Feature: OSV API integration for vulnerability checks

[ProduktEntdecker]

Overview

Query the OSV (Open Source Vulnerabilities) API to check packages for known vulnerabilities.

Depends On

• Pivot: CLI hook scaffold replacing MCP server #1 (CLI scaffold)
• Feature: Command parser for npm/pip/brew install #2 (Command parser)

Acceptance Criteria

• Query OSV API at https://api.osv.dev/v1/query
• Handle npm ecosystem (package name + version)
• Handle PyPI ecosystem (pip packages)
• Parse vulnerability response (CVE IDs, severity, fixed versions)
• Handle API errors gracefully (timeout, network issues)
• Cache results to avoid repeated API calls (optional)

OSV API Format

curl -X POST https://api.osv.dev/v1/query -d '{
  "package": {"name": "lodash", "ecosystem": "npm"},
  "version": "4.17.0"
}'

Response Structure

• vulns[].id (CVE/GHSA ID)
• vulns[].summary
• vulns[].severity[].score (CVSS)
• vulns[].affected[].ranges[].events (fixed version)

Priority: P0