLockCache.js

@@ -0,0 +1,33 @@
+import { MAX_NPM_LOCK_BYTES, MAX_NPM_LOCK_TOTAL_BYTES } from "./npmLockCopy.js";
+import { readRegularFile, capitalizeReason } from "./safeRead.js";
+import { parseBunLock, bunWorkspaceKeys, bunLockRelations, createBunWorkBudget } from "./bunLock.js";
+import { createParseBudget } from "./dependencyRelations.js";
+export class BunLockCache {
+    remaining;
+    locks = new Map();
+    coverageBudget = createBunWorkBudget();
+    relationBudget = createBunWorkBudget();
+    constructor(remaining = MAX_NPM_LOCK_TOTAL_BYTES) {
+        this.remaining = remaining;
+    }
+    async get(file, projectDir) {
+        const cached = this.locks.get(file);
+        if (cached)
+            return cached;
+        let captured;
+        if (this.remaining <= 0)
+            captured = { reason: "Bun lockfiles exceeded the total input size limit" };
+        else {
+            const read = await readRegularFile(file, { boundary: projectDir, maxBytes: Math.min(MAX_NPM_LOCK_BYTES, this.remaining) });
+            if (!read.ok)
+                captured = { reason: capitalizeReason(read.message) };
+            else {
+                this.remaining -= read.bytes.length;
+                const content = read.bytes.toString("utf8"), data = parseBunLock(content, createParseBudget(content));
+                captured = { content, workspaces: data === null ? null : bunWorkspaceKeys(data, this.coverageBudget), relations: data === null ? null : bunLockRelations(data, this.relationBudget) };
+            }
+        }
+        this.locks.set(file, captured);
+        return captured;
+    }
+}

package/dist/utils/dependencyRelations.js

@@ -12,6 +12,17 @@
 import { cargoSourceKind, parsePackageId } from "./cargoLock.js";
 /** たどる依存の辺の上限(巨大・悪意あるlockfileで処理が膨らまないように) */
 export const MAX_DEPENDENCY_EDGES = 2_000_000;
+/** Lockfile parsing operations allowed per KiB (dense pnpm lockfiles measured at about 440). */
+export const PARSE_OPERATIONS_PER_KIB = 1024;
+/** Line limit for YAML-like lockfiles; 200,000 lines rejected pnpm/Yarn lockfiles of about 6 MiB, below the 16 MiB limit. */
+export const MAX_LOCKFILE_LINES = 1_000_000;
+/**
+ * Parsing is linear and already bounded by the byte limits, so each lockfile gets its own budget sized from its length.
+ * A shared parse budget ran out at about 7.5 MiB of pnpm/Yarn input in a scan, well below the 16 MiB / 64 MiB read limits.
+ */
+export function createParseBudget(source) {
+    return { remaining: Math.max(MAX_DEPENDENCY_EDGES, Math.ceil(Buffer.byteLength(source) / 1024) * PARSE_OPERATIONS_PER_KIB) };
+}
 const UNKNOWN = { relation: "unknown" };
 /** Cargoの省略されたpackage IDは、一意に解決できるときだけたどる。 */
 export function cargoLockRelations(packages, manifests = new Map(), maxEdges = MAX_DEPENDENCY_EDGES) {