🚨 GetHighSeverityVulnerabilities

Runs a security audit and filters the list of high-severity vulnerabilities (high or critical). Under the hood it calls AuditWithJSON.

When to use

Use it when there are many vulnerabilities and you need to prioritize fixes. This method helps you focus on the most dangerous issues, making it suitable for triggering actions in alerts, tickets, or blocking CI only for high-severity vulnerabilities.

Signature

func (c *Composer) GetHighSeverityVulnerabilities() ([]Vulnerability, error)

Parameters

This method takes no parameters.

Return value

Return value	Type	Description
First return value	[]Vulnerability	List of vulnerabilities with severity high or critical; empty slice when there are no matches
Second return value	error	Returned when an error occurs during execution or parsing

Key fields of Vulnerability: Package, Version, Title, Severity, Link, CVE, Abandoned.

Example

package main

import (
	"fmt"
	"log"

	"github.com/scagogogo/composer-skills/pkg/composer"
)

func main() {
	comp, err := composer.NewComposer("")
	if err != nil {
		log.Fatalf("initialization failed: %v", err)
	}

	highVulns, err := comp.GetHighSeverityVulnerabilities()
	if err != nil {
		log.Fatalf("failed to get high-severity vulnerabilities: %v", err)
	}

	if len(highVulns) > 0 {
		fmt.Printf("Found %d high-severity vulnerabilities:\n", len(highVulns))
		for _, vuln := range highVulns {
			fmt.Printf("Package: %s Version: %s\n", vuln.Package, vuln.Version)
			fmt.Printf("Vulnerability: %s\n", vuln.Title)
			fmt.Printf("Severity: %s\n", vuln.Severity)
			fmt.Printf("Details: %s\n\n", vuln.Link)
		}
	} else {
		fmt.Println("No high-severity vulnerabilities found.")
	}
}

Advanced

• The severity field is provided by Composer's security data source, with values typically critical / high / medium / low. This method keeps only the first two.
• For all vulnerabilities (including medium and low): use AuditWithJSON.
• For more fine-grained advisory information: use GetAuditInfo.
• Related methods: HasVulnerabilities, GetAbandonedPackages.