Xueqin Cui

Something like [internal/resolution/client/osv_client.go](https://github.com/google/osv-scanner/blob/main/internal/resolution/client/osv_client.go) This will be helpful for testing (mocking the client instead of fetching directly from OSV.dev API).

Deprecate parser in `pkg/lockfile`

1

[Parser](https://github.com/google/osv-scanner/blob/main/pkg/lockfile/parse.go) is no longer being used so we probably should remove it.

Currently there are multiple places that we make a `deps.dev` client: - [pkg/depsdev/license.go](https://github.com/google/osv-scanner/blob/main/pkg/depsdev/license.go): fetching licenses from deps.dev - [internal/resolution/client/depsdev_client.go](https://github.com/google/osv-scanner/blob/main/internal/resolution/client/depsdev_client.go): dependency resolution required by guided remediation - [internal/manifest/maven.go](https://github.com/google/osv-scanner/blob/main/internal/manifest/maven.go): transitive dependency support...

feat: fetch Maven metadata from specified repositories

1

https://github.com/google/osv-scanner/issues/1045 There are [repositories](https://maven.apache.org/pom.html#Repositories) defined in a Maven pom.xml. When looking for an artifact, these repositories are searched one by one until the artifact is found. Maven Central is the...

Currently, by default, we fetch snapshots from all Maven repositories. However, snapshot can be disabled for a repository ([ref](https://maven.apache.org/pom.html#repositories)). We should take this into consideration when fetching projects from a...

Read Maven configurations from `settings.xml`

3

`settings.xml` contains the information about: - registry: local repository, remote repository servers, and authentication information - project: profiles and properties To give a better support for Maven dependency resolution, configurations...

Unexpected diff when writing XML

4

Texts are escaped to `	` when we write XML in Maven updater. Go does escaping in `EncodeToken`: https://github.com/golang/go/blob/master/src/encoding/xml/marshal.go#L223

Show the vulnerable path when doing transitive dependency scanning

1

Currently we only show vulnerabilities for transitive dependencies but not the path how we depend on the vulnerable dependency. Considering the lack of lockfile for these ecosystem, it will be...

OSV-Scanner sends data to various services for different purposes: - OSV.dev for vulnerabilities - deps.dev for license information and dependency resolution - Maven registries for package and version metadata -...

TODOs: - [ ] PyPI registry client - [ ] API client for resolver - [x] pip dependency resolution - [ ] manifest reader - [ ] manifest writer -...