Methods

Quick reference for the SDK's most-used methods. All verified against source.

Methods at a glance

Grouped by receiver type — this is the whole surface you will use day to day.

Aliases

Method	Signature	Description
GetCVE	() string	First alias matching CVE- (case-insensitive — upper-cased before matching, so cve-2024-1 is found and returned as CVE-2024-1)
Filter	(func(string) bool) Aliases	Filter aliases by predicate

AffectedSlice

Method	Signature	Description
HasEcosystem	(Ecosystem) bool	Whether any affected entry matches ecosystem
FilterByEcosystem	(Ecosystem) AffectedSlice	Narrow to one ecosystem
Filter	(func(*Affected) bool) AffectedSlice	Custom predicate filter

Package

Method	Signature	Description
IsMaven	() bool	Ecosystem == Maven
GetGroupID	() string	Maven groupId (left of :); empty if not Maven-shaped
GetArtifactID	() string	Maven artifactId (right of :); empty if not Maven-shaped
GetArtifactID	() string	Maven artifactId (right of :)

SeveritySlice

Method	Signature	Description
GetCVSS3	() *Severity	First entry whose Type == "CVSS_V3", or nil
GetCVSS2	() *Severity	First entry whose Type == "CVSS_V2", or nil

Note the two distinct string fields on Severity: Type (one of "CVSS_V2" / "CVSS_V3", the OSV severity[].type discriminator) and Score (the contents — a CVSS vector string like CVSS:3.1/AV:N/… or a bare number like 7.5). GetCVSS3 matches on Type, never on the vector prefix.

Severity

Method	Signature	Description
GetScore	() float64	Parse the CVSS score as float64
GetScoreAsFloat	() (float64, error)	Parse score, returning an error if the vector string is malformed
GetScoreAsPointer	() *float64	Score as pointer (for nullable fields)

All three share one parser (GetScoreAsFloat); the other two only differ in how they report a parse failure — and a score that holds a CVSS vector string (e.g. CVSS:3.1/AV:N/…) rather than a number is a parse failure. Pick the variant whose failure shape you can handle:

GetScore() hides the vector-string case

Because GetScore() drops the error, a vector-string score is indistinguishable from a real 0.0. When the distinction matters, use GetScoreAsFloat() (check err) or GetScoreAsPointer() (check nil) — and read the CVSS vector from Severity.Score directly.

References

Method	Signature	Description
FilterByType	(...ReferenceType) References	Keep references whose Type matches any of the given types (OR semantics); returns nil if no types are passed

Event

Method	Signature	Description
IsIntroduced	() bool	Event marks an introduced version
IsFixed	() bool	Event marks a fixed version
IsLastAffected	() bool	Event marks last affected version
IsLimit	() bool	Event marks a range limit

An Event struct carries four optional string fields (Introduced, Fixed, LastAffected, Limit); exactly one is populated per event. Each Is* predicate just checks whether its field is non-empty — so the four are mutually exclusive and exactly one returns true:

Walk events in order, not in isolation

A single event tells you what kind of boundary it is; the affected/not-affected answer comes from walking the timeline in order and toggling a flag at each introduced/fixed pair. See OSV Schema → event-timeline resolution.

Parsing

Function	Signature	Description
UnmarshalFromJson	([]byte) (*OsvSchema[Eco,DB], error)	Parse from bytes
UnmarshalFromJsonFile	(string) (*OsvSchema[Eco,DB], error)	Parse from file path

// General-purpose parsing — use `any` for both generics
v, err := osv.UnmarshalFromJsonFile[any, any]("vuln.json")

// Or attach ecosystem/database-specific data
v, err := osv.UnmarshalFromJsonFile[MyEco, MyDB]("vuln.json")

Always check err first — on error the pointer is nil

Both functions return (nil, err) on any failure (bad JSON, missing file, decode error). On success the pointer is never nil. So the contract is: inspect err before touching v, and you'll never dereference a nil *OsvSchema.

Method call graph

Parse & validate data flow

Maven coordinate decomposition

GetGroupID / GetArtifactID split a Maven package name on the first :. They only make sense when IsMaven() is true.

A real query, method by method

"Is GHSA-… a high-severity PyPI issue, and are there fix links?" — here's the exact method chain an agent (or your code) walks. (This sample's references happen to carry no FIX entries, so the last call returns an empty slice — the chain is the same regardless.)

Which method returns what

Serialization helpers

Most types implement sql.Scanner and driver.Valuer, so they store cleanly as JSON columns under GORM. The complex nested types (AffectedSlice, SeveritySlice, Package, Credits) marshal themselves to/from JSON automatically.

Source: root package *.go