fix-osv-vulnerabilities

Fix OSV Vulnerabilities

Overview

For each reported GHSA, check if a patched version exists via the GitHub Advisory API. If a patch exists → upgrade via package manager overrides or direct dependency bump. If no compatible reachable patch exists → collect reachability evidence and request a suppression decision.

Workflow

digraph fix_osv {
    "Collect GHSA IDs from scanner output" [shape=box];
    "Query GitHub Advisory API for each GHSA" [shape=box];
    "Compatible patch reachable?" [shape=diamond];
    "Reachability evidence collected?" [shape=diamond];
    "Explicit suppression approval?" [shape=diamond];
    "Is it a direct dependency?" [shape=diamond];
    "Bump version in package.json" [shape=box];
    "Add/update overrides (or resolutions)" [shape=box];
    "Add IgnoredVulns entry to osv-scanner.toml" [shape=box];
    "Run install + verify build" [shape=box];

    "Collect GHSA IDs from scanner output" -> "Query GitHub Advisory API for each GHSA";
    "Query GitHub Advisory API for each GHSA" -> "Compatible patch reachable?";
    "Compatible patch reachable?" -> "Is it a direct dependency?" [label="yes"];
    "Compatible patch reachable?" -> "Reachability evidence collected?" [label="no"];
    "Reachability evidence collected?" -> "Explicit suppression approval?" [label="yes"];
    "Reachability evidence collected?" -> "Stop and report" [label="no"];
    "Explicit suppression approval?" -> "Add IgnoredVulns entry to osv-scanner.toml" [label="yes"];
    "Explicit suppression approval?" -> "Stop and report" [label="no"];
    "Is it a direct dependency?" -> "Bump version in package.json" [label="yes"];
    "Is it a direct dependency?" -> "Add/update overrides (or resolutions)" [label="no, transitive"];
    "Bump version in package.json" -> "Run install + verify build";
    "Add/update overrides (or resolutions)" -> "Run install + verify build";
    "Add IgnoredVulns entry to osv-scanner.toml" -> "Run install + verify build";
}

Step 1 — Collect the alerts