osv-scanner-mcp 0.21.0 → 0.21.2

package/dist/index.js

@@ -66,7 +66,7 @@ if (startupWarning !== null) {
     }
 }
 // NOTE: リリース時はpackage.jsonのversionと同じ値に更新すること
-const SERVER_VERSION = "0.21.0";
+const SERVER_VERSION = "0.21.2";
 const server = new McpServer({
     name: "osv-scanner-mcp",
     version: SERVER_VERSION,
@@ -88,7 +88,7 @@ server.registerTool("scan_project", {
         "a PackageReference Version=\"x\" is looked up at its lower bound (version_is_lower_bound), and references with properties, ranges without a lower bound, floating versions, conditions, or Update/Remove are not looked up (unresolved_package_references). " +
         "The project's own projects are counted in local_projects. NuGet introduced_by follows target-scoped restore/build dependency graphs; declared_in names a uniquely associated, captured project with an unambiguous unconditional PackageReference. Ambiguous declarations, standalone build files, or analysis limits omit uncertain metadata. Graph paths are not followed and restore/MSBuild are not run. Names of packages from private NuGet feeds are also sent to api.osv.dev; see nuget_warnings. " +
         "Vulnerabilities marked informational (RustSec notices such as unmaintained or unsound crates) are not counted in vulnerability_count; they are counted in informational_count. " +
-        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, pnpm-lock.yaml formats 5.3/5.4/6.0/9.0, Yarn Classic/Berry, bun.lock text formats 0/1/2, uv.lock v1 revisions 0-5, go.mod, requirements.txt, pom.xml, Cargo.lock, .NET files and Composer; unknown where the format or captured metadata cannot establish it). pnpm uses locked importer declarations for declared_in and peer-context-specific dependency reachability for introduced_by; local links are not followed and unsupported/limited analysis remains unknown. uv uses captured workspace identities and manifest members for coverage, and unique version/source references plus requested extras for origins/declarations; ambiguous markers are not joined and uv/build backends are not executed. Bun uses captured workspace declarations and scoped package placement for origins/declarations and exact workspace paths for coverage; unresolvable identities stay unknown and Bun is never executed. Yarn derives origins/declarations from captured Classic manifests or Berry workspace entries; workspace coverage uses confirmed workspace membership and locked dependency descriptors, with ambiguous/unsupported cases unconfirmed. Yarn and project code are not executed. pnpm workspace coverage matches child project paths against captured ancestor lockfile importers; absent children are missing and unverifiable membership remains unconfirmed. " +
+        "Each package's dependency_relation tells whether it is a direct or transitive dependency (determined for package-lock.json, pnpm-lock.yaml formats 5.3/5.4/6.0/9.0, Yarn Classic/Berry, bun.lock text formats 0/1/2, uv.lock v1 revisions 0-5, poetry.lock lock versions 1.1/2.0/2.1, pdm.lock lock versions 4.0-4.5.1, go.mod, requirements.txt, pom.xml, Cargo.lock, .NET files and Composer; unknown where the format or captured metadata cannot establish it). pnpm uses locked importer declarations for declared_in and peer-context-specific dependency reachability for introduced_by; local links are not followed and unsupported/limited analysis remains unknown. uv uses captured workspace identities and manifest members for coverage, and unique version/source references plus requested extras for origins/declarations; ambiguous markers are not joined and uv/build backends are not executed. Poetry and PDM use the captured root pyproject.toml and confirmed child pyproject.toml declarations for declared_in, and unique locked dependency identities for introduced_by (Poetry follows unconditional edges only; PDM keeps extras distinct and does not join different markers). Child coverage requires a safe locked path package (or a PDM workspace member) whose name, version and runtime declarations agree with the lock; absent children are missing and unverifiable ones unconfirmed. Poetry, PDM and build backends are not executed. Bun uses captured workspace declarations and scoped package placement for origins/declarations and exact workspace paths for coverage; unresolvable identities stay unknown and Bun is never executed. Yarn derives origins/declarations from captured Classic manifests or Berry workspace entries; workspace coverage uses confirmed workspace membership and locked dependency descriptors, with ambiguous/unsupported cases unconfirmed. Yarn and project code are not executed. pnpm workspace coverage matches child project paths against captured ancestor lockfile importers; absent children are missing and unverifiable membership remains unconfirmed. " +
         "Composer files are scanned from sanitized copies containing package names and release versions only; local dist.type=path packages are not looked up and are counted in local_composer_packages; branch/dev versions and invalid entries are excluded and reported in skipped_files. A safely captured companion composer.json defines direct require/require-dev roots; locked require edges establish introduced_by, and direct declarations use declared_in. Missing/uninterpretable companions, ambiguous providers/replacements or names, and analysis limits leave relationships unknown. Composer and PHP code are never run. Other private Composer package names are sent to api.osv.dev; composer_warnings flags missing standard Packagist notification URLs, which are only a heuristic for origin. " +
         "If coverage.complete is false, do not conclude that the project is safe even with zero findings. Upgrade recommendations (suggest_fix) are available for Java, JavaScript, Python, Go, Rust, PHP, and .NET (NuGet). Cargo.lock dependency graphs provide direct/transitive relations, introduced_by, and uniquely mapped declaring Cargo.toml paths in declared_in.",
     inputSchema: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osv-scanner-mcp",
-  "version": "0.21.0",
+  "version": "0.21.2",
   "description": "MCP server that wraps Google's OSV-Scanner to scan Java, JavaScript, Python, Go, Rust, .NET, and PHP dependencies for known vulnerabilities and recommend fixes",
   "type": "module",
   "license": "Apache-2.0",