fix: address review feedback for URL dependency detection

- Scan all packages for URL deps, not just root (fixes transitive detection)
- Align isUrlDependency with resolveVersion URL patterns
- Use computed map for URL dep lookups in Dependencies.vue
- Remove orphaned url field from ResolvedPackage interface

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ndpvt-web

app/components/Package/Dependencies.vue

@@ -37,10 +37,15 @@ function getDeprecatedDepInfo(depName: string) {
   return vulnTree.value.deprecatedPackages.find(p => p.name === depName && p.depth === 'direct')
 }
 
+// Cache URL dependency lookups with computed map
+const urlDepMap = computed(() => {
+  if (!vulnTree.value) return new Map()
+  return new Map(vulnTree.value.urlDependencies.map(dep => [dep.name, dep]))
+})
+
 // Check if a dependency uses git: or https: URL
 function getUrlDepInfo(depName: string) {
-  if (!vulnTree.value) return null
-  return vulnTree.value.urlDependencies.find(p => p.name === depName)
+  return urlDepMap.value.get(depName) ?? null
 }
 
 // Expanded state for each section

server/utils/dependency-analysis.ts

@@ -260,7 +260,13 @@ function getSeverityLevel(vuln: OsvVulnerability): OsvSeverityLevel {
  * Check if a dependency URL is a git: or https: URL that should be flagged.
  */
 function isUrlDependency(url: string): boolean {
-  return url.startsWith('git:') || url.startsWith('https:') || url.startsWith('git+https:')
+  return (
+    url.startsWith('git:') ||
+    url.startsWith('git+') ||
+    url.startsWith('http:') ||
+    url.startsWith('https:') ||
+    url.startsWith('file:')
+  )
 }
 
 /**
@@ -336,8 +342,12 @@ export const analyzeDependencyTree = defineCachedFunction(
         return depthOrder[a.depth] - depthOrder[b.depth]
       })
 
-    // Scan for git: and https: URL dependencies in the root package
-    const urlDependencies = await scanUrlDependencies(name, version, 'root', [])
+    // Scan for git: and https: URL dependencies in all packages
+    const urlDependencies: UrlDependencyInfo[] = []
+    for (const pkg of packages) {
+      const pkgUrlDeps = await scanUrlDependencies(pkg.name, pkg.version, pkg.depth, pkg.path)
+      urlDependencies.push(...pkgUrlDeps)
+    }
 
     // Step 1: Use batch API to find which packages have vulnerabilities
     // This is much faster than individual queries - one request for all packages

server/utils/dependency-resolver.ts

@@ -106,8 +106,6 @@ export interface ResolvedPackage {
   path?: string[]
   /** Deprecation message if the version is deprecated */
   deprecated?: string
-  /** Original URL if this was a git: or https: dependency */
-  url?: string
 }
 
 /**