feat(vulnerabilities): Add Hackage support

[ysangkok]

Changes

This adds support for detecting vulnerabilities using Hackage/PVP. It relies on

• Add Hackage support osv-offline#775

Context

You can view the discussion on Haskell support at:

• Manager for Haskell Cabal files #31493

You can track the addition of the Haskell manager at:

• feat(manager): add Cabal/Haskell manager using Hackage/PVP #33142

The example vulnerability in the tests of this PR is extracted from a real vulnerability. You can see it rendered on:

• https://osv.dev/vulnerability/HSEC-2023-0001

You can see the OSV JSON representation of it at:

• https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2023/HSEC-2023-0001.json

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[viceice]

it seems this is blocked by osv offline missing type

[ysangkok]

@viceice I think osv-offline isn't released automatically. So even though the linked PR was merged, I can't, from this PR reference a released version that contains the change in osv-offline.

[rarkins]

I forget exactly how the osv-offline works. I do see new tags being published though: https://github.com/renovatebot/osv-offline/tags

[ysangkok]

I tried replacing the line in package.json with this:

"@renovatebot/osv-offline": "github:renovatebot/osv-offline#1-2024123105",

But that doesn't seem to work, as compilation errors:

lib/workers/repository/process/types.ts:1:26 - error TS2307: Cannot find module '@renovatebot/osv-offline' or its corresponding type declarations.

1 import type { Osv } from '@renovatebot/osv-offline';
                           ~~~~~~~~~~~~~~~~~~~~~~~~~~

[viceice]

https://github.com/renovatebot/osv-offline/actions/runs/12537436239/job/34961520018

it seems it didn't released the changes.
from git blame I see last release is 4 months ago. 🫣
I'll try to look into it tomorrow.

[viceice]

• Add Hackage support osv-offline#775

it misses a proper semantic release prefix, so no release happened. will send a new pr to force a release

[viceice]

• build(deps): update dependency @renovatebot/osv-offline to v1.5.11 #33364

[renovate-release]

🎉 This PR is included in version 39.87.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)
• 39.87.0

Your semantic-release bot 📦🚀

[ysangkok]

Ah sorry for missing the semantic commit message prefix! And thank you for fixing!