feat(go): OSV dependency scanning for go.mod - #244
Merged
Merged
Conversation
The OSV.dev core already covers the Go ecosystem; this adds the missing go.mod extractor and indexes the file so it reaches the scanner. - _extract_go parses direct and indirect `require`s (block and single-line forms), strips the leading `v` to OSV's semver (preserving +incompatible and pseudo-versions), and skips module/go/toolchain/replace/exclude/retract. - go.mod added to KEY_FILE_NAMES so ingestion indexes it — without this the OSV scanner (which reads repo.file_index) never saw it and returned clean on a vulnerable project. (Found by live testing, not unit tests.) Verified live end-to-end (real `isitsecure` scan of a go.mod project): - github.com/dgrijalva/jwt-go v3.2.0+incompatible -> 2 OSV vulnerabilities, grade dropped to C+. - Extractor unit test hit the OSV API and returned findings for jwt-go, golang.org/x/crypto, and gin. - Full suite: 2612 passed, 1 xfailed. Go is now a fully first-class language: injection SAST + route mapping + gopls-refined per-route auth + go.mod dependency (SCA) scanning. README marks Go Dependency Scan as Yes (go.mod). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EZ4QoTqRoYWE25CNoV2Wfy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
go.moddependency (SCA) scanning — the last Go gap. The OSV.dev core already covers the Go ecosystem; this adds the missing extractor and indexes the file._extract_goparses direct and indirectrequires (block and single-line), strips the leadingvto OSV's semver (preserving+incompatibleand pseudo-versions), and skipsmodule/go/toolchain/replace/exclude/retract.go.modadded toKEY_FILE_NAMESso ingestion indexes it — without this the OSV scanner (which readsrepo.file_index) never saw it and returned clean on a vulnerable project.Verified live (real
isitsecurescan)github.com/dgrijalva/jwt-go v3.2.0+incompatible→ 2 OSV vulnerabilities, grade dropped to C+.golang.org/x/crypto, and gin.Go is now fully first-class: injection SAST + route mapping + gopls-refined per-route auth + go.mod SCA. README marks Go Dependency Scan: Yes (go.mod).
🤖 Generated with Claude Code
https://claude.ai/code/session_01EZ4QoTqRoYWE25CNoV2Wfy