macos-package-review

5 Commits 1 Branch 0 Tags

3 Commits

Author	SHA1	Message	Date
FloandClaude Opus 4.8	5a610ff5c4	feat(security): scan Homebrew pkgs via brew-vulns Add Audit.ScanHomebrew, which shells out to "brew vulns --json" (the homebrew/brew-vulns tap) to cover the Homebrew formulae that ScanOSV skips. It resolves each formula's source repo and version tag and queries OSV via the GIT ecosystem. brew-vulns exits 1 when vulnerabilities are found, so success is detected by parseable JSON on stdout rather than the exit code; if the tool is not installed the scan is skipped with a notice instead of failing the audit. Qualitative severities are mapped through the existing severityLabelToScore/cvssToSeverity helpers for consistency. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg	2026-06-23 23:58:42 +02:00
FloandClaude Opus 4.8	aac1fa7351	fix(security): fix CVSS parsing and Claude prompt CI / Test (1.22) (push) Has been cancelled Details CI / Test (1.23) (push) Has been cancelled Details CI / Lint (push) Has been cancelled Details CI / Vulnerability Check (push) Has been cancelled Details CI / Format Check (push) Has been cancelled Details OSV returns severity.score as a CVSS vector string, not a number, so unmarshalling into float64 errored and every vuln was dropped. Read it as a string, compute the CVSS v3 base score from the vector, and fall back to the database_specific severity label otherwise. Invoke the analysis via "claude -p" instead of a nonexistent "ask" subcommand (which made the CLI treat "ask" as the prompt), and request strict JSON so recommendations are parsed reliably rather than by substring matching. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg	2026-06-23 15:30:05 +02:00
FloandClaude Opus 4.8	e34aa716b0	fix: repair audit-full build and inventory errors Fix bash 3.2 parser error on escaped space in collect-inventory.sh (=~ ^require\ ]] -> [[:space:]]). Remove unused Go imports in cmd/audit/main.go and internal/security/claude.go, and an unused test variable in osv_test.go so go build and go vet pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg	2026-06-23 15:01:17 +02:00

Author

SHA1

Message

Date

FloandClaude Opus 4.8

5a610ff5c4

feat(security): scan Homebrew pkgs via brew-vulns

Add Audit.ScanHomebrew, which shells out to "brew vulns --json" (the
homebrew/brew-vulns tap) to cover the Homebrew formulae that ScanOSV
skips. It resolves each formula's source repo and version tag and
queries OSV via the GIT ecosystem.

brew-vulns exits 1 when vulnerabilities are found, so success is
detected by parseable JSON on stdout rather than the exit code; if the
tool is not installed the scan is skipped with a notice instead of
failing the audit. Qualitative severities are mapped through the
existing severityLabelToScore/cvssToSeverity helpers for consistency.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg

2026-06-23 23:58:42 +02:00

FloandClaude Opus 4.8

aac1fa7351

fix(security): fix CVSS parsing and Claude prompt

CI / Test (1.22) (push) Has been cancelled

Details

CI / Test (1.23) (push) Has been cancelled

Details

CI / Lint (push) Has been cancelled

Details

CI / Vulnerability Check (push) Has been cancelled

Details

CI / Format Check (push) Has been cancelled

Details

OSV returns severity.score as a CVSS vector string, not a number, so
unmarshalling into float64 errored and every vuln was dropped. Read it
as a string, compute the CVSS v3 base score from the vector, and fall
back to the database_specific severity label otherwise.

Invoke the analysis via "claude -p" instead of a nonexistent "ask"
subcommand (which made the CLI treat "ask" as the prompt), and request
strict JSON so recommendations are parsed reliably rather than by
substring matching.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg

2026-06-23 15:30:05 +02:00

FloandClaude Opus 4.8

e34aa716b0

fix: repair audit-full build and inventory errors

Fix bash 3.2 parser error on escaped space in collect-inventory.sh
(=~ ^require\ ]] -> [[:space:]]). Remove unused Go imports in
cmd/audit/main.go and internal/security/claude.go, and an unused
test variable in osv_test.go so go build and go vet pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg

2026-06-23 15:01:17 +02:00