fix(vulns): correct Exposure over-count + native GHSA parity; window & cleanup fixes - #107
Merged
Merged
Conversation
…& cleanup fixes
The Tauri Exposure card over-reported (33 findings / 13 packages vs the real
17 / 12 from `brew vulns`). Root cause: `scan_all` wrote results into the
persistent vulns cache via `put()` then returned the ENTIRE accumulated cache —
keyed by (kind, name, version) and never pruned — so stale records (old
versions, packages OSV no longer flags) piled up across scans. Added
`VulnsCache::replace_full_scan`: a full `brew vulns` run is authoritative for
the whole install, so it now REPLACES the cache (mirrors the native shell's
wholesale `vulnFindings = findings`). Both shells now match the raw command.
Native GHSA enrichment parity (new VulnsEnrich.swift): faithful port of
`vulns/enrich.rs` — GET api.github.com/advisories/{id}, shared 7-day
ghsa_cache.json (LRU, fail-soft), merge summary/details/fixed-in/references
(never severity), gated on the GitHub master toggle; wired into scanAllVulns.
Makes the native Settings "enriched from api.github.com" claim true.
Exposure card: native now tracks scan source (live/cache) + shows the label;
both shells unified to "N findings across M of T installed packages · source: X".
Window geometry (#17): debounced save on resize/move (400ms) in addition to
clean exit, so size/position survive dev reloads, force-quits, and crashes.
Cleanup estimate: the Storage card "frees ~X" hint now refreshes after a
cleanup regardless of exit status, decoupled from the (fallible) disk
re-measure so a probe error can't leave a stale number.
Tests: cargo 658, swift 161 (+16 VulnsEnrich), vitest 35, svelte-check clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A batch of vulnerability/Exposure and Storage-card fixes, plus a window-state fix.
Exposure over-count (the headline bug)
The Tauri Exposure card reported 33 findings / 13 packages while the raw
brew vulns --quiet --json(and the native shell) reported 17 / 12. Root cause:commands/vulns.rs::scan_allwrote each result into the persistent vulns cache viaput()and then returned the entire accumulated cache — keyed by(kind, name, version)and never pruned — so stale records (old versions, packages OSV no longer flags) piled up across scans.Fix:
VulnsCache::replace_full_scan— a fullbrew vulnsrun is authoritative for the whole install, so it now clears + replaces the cache (mirrors the native shell's wholesale replace). Both shells now match the raw command. (+1 regression test reproducing the stale-entry accumulation.)Native GHSA enrichment parity
New
VulnsEnrich.swift— a faithful Swift port ofsrc-tauri/src/vulns/enrich.rs:GET api.github.com/advisories/{id}, sharedghsa_cache.json(7-day TTL, LRU, fail-soft), mergesummary/details/fixed-in/references(never severity), gated on the GitHub master toggle, wired intoscanAllVulns. This also makes the native Settings line "…enriched from api.github.com" actually true. (+16 unit tests mirroring the Rust suite.)Exposure card parity
Native now tracks scan source (
live/cache) and shows the label; both shells unified to "N findings across M of T installed packages · source: X".Window geometry (#17)
Saves on a debounced resize/move (400ms) in addition to clean exit, so size/position survive dev hot-reloads, force-quits, and crashes — not just a graceful Cmd-Q. (A stale 2700×1892 had been restored with no way to tell it was stale.)
Cleanup estimate refresh
The Storage card's "frees ~X GB" hint now refreshes after a cleanup regardless of exit status, decoupled from the (fallible) disk re-measure so a probe error can't leave a stale number.
Tests
cargo 658 · swift 161 (+16) · vitest 35 · svelte-check 0 errors.
🤖 Generated with Claude Code