[muntasir-396]

Summary

Addresses #1519 by updating LOCKFILE_NAMES in src/output/sarif.ts so that bun-lock resolves to the canonical bun.lock instead of the legacy/unsupported binary bun.lockb.

As documented in website/docs/troubleshooting.md:

"Run npm install, pnpm install, yarn install, or bun install to generate a lockfile before scanning. On Bun, use version 1.2 or newer, because earlier versions write bun.lockb, which the scanner does not read."

All other subsystems across the codebase (src/constants.ts:53, src/parsers/index.ts:80, src/remediation/fix-commands.ts:732) use bun.lock as the canonical filename for the bun-lock scan source. Emitting bun.lockb in SARIF caused GitHub Code Scanning to fail to link alerts to the repository's lockfile when filePath was null (such as in synthetic or in-memory scans).

Changes

• Changed "bun-lock": "bun.lockb" to "bun-lock": "bun.lock" in LOCKFILE_NAMES (src/output/sarif.ts).
• Added assertion verifying that deriveLockfileUri({ filePath: null, source: "bun-lock" }) returns "bun.lock" in tests/sarif.test.ts.

Closes #1519

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Bug Fixes
  • Corrected the lockfile name reported for Bun lockfile scans: the reported name is now bun.lock instead of bun.lockb.
  • Updated the related check to verify that a missing lockfile path for a Bun scan resolves to bun.lock.

When SARIF derives a lockfile URI for a bun-lock scan without a file path, it now returns bun.lock instead of bun.lockb. A test checks this fallback.

Changes: SARIF Bun lockfile URI

Layer / File(s)	Summary
Update and test the Bun fallback URI src/output/sarif.ts, tests/sarif.test.ts	The bun-lock fallback name changes to bun.lock. The test verifies the result when the file path is null.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested labels: bug

Merge Risk: Minimal · up to 77c27

The Bun lockfile fallback now uses the requested filename, with a matching test. No merge-blocking issue was identified.

Pre-merge checks: 7

Check name	Status	Explanation
Title check		The title uses the required "fix:" type prefix, lowercase after the colon, and no trailing period. It clearly describes the change: deriveLockfileUri now emits bun.lock instead of the unsupported bun.…
Description check		The description follows the repository template. It has a clear summary of what changed and why, a list of changes, and a closing reference to #1519 that matches the template's "Closes #" line. It cit…
Linked Issues check		I checked the whole-PR diff from merge base 105f72a to head 77c27c6. The only source change is in src/output/sarif.ts. In LOCKFILE_NAMES, the "bun-lock" entry changes from "bun.lockb" to "bun.lock". T…
Out of Scope Changes check		The whole-PR diff has two hunks. The first changes one entry in LOCKFILE_NAMES in src/output/sarif.ts. The second adds one assertion to the existing deriveLockfileUri test in tests/sarif.test.ts. Both…
Linked Issue		The pull request body references GitHub issue #1519 with the required marker: "Closes #1519".
Closes Keyword Matches Scope		The body uses “Closes #1519”. Issue #1519 asks for the bun-lock fallback URI to change from bun.lockb to bun.lock and for a corresponding test assertion. The PR changes LOCKFILE_NAMES to `bun.…
No New Runtime Dependency		The pull request changes only src/output/sarif.ts and tests/sarif.test.ts. The authoritative diff contains no package.json change, so it adds no runtime or optional dependency and moves no packa…

Full details: Title check

Explanation

The title uses the required "fix:" type prefix, lowercase after the colon, and no trailing period. It clearly describes the change: deriveLockfileUri now emits bun.lock instead of the unsupported bun.lockb, which matches the SARIF change in src/output/sarif.ts.

Full details: Description check

Explanation

The description follows the repository template. It has a clear summary of what changed and why, a list of changes, and a closing reference to #1519 that matches the template's "Closes #" line. It cites the troubleshooting doc and the other canonical bun.lock references, and it explains the GitHub Code Scanning failure when filePath is null.

Full details: Linked Issues check

Explanation

I checked the whole-PR diff from merge base 105f72a to head 77c27c6. The only source change is in src/output/sarif.ts. In LOCKFILE_NAMES, the "bun-lock" entry changes from "bun.lockb" to "bun.lock". This matches the proposed fix in #1519. The test change in tests/sarif.test.ts adds expect(deriveLockfileUri({ filePath: null, source: "bun-lock" })).toBe("bun.lock"). This matches the test requested in #1519. Both coding requirements of #1519 are met at the reviewed head. The incremental diff from the previous reviewed head e4421d7 could not be read, because the changed blobs are missing from the checkout. I relied on the whole-PR diff at head instead, which shows the same two hunks. The issue has no non-coding tasks.

Full details: Out of Scope Changes check

Explanation

The whole-PR diff has two hunks. The first changes one entry in LOCKFILE_NAMES in src/output/sarif.ts. The second adds one assertion to the existing deriveLockfileUri test in tests/sarif.test.ts. Both hunks implement the objective of #1519. The PR summary lists no other changed files, and the change set has no refactoring or unrelated edits. The incremental diff since e4421d7 was unreadable, so I cannot confirm that no unrelated edit was added there. The whole-PR diff at head shows no such edit.

Full details: Closes Keyword Matches Scope

Explanation

The body uses “Closes #1519”. Issue #1519 asks for the bun-lock fallback URI to change from bun.lockb to bun.lock and for a corresponding test assertion. The PR changes LOCKFILE_NAMES to bun.lock, and tests/sarif.test.ts verifies the null-path fallback. All requested items are delivered.

Full details: No New Runtime Dependency

Explanation

The pull request changes only src/output/sarif.ts and tests/sarif.test.ts. The authoritative diff contains no package.json change, so it adds no runtime or optional dependency and moves no package from devDependencies.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Automatic approval policy

Commit: 77c27c6769fe.

Setting	Effective value	Source
Automatic approvals	Enabled	Global configuration
Merge risk	Moderate	Global configuration
Security risk	Not set	Global configuration

No overrides matched. The global limits apply.

Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.

Run configuration

• Source mode: Auto
• Repository: OWASP/cve-lite-cli
• Branch: main
• File: .coderabbit.yaml
• Commit: 105f72a
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9c24c685-1f34-4b3f-bbd7-90f2d66bf571

Commits

Reviewing files that changed from the base of the PR and between e4421d7 and 77c27c6.

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 2 remain after this review.

[sonukapoor]

Thanks @muntasir-396. bun.lock is the only Bun lockfile the scanner reads, so SARIF should name that one, and the test pins it. Approved. I merge these one at a time rather than in a batch, so it will land shortly.

[sonukapoor]

Merged - thank you @muntasir-396!