osvcheck 1.0.0__tar.gz

osvcheck-1.0.0/PKG-INFO

@@ -0,0 +1,103 @@
+Metadata-Version: 2.3
+Name: osvcheck
+Version: 1.0.0
+Summary: Security vulnerability scanner for Python dependencies
+Author: David Nugent
+Author-email: David Nugent <davidn@uniquode.io>
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Dist: rich>=13.0.0 ; extra == 'rich'
+Requires-Python: >=3.11
+Provides-Extra: rich
+Description-Content-Type: text/markdown
+
+# osvcheck
+
+[![Python Tests](https://img.shields.io/github/actions/workflow/status/deeprave/osvcheck/python-test.yml?branch=main&label=tests)](https://github.com/deeprave/osvcheck/actions/workflows/python-test.yml)
+[![PyPI version](https://img.shields.io/pypi/v/osvcheck)](https://pypi.org/project/osvcheck/)
+[![Python versions](https://img.shields.io/pypi/pyversions/osvcheck)](https://pypi.org/project/osvcheck/)
+[![Downloads](https://img.shields.io/pypi/dm/osvcheck)](https://pypi.org/project/osvcheck/)
+[![Security](https://img.shields.io/github/actions/workflow/status/deeprave/osvcheck/codeql.yml?branch=main&label=security&logo=github)](https://github.com/deeprave/osvcheck/security/code-scanning)
+[![Maintenance](https://img.shields.io/badge/maintained-yes-green.svg)](https://github.com/deeprave/osvcheck/graphs/commit-activity)
+
+Lightweight vulnerability scanner for Python dependencies using the OSV database.
+
+osvcheck scans your Python project's dependencies for known security vulnerabilities by querying the [OSV (Open Source Vulnerabilities)](https://osv.dev) database. It's designed for source-level checking during development and CI/CD pipelines.
+
+**Key features:**
+- Zero runtime dependencies (stdlib only)
+- Auto-detects package manager (uv.lock, uv, or pip)
+- Smart caching (12-48 hour TTL) minimizes API calls
+- Distinguishes direct vs indirect vulnerabilities
+- Optional rich integration for enhanced output (auto-detected if installed)
+
+## Installation
+
+Install via pip or uv, or add to your project's dev dependencies.
+
+## Usage
+
+```bash
+# Scan current project
+osvcheck
+
+# Logging options
+osvcheck -v              # Verbose (debug) output
+osvcheck -q              # Quiet (warnings/errors only)
+osvcheck --log-json      # JSON format logs
+osvcheck --log-file FILE # Write logs to file
+
+# Color control
+osvcheck --color         # Force color output
+osvcheck --no-color      # Disable color output
+```
+
+**Exit codes:**
+- `0` - No vulnerabilities found
+- `1` - Indirect dependency vulnerabilities only
+- `2` - Direct dependency vulnerabilities found
+
+**As a Pre-commit hook:**
+
+Add to `.pre-commit-config.yaml`:
+```yaml
+- repo: https://github.com/deeprave/osvcheck
+  rev: v1.0.0b1
+  hooks:
+    - id: osvcheck
+```
+
+**CI/CD integration:**
+```bash
+# Fail only on direct vulnerabilities
+osvcheck || [ $? -eq 1 ]
+
+# Fail on any vulnerabilities
+osvcheck
+```
+
+## Features
+
+- Scans Python dependencies for known security vulnerabilities
+- Uses the OSV (Open Source Vulnerabilities) database
+- Multi-environment support with auto-detection:
+  - Uses `uv.lock` if present and up-to-date (fastest)
+  - Falls back to `uv pip list` if uv is available
+  - Falls back to `pip list` if pip is available
+- Smart caching with 12-48 hour randomized TTL
+- Distinguishes between direct and indirect dependency vulnerabilities
+- Zero runtime dependencies (Python stdlib only)
+- Optional rich integration for enhanced output (auto-detected if already installed)
+
+## License
+
+MIT License - See LICENSE file for details.

osvcheck-1.0.0/README.md

@@ -0,0 +1,81 @@
+# osvcheck
+
+[![Python Tests](https://img.shields.io/github/actions/workflow/status/deeprave/osvcheck/python-test.yml?branch=main&label=tests)](https://github.com/deeprave/osvcheck/actions/workflows/python-test.yml)
+[![PyPI version](https://img.shields.io/pypi/v/osvcheck)](https://pypi.org/project/osvcheck/)
+[![Python versions](https://img.shields.io/pypi/pyversions/osvcheck)](https://pypi.org/project/osvcheck/)
+[![Downloads](https://img.shields.io/pypi/dm/osvcheck)](https://pypi.org/project/osvcheck/)
+[![Security](https://img.shields.io/github/actions/workflow/status/deeprave/osvcheck/codeql.yml?branch=main&label=security&logo=github)](https://github.com/deeprave/osvcheck/security/code-scanning)
+[![Maintenance](https://img.shields.io/badge/maintained-yes-green.svg)](https://github.com/deeprave/osvcheck/graphs/commit-activity)
+
+Lightweight vulnerability scanner for Python dependencies using the OSV database.
+
+osvcheck scans your Python project's dependencies for known security vulnerabilities by querying the [OSV (Open Source Vulnerabilities)](https://osv.dev) database. It's designed for source-level checking during development and CI/CD pipelines.
+
+**Key features:**
+- Zero runtime dependencies (stdlib only)
+- Auto-detects package manager (uv.lock, uv, or pip)
+- Smart caching (12-48 hour TTL) minimizes API calls
+- Distinguishes direct vs indirect vulnerabilities
+- Optional rich integration for enhanced output (auto-detected if installed)
+
+## Installation
+
+Install via pip or uv, or add to your project's dev dependencies.
+
+## Usage
+
+```bash
+# Scan current project
+osvcheck
+
+# Logging options
+osvcheck -v              # Verbose (debug) output
+osvcheck -q              # Quiet (warnings/errors only)
+osvcheck --log-json      # JSON format logs
+osvcheck --log-file FILE # Write logs to file
+
+# Color control
+osvcheck --color         # Force color output
+osvcheck --no-color      # Disable color output
+```
+
+**Exit codes:**
+- `0` - No vulnerabilities found
+- `1` - Indirect dependency vulnerabilities only
+- `2` - Direct dependency vulnerabilities found
+
+**As a Pre-commit hook:**
+
+Add to `.pre-commit-config.yaml`:
+```yaml
+- repo: https://github.com/deeprave/osvcheck
+  rev: v1.0.0b1
+  hooks:
+    - id: osvcheck
+```
+
+**CI/CD integration:**
+```bash
+# Fail only on direct vulnerabilities
+osvcheck || [ $? -eq 1 ]
+
+# Fail on any vulnerabilities
+osvcheck
+```
+
+## Features
+
+- Scans Python dependencies for known security vulnerabilities
+- Uses the OSV (Open Source Vulnerabilities) database
+- Multi-environment support with auto-detection:
+  - Uses `uv.lock` if present and up-to-date (fastest)
+  - Falls back to `uv pip list` if uv is available
+  - Falls back to `pip list` if pip is available
+- Smart caching with 12-48 hour randomized TTL
+- Distinguishes between direct and indirect dependency vulnerabilities
+- Zero runtime dependencies (Python stdlib only)
+- Optional rich integration for enhanced output (auto-detected if already installed)
+
+## License
+
+MIT License - See LICENSE file for details.

osvcheck-1.0.0/pyproject.toml

@@ -0,0 +1,40 @@
+[project]
+name = "osvcheck"
+version = "1.0.0"
+description = "Security vulnerability scanner for Python dependencies"
+readme = "README.md"
+authors = [
+    { name = "David Nugent", email = "davidn@uniquode.io" }
+]
+requires-python = ">=3.11"
+dependencies = []
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+]
+
+[project.optional-dependencies]
+rich = ["rich>=13.0.0"]
+
+[project.scripts]
+osvcheck = "osvcheck:main"
+
+[build-system]
+requires = ["uv_build>=0.9.27,<0.11.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "mypy>=1.19.1",
+    "pytest>=9.0.2",
+    "ruff>=0.15.1",
+]

osvcheck-1.0.0/src/osvcheck/__init__.py

@@ -0,0 +1,203 @@
+#!/usr/bin/env python
+"""osvcheck - Lightweight vulnerability scanner for Python dependencies."""
+
+import logging
+from pathlib import Path
+from typing import Optional, Tuple
+
+from .cache import load_cache, save_cache
+from .cli import get_log_level, parse_args
+from .dependencies import get_direct_dependencies
+from .log import setup_logging
+from .osv import OSVClient
+from .package_detection import is_pip_available, is_uv_available, is_uv_lock_current
+from .scanner import (
+    PackageLister,
+    PackageScanner,
+    PipPackageLister,
+    UvLockPackageLister,
+    UvPackageLister,
+)
+
+CACHE_FILE = Path(".osvcheck_cache")
+logger = logging.getLogger("osvcheck")
+
+
+def detect_package_lister() -> Tuple[PackageLister, Optional[str]]:
+    """Detect and return appropriate package lister.
+
+    Returns:
+        Tuple of (PackageLister, warning_message)
+    """
+    project_root = Path.cwd()
+    pyproject = project_root / "pyproject.toml"
+    uv_lock = project_root / "uv.lock"
+    warning = None
+
+    logger.debug("Detecting package manager...")
+    logger.debug("  pyproject.toml exists: %s", pyproject.exists())
+    logger.debug("  uv.lock exists: %s", uv_lock.exists())
+
+    # If no pyproject.toml, not a uv project - require pip
+    if not pyproject.exists():
+        logger.debug("  No pyproject.toml found")
+        if is_pip_available():
+            logger.debug("  Selected package lister: PipPackageLister")
+            return PipPackageLister(), None
+        raise RuntimeError(
+            "No pyproject.toml found and pip is not available.\n"
+            "osvcheck requires either:\n"
+            "  - A pyproject.toml-based project with uv or pip\n"
+            "  - pip installed for scanning arbitrary environments\n"
+        )
+
+    # pyproject.toml exists - check uv.lock
+    if uv_lock.exists():
+        if is_uv_lock_current(project_root):
+            logger.debug("  uv.lock is current")
+            logger.debug("  Selected package lister: UvLockPackageLister")
+            return UvLockPackageLister(uv_lock), None
+        else:
+            logger.debug("  uv.lock is stale")
+            warning = "uv.lock is out of date with pyproject.toml"
+
+    # Try uv
+    logger.debug("  uv available: %s", is_uv_available())
+    if is_uv_available():
+        logger.debug("  Selected package lister: UvPackageLister")
+        return UvPackageLister(), warning
+
+    # Try pip
+    logger.debug("  pip available: %s", is_pip_available())
+    if is_pip_available():
+        logger.debug("  Selected package lister: PipPackageLister")
+        return PipPackageLister(), warning
+
+    # Fail
+    raise RuntimeError(
+        "No package manager found.\n"
+        "osvcheck requires either:\n"
+        "  - uv (recommended): https://github.com/astral-sh/uv\n"
+        "  - pip (usually included with Python)\n\n"
+        "Ensure one is installed and available."
+    )
+
+
+def report_results(
+    direct_vulnerable: list[str], indirect_vulnerable: list[str]
+) -> None:
+    """Report vulnerability scan results."""
+    for pkg_name in direct_vulnerable:
+        logger.warning("⚠️  [DIRECT] %s: vulnerabilities found", pkg_name)
+
+    for pkg_name in indirect_vulnerable:
+        logger.warning("  ⚠️ [indirect] %s: vulnerabilities found", pkg_name)
+
+    v_direct = len(direct_vulnerable)
+    v_indirect = len(indirect_vulnerable)
+
+    if v_direct or v_indirect:
+        logger.info("")
+        logger.info("Vulnerabilities found!")
+    if v_direct:
+        logger.info("  - %d direct dependency vulnerabilities:", v_direct)
+        logger.info("    %s", ", ".join(direct_vulnerable))
+    if v_indirect:
+        logger.info("  - %d indirect dependency vulnerabilities:", v_indirect)
+        logger.info("    %s", ", ".join(indirect_vulnerable))
+
+    if not v_direct and not v_indirect:
+        logger.info("No vulnerabilities found.")
+
+
+def determine_exit_code(
+    direct_vulnerable: list[str], indirect_vulnerable: list[str]
+) -> int:
+    """Determine exit code based on vulnerabilities found."""
+    if direct_vulnerable:
+        return 2
+    if indirect_vulnerable:
+        return 1
+    return 0
+
+
+def main() -> None:
+    """Main entry point for osvcheck."""
+    # Parse CLI arguments
+    args = parse_args()
+
+    # Setup logging
+    log_level = get_log_level(args)
+    setup_logging(
+        level=log_level,
+        log_file=args.log_file,
+        use_json=args.log_json,
+        use_color=args.color,
+        use_rich=not args.log_json and args.color is not False,
+    )
+
+    logger.debug("Starting osvcheck")
+
+    # Detect package manager
+    package_lister, warning = detect_package_lister()
+
+    if warning:
+        logger.warning(warning)
+
+    # Load dependencies if pyproject.toml exists
+    pyproject = Path("pyproject.toml")
+    direct_deps = get_direct_dependencies(pyproject) if pyproject.exists() else []
+    logger.debug("Loaded %d direct dependencies", len(direct_deps))
+
+    # Load cache
+    logger.debug("Loading cache from %s", CACHE_FILE)
+    cache = load_cache(CACHE_FILE)
+    logger.debug("Cache loaded with %d entries", len(cache))
+
+    # Setup scanner
+    osv_client = OSVClient()
+    scanner = PackageScanner(osv_client, package_lister)
+
+    # Get package count for display
+    all_packages = package_lister.list_packages()
+    if direct_deps:
+        logger.info(
+            "Checking %d packages (%d direct dependencies)...",
+            len(all_packages),
+            len(direct_deps),
+        )
+    else:
+        logger.info("Checking %d packages...", len(all_packages))
+
+    # Scan for vulnerabilities
+    direct_vulnerable, indirect_vulnerable = scanner.scan_packages(direct_deps, cache)
+
+    # Log statistics
+    logger.info(
+        "Queries: %d, %d packages",
+        scanner.stats.api_queries,
+        scanner.stats.cache_misses,
+    )
+    next_expiry = scanner.stats.get_next_expiry_str()
+    expiry_str = f", next expiry: {next_expiry}" if next_expiry else ""
+    logger.debug("Cache entries: %d%s", len(cache), expiry_str)
+
+    # Save cache and report
+    save_cache(cache, CACHE_FILE)
+    logger.debug("Cache saved to %s", CACHE_FILE)
+
+    report_results(direct_vulnerable, indirect_vulnerable)
+
+    # Exit with appropriate code
+    exit(determine_exit_code(direct_vulnerable, indirect_vulnerable))
+
+    # Save cache and report
+    save_cache(cache, CACHE_FILE)
+    report_results(direct_vulnerable, indirect_vulnerable)
+
+    # Exit with appropriate code
+    exit(determine_exit_code(direct_vulnerable, indirect_vulnerable))
+
+
+if __name__ == "__main__":
+    main()

osvcheck-1.0.0/src/osvcheck/cache.py

@@ -0,0 +1,71 @@
+"""Cache operations for vulnerability scan results."""
+
+import json
+import random
+import time
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+CACHE_MIN_TTL = 12 * 3600  # 12 hours in seconds
+CACHE_MAX_TTL = 48 * 3600  # 48 hours in seconds
+
+
+def get_cache_key(pkg_name: str, pkg_version: str) -> str:
+    """Generate cache key for a package."""
+    return f"{pkg_name}:{pkg_version}"
+
+
+def is_cache_entry_valid(entry: Dict[str, Any], current_time: float) -> bool:
+    """Check if cache entry is still valid."""
+    return entry.get("expires_at", 0) > current_time
+
+
+def generate_cache_ttl() -> int:
+    """Generate random TTL between min and max."""
+    return random.randint(CACHE_MIN_TTL, CACHE_MAX_TTL)
+
+
+def load_cache(cache_file: Path) -> Dict[str, Dict[str, Any]]:
+    """Load cache from file, removing expired entries."""
+    if not cache_file.exists():
+        return {}
+
+    try:
+        with open(cache_file, "r") as f:
+            cache = json.load(f)
+
+        # Remove expired entries
+        current_time = time.time()
+        return {k: v for k, v in cache.items() if is_cache_entry_valid(v, current_time)}
+    except Exception:
+        return {}
+
+
+def save_cache(cache: Dict[str, Dict[str, Any]], cache_file: Path) -> None:
+    """Save cache to file."""
+    try:
+        with open(cache_file, "w") as f:
+            json.dump(cache, f, indent=2)
+    except Exception:
+        pass
+
+
+def get_cached_result(
+    cache: Dict[str, Dict[str, Any]], pkg_name: str, pkg_version: str
+) -> Optional[str]:
+    """Get cached vulnerability result for a package."""
+    cache_key = get_cache_key(pkg_name, pkg_version)
+    cached_entry = cache.get(cache_key)
+    return cached_entry.get("vuln_type") if cached_entry else None
+
+
+def update_cache(
+    cache: Dict[str, Dict[str, Any]],
+    pkg_name: str,
+    pkg_version: str,
+    vuln_type: Optional[str],
+) -> None:
+    """Update cache with vulnerability result."""
+    cache_key = get_cache_key(pkg_name, pkg_version)
+    ttl = generate_cache_ttl()
+    cache[cache_key] = {"vuln_type": vuln_type, "expires_at": time.time() + ttl}

osvcheck-1.0.0/src/osvcheck/cli.py

@@ -0,0 +1,69 @@
+"""Command-line interface."""
+
+import argparse
+import logging
+from pathlib import Path
+
+
+def parse_args() -> argparse.Namespace:
+    """Parse command-line arguments."""
+    parser = argparse.ArgumentParser(
+        prog="osvcheck",
+        description="Lightweight vulnerability scanner for Python dependencies",
+    )
+
+    # Logging options
+    parser.add_argument(
+        "--log-file",
+        type=Path,
+        help="Write logs to file",
+    )
+    parser.add_argument(
+        "--log-json",
+        action="store_true",
+        help="Output logs as JSON",
+    )
+
+    # Color options (mutually exclusive)
+    color_group = parser.add_mutually_exclusive_group()
+    color_group.add_argument(
+        "--color",
+        "--colour",
+        action="store_true",
+        dest="color",
+        help="Force color output",
+    )
+    color_group.add_argument(
+        "--no-color",
+        "--no-colour",
+        action="store_false",
+        dest="color",
+        help="Disable color output",
+    )
+    parser.set_defaults(color=None)  # Auto-detect
+
+    # Verbosity options (mutually exclusive)
+    verbosity_group = parser.add_mutually_exclusive_group()
+    verbosity_group.add_argument(
+        "-v",
+        "--verbose",
+        action="store_true",
+        help="Enable debug logging",
+    )
+    verbosity_group.add_argument(
+        "-q",
+        "--quiet",
+        action="store_true",
+        help="Only show warnings and errors",
+    )
+
+    return parser.parse_args()
+
+
+def get_log_level(args: argparse.Namespace) -> int:
+    """Determine log level from arguments."""
+    if args.verbose:
+        return logging.DEBUG
+    if args.quiet:
+        return logging.WARNING
+    return logging.INFO

osvcheck-1.0.0/src/osvcheck/dependencies.py

@@ -0,0 +1,32 @@
+"""Dependency parsing from pyproject.toml."""
+
+import re
+import tomllib
+from pathlib import Path
+from typing import List
+
+
+def parse_package_name(dep_spec: str) -> str:
+    """Extract package name from dependency specifier.
+
+    Examples:
+        'requests>=2.0' -> 'requests'
+        'django[extra]~=4.0' -> 'django'
+    """
+    return re.split(r"[<>=\[~!]", dep_spec)[0].strip().lower()
+
+
+def get_direct_dependencies(pyproject_path: Path) -> List[str]:
+    """Get list of direct dependency names from pyproject.toml."""
+    try:
+        with open(pyproject_path, "rb") as f:
+            data = tomllib.load(f)
+        deps = data.get("project", {}).get("dependencies", [])
+        return [parse_package_name(dep) for dep in deps]
+    except Exception:
+        return []
+
+
+def is_direct_dependency(pkg_name: str, direct_deps: List[str]) -> bool:
+    """Check if package is a direct dependency."""
+    return pkg_name.lower() in direct_deps

osvcheck-1.0.0/src/osvcheck/log.py

@@ -0,0 +1,124 @@
+"""Logging configuration and setup."""
+
+import importlib.util
+import json
+import logging
+import sys
+from datetime import datetime
+from pathlib import Path
+from typing import Optional
+
+
+def is_rich_available() -> bool:
+    """Check if rich module is available."""
+    return importlib.util.find_spec("rich") is not None
+
+
+class JSONFormatter(logging.Formatter):
+    """JSON log formatter."""
+
+    def format(self, record: logging.LogRecord) -> str:
+        """Format log record as JSON."""
+        log_data = {
+            "timestamp": datetime.fromtimestamp(record.created).isoformat(),
+            "level": record.levelname,
+            "message": record.getMessage(),
+        }
+        if record.exc_info:
+            log_data["exception"] = self.formatException(record.exc_info)
+        return json.dumps(log_data)
+
+
+class ColorFormatter(logging.Formatter):
+    """Color log formatter for console output."""
+
+    COLORS = {
+        "DEBUG": "\033[36m",  # Cyan
+        "INFO": "\033[32m",  # Green
+        "WARNING": "\033[33m",  # Yellow
+        "ERROR": "\033[31m",  # Red
+        "CRITICAL": "\033[35m",  # Magenta
+    }
+    RESET = "\033[0m"
+
+    def format(self, record: logging.LogRecord) -> str:
+        """Format log record with colors."""
+        color = self.COLORS.get(record.levelname, "")
+        record.levelname = f"{color}{record.levelname}{self.RESET}"
+        return super().format(record)
+
+
+def setup_logging(
+    level: int = logging.INFO,
+    log_file: Optional[Path] = None,
+    use_json: bool = False,
+    use_color: Optional[bool] = None,
+    use_rich: bool = True,
+) -> logging.Logger:
+    """Setup and configure logging.
+
+    Args:
+        level: Logging level (DEBUG, INFO, WARNING)
+        log_file: Optional file path for logging
+        use_json: Output logs as JSON
+        use_color: Enable color output (None = auto-detect)
+        use_rich: Use rich console if available
+
+    Returns:
+        Configured logger instance
+    """
+    logger = logging.getLogger("osvcheck")
+    logger.setLevel(level)
+    logger.handlers.clear()
+
+    # Auto-detect color support if not specified
+    if use_color is None:
+        use_color = sys.stderr.isatty()
+
+    # Console handler
+    console_handler: logging.Handler
+    if use_json:
+        console_handler = logging.StreamHandler(sys.stderr)
+        console_handler.setFormatter(JSONFormatter())
+    elif use_rich and use_color and is_rich_available():
+        from rich.logging import RichHandler  # type: ignore[import-not-found]
+
+        console_handler = RichHandler(
+            rich_tracebacks=True,
+            markup=False,
+            show_time=False,
+            show_path=False,
+        )
+    else:
+        console_handler = logging.StreamHandler(sys.stderr)
+        if use_color:
+            console_handler.setFormatter(
+                ColorFormatter(
+                    "%(asctime)s %(levelname)s %(message)s",
+                    datefmt="%Y-%m-%d %H:%M:%S",
+                )
+            )
+        else:
+            console_handler.setFormatter(
+                logging.Formatter(
+                    "%(asctime)s %(levelname)s %(message)s",
+                    datefmt="%Y-%m-%d %H:%M:%S",
+                )
+            )
+
+    console_handler.setLevel(level)
+    logger.addHandler(console_handler)
+
+    # File handler
+    if log_file:
+        file_handler = logging.FileHandler(log_file)
+        if use_json:
+            file_handler.setFormatter(JSONFormatter())
+        else:
+            file_handler.setFormatter(
+                logging.Formatter("%(asctime)s - %(levelname)s - %(message)s")
+            )
+        file_handler.setLevel(level)
+        logger.addHandler(file_handler)
+
+    return logger

osvcheck-1.0.0/src/osvcheck/osv.py

@@ -0,0 +1,74 @@
+"""OSV API client for vulnerability checking."""
+
+import json
+import urllib.request
+from typing import Dict, List, Tuple
+
+
+class OSVClient:
+    """Client for querying the OSV vulnerability database."""
+
+    def __init__(self, api_url: str = "https://api.osv.dev/v1"):
+        self.api_url = api_url
+
+    def check_vulnerability(self, pkg_name: str, pkg_version: str) -> bool:
+        """Check if package version has known vulnerabilities.
+
+        Returns:
+            True if vulnerabilities found, False otherwise.
+        """
+        query = {
+            "package": {"ecosystem": "PyPI", "name": pkg_name},
+            "version": pkg_version,
+        }
+
+        req = urllib.request.Request(
+            f"{self.api_url}/query",
+            data=json.dumps(query).encode(),
+            headers={"Content-Type": "application/json"},
+        )
+
+        try:
+            if not req.full_url.startswith("https://"):
+                raise ValueError("Only HTTPS URLs are allowed for security")
+
+            with urllib.request.urlopen(req) as response:  # nosec B310
+                result = json.loads(response.read())
+                return bool(result.get("vulns", []))
+        except Exception:
+            return False
+
+    def check_vulnerabilities_batch(
+        self, packages: List[Tuple[str, str]]
+    ) -> Dict[Tuple[str, str], bool]:
+        """Check multiple packages for vulnerabilities in a single request.
+
+        Args:
+            packages: List of (pkg_name, pkg_version) tuples
+
+        Returns:
+            Dict mapping (pkg_name, pkg_version) to vulnerability status
+        """
+        queries = [
+            {"package": {"ecosystem": "PyPI", "name": name}, "version": version}
+            for name, version in packages
+        ]
+
+        req = urllib.request.Request(
+            f"{self.api_url}/querybatch",
+            data=json.dumps({"queries": queries}).encode(),
+            headers={"Content-Type": "application/json"},
+        )
+
+        try:
+            if not req.full_url.startswith("https://"):
+                raise ValueError("Only HTTPS URLs are allowed for security")
+
+            with urllib.request.urlopen(req) as response:  # nosec B310
+                result = json.loads(response.read())
+                return {
+                    packages[i]: bool(r.get("vulns", []))
+                    for i, r in enumerate(result.get("results", []))
+                }
+        except Exception:
+            return {pkg: False for pkg in packages}

osvcheck-1.0.0/src/osvcheck/package_detection.py

@@ -0,0 +1,74 @@
+"""Package manager detection and package listing."""
+
+import importlib.util
+import json
+import shutil
+import subprocess
+import sys
+import tomllib
+from pathlib import Path
+from typing import Dict, List
+
+
+def is_uv_lock_current(project_root: Path) -> bool:
+    """Check if uv.lock is up-to-date with pyproject.toml."""
+    uv_lock = project_root / "uv.lock"
+    pyproject = project_root / "pyproject.toml"
+
+    if not uv_lock.exists() or not pyproject.exists():
+        return False
+
+    return uv_lock.stat().st_mtime >= pyproject.stat().st_mtime
+
+
+def parse_uv_lock(uv_lock_path: Path) -> List[Dict[str, str]]:
+    """Parse uv.lock and extract package list."""
+    try:
+        with open(uv_lock_path, "rb") as f:
+            data = tomllib.load(f)
+
+        packages = []
+        for pkg in data.get("package", []):
+            packages.append({"name": pkg["name"], "version": pkg["version"]})
+
+        return packages
+    except Exception:
+        return []
+
+
+def is_uv_available() -> bool:
+    """Check if uv command is available."""
+    return shutil.which("uv") is not None
+
+
+def is_pip_available() -> bool:
+    """Check if pip module is available."""
+    return importlib.util.find_spec("pip") is not None
+
+
+def get_packages_via_uv() -> List[Dict[str, str]]:
+    """Get packages using uv pip list."""
+    try:
+        result = subprocess.run(
+            ["uv", "pip", "list", "--format", "json"],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        return json.loads(result.stdout)
+    except Exception:
+        return []
+
+
+def get_packages_via_pip() -> List[Dict[str, str]]:
+    """Get packages using pip list."""
+    try:
+        result = subprocess.run(
+            [sys.executable, "-m", "pip", "list", "--format", "json"],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        return json.loads(result.stdout)
+    except Exception:
+        return []

osvcheck-1.0.0/src/osvcheck/scanner.py

@@ -0,0 +1,162 @@
+"""Package scanning logic."""
+
+import logging
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Protocol, Tuple
+
+from .cache import get_cached_result, update_cache
+from .dependencies import is_direct_dependency
+from .package_detection import get_packages_via_pip, get_packages_via_uv, parse_uv_lock
+
+logger = logging.getLogger("osvcheck")
+
+
+class ScanStatistics:
+    """Track scanning statistics."""
+
+    def __init__(self) -> None:
+        self.cache_hits = 0
+        self.cache_misses = 0
+        self.api_queries = 0
+        self.packages_scanned = 0
+        self.next_expiry: Optional[float] = None
+
+    def update_next_expiry(self, expires_at: float) -> None:
+        """Update next expiry time."""
+        if self.next_expiry is None or expires_at < self.next_expiry:
+            self.next_expiry = expires_at
+
+    def get_next_expiry_str(self) -> Optional[str]:
+        """Get formatted next expiry time."""
+        if self.next_expiry:
+            return datetime.fromtimestamp(self.next_expiry).strftime(
+                "%Y-%m-%d %H:%M:%S"
+            )
+        return None
+
+
+class PackageLister(Protocol):
+    """Protocol for listing installed packages."""
+
+    def list_packages(self) -> List[Dict[str, str]]:
+        """Return list of installed packages with 'name' and 'version' keys."""
+        ...
+
+
+class UvLockPackageLister:
+    """Package lister using uv.lock file."""
+
+    def __init__(self, uv_lock_path: Path):
+        self.uv_lock_path = uv_lock_path
+
+    def list_packages(self) -> List[Dict[str, str]]:
+        """Get packages from uv.lock."""
+        return parse_uv_lock(self.uv_lock_path)
+
+
+class UvPackageLister:
+    """Package lister using uv pip list."""
+
+    def list_packages(self) -> List[Dict[str, str]]:
+        """Get all installed packages using uv."""
+        return get_packages_via_uv()
+
+
+class PipPackageLister:
+    """Package lister using pip list."""
+
+    def list_packages(self) -> List[Dict[str, str]]:
+        """Get all installed packages using pip."""
+        return get_packages_via_pip()
+
+
+class PackageScanner:
+    """Coordinates vulnerability scanning of packages."""
+
+    def __init__(self, osv_client: Any, package_lister: PackageLister):
+        self.osv_client = osv_client
+        self.package_lister = package_lister
+        self.stats = ScanStatistics()
+
+    def scan_packages(
+        self, direct_deps: List[str], cache: Dict[str, Dict[str, Any]]
+    ) -> Tuple[List[str], List[str]]:
+        """Scan packages for vulnerabilities.
+
+        Returns:
+            Tuple of (direct_vulnerable, indirect_vulnerable) package names.
+        """
+        all_packages = self.package_lister.list_packages()
+        direct_vulnerable: List[str] = []
+        indirect_vulnerable: List[str] = []
+
+        # Calculate next expiry from cache
+        for entry in cache.values():
+            if "expires_at" in entry:
+                self.stats.update_next_expiry(entry["expires_at"])
+
+        # Separate cached and uncached packages
+        uncached_packages = []
+        for pkg in all_packages:
+            pkg_name = pkg["name"]
+            pkg_version = pkg["version"]
+            is_direct = is_direct_dependency(pkg_name, direct_deps)
+
+            self.stats.packages_scanned += 1
+
+            cached = get_cached_result(cache, pkg_name, pkg_version)
+            if cached:
+                self.stats.cache_hits += 1
+                dep_type = "direct" if is_direct else "indirect"
+                logger.debug("  %s:%s cache hit (%s)", pkg_name, pkg_version, dep_type)
+                if cached in ("direct", "indirect"):
+                    (direct_vulnerable if is_direct else indirect_vulnerable).append(
+                        pkg_name
+                    )
+            else:
+                self.stats.cache_misses += 1
+                dep_type = "direct" if is_direct else "indirect"
+                logger.debug("  %s:%s cache miss (%s)", pkg_name, pkg_version, dep_type)
+                uncached_packages.append((pkg_name, pkg_version, is_direct))
+
+        # Batch query uncached packages
+        logger.info(
+            "Cache scan: %d packages processed, %d hits (skipped), %d misses",
+            len(all_packages),
+            self.stats.cache_hits,
+            self.stats.cache_misses,
+        )
+
+        if uncached_packages:
+            batch_size = 256
+            for i in range(0, len(uncached_packages), batch_size):
+                batch = uncached_packages[i : i + batch_size]
+                pkg_tuples = [(name, ver) for name, ver, _ in batch]
+
+                logger.debug(
+                    "  Batch querying %d packages (batch %d/%d)",
+                    len(pkg_tuples),
+                    i // batch_size + 1,
+                    (len(uncached_packages) + batch_size - 1) // batch_size,
+                )
+
+                self.stats.api_queries += 1
+                results = self.osv_client.check_vulnerabilities_batch(pkg_tuples)
+
+                for (pkg_name, pkg_version, is_direct), has_vuln in zip(
+                    batch, [results.get((n, v), False) for n, v in pkg_tuples]
+                ):
+                    vuln_status = "vulnerability" if has_vuln else "no vulnerability"
+                    logger.debug("  %s:%s %s", pkg_name, pkg_version, vuln_status)
+                    vuln_type = (
+                        ("direct" if is_direct else "indirect") if has_vuln else None
+                    )
+                    update_cache(cache, pkg_name, pkg_version, vuln_type)
+
+                    if has_vuln:
+                        (
+                            direct_vulnerable if is_direct else indirect_vulnerable
+                        ).append(pkg_name)
+
+        return direct_vulnerable, indirect_vulnerable