Function queryOsvBatch

server/utils/dependency-analysis.ts:34–74

* Query OSV batch API to find which packages have vulnerabilities. * Returns indices of packages that have vulnerabilities (for follow-up detailed queries). * @see https://google.github.io/osv.dev/post-v1-querybatch/

(
  packages: PackageQueryInfo[],
)

 * @see https://google.github.io/osv.dev/post-v1-querybatch/
 */
async function queryOsvBatch(
  packages: PackageQueryInfo[],
): Promise<{ vulnerableIndices: number[]; failed: boolean }> {
  if (packages.length === 0) return { vulnerableIndices: [], failed: false }

  try {
    const response = await $fetch<OsvBatchResponse>('https://api.osv.dev/v1/querybatch', {
      method: 'POST',
      body: {
        queries: packages.map(pkg => ({
          package: { name: pkg.name, ecosystem: 'npm' },
          version: pkg.version,
        })),
      },
    })

    // Find indices of packages that have vulnerabilities
    const vulnerableIndices: number[] = []
    for (let i = 0; i < response.results.length; i++) {
      const result = response.results[i]
      if (result?.vulns && result.vulns.length > 0) {
        vulnerableIndices.push(i)
      }
      // Warn if pagination token present (>1000 vulns for single query or >3000 total)
      // This is extremely unlikely for npm packages but log for visibility
      if (result?.next_page_token) {
        // oxlint-disable-next-line no-console -- warn about paginated results
        console.warn(
          `[dep-analysis] OSV batch result has pagination token for package index ${i} ` +
            `(${packages[i]?.name}@${packages[i]?.version}) - some vulnerabilities may be missing`,
        )
      }
    }

    return { vulnerableIndices, failed: false }
  } catch (error) {
    // oxlint-disable-next-line no-console -- log OSV API failures for debugging
    console.warn(`[dep-analysis] OSV batch query failed:`, error)
    return { vulnerableIndices: [], failed: true }
  }
}

/**
 * Query OSV for full vulnerability details for a single package.