lettland / bb-plugins / 38222000075

98%

push

github

devkit: harden the CVE lookup after review

Fail closed on fetch errors: --fail-early plus a per-file check, clear old
results before each curl, and report missing jq/curl or all-skipped runs.
Fixed versions are listed in version order for every affected range, and the
PyPI name normaliser no longer applies to other ecosystems.

Tighten private-package detection so internal names stay local: Go reads the
default go env file and skips replace targets, go.work, vendor trees and
non-default proxies; npm skips scopes when any npmrc, env or yarnrc config
points at a private registry or token; Poetry, uv and requirements sources are
checked per package and includes stay inside the checkout.

ID regexes avoid backslashes so the jq programs work under fish. The README
states what is sent, that the lookup is on by default, and how to opt out.
Tests now execute the embedded jq programs against fixtures.

2803 of 3033 branches covered (92.42%)

Branch coverage included in aggregate %.

7089 of 7404 relevant lines covered (95.75%)

234.38 hits per line