fixup

Author: santigimeno

dep_checker/npm_audit.py

@@ -347,10 +347,13 @@ def merge_vulnerability(vuln) -> None:
         logger.info(
             f"Querying npm advisories for {len(packages_for_global_advisories)} installed packages from {package_dir}"
         )
-        for traced in packages_for_global_advisories:
-            if traced["name"] in TRACE_PACKAGES:
+        for package in packages_for_global_advisories:
+            logger.info(
+                f"NPM package advisory query target: {package['name']}@{package['version']} path={package.get('path', '<unknown>')}"
+            )
+            if package["name"] in TRACE_PACKAGES:
                 logger.info(
-                    f"Trace package entering advisory queries: {traced['name']}@{traced['version']} path={traced.get('path', '<unknown>')}"
+                    f"Trace package entering advisory queries: {package['name']}@{package['version']} path={package.get('path', '<unknown>')}"
                 )
         if self.gh_token is not None:
             transport = AIOHTTPTransport(
@@ -365,6 +368,9 @@ def merge_vulnerability(vuln) -> None:
             )
 
             for package in packages:
+                logger.info(
+                    f"GHAD package query: {package['name']}@{package['version']}"
+                )
                 try:
                     result = client.execute(
                         github_vulnerabilities_query,
@@ -375,6 +381,9 @@ def merge_vulnerability(vuln) -> None:
                         f"Skipping GitHub advisory query for {package['name']}@{package['version']}: {exc}"
                     )
                     continue
+                logger.info(
+                    f"GHAD package query result count for {package['name']}@{package['version']}: {len(result['securityVulnerabilities']['nodes'])}"
+                )
                 if package["name"] in TRACE_PACKAGES:
                     logger.info(
                         f"Trace package GHAD results for {package['name']}@{package['version']}: {len(result['securityVulnerabilities']['nodes'])} candidates"
@@ -428,6 +437,9 @@ def merge_vulnerability(vuln) -> None:
 
         for package in packages_for_global_advisories:
             matched_global = self.match_global_advisories(package, global_advisories)
+            logger.info(
+                f"Global advisory filtered match count for {package['name']}@{package['version']}: {len(matched_global)}"
+            )
             if package["name"] in TRACE_PACKAGES:
                 logger.info(
                     f"Trace package global advisory matches for {package['name']}@{package['version']}: {len(matched_global)}"
@@ -559,6 +571,9 @@ def fetch_global_advisories(self, packages: List[Dict[str, str]]) -> List[Dict]:
             logger.info(
                 f"Fetching global advisories batch {index // batch_size + 1} of {((len(requested) - 1) // batch_size) + 1} with {len(batch)} packages"
             )
+            logger.info(
+                "Global advisory batch package list: " + ", ".join(batch)
+            )
             traced_batch = [item for item in batch if item.split('@', 1)[0] in TRACE_PACKAGES]
             if traced_batch:
                 logger.info(f"Trace package present in global advisory batch: {traced_batch}")