fix: use low-memory native HTTPS client

Author: clynbmilio

skill/dependency-cve-audit/audit.mjs

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto"
 import { readFile, mkdir, writeFile } from "node:fs/promises"
+import { request } from "node:https"
 import path from "node:path"
 import { fileURLToPath } from "node:url"
 
@@ -194,24 +195,11 @@ function markdownReport(report) {
 
 async function queryOsv(queries) {
   const requestBody = { queries }
-  const response = await fetch(OSV_BATCH_URL, {
-    method: "POST",
-    redirect: "error",
-    headers: { "content-type": "application/json", "user-agent": `dependency-cve-audit/${SCANNER_VERSION}` },
-    body: JSON.stringify(requestBody),
-  })
-  if (!response.ok) throw new Error(`OSV batch query failed with HTTP ${response.status}`)
-  const batchResponse = await response.json()
+  const batchResponse = await requestJson(OSV_BATCH_URL, { method: "POST", body: requestBody })
   const ids = [...new Set((batchResponse.results ?? []).flatMap((result) => (result.vulns ?? []).map((vuln) => vuln.id)).filter(Boolean))]
   const details = new Map()
   for (const id of ids) {
-    const detailResponse = await fetch(`https://api.osv.dev/v1/vulns/${encodeURIComponent(id)}`, {
-      method: "GET",
-      redirect: "error",
-      headers: { "user-agent": `dependency-cve-audit/${SCANNER_VERSION}` },
-    })
-    if (!detailResponse.ok) throw new Error(`OSV advisory ${id} failed with HTTP ${detailResponse.status}`)
-    details.set(id, await detailResponse.json())
+    details.set(id, await requestJson(`https://api.osv.dev/v1/vulns/${encodeURIComponent(id)}`, { method: "GET" }))
   }
   const responseBody = {
     results: (batchResponse.results ?? []).map((result) => ({
@@ -221,6 +209,47 @@ async function queryOsv(queries) {
   return { requestBody, batchResponse, detailResponses: [...details.values()], responseBody }
 }
 
+function requestJson(url, { method, body }) {
+  const encoded = body === undefined ? null : JSON.stringify(body)
+  return new Promise((resolve, reject) => {
+    const req = request(url, {
+      method,
+      headers: {
+        accept: "application/json",
+        "user-agent": `dependency-cve-audit/${SCANNER_VERSION}`,
+        ...(encoded ? { "content-type": "application/json", "content-length": Buffer.byteLength(encoded) } : {}),
+      },
+    }, (response) => {
+      const chunks = []
+      let bytes = 0
+      response.on("data", (chunk) => {
+        bytes += chunk.length
+        if (bytes > 10 * 1024 * 1024) {
+          req.destroy(new Error("OSV response exceeded 10 MiB"))
+          return
+        }
+        chunks.push(chunk)
+      })
+      response.on("end", () => {
+        const text = Buffer.concat(chunks).toString("utf8")
+        if ((response.statusCode ?? 0) < 200 || (response.statusCode ?? 0) >= 300) {
+          reject(new Error(`OSV request failed with HTTP ${response.statusCode}: ${text.slice(0, 200)}`))
+          return
+        }
+        try {
+          resolve(JSON.parse(text))
+        } catch (error) {
+          reject(new Error("OSV returned invalid JSON", { cause: error }))
+        }
+      })
+    })
+    req.setTimeout(30_000, () => req.destroy(new Error("OSV request timed out")))
+    req.on("error", reject)
+    if (encoded) req.write(encoded)
+    req.end()
+  })
+}
+
 export async function runAudit(inputs) {
   const targetDir = path.resolve(String(inputs.target_dir ?? ""))
   const outputDir = path.resolve(String(inputs.output_dir ?? ""))