fix: False positive when no version specified (npx <tool>)

[ProduktEntdecker]

Problem

Wenn der Parser eine Package-Referenz ohne Version findet (z.B. npx vite, npx playwright install chromium), schickt PatchPilot die OSV-Query ohne Version. OSV liefert dann alle Vulnerabilities über alle Versionen hinweg.

Der User sieht dann:

🚨 vite@latest has 5 HIGH vulnerabilities
🚨 playwright@latest has 1 HIGH vulnerabilities

Beide sind False Positives:

• vite@8.0.8 (aktuelles latest): 0 Vulns
• playwright@1.59.1 (aktuelles latest): 0 Vulns

Die gemeldeten Vulns betreffen alte Versionen.

Reproduktion

# Returns 19 vulns (5 HIGH + others)
curl -s -X POST https://api.osv.dev/v1/query \
  -H "Content-Type: application/json" \
  -d '{"package":{"name":"vite","ecosystem":"npm"}}'

# Returns 0 vulns
curl -s -X POST https://api.osv.dev/v1/query \
  -H "Content-Type: application/json" \
  -d '{"package":{"name":"vite","ecosystem":"npm"},"version":"8.0.8"}'

Fix

In osv.ts: Bei fehlender Version zuerst latest über die Registry resolven (npm: https://registry.npmjs.org/<pkg>/latest, PyPI: https://pypi.org/pypi/<pkg>/json), dann OSV mit echter Version querien.

Fail-open auf den Resolve: bei Registry-Error (404, Timeout) Query ohne Version senden wie bisher.

Impact

Eliminiert die häufigste False-Positive-Quelle bei npx <tool> für lokal installierte Binaries.

[coderabbitai]

🔗 Related PRs

#7 - fix(parser): prevent command chaining bypass vulnerability [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!