feat(security): osv-scanner universal dependency audit + rules for JVM/.NET/Elixir/Swift/Scala/Dart

[OBenner]

Summary

Second half of roadmap phase 2 (follows #390).

Rather than one bespoke audit runner per remaining ecosystem, this adds a single osv-scanner runner — Google's cross-ecosystem known-vulnerability scanner — covering Maven/Gradle, NuGet, Hex (Elixir), SwiftPM, pub (Dart), and Go modules in one pass.

• Triggered by those ecosystems' manifests (pom.xml, gradle.lockfile, packages.lock.json, mix.lock, Package.resolved, pubspec.lock, go.mod)
• npm/cargo/composer manifests deliberately excluded — dedicated runners from feat(security): real SAST and dependency audits for C/C++, Go, Rust, and PHP #390 already cover them, avoiding double-reporting
• Same graceful-skip contract: missing binary → silent skip, timeout/parse failure → scan_errors

Also completes the language_rules.py tables: java, kotlin, csharp, elixir, swift, scala, dart now have scanner entries and dangerous-function rules (Runtime.exec, BinaryFormatter, Code.eval_string, String.to_atom, unsafeBitCast, …) with secure alternatives. Every language the stack detector recognizes now has scanner + rule coverage.

Testing

tests/test_security_scanner.py + tests/test_security.py: 189 passed (6 new). Ruff clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Expanded security scanning to cover more ecosystems and added OSV-based dependency checks where applicable.
  • Added broader language security coverage for several JVM-adjacent and other supported languages.

• Bug Fixes

  • Security findings from dependency scans now feed into existing blocking logic consistently.
  • Improved handling when the OSV scanner is unavailable or returns output errors.

• Tests

  • Added coverage for new language security rules and OSV scan detection/parsing behavior.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Warning

Review limit reached

@OBenner, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 25 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e267596e-2aed-4bb4-ba4e-72fb5f8e8ff7

📥 Commits

Reviewing files that changed from the base of the PR and between 3ef4e9e and b13c187.

📒 Files selected for processing (3)

• apps/backend/analysis/security_scanner.py
• tests/test_security.py
• tests/test_security_scanner.py

📝 Walkthrough

Walkthrough

This PR adds OSV-scanner integration to SecurityScanner for dependency ecosystems lacking dedicated audit runners, introducing manifest detection, scanner execution, and JSON output parsing into vulnerabilities. Separately, it expands LANGUAGE_SECURITY_SCANNERS and LANGUAGE_SECURITY_RULES with entries for java, kotlin, csharp, elixir, swift, scala, and dart, plus corresponding tests.

Changes

OSV-scanner integration and language security rules

Layer / File(s)	Summary
OSV manifest detection and audit wiring apps/backend/analysis/security_scanner.py	Adds OSV_MANIFESTS tuple and _has_osv_manifests check, wired into _run_dependency_audits to conditionally trigger an OSV scan.
OSV-scanner execution and parsing apps/backend/analysis/security_scanner.py	Implements _run_osv_scanner to run the external osv-scanner command with error handling, and _parse_osv_output to convert JSON results into SecurityVulnerability entries.
OSV-scanner tests tests/test_security_scanner.py	Adds tests for manifest detection and mocked _run_osv_scanner execution covering successful parsing and FileNotFoundError handling.
Expanded language security scanners and rules apps/backend/security/language_rules.py	Adds a shared JVM secure-random guidance string and extends scanner commands and rule definitions (dangerous functions, unsafe patterns, secure alternatives) for java, kotlin, csharp, elixir, swift, scala, and dart.
Language security rules tests tests/test_security.py	Adds tests verifying scanner and rule completeness for the newly added languages.

Estimated code review effort: 2 (Simple) | ~15 minutes

Sequence Diagram(s)

sequenceDiagram
  participant SecurityScanner
  participant OsvScannerCLI
  participant ScanResult

  SecurityScanner->>SecurityScanner: _has_osv_manifests(project_dir)
  alt manifests found
    SecurityScanner->>OsvScannerCLI: run osv-scanner --json
    OsvScannerCLI-->>SecurityScanner: JSON output or error
    SecurityScanner->>SecurityScanner: _parse_osv_output(json)
    SecurityScanner->>ScanResult: append SecurityVulnerability entries
  end

Loading

Suggested labels: size/XL

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: adding osv-scanner dependency audits and expanding language security rules for several languages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/security-osv-universal-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/backend/analysis/security_scanner.py`:
- Around line 664-680: The OSV manifest check in _has_osv_manifests() only looks
at root-level paths, so scan() can skip osv-scanner in monorepos with nested
manifests. Update _has_osv_manifests() in security_scanner.py to search
recursively from project_dir (for example using rglob for each entry in
OSV_MANIFESTS) so nested pom.xml, mix.lock, go.mod, etc. are detected and
trigger the existing osv-scanner -r . flow.
- Around line 711-731: The _parse_osv_output method is forcing every OSV finding
to severity high, which overstates the scan results. Update
SecurityScanner._parse_osv_output to read the severity from each vulnerability’s
OSV payload when available, and only default to high when that field is missing.
Keep the existing SecurityVulnerability creation flow, but ensure the severity
value comes from the vulnerability data instead of a hardcoded literal.

In `@tests/test_security.py`:
- Around line 1670-1686: Update test_jvm_dotnet_tail_languages_have_rules to
also assert unsafe_patterns for each language returned by get_security_rules,
since the new language entries in security.profile are expected to define them.
Extend the existing expectations in test_jvm_dotnet_tail_languages_have_rules
with a per-language unsafe pattern token and add an assertion that the token
appears in rules["unsafe_patterns"] alongside the existing dangerous_functions
and secure_alternatives checks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3151517c-8ae0-4bfb-b43b-382f223b954e

📥 Commits

Reviewing files that changed from the base of the PR and between 9aac5ab and 3ef4e9e.

📒 Files selected for processing (4)

• apps/backend/analysis/security_scanner.py
• apps/backend/security/language_rules.py
• tests/test_security.py
• tests/test_security_scanner.py

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud