fix: add filter to show packages with license violations but no vulnerabilities by summerpan688 · Pull Request #2919 · google/osv-scanner

summerpan688 · 2026-07-08T04:03:03Z

Summary

Packages with license violations but no vulnerabilities were always
hidden in the HTML report, since the filtering logic only checked
.vuln-tr rows. This adds a "Show license violations without
vulnerabilities" filter checkbox (default: off) that reveals these
packages on request.

Also fixed two related issues surfaced during testing:

Packages with zero vulnerabilities were mislabeled "Filtered out"
(a label meant for packages whose vulns were filtered by call
analysis) — now shows "No known vulnerabilities" instead.

Clicking into these packages' details previously showed an empty
vuln table — now shows a placeholder message instead.

Design discussion

See discussion in the issue comment
"Show all packages“ vs. the more scoped "Show license violations without vulnerabilities"
（happy to adjust based on feedback）

Fixes google#1643. Packages with license violations but no vulnerabilities were always hidden by showAndHideParentSections(), which only checked .vuln-tr rows. This adds a "Show license violations without vulnerabilities" checkbox that reveals these packages on demand, defaulting to off so existing report behavior is unchanged.

…ltered out'

…ties Previously, clicking into a package with zero vulnerabilities (e.g. one with only a license violation) showed an empty vuln table, since vuln_table_template.gohtml renders a table with headers regardless of whether RegularVulns/HiddenVulns actually contain any entries. This now shows "No known vulnerabilities for this package." instead, reusing the existing .package-detail-title style.

google-cla · 2026-07-08T04:03:17Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

summerpan688 · 2026-08-05T00:59:31Z

Looked into the failing Run unit tests checks — the failure is in TestDoScan/Test_curl_git_scanning, unrelated to the files changed in this PR (internal/output/html/*). The diff is a single modified timestamp on CVE-2025-63675 in the snapshot, which appears to just reflect the OSV DB updating that record between snapshot refreshes (saw the same pattern referenced in #2920). Confirmed locally that re-running with the latest main merged in still shows this as the only diff — happy to update the snapshot if preferred, just didn't want to bundle in an unrelated data-only diff without checking first.

summerpan688 · 2026-08-05T01:01:45Z

Hi @jess-lowe @another-rex , just checking in on this PR whenever you have a chance to take a look — no rush! Also wanted to flag that the CI test failures (Run unit tests) appear unrelated to this change; left a note with details above. Thanks so much!
(Also, apologies for the gap in activity — my account was temporarily suspended and I just got access back)

codecov-commenter · 2026-08-05T03:34:03Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.38%. Comparing base (d54ee37) to head (e068ab7).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2919      +/-   ##
==========================================
+ Coverage   79.37%   79.38%   +0.01%     
==========================================
  Files         118      118              
  Lines        8077     8086       +9     
==========================================
+ Hits         6411     6419       +8     
- Misses       1309     1310       +1     
  Partials      357      357

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

another-rex

Thanks! Sorry for the late review, been a bit busy recently!

another-rex · 2026-08-10T01:49:12Z

    {{template "vuln_table_entry_template.gohtml" $args}}
  {{ end }}
 </table>
+{{ end }}


hmm... this looks weird, why is there a + here.

Ah, that was a mistake and missing newline at end of file. Fixed — pushed in the latest commit.

another-rex · 2026-08-10T01:50:53Z

          <input type="checkbox" id="uncalled-type-checkbox" data-type-uncalled-count="{{ .VulnTypeSummary.Hidden }}">
          Uncalled/Unimportant ({{ .VulnTypeSummary.Hidden }})
        </label>
+        {{ if .LicenseSummary.Summary }}


I think osv-scanner can have --license-violations without having the summary flag, LicenseSummary.ShowViolations is the bool here, we also need to show this.

Good catch, thank you! You're right, updated to check LicenseSummary.ShowViolations instead of Summary so the checkbox shows up correctly even without the summary flag.

Not sure if we need both the summary and license violations here or just a license violation check...

I think just ShowViolations is enough here. Summary controls the separate license count summary, while ShowViolations is specifically set when an allowlist exists. Using both could also reintroduce the original issue where the checkbox disappears when violations exist but the summary isn't enabled.

another-rex · 2026-08-10T01:53:40Z

+    "license-violation-type-checkbox"
+  );
+  if (licenseViolationCheckbox) {
+    licenseViolationCheckbox.addEventListener("change", () => {


do we need to add a stopPropagation here?

Actually we might not need applyFilers, since it's already being called by the parent listener. Please have a look.

You're right — this checkbox lives inside type-filter-option-container, which already has a change listener that calls applyFilters. Removed the separate listener and folded the license-violation checkbox's state into the existing one, so applyFilters only runs once now.

- Use LicenseSummary.ShowViolations instead of Summary so the filter checkbox shows correctly when --licenses is set without a summary flag - Consolidate the license violation checkbox's change handling into the existing type-filter-option-container listener to avoid duplicate applyFilters calls - Fix missing newline at end of vuln_table_template.gohtml

summerpan688 · 2026-08-11T04:14:50Z

Thanks! Sorry for the late review, been a bit busy recently!

Thanks for the thorough review! Pushed fixes for all three — replied inline on each.

summerpan688 and others added 3 commits July 5, 2026 22:00

html: distinguish 'no known vulnerabilities' from 'vulnerabilities fi…

e690600

…ltered out'

summerpan688 changed the title ~~Fix/1643 Add filter to show packages with license violations but no vulnerabilities~~ fix: add filter to show packages with license violations but no vulnerabilities Jul 8, 2026

summerpan688 added 2 commits July 8, 2026 17:37

style: fix prettier formatting issues in script.js

02f4d92

Merge branch 'main' into fix/1643-license-violation-filter

f7a0040

another-rex self-requested a review August 5, 2026 01:57

Merge branch 'main' into fix/1643-license-violation-filter

e672f42

another-rex reviewed Aug 10, 2026

View reviewed changes

another-rex approved these changes Aug 11, 2026

View reviewed changes

Uh oh!

Conversation

summerpan688 commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Design discussion

Uh oh!

google-cla Bot commented Jul 8, 2026

Uh oh!

summerpan688 commented Aug 5, 2026

Uh oh!

summerpan688 commented Aug 5, 2026

Uh oh!

codecov-commenter commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

another-rex left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

summerpan688 commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

summerpan688 commented Jul 8, 2026 •

edited

Loading

codecov-commenter commented Aug 5, 2026 •

edited

Loading