feat(backend): implement reachability analysis for vulnerable dependencies

[lakshay122007]

Before opening: make sure there is an issue tracking this work, and link it below. PRs without a linked issue may be closed without review.

Linked issue

Closes #22

What this PR does

This PR introduces a reachability analysis engine that triggers after the osv-scanner finishes. It actively parses the source code directory to detect if flagged vulnerable packages are actually being imported (e.g., require('pkg') or import 'pkg'), helping developers distinguish between passive, unused dependencies and actively executing vulnerabilities.

Type of change

• Bug fix
• New feature
• ML model / training pipeline
• Refactor (no behaviour change)
• Documentation
• Tests only

ML tier (if applicable)

• Tier 1 — Triage
• Tier 2 — Predictive
• Tier 3 — Autonomous
• Not ML-related

---

Changes

Backend

• app/models.py: Extended the Finding schema with a new Reachability Pydantic model (reachable boolean and evidence string).
• app/utils/fs.py: Added check_reachability, a highly optimized regex parser. It uses os.walk with in-place pruning of heavy directories (node_modules, .git, venv, etc.) to quickly find active imports in target source files without tanking performance.
• app/scanners/osv.py: Implemented a post-scan hook that iterates over the OSV findings, runs the reachability check for each vulnerable package, and mutates the finding object before returning it.

---

Testing

How did you test this?

• Created a local, isolated dummy Node.js project.
• Installed an outdated version of lodash (4.17.20) with known vulnerabilities.
• Created an index.js file containing const _ = require('lodash');.
• Executed the run_osv_scanner directly against the dummy project and verified the final JSON payload successfully appended: "reachability": { "reachable": true, "evidence": "Imported in index.js: line 1" }.

see the screenshot -

Checklist

• Tested locally end-to-end (upload ZIP or GitHub URL → scan → findings returned correctly)
• New ML model falls back gracefully when model file is absent
• No new console.error or unhandled Python exceptions introduced
• Added or updated tests where applicable
• requirements.txt / package.json updated if new dependencies added
• New model files (.pkl, .pt, etc.) are gitignored, not committed

---

[lakshay122007]

hi @ionfwsrijan kindly review it and let me know if any changes required. also attatched the screenshot for verification, its shows - reachability: true. Thanks!

[ionfwsrijan]

@lakshay122007 The code looks clean and good to me.

[Copilot]

Pull request overview

Implements a post-processing “reachability analysis” step for OSV dependency findings, enriching each finding with whether the vulnerable package appears to be imported/required in the scanned source tree.

Changes:

• Extends the backend finding schema with an optional reachability object (reachable, evidence).
• Adds a filesystem-based reachability check that scans source files for import / require(...) patterns while pruning heavy directories.
• Hooks reachability computation into the OSV scanner output so findings are returned with reachability metadata.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
backend/app/utils/fs.py	Adds check_reachability() to scan repo source files for import/require evidence while skipping heavy directories.
backend/app/scanners/osv.py	Enriches OSV findings with reachability results after the scanner JSON is parsed.
backend/app/models.py	Introduces Reachability model and adds optional reachability field to Finding.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ionfwsrijan]

@lakshay122007 Kindly review copilot comments

[lakshay122007]

Done! @ionfwsrijan made the changes and they were valid also.

[ionfwsrijan]

Done! @ionfwsrijan made the changes and they were valid also.

Yes. Thanks for fixing them up.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

[lakshay122007]

let me fix the rest of the changes

[ionfwsrijan]

@lakshay122007 Can you please look into the suggestions again? They seem important to me.

[lakshay122007]

wait i forgot reuff formatting, just a moment!

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

[lakshay122007]

Why so many suggestions😭, i guess they all are just ruff formatting issues?? i have fixed it

[lakshay122007]

Done @ionfwsrijan