Enum UpgradeStatus 

#[non_exhaustive]
pub enum UpgradeStatus {
    NotChecked,
    CandidateClean {
        version: ConcreteVersion,
    },
    CandidateVulnerable {
        version: ConcreteVersion,
        advisory_ids: Capped<String>,
        worst_severity: Option<VulnSeverity>,
    },
    CandidateUnverified {
        version: ConcreteVersion,
        reason: SkipReason,
    },
    StructurallyUnchecked(StructuralSkipReason),
}

Result of checking whether a recommended upgrade target is itself affected.

Populated by crate::osv::OsvClient::check_candidates (phase B, issue #1517: now run for every dependency with a registry-cached latest, not only ones phase A already flagged ScanOutcome::Vulnerable). Used for both the registry’s “latest” candidate (the per-key entry in crate::osv::LatestStatusMap) and the independently-verified fix target F (DependencyVulnerabilities::fix_target_status) — see the latter’s doc for why F needs its own verification result distinct from latest’s.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

NotChecked

Phase B has not run for this dependency (phase A found nothing, or phase B has not completed yet).

CandidateClean

The candidate upgrade version is not itself affected by any known advisory.

Fields

version: ConcreteVersion

The version that was checked.

CandidateVulnerable

The candidate upgrade version is itself affected.

Fields

version: ConcreteVersion

The version that was checked.

advisory_ids: Capped<String>

Advisory IDs that still apply to the candidate version, capped at crate::osv::MAX_ADVISORY_RECORDS the same way DependencyVulnerabilities::advisories is (#462 critic M1) — not necessarily exhaustive. Check Capped::is_complete before treating it as the complete set of advisories still affecting this candidate; an incomplete list means some are missing, not that none exist.

worst_severity: Option<VulnSeverity>

The most severe VulnSeverity among advisory_ids’s full records, or None when no record could be fetched for any of them (issue #1517) — a caller must treat None as blocking (never render this candidate as safe), never as “no advisories”. Exists so an VulnSeverity::Informational-only advisory that affects every version of a dependency (common for RUSTSEC-style maintenance notices) does not wrongly suppress “outdated” status for that dependency’s latest — a caller checks this field before treating Self::CandidateVulnerable as a hard block.

CandidateUnverified

The candidate upgrade version’s OSV status could not be determined, but a version was still attempted or is otherwise known: either the check itself failed (transient — query failure, timeout, truncation) or the reason is structural but a real candidate version was already on hand (SkipReason::UnmappableName/SkipReason::UnmappableEcosystem — the registry’s “latest” is known, only its OSV mapping is not). See Self::StructurallyUnchecked for the case where no version is known at all. A caller must fail closed (never render this as “verified safe”) until a later phase B run replaces it — SkipReason::is_structural tells a transient reason apart from a structural-but-version-known one, which callers treat differently (issue #1517).

Fields

version: ConcreteVersion

The version that was attempted.

reason: SkipReason

Why the check did not produce a definite clean/vulnerable verdict.

StructurallyUnchecked(StructuralSkipReason)

This dependency’s source/ecosystem is never checked against OSV at all, and no candidate version is known either, so there is nothing to report — unlike Self::CandidateUnverified, which always names a version even when its reason is also structural. Only ever holds a StructuralSkipReason (issue #1624 S1): unlike a bare SkipReason, which also admits transient reasons like SkipReason::QueryFailed, this makes “this dependency is never checked, for a permanent reason” the only state this variant can represent — a caller (e.g. crate::lsp_helpers::latest_verdict) degrades it to “not applicable” rather than “unverified” (issue #1517).

Trait Implementations

impl Clone for UpgradeStatus

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UpgradeStatus

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for UpgradeStatus

impl PartialEq for UpgradeStatus

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for UpgradeStatus