Skip to content

feat(seal): add languages support#603

Draft
DmitriyLewen wants to merge 4 commits intoaquasecurity:mainfrom
DmitriyLewen:feat/seal/add-language-support
Draft

feat(seal): add languages support#603
DmitriyLewen wants to merge 4 commits intoaquasecurity:mainfrom
DmitriyLewen:feat/seal/add-language-support

Conversation

@DmitriyLewen
Copy link
Contributor

Description

This PR adds support for language ecosystem vulnerability tracking in the Seal Security Database integration. The implementation extends the existing OS-based vulnerability tracking (Alpine, Debian, Red Hat) to include four major language ecosystems: Maven, PyPI, npm, and Go.

Changes

  • Extended newBucket() function (pkg/vulnsrc/seal/bucket.go:33):
    • Added support for Maven, PyPI, npm, and Go ecosystems
    • Implemented error handling for language-specific bucket initialization
    • Added cases for ecosystem.Maven, ecosystem.Pip, ecosystem.Npm, and ecosystem.Go
  • Updated resolveBucket() function (pkg/vulnsrc/seal/seal.go:30):
    • Added parsing logic for "maven", "pypi", "npm", and "go" ecosystem identifiers
    • Updated documentation comment to reflect new supported ecosystems
  • Comprehensive test coverage (pkg/vulnsrc/seal/seal_test.go:145):
    • Added test cases for all four language ecosystems
    • Created test data files for Maven (log4j-core), PyPI (requests), npm (lodash), and Go (crypto) packages
    • Validates proper vulnerability parsing, version range handling, and data source registration

Benefits

  1. Broader vulnerability coverage: Extends Seal Security Database support beyond OS packages to application dependencies
  2. Multi-language support: Enables vulnerability scanning for Java (Maven), Python (PyPI), JavaScript/TypeScript (npm), and Go projects
  3. Consistent architecture: Reuses existing bucket pattern for language ecosystems, maintaining code consistency
  4. Production-ready: Includes comprehensive test coverage with realistic vulnerability data

@DmitriyLewen DmitriyLewen self-assigned this Dec 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant