Run osv-sanner on uv & dart & java

.codacy.yaml

@@ -24,6 +24,9 @@
 #   suppress per line. It is a false positive -- the args are cargo's own trusted rustc invocation -- and forwarding
 #   argv to rustc is the whole file's purpose, so no code change removes it. The crate is already this one minimal
 #   file; rationale lives in its header. Still covered by clippy + DeepSource Rust.
+# - uv.lock: the uv workspace's machine-generated dependency lock. Codacy's line-count metric flags its 500+ rows,
+#   but it is not hand-authored source and has nothing to review; the other lock files are well-known names Codacy
+#   already skips, whereas uv.lock is new enough that it isn't on that list yet.
 exclude_paths:
   - ".github/actions/**"
   - ".github/workflows/**"
@@ -35,3 +38,4 @@ exclude_paths:
   - "services/ws-modules/wasi-data1/src/coverage.rs"
   - "services/ws-web-runner/mingw-shim/msvc_crt_alloc.c"
   - "utilities/wasm-cov-wrapper/src/main.rs"
+  - "uv.lock"

.dockerignore

@@ -20,7 +20,6 @@ services/ws-server/static/models/
 **/__pycache__/
 **/.pytest_cache/
 **/.python-version
-**/uv.lock
 **/node_modules/
 **/pnpm-lock.yaml
 **/.venv/
@@ -42,6 +41,8 @@ lcov.info
 !.vscode/extensions.json
 **/.ruff_cache/
 **/.lycheecache
+# Dart pub tool dir, regenerated by `dart pub get`; one global rule for the whole workspace (root + members).
+**/.dart_tool/
 services/ws-server/storage/
 **/.git/
 **/Dockerfile*

.editorconfig

@@ -56,7 +56,7 @@ max_line_length = unset
 
 # openapi-python-client emits framework-boilerplate docstrings (e.g. the
 # "errors.UnexpectedStatus: If the server returns an undocumented status code ..." line in every operation) that exceed
-# 120 chars, and continuation lines inside the generated function signatures use 3-space indentation that
+# the line length, and continuation lines inside the generated function signatures use 3-space indentation that
 # clashes with the workspace `indent_size = 2`. ruff format doesn't reflow plain-text docstrings or
 # re-indent the templates, so we drop both checks for this tree.
 [generated/python-rest/**]
@@ -66,12 +66,12 @@ max_line_length = unset
 # datamodel-code-generator renders each Pydantic field's `description=` from the schemars `description`
 # (i.e. the source enum's `///` doc comment) as a single string literal -- `\n`-joined, no implicit
 # concatenation. ruff format won't break string literals, so any multi-paragraph Rust doc comment on
-# `ClientMessage` / `ServerMessage` blows past 120 chars in the generated Python.
+# `ClientMessage` / `ServerMessage` blows past the line length in the generated Python.
 [generated/python-ws/**]
 max_line_length = unset
 
 # Same story for openapi2zig: a handful of helpers (SSE parsing, query-string
-# encoding) emit lines that exceed 120 chars and `zig fmt` won't reflow them.
+# encoding) emit lines that exceed the line length and `zig fmt` won't reflow them.
 # The generator is the source of truth; we don't edit its output by hand.
 [generated/zig-rest/**]
 max_line_length = unset

.github/workflows/coverage.yaml

@@ -32,8 +32,13 @@ jobs:
       ET_TEST_COVERAGE: "true"
     steps:
       - name: Checkout
+        # DeepSource's test-coverage analyzer keys the uploaded artifact to the checked-out commit's SHA.
+        # actions/checkout defaults to the PR *merge* commit, which does not exist upstream, so DeepSource can't
+        # match it to the run it analyzed and the coverage reads as "never reported" (the check then times out).
+        # Check out the PR head SHA instead; `|| github.sha` keeps the push-to-main path working.
         uses: actions/checkout@v4
         with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 1
           persist-credentials: false
 

.gitignore

@@ -16,7 +16,6 @@ mprocs.log
 __pycache__/
 .pytest_cache/
 .python-version
-uv.lock
 node_modules/
 pnpm-lock.yaml
 .venv/
@@ -38,4 +37,6 @@ coverage-python.xml
 !.vscode/extensions.json
 .ruff_cache/
 .lycheecache
+# Dart pub tool dir, regenerated by `dart pub get`; one global rule for the whole workspace (root + members).
+**/.dart_tool/
 services/ws-server/storage/

.mise/config.dart.toml

@@ -27,19 +27,13 @@ fromJSON(body).prefixes
 version_list_url = "{{ vars.dart_bucket }}?prefix=channels/stable/release/&delimiter=/"
 
 [tasks.dart-pub-get]
-# Run `dart pub get` for every Dart package before any dart-* task.
-# This makes .dart_tool/ exist so the format is stable. `dart format` and `dart analyze` walk up to find
-# pubspec.yaml *and* read `.dart_tool/package_config.json` if present. With package_config.json, the formatter
-# picks the package's exact language version; without it, it falls back to a different default -- same source
-# file, different output. That mismatch is invisible locally (we accumulate .dart_tool/ over time) but bites
-# CI's fresh checkout.
-run = """
-dart pub get --directory generated/dart-ws
-dart pub get --directory generated/dart-rest
-dart pub get --directory services/ws-modules/dart-comm1
-dart pub get --directory services/ws-modules/dart-data1
-"""
-shell = "bash -euo pipefail -c"
+# Resolve the whole Dart pub workspace before any dart-* task.
+# One `dart pub get` at the workspace root (pubspec.yaml's `workspace:` list) resolves every member into the
+# single root pubspec.lock and writes the shared .dart_tool/package_config.json. `dart format` and `dart analyze`
+# walk up from each member to find pubspec.yaml *and* that package_config.json; with it, the formatter picks the
+# exact language version, without it a different default -- same source, different output. That mismatch is
+# invisible locally (we accumulate .dart_tool/ over time) but bites CI's fresh checkout.
+run = "dart pub get"
 
 [tasks.dart-check]
 depends = ["dart-pub-get"]

.mise/config.js.toml

@@ -99,7 +99,7 @@ description = "Check JS/TS formatting (oxfmt)"
 # detection mis-parses the multiple `"""..."""` TOML basic-multiline strings in these files as JS template
 # literals (and silently concatenates `description = "..."` into the closing `"""` of an adjacent
 # `run = """..."""` block on --write); it also flattens short TOML arrays like `depends = [...]` into single
-# lines because they look like JS arrays under 120 chars. The `ignorePatterns: ["**/*.toml"]` in
+# lines because they look like short JS arrays. The `ignorePatterns: ["**/*.toml"]` in
 # config/oxfmtrc.jsonc filters every other TOML file correctly but fails to match dotfile-directory paths like
 # `.mise/config*.toml`, so we override here positionally.
 run = "oxfmt --config config/oxfmtrc.jsonc --check . '!.mise/config*.toml'"

.mise/config.maint.toml

@@ -31,7 +31,7 @@
 
 [env]
 # Shared HF base URLs + release-target coords hoisted out of every publish task.
-# Hoisted from every publish-*-to-hf-cache task so the xh/jaq/gh lines stay under 120 chars without
+# Hoisted from every publish-*-to-hf-cache task so the xh/jaq/gh lines stay short without
 # backslash continuations. All literals -- composing one from another (e.g. `HF_API = "{{ env.HF_CO }}/api/models"`)
 # would trip mise's alphabetical env render order.
 #

.mise/config.python.toml

@@ -165,7 +165,7 @@ mkdir -p generated/python-rest/et_rest_client
 # None of these args move into config/openapi-python-client.yaml.
 # path / meta / overwrite / output-path are CLI-only `generate` options. Build
 # them up in a shell var (split over two lines) so neither line needs a backslash
-# continuation or runs past 120 cols; unquoted $args word-splits into argv.
+# continuation or runs past the line length; unquoted $args word-splits into argv.
 args="--config config/openapi-python-client.yaml --path generated/specs/rest.yaml"
 args="$args --meta none --overwrite --output-path generated/python-rest/et_rest_client"
 # $args is a space-separated CLI flag list; word-splitting is intentional.

.mise/config.toml

@@ -101,7 +101,7 @@ ripgrep = "latest"
 "cargo:ryl" = { version = "latest", os = ["macos/x64"] }
 "github:microsoft/onnxruntime" = "1.22.0"
 "github:owenlamont/ryl" = { version = "latest", os = ["linux", "macos/arm64", "windows"] }
-"github:wasm-bindgen/wasm-bindgen" = "0.2.125"
+"github:wasm-bindgen/wasm-bindgen" = "0.2.126"
 # Sole consumer right now is the `go:` backend that source-builds jqfmt.
 # (noperator/jqfmt ships no release assets); add Go users here as they arrive.
 go = "latest"
@@ -144,7 +144,7 @@ zizmor = "latest"
 # `profile = "minimal"` to skip the ~1 GB rust-docs HTML tree per toolchain (the Nano docker build otherwise
 # filled its disk during the second toolchain install -- crashing inside an HCS re-exec on the rust-docs HTML
 # write under share/doc/rust/html/ with "There is not enough space on the disk"). Array-of-tables form
-# rather than inline so each entry fits within the 120-char limit alongside `os` + the component / target
+# rather than inline so each entry's fields sit on their own lines alongside `os` + the component / target
 # lists; must come at the end of [tools] (TOML can't re-open the table after the [[ ... ]] array-of-tables
 # headers below).
 [[tools.rust]]
@@ -272,6 +272,10 @@ augeas_windows_x64_asset = "1.14.1-x86_64-pc-windows-mingw.tar.gz"
 # Used to compose absolute paths into a tool's install dir from [env] (e.g. AUGEAS_LENS_LIB). Honours
 # MISE_DATA_DIR if set; otherwise mise's default of $XDG_DATA_HOME (~/.local/share/mise on Linux/macOS).
 mise_data_dir = '{{ env?.MISE_DATA_DIR or (vars.a_home ~ "/.local/share/mise") }}'
+# The committed lockfiles osv-scanner scans, one per ecosystem (Rust/Python/Dart/Java).
+# The gitignored pnpm-lock.yaml is intentionally excluded: it is regenerated per install (onnxruntime-web is
+# unpinned), so there is no stable committed file to scan.
+osv_locks = "--lockfile Cargo.lock --lockfile uv.lock --lockfile pubspec.lock --lockfile pom.xml"
 # clang-tidy's resource-dir arg (points clang at its builtin headers, e.g.
 # stddef.h). Empty default; config.linux.toml sets it from conda:clangxx.
 clang_resource_arg = ""
@@ -298,8 +302,8 @@ dart_release = "https://storage.googleapis.com/dart-archive/channels/stable/rele
 a_et_cli_exe = "et-cli{% if os() == 'windows' %}.exe{% endif %}"
 a_et_cli_target_dir = "target{% if os() == 'windows' %}/x86_64-pc-windows-gnullvm{% endif %}/debug"
 # RUSTC_WORKSPACE_WRAPPER assignment for the coverage build; leaf var referenced by web_cov_wrapper below.
-# `a_` prefix so mise's alphabetical [vars] render defines it before web_cov_wrapper uses it. Split out from
-# web_cov_wrapper (rather than inlined) to keep that line under the 120-char limit.
+# `a_` prefix so mise's alphabetical [vars] render defines it before web_cov_wrapper uses it. Split out so
+# web_cov_wrapper only adds the ET_TEST_COVERAGE conditional around this value.
 a_web_cov_wrapper_env = 'RUSTC_WORKSPACE_WRAPPER={{ config_root }}/target/debug/int-wasm-cov-wrapper '
 et_cli = "{{ vars.config_root_fwd }}/{{ vars.a_et_cli_target_dir }}/{{ vars.a_et_cli_exe }}"
 # mise-managed CPython (Linux/macOS); the PYO3_PYTHON default below.
@@ -329,9 +333,9 @@ web_cov_feat = '{% if env?.ET_TEST_COVERAGE == "true" %} -- --features et-web/co
 # no wrapper (no fingerprint churn). The wrapper binary is built by the build-wasm-cov-wrapper task dependency.
 web_cov_wrapper = '{% if env?.ET_TEST_COVERAGE == "true" %}{{ vars.a_web_cov_wrapper_env }}{% endif %}'
 # Override-free head of a browser module's wasm-pack build: coverage wrapper prefix plus fixed build args.
-# Only the two modules that then run et-cli module-package-json (har1, face-detection) use it, so their
-# single-line `&&` run stays under 120. It excludes no_opt / web_cov_feat -- those are appended inline at the
-# call site because no_opt carries a per-platform override that a nested var would freeze at this file's value.
+# Used by the two modules that also run et-cli module-package-json (har1, face-detection). It excludes no_opt /
+# web_cov_feat -- those are appended inline at the call site because no_opt carries a per-platform override that a
+# nested var would freeze at this file's value.
 web_pack_cov = '{{ vars.web_cov_wrapper }}wasm-pack build . --target web'
 # Extra flag for the wasm-pack module builds; empty so wasm-opt runs.
 # config.windows.toml overrides it to --no-opt where wasm-opt can't execute.
@@ -902,9 +906,10 @@ mise install rclone
 shell = "bash -euo pipefail -c"
 
 [tasks.osv-scanner]
-# Scans the committed Cargo.lock only, with no build dependency.
-# So the same task serves both ad-hoc local use and the dependencies workflow.
-run = "osv-scanner --lockfile Cargo.lock --config config/osv-scanner.toml"
+# Scans every committed lockfile across languages for known vulnerabilities.
+# Covers Cargo.lock, uv.lock, pubspec.lock, and pom.xml (one per ecosystem), with no build dependency, so the same
+# task serves both ad-hoc local use and the dependencies workflow. The `--lockfile` args live in vars.osv_locks.
+run = "osv-scanner {{ vars.osv_locks }} --config config/osv-scanner.toml"
 
 [tasks."gen:osv-scanner"]
 description = "Regenerate config/osv-scanner.toml from config/deny.toml's [advisories].ignore list"
@@ -933,7 +938,7 @@ description = "Audit dependencies with cargo-deny (advisories, bans, licenses, s
 # expression must then land in clarify intentionally, not silently.
 run = """
 rc=0
-out="$(cargo deny check --config config/deny.toml 2>&1)" || rc=$?
+out="$(cargo deny --config config/deny.toml check 2>&1)" || rc=$?
 echo "$out"
 extra="$(echo "$out" | rg 'warning\\[no-license-field\\]' | rg -v 'saffron' || true)"
 if [ -n "$extra" ]; then