Struct CheckFinding 

pub struct CheckFinding {
    pub ecosystem: EcosystemId,
    pub manifest_path: PathBuf,
    pub dependency_name: Option<String>,
    pub requirement: Option<String>,
    pub category: Category,
    pub code: Option<String>,
    pub advisory_url: Option<String>,
    pub advisory_severity: Option<VulnSeverity>,
    pub severity: Severity,
    pub range: Range,
    pub message: String,
}

One reported issue, derived 1:1 from a Diagnostic generate_diagnostics produced.

Fields

ecosystem: EcosystemId

Which ecosystem’s manifest this finding came from.

manifest_path: PathBuf

Path to the manifest, relative to the walked root when discovered by crate::walk. Passed through crate::sanitize::sanitize_path_for_display (#1299) at to_finding construction time, so a raw ANSI escape byte or bidi-override character embedded in the walked path never reaches the table or JSON sink unescaped. Every other deps-cli warning sink sanitizes at its own construction boundary the same way — see that module’s doc.

dependency_name: Option<String>

The dependency’s declared name, when a manifest occurrence’s range matched the diagnostic’s own range. None for a document-level finding not anchored to one dependency (e.g. an offline/dependency-count notice). Passed through deps_core::lsp_helpers::redact_name_for_diagnostic (#1242, #1246), so this is never the raw manifest value.

requirement: Option<String>

The dependency’s declared version requirement, when known. Passed through deps_core::lsp_helpers::redact_requirement_for_diagnostic (#1258, #1300), so this is never the raw manifest value either.

category: Category

The classified category (see Category).

code: Option<String>

The diagnostic’s own code, when it carried a string one (spec 062 review S3, issue #1075): a vulnerability diagnostic’s code is an OSV advisory id (RUSTSEC-.../GHSA-...), finer-grained than Self::category; the workspace’s other stable diagnostic-code constants (UNSATISFIABLE_DIAGNOSTIC_CODE, etc.) are 1:1 with a category, so carrying them here changes nothing beyond echoing category. None when classify fell back to matching the diagnostic’s message text instead of its code (Outdated/Yanked/Other).

advisory_url: Option<String>

The advisory’s own https://osv.dev/vulnerability/{id} page, when Self::code is an OSV advisory id — sourced from the diagnostic’s code_description.href (already Uri-parsed and validated by deps_core::lsp_helpers::diagnostics:: push_vulnerability_diagnostics before it ever reaches a Diagnostic), not re-derived from code — the authoritative URL OSV itself gave us, rather than a second, redundant formula that could drift from it. None whenever code_description is absent (every non-advisory finding, and the rare case where OSV’s own url failed Uri parsing upstream).

advisory_severity: Option<VulnSeverity>

The OSV-derived severity bucket for Self::code, when it names an advisory this manifest’s OSV scan actually fetched (issue #1077 C2) — looked up by advisory id from the same scan results generate_diagnostics consumed, not re-derived from Self::severity (the three-bucket Severity code already collapsed into is too coarse to recover a CVSS-style grade from). None for every non-advisory finding, and for an advisory code this run’s scan did not itself fetch (e.g. a stale code from a formatter that does not source it from a live scan).

severity: Severity

The diagnostic’s severity.

range: Range

The diagnostic’s range within the manifest.

message: String

The diagnostic’s human-readable message.

Trait Implementations

impl Clone for CheckFinding

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CheckFinding

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.