[vianmangal]

What changed and why

Extract the function, class, method and arrow signature pass from importTypeQueryOffsets into a private collectSignatureTypeQueries helper. This addresses the optional CodeRabbit maintainability comment on merged PR #1445, making the signature-specific guards easier to review separately from type declarations.

The pass body, token handling, shared offset set and execution order are unchanged. Runtime call-expression and default-initializer guards remain intact.

Follow-up to #1445. Refs #1444.

Validation

• npm ci
• npm run lint:tests
• npm run build
• npm test -- --runInBand tests/usage-typescript-extensions.test.ts tests/e2e/typescript-extensions.test.ts — 264 existing regression cases passed.
• npm test -- --runInBand — 203 suites, 3,073 tests passed, using the advisory database freshly synced during this review session.
• node scripts/typecheck-changed-tests.mjs origin/main — no changed test files; source type-checking passes through the build.
• git diff --check

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Bug Fixes
  • Import type queries are now recognized in function, class, method, and arrow-function signatures, alongside existing declaration scanning. This improves the app’s ability to account for these queries across more kinds of type declarations.

The change extracts signature-query scanning into collectSignatureTypeQueries. importTypeQueryOffsets calls the helper before returning offsets, while the existing declaration scan remains in place.

Changes: Signature query scanning

Layer / File(s)	Summary
Extract signature scan src/utils/import-type-queries.ts	importTypeQueryOffsets now calls collectSignatureTypeQueries to scan function, class, method, and arrow signatures for import() type queries.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Refactor

Possibly related PRs

• OWASP/cve-lite-cli#1445: Added importTypeQueryOffsets and the signature scan that this change extracts into a helper.

Merge Risk: Minimal · up to 70dde

The extraction preserves existing type-query scanning behavior. No concrete merge-blocking risk remains.

Pre-merge checks: 7

Check name	Status	Explanation
Title check		The title uses the required "refactor: " prefix, lowercase after the colon, and no trailing period. It accurately names the change: the signature-query scanning pass is extracted from importTypeQueryO…
Description check		The description follows the repository template. It has the "What changed and why" section with a clear explanation of the extraction of the signature pass into collectSignatureTypeQueries, and it sta…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Linked Issue		The pull request body references issues with the required keyword and issue number: “Refs #1444” and “Follow-up to #1445.”
Closes Keyword Matches Scope		The pull request body uses “Refs #1444” and does not use “Closes,” “Fixes,” or “Resolves” for an issue. It therefore does not auto-close an issue with incomplete work.
No New Runtime Dependency		The pull request changes only src/utils/import-type-queries.ts. The package.json dependency sections are identical at the base and head refs: no new dependencies or optionalDependencies were added, an…

Full details: Title check

Explanation

The title uses the required "refactor: " prefix, lowercase after the colon, and no trailing period. It accurately names the change: the signature-query scanning pass is extracted from importTypeQueryOffsets into a helper. This is the main change in the changeset, so the title passes.

Full details: Description check

Explanation

The description follows the repository template. It has the "What changed and why" section with a clear explanation of the extraction of the signature pass into collectSignatureTypeQueries, and it states that behavior is unchanged. It also explains the motivation and links the related issues and PRs. The template's "Closes #" line is missing. The PR uses "Follow-up to #1445. Refs #1444." instead, so the author should confirm whether an issue should be closed and add a "Closes #N" line if so. This is a non-critical gap, so the description passes.

Full details: No New Runtime Dependency

Explanation

The pull request changes only src/utils/import-type-queries.ts. The package.json dependency sections are identical at the base and head refs: no new dependencies or optionalDependencies were added, and no devDependency moved to dependencies.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Automatic approval policy

Commit: 70dde35c52ff.

Setting	Effective value	Source
Automatic approvals	Enabled	Global configuration
Merge risk	Moderate	Global configuration
Security risk	Not set	Global configuration

No overrides matched. The global limits apply.

Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.

Run configuration

• Source mode: Auto
• Repository: OWASP/cve-lite-cli
• Branch: main
• File: .coderabbit.yaml
• Commit: 98ed40e
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: a8af246e-de9f-4575-aaec-7d3c5065f1bc

Commits

Reviewing files that changed from the base of the PR and between 98ed40e and 70dde35.

Files selected for processing: 1

• src/utils/import-type-queries.ts

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 2 remain after this review.

[sonukapoor]

Thanks @vianmangal, a clean extraction: the pass moves as one block into its own named helper, the shared offset set and the order are unchanged, and the full suite passes on the merge with current main. Approved.

[sonukapoor]

Merged - thank you @vianmangal!