Skip to content

Commit 6260a52

Browse files
arpitjain099arpitjain099
authored
Look up OSV advisories under the npm package name (#626)
checkOSV was given the repository's display key, which is the name shown in reports rather than the name on npm. 21 of the 26 components that declare an npmname differ, so the deps.dev request 404s, loadJson turns that into undefined and checkOSV returns an empty list with nothing logged. The reporter already resolves this the same way, with npmname falling back to component. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
1 parent 35696b7 commit 6260a52

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

‎node/src/scanner.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ function emitResults(finding: Finding, options: Options, repo: Repository) {
2525
if (options.includeOsv === true) {
2626
Promise.all(
2727
finding.results.map((r) =>
28-
checkOSV(r.component, r.version, options).then(
28+
checkOSV(r.npmname ?? r.component, r.version, options).then(
2929
(v) => (r.vulnerabilities = (r.vulnerabilities ?? []).concat(v)),
3030
),
3131
),

0 commit comments

Comments
 (0)