vulnera-advisor 0.1.7

Aggregates security advisories from GHSA, NVD, OSV, CISA KEV, and more
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

# Remediation API

The Remediation API provides safe version recommendations when vulnerabilities are detected.

## Types

### UpgradeImpact

Classification of the upgrade's impact based on semantic versioning.

```rust
pub enum UpgradeImpact {
    Patch,  // x.y.Z - Bug fixes only
    Minor,  // x.Y.z - New features, backward compatible
    Major,  // X.y.z - Breaking changes
}
```

### Remediation

A remediation suggestion for a vulnerable package.

```rust
pub struct Remediation {
    pub ecosystem: String,
    pub package: String,
    pub current_version: String,
    pub nearest_safe: Option<String>,    // Minimal upgrade
    pub latest_safe: Option<String>,     // Latest safe version
    pub upgrade_impact: Option<UpgradeImpact>,
    pub vulnerabilities: Vec<String>,    // CVE/GHSA IDs
}
```

## Methods

### suggest_remediation

Get remediation suggestions using advisory data only.

```rust
let remediation = manager.suggest_remediation("npm", "lodash", "4.17.20").await?;

if let Some(nearest) = &remediation.nearest_safe {
    println!("Upgrade to {} ({:?} impact)", nearest, remediation.upgrade_impact);
}
```

### suggest_remediation_with_registry

Enhanced version that fetches all available versions from package registries.

```rust
use vulnera_advisor::PackageRegistry;

let registry = PackageRegistry::new();
let remediation = manager
    .suggest_remediation_with_registry("npm", "lodash", "4.17.20", &registry)
    .await?;
```

## Helper Functions

### classify_upgrade_impact

Classify the impact of upgrading between two versions.

```rust
use vulnera_advisor::classify_upgrade_impact;

let impact = classify_upgrade_impact("1.0.0", "1.0.1"); // Patch
let impact = classify_upgrade_impact("1.0.0", "1.1.0"); // Minor
let impact = classify_upgrade_impact("1.0.0", "2.0.0"); // Major
```

### build_remediation

Build a complete remediation from advisories.

```rust
use vulnera_advisor::build_remediation;

let remediation = build_remediation(
    "npm",
    "lodash",
    "4.17.20",
    &advisories,
    Some(&available_versions),
    |v, events| version_matcher(v, events),
);
```

## JSON Response Format

When serialized, a `Remediation` produces:

```json
{
  "ecosystem": "npm",
  "package": "lodash",
  "current_version": "4.17.20",
  "nearest_safe": "4.17.21",
  "latest_safe": "4.17.21",
  "upgrade_impact": "patch",
  "vulnerabilities": ["CVE-2021-23337", "GHSA-xxxx-xxxx-xxxx"]
}
```

## Upgrade Impact Classification

| Impact | Version Change | Description |
|--------|---------------|-------------|
| `patch` | x.y.**Z** | Bug fixes only |
| `minor` | x.**Y**.z | New features, backward compatible |
| `major` | **X**.y.z | Breaking changes |