#!/bin/bash
# 1) Confirm advisory status in OSV.
# 2) Locate where jsonparser is pinned in module files.
set -euo pipefail

curl -s https://api.osv.dev/v1/query -d '{
  "package": {"name":"github.com/buger/jsonparser","ecosystem":"Go"},
  "version":"1.1.1"
}' | jq .

echo "---- occurrences in go.mod/go.sum ----"
rg -n "github.com/buger/jsonparser|google.golang.org/grpc" go.mod go.sum || true

#!/bin/bash
set -euo pipefail

# Find the parent dependency that brings in jsonparser
# First, let's examine the full go.mod to understand the dependency tree
echo "=== Full go.mod content ==="
cat go.mod

echo ""
echo "=== Searching for direct dependencies that might depend on jsonparser ==="
# Common libraries that use jsonparser: protobuf libraries, gRPC, etc.
rg -i "protobuf|encoding|grpc|json" go.mod -B 1 -A 1 | head -30

#!/bin/bash
set -euo pipefail

# Search for any imports of jsonparser in the source code
echo "=== Searching for jsonparser imports in source code ==="
rg -i "jsonparser|buger" --type go . 2>/dev/null || echo "No direct usage found"

# Check if we can use go mod graph-like output
echo ""
echo "=== Checking forge.lthn.ai packages ==="
# These are internal packages, they're likely where jsonparser is used
git ls-files | grep -E "\.go$" | head -5

# Let's also check go.sum to see if there are any helpful clues
echo ""
echo "=== Lines around jsonparser in go.sum ==="
grep -B 2 -A 2 "buger/jsonparser" go.sum || true

#!/bin/bash
set -euo pipefail

# Check bytedance/sonic usage - it's a JSON serialization library that might use jsonparser
echo "=== Searching for sonic usage ==="
rg -i "sonic|serialize" --type go . 2>/dev/null | head -20 || echo "No direct usage found"

# Check the relationship - sonic is known to use jsonparser internally
echo ""
echo "=== Checking versions of bytedance packages in go.mod ==="
grep -E "bytedance/(sonic|gopkg)" go.mod

# Check if there are newer versions available that might pull in jsonparser v1.1.2
echo ""
echo "=== Go.sum entries for bytedance ==="
grep "bytedance" go.sum | head -20

#!/bin/bash
set -euo pipefail

# Check go.sum to see if jsonparser is only v1.1.1 or if there are other versions
echo "=== All jsonparser entries in go.sum ==="
grep "jsonparser" go.sum

# Let's check the direct dependencies from forge.lthn.ai - they might have been updated
echo ""
echo "=== forge.lthn.ai direct dependencies ==="
grep "forge.lthn.ai" go.mod | grep -v "//" | head -20

#!/bin/bash
# Verify vulnerability status directly from OSV for grpc-go.
set -euo pipefail

curl -s https://api.osv.dev/v1/query -d '{
  "package": {"name":"google.golang.org/grpc","ecosystem":"Go"},
  "version":"1.79.2"
}' | jq .