macos-package-review

4 Commits

Author	SHA1	Message	Date
FloandClaude Opus 4.8	71386f0e28	chore: ignore generated audit_data.json CI / Test (1.22) (push) Has been cancelled Details CI / Test (1.23) (push) Has been cancelled Details CI / Lint (push) Has been cancelled Details CI / Vulnerability Check (push) Has been cancelled Details CI / Format Check (push) Has been cancelled Details Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg	2026-06-23 23:59:35 +02:00
FloandClaude Opus 4.8	5a610ff5c4	feat(security): scan Homebrew pkgs via brew-vulns Add Audit.ScanHomebrew, which shells out to "brew vulns --json" (the homebrew/brew-vulns tap) to cover the Homebrew formulae that ScanOSV skips. It resolves each formula's source repo and version tag and queries OSV via the GIT ecosystem. brew-vulns exits 1 when vulnerabilities are found, so success is detected by parseable JSON on stdout rather than the exit code; if the tool is not installed the scan is skipped with a notice instead of failing the audit. Qualitative severities are mapped through the existing severityLabelToScore/cvssToSeverity helpers for consistency. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg	2026-06-23 23:58:42 +02:00
FloandClaude Opus 4.8	aac1fa7351	fix(security): fix CVSS parsing and Claude prompt CI / Test (1.22) (push) Has been cancelled Details CI / Test (1.23) (push) Has been cancelled Details CI / Lint (push) Has been cancelled Details CI / Vulnerability Check (push) Has been cancelled Details CI / Format Check (push) Has been cancelled Details OSV returns severity.score as a CVSS vector string, not a number, so unmarshalling into float64 errored and every vuln was dropped. Read it as a string, compute the CVSS v3 base score from the vector, and fall back to the database_specific severity label otherwise. Invoke the analysis via "claude -p" instead of a nonexistent "ask" subcommand (which made the CLI treat "ask" as the prompt), and request strict JSON so recommendations are parsed reliably rather than by substring matching. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg	2026-06-23 15:30:05 +02:00
FloandClaude Opus 4.8	e34aa716b0	fix: repair audit-full build and inventory errors Fix bash 3.2 parser error on escaped space in collect-inventory.sh (=~ ^require\ ]] -> [[:space:]]). Remove unused Go imports in cmd/audit/main.go and internal/security/claude.go, and an unused test variable in osv_test.go so go build and go vet pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg	2026-06-23 15:01:17 +02:00