vulns: add advisory matcher and dev-cmd/advisory-match - #23329

Merged

andrew merged 30 commits into

Homebrew:mainfrom

andrew:vulns-identify

Jul 28, 2026

Commits on Jul 28, 2026

vulns: extract Identify from Scanner
andrew
committed
7f40278
vulns: add Purl builder and Identify.registry_package
andrew
committed
3dfee79
vulns: extend Identify::FORGES with OSV-indexed GitLab hosts
andrew
committed
093fd5f
vulns: add CPANSec loader for cpan-security-advisory.json
andrew
committed
e650a47
vulns: extract CachedFeed base class from CPANSec
andrew
committed
8eab7af
vulns: add Repology reader for advisory-database's distro index
andrew
committed
0420992
vulns/repology: delegate fetch_project to shared ::Repology client
andrew
committed
5441227
vulns/osv: generalise query_batch to arbitrary ecosystems
andrew
committed
e3a6164
vulns: add Match with identify and advisories_for
andrew
committed
6dff421
vulns/match: add to_brew_record and first_fixed_version
andrew
committed
7edb93f
vulns/vulnerability: include OSV upstream field in identifiers
andrew
committed
2e00163
dev-cmd/advisory-match: wire Vulns::Match to a CLI
andrew
committed
a03c814
Address style and Copilot review
andrew
committed
e2c5553
vulns: raise spec files to typed: true
andrew
committed
6525bc1
vulns: add per-package range evaluation
andrew
committed
d7e7161
vulns/match: query versionlessly and evaluate ranges per evidence
andrew
committed
f5b8b6a
vulns/match: batch OSV queries across formulae and stream output
andrew
committed
ac85818
vulns: raise let-free spec files to typed: strict
andrew
committed
269b3ae
vulns: three-state range status over the union of matching entries
andrew
committed
8aa628f
vulns/match: transitive upstream, CPANSA-only hits, threaded prefetch
andrew
committed
3f0f00f
dev-cmd/advisory-match: leave source: generated records untouched
andrew
committed
a67b535
vulns/match: tighten range-state edge cases
andrew
committed
35a9239
vulns/match: keep per-evidence source records and aggregate subjects
andrew
committed
9cb74dc
vulns/match: aggregate every subject per historical revision
andrew
committed
4206491
vulns/match: keep versionless evidence uncheckable in the history walk
andrew
committed
1ac19d2
vulns/match: return :never_affected when Homebrew skipped the interval
andrew
committed
2c1daef
vulns: lowercase github.com paths and accept sibling-formula Repology projects
andrew
committed
4f439a9
Merge branch 'main' into vulns-identify
andrew
authored
119bb74
dev-cmd/advisory-match: explicit require "fileutils"
andrew
committed
966b021
Merge branch 'main' into vulns-identify
andrew
authored
bd990a5

Navigation Menu

Uh oh!

Uh oh!

vulns: add advisory matcher and dev-cmd/advisory-match - #23329

vulns: add advisory matcher and dev-cmd/advisory-match#23329
andrew merged 30 commits into
Homebrew:mainfrom
andrew:vulns-identify

Commits on Jul 28, 2026

vulns: extract Identify from Scanner

vulns: add Purl builder and Identify.registry_package

vulns: extend Identify::FORGES with OSV-indexed GitLab hosts

vulns: add CPANSec loader for cpan-security-advisory.json

vulns: extract CachedFeed base class from CPANSec

vulns: add Repology reader for advisory-database's distro index

vulns/repology: delegate fetch_project to shared ::Repology client

vulns/osv: generalise query_batch to arbitrary ecosystems

vulns: add Match with identify and advisories_for

vulns/match: add to_brew_record and first_fixed_version

vulns/vulnerability: include OSV upstream field in identifiers

dev-cmd/advisory-match: wire Vulns::Match to a CLI

Address style and Copilot review

vulns: raise spec files to typed: true

vulns: add per-package range evaluation

vulns/match: query versionlessly and evaluate ranges per evidence

vulns/match: batch OSV queries across formulae and stream output

vulns: raise let-free spec files to typed: strict

vulns: three-state range status over the union of matching entries

vulns/match: transitive upstream, CPANSA-only hits, threaded prefetch

dev-cmd/advisory-match: leave source: generated records untouched

vulns/match: tighten range-state edge cases

vulns/match: keep per-evidence source records and aggregate subjects

vulns/match: aggregate every subject per historical revision

vulns/match: keep versionless evidence uncheckable in the history walk

vulns/match: return :never_affected when Homebrew skipped the interval

vulns: lowercase github.com paths and accept sibling-formula Repology projects

Merge branch 'main' into vulns-identify

dev-cmd/advisory-match: explicit require "fileutils"

Merge branch 'main' into vulns-identify