licence_audit/osv

OSV.dev REST client.

Two endpoints are used:

POST /v1/querybatch — given a list of purls, returns the vulnerability IDs that affect each one.
GET /v1/vulns/{id} — returns the full advisory record for an ID so we can extract a severity bucket and a human summary.

All public functions accept an injected HTTP client (mirroring licence_audit/hex) so callers can drive the decoder/dispatch logic from tests without performing real network I/O.

Types

BatchEntry

</>

A single per-purl result from /v1/querybatch.

pub type BatchEntry {
  BatchEntry(purl: String, vuln_ids: List(String))
}

Constructors

BatchEntry(purl: String, vuln_ids: List(String))

Error

</>

pub type Error {
  InvalidJson(String)
  InvalidResponse(String)
  RateLimited
  NotFound
  UnexpectedResponse(status: Int)
  NetworkFailure
}

Constructors

```
InvalidJson(String)
```
```
InvalidResponse(String)
```
```
RateLimited
```
```
NotFound
```
```
UnexpectedResponse(status: Int)
```
```
NetworkFailure
```

A single CVSS score as reported by OSV’s severity[] array. kind is the OSV score type (e.g. “CVSS_V3”); vector is the raw CVSS vector string (e.g. “CVSS:3.1/AV:N/…”). Retained so callers can surface the full vector rather than only the coarse Severity bucket derived from it.

pub type Score {
  Score(kind: String, vector: String)
}

Constructors

```
Score(kind: String, vector: String)
```

Severity

</>

pub type Severity {
  NoSeverity
  Low
  Medium
  High
  Critical
  UnknownSeverity
}

Constructors

```
NoSeverity
```
```
Low
```
```
Medium
```
```
High
```
```
Critical
```
```
UnknownSeverity
```

Vulnerability

</>

pub type Vulnerability {
  Vulnerability(
    id: String,
    aliases: List(String),
    summary: String,
    severity: Severity,
    scores: List(Score),
  )
}

Constructors

Vulnerability(
  id: String,
  aliases: List(String),
  summary: String,
  severity: Severity,
  scores: List(Score),
)

Values

decode_vuln_body

</>

pub fn decode_vuln_body(
  body: String,
  fallback_id: String,
) -> Result(Vulnerability, Error)

encode_batch_body

</>

pub fn encode_batch_body(purls: List(String)) -> String

fetch_vulnerability_from_osv

</>

pub fn fetch_vulnerability_from_osv(
  id: String,
) -> Result(Vulnerability, Error)

parse_severity_label

</>

pub fn parse_severity_label(raw: String) -> Severity

Parse a textual severity label (e.g. “LOW”, “moderate”, “HIGH”). Treats “moderate” as Medium to match GHSA terminology.

query_batch

</>

pub fn query_batch(
  purls: List(String),
  client: fn(request.Request(String)) -> Result(
    response.Response(String),
    Error,
  ),
) -> Result(List(BatchEntry), Error)

Query OSV for vulnerabilities affecting each of purls. Returns one BatchEntry per input purl, preserving input order. Empty vuln_ids means OSV reports no known vulnerabilities for that purl. GitHub purls use commit queries; Hex purls use package queries.

query_batch_from_osv

</>

pub fn query_batch_from_osv(
  purls: List(String),
) -> Result(List(BatchEntry), Error)

Default OSV client. Suitable for the small number of requests a single licence_audit vulns run makes.

severity_from_cvss_vector

</>

pub fn severity_from_cvss_vector(vector: String) -> Severity

Calculate a severity bucket from a complete CVSS v2, v3, or v4 vector.

severity_rank

</>

pub fn severity_rank(severity: Severity) -> Int

severity_to_string

</>

pub fn severity_to_string(severity: Severity) -> String