patchsense 0.1.2__py3-none-win_amd64.whl

patchsense-0.1.2.dist-info/METADATA

@@ -0,0 +1,446 @@
+Metadata-Version: 2.4
+Name: patchsense
+Version: 0.1.2
+Classifier: Environment :: Console
+Classifier: Programming Language :: Rust
+Classifier: Topic :: Security
+License-File: LICENSE-APACHE
+License-File: LICENSE-MIT
+Summary: Prioritize vulnerabilities from lockfiles using OSV, EPSS, and CISA KEV
+Keywords: security,cve,osv,lockfile,dependencies
+Home-Page: https://github.com/Widyasa/patchsense
+Author: Widya Yasa
+License-Expression: MIT OR Apache-2.0
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
+Project-URL: Homepage, https://github.com/Widyasa/patchsense
+Project-URL: Repository, https://github.com/Widyasa/patchsense
+
+# PatchSense
+
+[![crates.io](https://img.shields.io/crates/v/patchsense.svg)](https://crates.io/crates/patchsense)
+[![license](https://img.shields.io/crates/l/patchsense.svg)](https://github.com/Widyasa/patchsense#license)
+
+PatchSense reads your lockfiles, looks up every pinned package in [OSV](https://osv.dev), and ranks each advisory from 0 to 100 using CISA KEV (known exploited), FIRST EPSS (exploit probability), CVSS, whether the package is a direct dependency, and whether a fix exists. Instead of a flat list of CVEs you get three tiers, **Critical**, **Review**, and **Defer**, so you know what to patch first. It runs locally, caches data in SQLite, works offline from that cache, writes table, JSON, SARIF, Markdown, and GitLab reports, can post a pull-request or merge-request comment, and ships an MCP server for coding agents.
+
+![Scan of log4j-core 2.14.1 showing CVE-2021-44228 as Critical](https://raw.githubusercontent.com/Widyasa/patchsense/master/docs/demo.gif)
+
+## Install
+
+### cargo (available now)
+
+```bash
+cargo install patchsense --locked
+```
+
+This installs the latest `patchsense` release from crates.io. It needs Rust 1.99 or newer (`rust-version` in `Cargo.toml`).
+
+From a checkout of this repository:
+
+```bash
+cargo build --release -p patchsense
+cargo run -p patchsense -- --version
+```
+
+### Prebuilt binaries
+
+npm, PyPI, Composer, Go, Homebrew, the shell installer, and Docker install a prebuilt binary from GitHub Release [`v0.1.2`](https://github.com/Widyasa/patchsense/releases/tag/v0.1.2). The npm, PyPI, and Composer commands work once the package is live on that registry.
+
+| Channel | Command | Notes |
+|---|---|---|
+| npm | `npm install --save-dev patchsense`, then `npx patchsense scan .` | cargo-dist package, created when the GitHub Release is published. Also `pnpm add -D patchsense && pnpm exec patchsense scan .` and `yarn add -D patchsense && yarn patchsense scan .` |
+| PyPI | `pip install patchsense`, `pipx install patchsense`, or `uv tool install patchsense` | Wheels from [`.github/workflows/pypi.yml`](.github/workflows/pypi.yml): Linux x64 and arm64 (manylinux, glibc), macOS x64 and arm64, Windows x64. Not Alpine. The wheel does not download a GitHub Release |
+| Composer | `composer require --dev widyasa/patchsense`, then `vendor/bin/patchsense scan .` | Root [`composer.json`](composer.json). The first run downloads the release archive and checks sha256 |
+| Go | `go install github.com/Widyasa/patchsense/go/cmd/patchsense@v0.1.2` | [`go/cmd/patchsense`](go/cmd/patchsense) downloads the same archive and checks sha256 |
+| Homebrew | `brew install Widyasa/tap/patchsense` | Formula in [`Widyasa/homebrew-tap`](https://github.com/Widyasa/homebrew-tap) |
+| shell | `curl --proto '=https' --tlsv1.2 -fsSL https://github.com/Widyasa/patchsense/releases/download/v0.1.2/patchsense-installer.sh \| sh` | cargo-dist installer. Checks sha256 before unpacking. Windows: `patchsense-installer.ps1` |
+| Docker | `docker build -t patchsense .`, then `docker run --rm -v "$PWD:/work" -w /work patchsense scan .` | Local image only ([`Dockerfile`](Dockerfile)). Alpine x64, so [`scripts/fetch-release.sh`](scripts/fetch-release.sh) downloads the musl archive. The image is not pushed to a registry |
+
+The release archives cover `x86_64-unknown-linux-gnu`, `x86_64-unknown-linux-musl`, `aarch64-unknown-linux-gnu`, `x86_64-apple-darwin`, `aarch64-apple-darwin`, and `x86_64-pc-windows-msvc`. There is no Linux arm64 musl archive and no Windows arm64 archive.
+
+Composer, Go, and the Docker entrypoint cache the downloaded binary under `~/.cache/patchsense` (`PATCHSENSE_CACHE_DIR` overrides that directory). `PATCHSENSE_BINARY` points them at a binary you already built and skips the download. `PATCHSENSE_TARGET` overrides target detection. The PyPI wheel and the cargo-dist npm package do not read `PATCHSENSE_BINARY`.
+
+Archives are `patchsense-<target>.tar.gz` (Windows included) and are listed with their sha256 in the release `dist-manifest.json` and `sha256.sum`.
+
+## Quick start
+
+```bash
+patchsense scan .                         # scan every lockfile under the current directory
+patchsense scan . --fail-on review        # exit 1 if any finding is Review or Critical
+patchsense scan . -f json -o report.json  # save a JSON report
+patchsense init                           # write an example patchsense.toml
+patchsense scan . --offline               # rescan from the local cache, no network
+```
+
+Example output:
+
+```text
+┌───────┬──────────┬─────────────────────────────────────┬─────────┬──────────────────────────────────────┬─────┬────────────────────────────┬──────┬────────┐
+│ Score ┆ Tier     ┆ Package                             ┆ Version ┆ Advisory/CVE                         ┆ KEV ┆ EPSS                       ┆ CVSS ┆ Fix    │
+╞═══════╪══════════╪═════════════════════════════════════╪═════════╪══════════════════════════════════════╪═════╪════════════════════════════╪══════╪════════╡
+│ 100   ┆ Critical ┆ org.apache.logging.log4j:log4j-core ┆ 2.14.1  ┆ GHSA-jfh8-c2jp-5v3q (CVE-2021-44228) ┆ yes ┆ 1.0000 (percentile 1.0000) ┆ 10   ┆ 2.15.0 │
+│ 62    ┆ Review   ┆ org.apache.logging.log4j:log4j-core ┆ 2.14.1  ┆ GHSA-p6xc-xr62-6r2g (CVE-2021-45105) ┆ no  ┆ 1.0000 (percentile 0.9999) ┆ 8.6  ┆ 2.17.0 │
+│ 34    ┆ Defer    ┆ org.apache.logging.log4j:log4j-core ┆ 2.14.1  ┆ GHSA-6hg6-v5c8-fphq (CVE-2026-34477) ┆ no  ┆ 0.0056 (percentile 0.4647) ┆ 6.3  ┆ 2.25.4 │
+└───────┴──────────┴─────────────────────────────────────┴─────────┴──────────────────────────────────────┴─────┴────────────────────────────┴──────┴────────┘
+Critical: 2  Review: 2  Defer: 4
+```
+
+## Command reference
+
+```text
+patchsense <COMMAND>
+
+  scan     Scan lockfiles and print matching advisories
+  cache    Inspect or delete the local SQLite cache
+  init     Write an example config, agent instructions, or MCP snippets
+  comment  Create or update a pull-request comment from a JSON report
+  mcp      Run the MCP server on stdio
+  help     Print help for a subcommand
+
+  -h, --help     Print help
+  -V, --version  Print version
+```
+
+### `patchsense scan [OPTIONS] [PATH]`
+
+`PATH` is a directory or a single lockfile. Default: the current directory.
+
+| Option | Description |
+|---|---|
+| `--ecosystem <LIST>` | Ecosystems to scan, comma-separated (`npm,pypi`). Repeatable. Names: `npm`, `pypi`, `packagist` (or `composer`), `go`, `maven`, `cargo` (or `crates.io`). |
+| `--no-dev` | Skip packages the parser marked as dev dependencies. |
+| `--exclude <GLOB>` | Extra paths to skip. Repeatable. Added to `[scan] exclude`. |
+| `--keep-going` | Continue after a lockfile fails to parse. This is the default. |
+| `--no-keep-going` | Stop at the first lockfile that cannot be read or parsed. |
+| `--fail-on <WHEN>` | Exit 1 when a finding reaches this bar: `critical` (default), `review`, `any`, `never`, or a score `0`–`100`. |
+| `--min-score <N>` | Hide findings below this score in every output. Does not change the exit code. |
+| `-f, --format <FORMAT>` | `table`, `json`, `sarif`, `markdown`, or `gitlab`. Repeatable, paired with `--output` in order. |
+| `-o, --output <FILE>` | Write the paired `--format` to this file instead of stdout. Repeatable. Parent directories are created. |
+| `--no-color` | Plain table. `NO_COLOR` is also honored. |
+| `--offline` | Use only the local cache. No network calls. |
+| `--strict-cache` | With `--offline`, exit 2 when an EPSS row or the KEV catalog is missing or past its TTL. |
+| `--no-cache` | Do not read or write the cache. |
+| `--cache-dir <DIR>` | Directory containing `cache.db`. Overrides `PATCHSENSE_CACHE_DIR`. |
+| `--config <FILE>` | Path to `patchsense.toml`. Overrides discovery and `PATCHSENSE_CONFIG`. |
+| `--explain` | Ask a local coding agent CLI to explain the top findings. |
+| `--agent <AGENT>` | Agent for `--explain`: `auto`, `codex`, `claude`, or `cursor`. |
+| `--explain-top <N>` | Number of findings sent to the agent. Default from `[explain] top` (10). |
+
+Writing several reports in one run:
+
+```bash
+patchsense scan . --no-color \
+  --format json     --output patchsense-report.json \
+  --format sarif    --output patchsense.sarif \
+  --format markdown --output patchsense-report.md
+```
+
+Rules for pairing: the n-th `--format` goes to the n-th `--output`. At most one format may be left without an `--output` (it goes to stdout). More `--output` values than `--format` values is an error.
+
+### `patchsense cache [--cache-dir <DIR>] <info|clear>`
+
+| Command | Description |
+|---|---|
+| `cache info` | Print the cache path, schema version, and row counts (`osv_vuln`, `osv_query`, `epss`, `kev`). |
+| `cache clear` | Delete `cache.db`. |
+
+`--cache-dir` works before or after the subcommand (`cache info --cache-dir DIR` or `cache --cache-dir DIR info`).
+
+### `patchsense init [OPTIONS]`
+
+| Option | Description |
+|---|---|
+| *(none)* | Write an example `patchsense.toml` in the current directory. An existing file is kept. |
+| `--force` | Replace an existing `patchsense.toml`. |
+| `--agent [<AGENT>]` | Also write a PatchSense instruction block for `all` (default when no value), `codex` (`AGENTS.md`), `claude` (`CLAUDE.md`), or `cursor` (`.cursor/rules/patchsense.mdc`). The block sits between `<!-- patchsense:start -->` and `<!-- patchsense:end -->` and is updated in place on rerun. |
+| `--print-mcp-config` | Print MCP config snippets for Cursor, Claude Code, and Codex. Writes no files and no `patchsense.toml`. |
+
+### `patchsense comment --report <FILE> [OPTIONS]`
+
+Posts the Markdown summary of a JSON report as a pull-request comment (GitHub) or merge-request note (GitLab). A hidden `<!-- patchsense-report -->` marker means later runs edit the same comment instead of adding a new one.
+
+| Option | Description |
+|---|---|
+| `--report <FILE>` | JSON report from `patchsense scan --format json`. Required. |
+| `--provider <PROVIDER>` | `auto` (default), `github`, or `gitlab`. `auto` picks GitHub when `GITHUB_ACTIONS=true`, GitLab when `GITLAB_CI=true`. |
+| `--top <N>` | Findings in the comment table. Default 20. |
+| `--dry-run` | Print the Markdown and do not call any API. |
+
+Environment it reads:
+
+- GitHub: `GITHUB_TOKEN` with `pull-requests: write`, `GITHUB_REPOSITORY`, `GITHUB_EVENT_PATH`, optional `GITHUB_API_URL`. The comment is a pull-request conversation comment: `GET` and `POST /repos/{owner}/{repo}/issues/{pull_number}/comments`, and `PATCH /repos/{owner}/{repo}/issues/comments/{comment_id}`. On a pull request, `pull-requests: write` authorizes those calls. `issues: write` is not required.
+- GitLab: `GITLAB_TOKEN` (project access token with `api` scope; `CI_JOB_TOKEN` cannot write notes), `CI_API_V4_URL`, `CI_PROJECT_ID`, `CI_MERGE_REQUEST_IID`.
+
+### `patchsense mcp`
+
+Runs a Model Context Protocol server on stdio. Tools:
+
+| Tool | Parameters | Returns |
+|---|---|---|
+| `list_supported_lockfiles` | none | Lockfile names and their OSV ecosystems |
+| `scan_project` | `path`, `ecosystems`, `min_score`, `include_dev`, `offline` | Top 50 findings plus the full summary |
+| `get_finding` | `id` (GHSA, CVE, or OSV id), `path` | One advisory |
+| `get_fix_plan` | `path`, `tier` (`critical`, `review`, `defer`) | Minimum upgrade covering every advisory on a package |
+| `explain_score` | `id`, `path` | Deterministic score breakdown (no AI call) |
+
+`patchsense init --print-mcp-config` prints ready-to-paste snippets, for example Cursor's `.cursor/mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "patchsense": { "command": "patchsense", "args": ["mcp"] }
+  }
+}
+```
+
+Claude Code: `claude mcp add --transport stdio patchsense -- patchsense mcp`
+
+## How the score works
+
+Each finding gets 0–100 points:
+
+| Signal | Default weight | Meaning |
+|---|---:|---|
+| KEV | 35 | CVE is in the CISA Known Exploited Vulnerabilities catalog |
+| EPSS | 25 | FIRST exploit probability; full weight at probability 0.10 (`probability` mode) |
+| CVSS | 20 | Highest usable CVSS base score / 10 |
+| Direct | 10 | Package is a direct dependency |
+| Fix available | 10 | OSV lists a fixed version |
+
+Tiers: **Critical** ≥ 70, **Review** ≥ 40, otherwise **Defer**. Weights that do not sum to 100 are scaled to 100, with a warning. All of this is configurable.
+
+## Configuration
+
+PatchSense looks for `patchsense.toml` starting at the scan directory and walking up to the git root. `--config` or `PATCHSENSE_CONFIG` points at a specific file. Precedence: **flag > environment variable > file > built-in default**. Unknown keys are rejected. Every key is optional; this is the full file with defaults:
+
+```toml
+schema_version = 1                      # only 1 is accepted
+
+[scan]
+ecosystems = ["npm", "pypi", "packagist", "go", "maven", "cargo"]  # default: all
+exclude = []                            # extra glob patterns to skip
+include_dev = true                      # false = same as --no-dev
+fail_on = "critical"                    # critical | review | any | never | 0-100
+
+[scan.go_imports]                       # Go import check, see below
+skip_vendor = true                      # skip directories named vendor
+skip_testdata = true                    # skip directories named testdata
+skip_tests = true                       # skip *_test.go
+
+[score.weights]
+kev = 35
+epss = 25
+cvss = 20
+direct = 10
+fix_available = 10
+
+[score.epss]
+mode = "probability"                    # probability | percentile
+saturation = 0.10                       # probability that earns the full EPSS weight
+
+[score.thresholds]
+critical = 70
+review = 40
+
+[score.unknown_direct]
+weight_fraction = 1.0                   # share of the direct weight when the parser cannot tell
+
+[cache]
+ttl_hours_osv = 24                      # whole hours
+ttl_hours_epss = 24
+ttl_hours_kev = 24
+strict_cache = false                    # true = --strict-cache
+
+[output]
+top = 20                                # rows in the Markdown report
+
+[explain]
+agent = "auto"                          # auto | codex | claude | cursor
+top = 10                                # findings sent to the agent
+timeout_secs = 120
+
+# Suppress an advisory. Repeat the table for more rules.
+[[ignore]]
+id = "GHSA-xxxx-xxxx-xxxx"              # OSV, GHSA, or CVE id (aliases match too)
+reason = "Used only in a build script"  # required
+expires = "2027-01-31"                  # optional, inclusive YYYY-MM-DD
+```
+
+Ignored findings are listed under `ignored` in the JSON report. An expired rule is dropped with a warning. `[explain] lang` from older configs is accepted but ignored (output is English only).
+
+### Environment variables
+
+| Variable | Effect |
+|---|---|
+| `PATCHSENSE_CONFIG` | Config file path (overridden by `--config`) |
+| `PATCHSENSE_CACHE_DIR` | Cache directory (overridden by `--cache-dir`) |
+| `PATCHSENSE_FAIL_ON` | Same values as `--fail-on` |
+| `PATCHSENSE_AGENT` | Same values as `--agent` |
+| `PATCHSENSE_OSV_URL` | OSV API base URL (default `https://api.osv.dev`) |
+| `PATCHSENSE_EPSS_URL` | EPSS API base URL (default `https://api.first.org`) |
+| `PATCHSENSE_KEV_URL` | Full URL of the CISA KEV JSON feed |
+| `NO_COLOR` | Disable table colors |
+
+## Output formats
+
+| Format | Use |
+|---|---|
+| `table` | Human-readable priority table. Default when stdout is a terminal. |
+| `json` | Full report (`schema_version`, `tool`, `target`, `lockfiles`, `data_sources`, `summary`, `findings`, `ignored`, `warnings`, …). Default when stdout is a pipe or file. Schema: [`schemas/report.v1.json`](schemas/report.v1.json). |
+| `sarif` | SARIF 2.1.0 for GitHub code scanning and other SARIF viewers. |
+| `markdown` | Summary and findings table with per-finding details. This is the PR/MR comment body. |
+| `gitlab` | GitLab Dependency Scanning report (schema 15.2.5). |
+
+Warnings (stale cache, parse failures, unsupported lockfiles) go to stderr and are also stored in the JSON and Markdown reports.
+
+## Exit codes
+
+| Code | Meaning |
+|---|---|
+| `0` | Scan finished and no finding reached the `--fail-on` bar |
+| `1` | At least one finding reached the `--fail-on` bar |
+| `2` | The scan could not run: bad config or flag value, no supported lockfile, unreadable input, every lockfile failed, offline OSV cache missing or expired, `--strict-cache` with missing or expired EPSS/KEV, or a `comment` API error |
+
+`--fail-on never` always exits 0 when the scan runs. `--min-score` never changes the exit code.
+
+## Offline mode and cache
+
+Data is cached in `cache.db`:
+
+| OS | Default location |
+|---|---|
+| Linux | `$XDG_CACHE_HOME/patchsense/` or `~/.cache/patchsense/` |
+| macOS | `~/Library/Caches/patchsense/` (or `$XDG_CACHE_HOME/patchsense/` if set) |
+| Windows | `%LOCALAPPDATA%\patchsense\` (or `$XDG_CACHE_HOME/patchsense/` if set) |
+
+Online scans reuse rows younger than their TTL and refetch older ones. With `--offline`:
+
+- **OSV** results must be in the cache and within `ttl_hours_osv`. A missing or expired row exits 2 and the error says which package and how old. No partial report is printed.
+- **EPSS / KEV**: a missing row is a warning and that signal counts as absent. An expired row is still used, with a warning naming its age, so scores do not drop just because the cache aged.
+- `--strict-cache` (or `[cache] strict_cache = true`) turns missing or expired EPSS/KEV into exit 2.
+
+Typical CI pattern: run one online scan to warm the cache, then `--offline` for later runs.
+
+```bash
+patchsense scan .             # fills the cache
+patchsense scan . --offline   # reuses it
+patchsense cache info         # see what is stored
+```
+
+## CI usage
+
+Any CI that has Rust:
+
+```bash
+cargo install patchsense --locked
+patchsense scan . --no-color --fail-on critical \
+  --format json  --output patchsense-report.json \
+  --format sarif --output patchsense.sarif
+```
+
+GitHub Actions with a PR comment:
+
+```yaml
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo install patchsense --locked
+      - run: patchsense scan . --no-color --format json --output patchsense-report.json
+      - if: always() && github.event_name == 'pull_request'
+        run: patchsense comment --report patchsense-report.json
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
+
+`pull-requests: write` is the permission for that comment. `patchsense comment` writes a pull-request conversation comment through the issue-comment routes above, and GitHub authorizes those routes on a pull request with `pull-requests: write`. `issues: write` is not required.
+
+The composite action in [`action.yml`](action.yml) downloads the GitHub Release installer by default (`uses: Widyasa/patchsense@v0`, or pin `version: 0.1.2`). To test an unreleased build instead, build the binary and pass `binary-path`, as [`.github/workflows/self-test.yml`](.github/workflows/self-test.yml) does. The job needs `pull-requests: write` when `comment` is left at its default (`true`), and `security-events: write` when `sarif` is left at its default (`true`):
+
+```yaml
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: write
+
+jobs:
+  patchsense:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo build --release -p patchsense --bin patchsense
+      - uses: ./
+        with:
+          path: .
+          fail-on: critical
+          binary-path: target/release/patchsense
+```
+
+On GitLab, run the same scan with `--format gitlab --output gl-dependency-scanning-report.json` and `patchsense comment --provider gitlab` with a masked `GITLAB_TOKEN`. [`templates/gitlab/patchsense.gitlab-ci.yml`](templates/gitlab/patchsense.gitlab-ci.yml) is the template. Its installer downloads `patchsense-installer.sh` from the GitHub Release (`latest`, or set `PATCHSENSE_VERSION`). Details are in [`docs/gitlab.md`](docs/gitlab.md).
+
+## Supported ecosystems and lockfiles
+
+| Ecosystem | Files |
+|---|---|
+| npm | `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock` |
+| PyPI | `poetry.lock`, `requirements.txt` |
+| Packagist (PHP) | `composer.lock` |
+| Go | `go.sum` |
+| Maven | `pom.xml` |
+| crates.io | `Cargo.lock` |
+
+Details:
+
+- Directories named `node_modules`, `vendor`, `target`, `.git`, `.venv`, and `venv` are skipped during discovery.
+- **requirements**: discovery also picks up `requirements-*.txt`, `requirements_*.txt`, `*.requirements.txt`, and any `.txt` inside a `requirements/` directory (case-insensitive). `-r`/`--requirement` and `-c`/`--constraint` includes are followed relative to the including file. A cycle or missing include is a warning; remote includes are skipped with a warning.
+- **Composer**: `platform` constraints such as `php: ^8.3` are skipped; a concrete version such as `php: 8.3.35` is scanned.
+- **Go import check**: when an OSV advisory lists affected import paths, PatchSense checks `.go` files under the scan root. If none of those packages is imported, the finding stays (same score and tier) but gets the note `imported package not seen` (JSON field `import_note`). Subpackages, aliases, dot, and blank imports count. See [`docs/go-import-reachability.md`](docs/go-import-reachability.md).
+- **Not supported**: `bun.lock` / `bun.lockb` (a warning is printed when one is found).
+
+## `--explain` (optional AI summary)
+
+`patchsense scan . --explain` sends the top findings to a local, read-only coding agent CLI found on `PATH`: `codex`, `claude`, or Cursor's `agent` / `cursor-agent`. With `auto` they are tried in that order. The text is labeled `AI explanation, may be wrong`. A missing agent, a timeout (`[explain] timeout_secs`), or a bad response is only a warning and never changes the exit code.
+
+## Troubleshooting / FAQ
+
+**`error: no supported lockfile found in .`** — Run from the project root, pass the lockfile path directly, or check that the file is not under a skipped directory or `--exclude` / `[scan] exclude`.
+
+**`error: offline cache is missing OSV results …`** — Run one scan without `--offline` first, using the same `--cache-dir` (or `PATCHSENSE_CACHE_DIR`). `--offline` together with `--no-cache` can never succeed.
+
+**`offline cache expired …`** — Rerun online, or raise `[cache] ttl_hours_osv`.
+
+**`more than one --format would be written to stdout`** — Give every `--format` except one an `--output`.
+
+**`failed to parse fail_on`** — Use `critical`, `review`, `any`, `never`, or an integer `0`–`100`.
+
+**`unknown field` in the config** — Keys are strict; compare with the configuration reference above.
+
+**`could not detect a comment provider`** — Outside GitHub Actions or GitLab CI, pass `--provider github` or `--provider gitlab`, or use `--dry-run` to preview.
+
+**A Go finding says `imported package not seen`.** — Your code does not import the vulnerable package of that module. The finding is kept because tests, vendored code, and build tags are not fully analysed; verify before ignoring it with an `[[ignore]]` rule.
+
+**Is my code uploaded anywhere?** — No. Only package names and versions are sent to OSV, and CVE ids to EPSS; the KEV catalog is downloaded as a whole. `--offline` makes no network calls.
+
+## Links
+
+- Changelog: [`CHANGELOG.md`](CHANGELOG.md)
+- Known limitations: [`docs/limitations.md`](docs/limitations.md)
+- Go import check: [`docs/go-import-reachability.md`](docs/go-import-reachability.md)
+- GitLab CI: [`docs/gitlab.md`](docs/gitlab.md)
+- Release checklist: [`docs/release-checklist.md`](docs/release-checklist.md)
+- Contributing: [`CONTRIBUTING.md`](CONTRIBUTING.md)
+- JSON schema: [`schemas/report.v1.json`](schemas/report.v1.json)
+- Issues: <https://github.com/Widyasa/patchsense/issues>
+- Library API docs: <https://docs.rs/patchsense>
+
+## License
+
+Licensed under either of [MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE), at your option.
+

patchsense-0.1.2.dist-info/RECORD

@@ -0,0 +1,7 @@
+patchsense-0.1.2.data/scripts/patchsense.exe,sha256=80fsctuEBsey6TamnWCQNHq5AcDfqP8_ArWBvJYsB9s,13451264
+patchsense-0.1.2.dist-info/METADATA,sha256=-V8L0JoNYvzlbSDjvAyWpF6Y9bTfkZtmDjDDWtCI0AY,25452
+patchsense-0.1.2.dist-info/WHEEL,sha256=8Aej0W0a6Cz6apA3IzJrTnxLRVLAt-w0Oh8SA3Con_c,94
+patchsense-0.1.2.dist-info/licenses/LICENSE-APACHE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+patchsense-0.1.2.dist-info/licenses/LICENSE-MIT,sha256=IFEduqjKmxxZcUTwI0agjB5bbqL0JuNQ7lFG7JTRjoU,1067
+patchsense-0.1.2.dist-info/sboms/patchsense.cyclonedx.json,sha256=yNWC-Mqkn-MRe90cntzy5J_T01RrDGifUaubL12Kpoo,238202
+patchsense-0.1.2.dist-info/RECORD,,

patchsense-0.1.2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: maturin (1.15.0)
+Root-Is-Purelib: false
+Tag: py3-none-win_amd64

patchsense-0.1.2.dist-info/licenses/LICENSE-APACHE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.