Skip to content

refactor: remove unsafe plugin warning #2721

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Ly-Joey merged 4 commits into from
Apr 23, 2026
Merged

refactor: remove unsafe plugin warning #2721

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a3aaaa2
refacotor: remove unsafe plugin warning
cuixq Apr 14, 2026
869360d
snapshot
cuixq Apr 14, 2026
ff663d8
snapshot
cuixq Apr 14, 2026
a613b32
fix tests + update snapshots
Ly-Joey Apr 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions cmd/osv-scanner/__snapshots__/main_test.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,6 @@ built at: n/a
Scanning dir ./testdata/locks-one-with-nested
Scanned <rootdir>/testdata/locks-one-with-nested/nested/composer.lock file and found 1 package
Scanned <rootdir>/testdata/locks-one-with-nested/yarn.lock file and found 1 package
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.

No issues found

Expand All @@ -75,7 +74,6 @@ Warning: `scan` exists as both a subcommand of OSV-Scanner and as a file on the
[Test_run_SubCommands/with_no_subcommand - 1]
Scanning dir ./testdata/locks-many/composer.lock
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.

No issues found

Expand All @@ -88,7 +86,6 @@ No issues found
[Test_run_SubCommands/with_scan_subcommand - 1]
Scanning dir ./testdata/locks-many/composer.lock
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.

No issues found

Expand Down
116 changes: 68 additions & 48 deletions cmd/osv-scanner/fix/__snapshots__/command_test.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5260,16 +5260,16 @@ unsupported strategy "force" - must be one of: in-place, relax, override

[TestCommand/fix_non-interactive_in-place_package-lock.json - 1]
Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.
Found 15 vulnerabilities matching the filter
Can fix 8/15 matching vulnerabilities by changing 5 dependencies
Found 16 vulnerabilities matching the filter
Can fix 8/16 matching vulnerabilities by changing 5 dependencies
UPGRADED-PACKAGE: minimatch,3.1.2,3.1.5
UPGRADED-PACKAGE: brace-expansion,1.1.11,1.1.14
UPGRADED-PACKAGE: ajv,6.12.6,6.14.0
UPGRADED-PACKAGE: ajv,6.12.6,6.15.0
UPGRADED-PACKAGE: concat-stream,1.5.0,1.6.1
UPGRADED-PACKAGE: hosted-git-info,2.1.4,2.8.9
FIXED-VULN-IDS: GHSA-23c5-xmqv-rm74,GHSA-2g4f-4pwh-qvx6,GHSA-3ppc-4f35-3m26,GHSA-43f8-2h32-f4cj,GHSA-7r86-cg39-jmmj,GHSA-f886-m6hf-6m8v,GHSA-g74r-ffvr-5q9f,GHSA-v6h2-p8h4-qcjw
REMAINING-VULNS: 7
UNFIXABLE-VULNS: 7
REMAINING-VULNS: 8
UNFIXABLE-VULNS: 8

---

Expand All @@ -5293,9 +5293,9 @@ UNFIXABLE-VULNS: 7
}
},
"node_modules/ajv": {
"version": "6.14.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
"version": "6.15.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
"dependencies": {
"fast-deep-equal": "^3.1.1",
"fast-json-stable-stringify": "^2.0.0",
Expand Down Expand Up @@ -6229,9 +6229,9 @@ UNFIXABLE-VULNS: 7
},
"dependencies": {
"ajv": {
"version": "6.14.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
"version": "6.15.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
"requires": {
"fast-deep-equal": "^3.1.1",
"fast-json-stable-stringify": "^2.0.0",
Expand Down Expand Up @@ -7148,6 +7148,16 @@ UNFIXABLE-VULNS: 7
"version": "1.1.11"
}
]
},
{
"id": "GHSA-w5hq-g745-h8pq",
"packages": [
{
"name": "uuid",
"version": "3.4.0"
}
],
"unactionable": true
}
],
"patches": [
Expand Down Expand Up @@ -7225,7 +7235,7 @@ UNFIXABLE-VULNS: 7
{
"name": "ajv",
"versionFrom": "6.12.6",
"versionTo": "6.14.0",
"versionTo": "6.15.0",
"transitive": true
}
],
Expand Down Expand Up @@ -7309,9 +7319,9 @@ Guided remediation (the fix command) can be risky when run on untrusted projects
}
},
"node_modules/ajv": {
"version": "6.14.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
"version": "6.15.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
"dependencies": {
"fast-deep-equal": "^3.1.1",
"fast-json-stable-stringify": "^2.0.0",
Expand Down Expand Up @@ -8245,9 +8255,9 @@ Guided remediation (the fix command) can be risky when run on untrusted projects
},
"dependencies": {
"ajv": {
"version": "6.14.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
"version": "6.15.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
"requires": {
"fast-deep-equal": "^3.1.1",
"fast-json-stable-stringify": "^2.0.0",
Expand Down Expand Up @@ -9437,6 +9447,16 @@ Guided remediation (the fix command) can be risky when run on untrusted projects
}
],
"unactionable": true
},
{
"id": "GHSA-w5hq-g745-h8pq",
"packages": [
{
"name": "uuid",
"version": "3.4.0"
}
],
"unactionable": true
}
],
"patches": [
Expand Down Expand Up @@ -9575,12 +9595,12 @@ UNFIXABLE-VULNS: 0

[TestCommand/fix_non-interactive_relax_package.json - 1]
Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.
Found 7 vulnerabilities matching the filter
Can fix 3/7 matching vulnerabilities by changing 1 dependencies
Found 8 vulnerabilities matching the filter
Can fix 3/8 matching vulnerabilities by changing 1 dependencies
UPGRADED-PACKAGE: npm-registry-client,6.2.0,^7.5.0
FIXED-VULN-IDS: GHSA-43f8-2h32-f4cj,GHSA-c2qf-rxjj-qqgw,GHSA-c6rq-rjc2-86v2
REMAINING-VULNS: 4
UNFIXABLE-VULNS: 4
REMAINING-VULNS: 5
UNFIXABLE-VULNS: 5

---

Expand Down Expand Up @@ -9608,16 +9628,16 @@ UNFIXABLE-VULNS: 4

[TestCommand/fix_non_interactive_in_place_package_lock_json_with_native_data_source - 1]
Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.
Found 15 vulnerabilities matching the filter
Can fix 8/15 matching vulnerabilities by changing 5 dependencies
Found 16 vulnerabilities matching the filter
Can fix 8/16 matching vulnerabilities by changing 5 dependencies
UPGRADED-PACKAGE: minimatch,3.1.2,3.1.5
UPGRADED-PACKAGE: brace-expansion,1.1.11,1.1.14
UPGRADED-PACKAGE: ajv,6.12.6,6.14.0
UPGRADED-PACKAGE: ajv,6.12.6,6.15.0
UPGRADED-PACKAGE: concat-stream,1.5.0,1.6.1
UPGRADED-PACKAGE: hosted-git-info,2.1.4,2.8.9
FIXED-VULN-IDS: GHSA-23c5-xmqv-rm74,GHSA-2g4f-4pwh-qvx6,GHSA-3ppc-4f35-3m26,GHSA-43f8-2h32-f4cj,GHSA-7r86-cg39-jmmj,GHSA-f886-m6hf-6m8v,GHSA-g74r-ffvr-5q9f,GHSA-v6h2-p8h4-qcjw
REMAINING-VULNS: 7
UNFIXABLE-VULNS: 7
REMAINING-VULNS: 8
UNFIXABLE-VULNS: 8

---

Expand All @@ -9641,9 +9661,9 @@ UNFIXABLE-VULNS: 7
}
},
"node_modules/ajv": {
"version": "6.14.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
"version": "6.15.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
"dependencies": {
"fast-deep-equal": "^3.1.1",
"fast-json-stable-stringify": "^2.0.0",
Expand Down Expand Up @@ -10577,9 +10597,9 @@ UNFIXABLE-VULNS: 7
},
"dependencies": {
"ajv": {
"version": "6.14.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
"version": "6.15.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
"requires": {
"fast-deep-equal": "^3.1.1",
"fast-json-stable-stringify": "^2.0.0",
Expand Down Expand Up @@ -11427,16 +11447,16 @@ manifest or lockfile is required

[TestCommand_OfflineDatabase/fix_non_interactive_in_place_package_lock_json_with_offline_vulns - 1]
Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.
Found 15 vulnerabilities matching the filter
Can fix 8/15 matching vulnerabilities by changing 5 dependencies
Found 16 vulnerabilities matching the filter
Can fix 8/16 matching vulnerabilities by changing 5 dependencies
UPGRADED-PACKAGE: minimatch,3.1.2,3.1.5
UPGRADED-PACKAGE: brace-expansion,1.1.11,1.1.14
UPGRADED-PACKAGE: ajv,6.12.6,6.14.0
UPGRADED-PACKAGE: ajv,6.12.6,6.15.0
UPGRADED-PACKAGE: concat-stream,1.5.0,1.6.1
UPGRADED-PACKAGE: hosted-git-info,2.1.4,2.8.9
FIXED-VULN-IDS: GHSA-23c5-xmqv-rm74,GHSA-2g4f-4pwh-qvx6,GHSA-3ppc-4f35-3m26,GHSA-43f8-2h32-f4cj,GHSA-7r86-cg39-jmmj,GHSA-f886-m6hf-6m8v,GHSA-g74r-ffvr-5q9f,GHSA-v6h2-p8h4-qcjw
REMAINING-VULNS: 7
UNFIXABLE-VULNS: 7
REMAINING-VULNS: 8
UNFIXABLE-VULNS: 8

---

Expand All @@ -11460,9 +11480,9 @@ UNFIXABLE-VULNS: 7
}
},
"node_modules/ajv": {
"version": "6.14.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
"version": "6.15.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
"dependencies": {
"fast-deep-equal": "^3.1.1",
"fast-json-stable-stringify": "^2.0.0",
Expand Down Expand Up @@ -12396,9 +12416,9 @@ UNFIXABLE-VULNS: 7
},
"dependencies": {
"ajv": {
"version": "6.14.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
"version": "6.15.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
"requires": {
"fast-deep-equal": "^3.1.1",
"fast-json-stable-stringify": "^2.0.0",
Expand Down Expand Up @@ -13170,12 +13190,12 @@ UNFIXABLE-VULNS: 7

[TestCommand_OfflineDatabase/fix_non_interactive_relax_package_json_with_offline_vulns - 1]
Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.
Found 7 vulnerabilities matching the filter
Can fix 3/7 matching vulnerabilities by changing 1 dependencies
Found 8 vulnerabilities matching the filter
Can fix 3/8 matching vulnerabilities by changing 1 dependencies
UPGRADED-PACKAGE: npm-registry-client,6.2.0,^7.5.0
FIXED-VULN-IDS: GHSA-43f8-2h32-f4cj,GHSA-c2qf-rxjj-qqgw,GHSA-c6rq-rjc2-86v2
REMAINING-VULNS: 4
UNFIXABLE-VULNS: 4
REMAINING-VULNS: 5
UNFIXABLE-VULNS: 5

---

Expand Down
3 changes: 0 additions & 3 deletions cmd/osv-scanner/scan/__snapshots__/command_test.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
Scanning dir ./testdata/locks-one-with-nested
Scanned <rootdir>/testdata/locks-one-with-nested/nested/composer.lock file and found 1 package
Scanned <rootdir>/testdata/locks-one-with-nested/yarn.lock file and found 1 package
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.

No issues found

Expand Down Expand Up @@ -39,7 +38,6 @@ OPTIONS:
[TestCommand_SubCommands/with_no_subcommand - 1]
Scanning dir ./testdata/locks-many/composer.lock
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.

No issues found

Expand All @@ -52,7 +50,6 @@ No issues found
[TestCommand_SubCommands/with_scan_subcommand - 1]
Scanning dir ./testdata/locks-many/composer.lock
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.

No issues found

Expand Down
Loading
Loading