From 0504488a0bcb6150af6dc6dc0aa9da9a1797c101 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 29 Mar 2026 18:41:11 +0000
Subject: [PATCH 1/2] Add Python vulnerability lookup tool

Single-file HTML tool that parses pyproject.toml or requirements.txt files,
queries the OSV.dev API for known vulnerabilities, and displays results with
severity badges, affected version ranges, and expandable raw JSON.

Supports fetching dependencies directly from GitHub repos via ?path=owner/repo
parameter, with bookmarkable URLs and document title updates.

https://claude.ai/code/session_01FofeT3UVvJGdSBqi4vkQg6
---
 python-vulnerability-lookup.html | 674 +++++++++++++++++++++++++++++++
 1 file changed, 674 insertions(+)
 create mode 100644 python-vulnerability-lookup.html
diff --git a/python-vulnerability-lookup.html b/python-vulnerability-lookup.html
new file mode 100644
index 0000000..d5b9769
--- /dev/null
+++ b/python-vulnerability-lookup.html
@@ -0,0 +1,674 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Python Vulnerability Lookup</title>
+    <style>
+        * { box-sizing: border-box; }
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+            max-width: 900px;
+            margin: 0 auto;
+            padding: 20px;
+            line-height: 1.6;
+            color: #333;
+        }
+        h1 { margin-top: 0; }
+        textarea {
+            width: 100%;
+            min-height: 200px;
+            padding: 12px;
+            border: 2px solid #ddd;
+            border-radius: 6px;
+            font-family: 'Courier New', monospace;
+            font-size: 14px;
+            resize: vertical;
+        }
+        textarea:focus {
+            outline: none;
+            border-color: #4a90e2;
+        }
+        button {
+            background-color: #0066cc;
+            color: white;
+            border: none;
+            padding: 10px 20px;
+            border-radius: 6px;
+            cursor: pointer;
+            font-size: 15px;
+            margin-top: 10px;
+        }
+        button:hover { background-color: #0052a3; }
+        button:disabled { background-color: #999; cursor: not-allowed; }
+        #fetchBtn { margin-top: 0; }
+        #status {
+            margin-top: 12px;
+            padding: 10px;
+            border-radius: 6px;
+            display: none;
+        }
+        #status.visible { display: block; }
+        #status.info { background: #e8f4fd; color: #0c5494; }
+        #status.error { background: #fef5f5; color: #c0392b; }
+        #results { margin-top: 20px; }
+        .summary {
+            padding: 14px;
+            background: #f0f0f0;
+            border-radius: 6px;
+            margin-bottom: 16px;
+            font-size: 15px;
+        }
+        .package-section {
+            border: 1px solid #ddd;
+            border-radius: 6px;
+            margin-bottom: 12px;
+            overflow: hidden;
+        }
+        .package-header {
+            padding: 12px 16px;
+            font-weight: 600;
+            font-size: 15px;
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            flex-wrap: wrap;
+        }
+        .package-header.has-vulns { background: #fff5f5; border-bottom: 1px solid #ddd; }
+        .package-header.clean { background: #f0faf0; }
+        .version-tag {
+            font-weight: normal;
+            font-size: 13px;
+            color: #666;
+            background: #e8e8e8;
+            padding: 2px 8px;
+            border-radius: 4px;
+        }
+        .vuln-count {
+            margin-left: auto;
+            font-size: 13px;
+            color: #c0392b;
+            font-weight: normal;
+        }
+        .vuln-item {
+            padding: 12px 16px;
+            border-top: 1px solid #eee;
+        }
+        .vuln-item:first-child { border-top: none; }
+        .vuln-title {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            flex-wrap: wrap;
+            margin-bottom: 4px;
+        }
+        .severity-badge {
+            font-size: 11px;
+            font-weight: 700;
+            padding: 2px 8px;
+            border-radius: 4px;
+            text-transform: uppercase;
+            letter-spacing: 0.3px;
+        }
+        .severity-critical { background: #dc3545; color: white; }
+        .severity-high { background: #e8740c; color: white; }
+        .severity-moderate { background: #f0ad4e; color: #333; }
+        .severity-low { background: #5bc0de; color: #333; }
+        .severity-unknown { background: #999; color: white; }
+        .vuln-id a {
+            font-family: monospace;
+            font-size: 14px;
+            color: #0066cc;
+            text-decoration: none;
+        }
+        .vuln-id a:hover { text-decoration: underline; }
+        .vuln-summary {
+            margin: 4px 0 0;
+            font-size: 14px;
+            color: #555;
+        }
+        .vuln-aliases {
+            font-size: 13px;
+            color: #777;
+            margin-top: 2px;
+        }
+        .vuln-affected {
+            font-size: 13px;
+            color: #666;
+            margin-top: 4px;
+        }
+        details.raw-json {
+            margin-top: 8px;
+        }
+        details.raw-json summary {
+            cursor: pointer;
+            font-size: 13px;
+            color: #666;
+            user-select: none;
+        }
+        details.raw-json summary:hover { color: #333; }
+        .json-container {
+            position: relative;
+            margin-top: 6px;
+        }
+        .json-container pre {
+            background: #f6f8fa;
+            border: 1px solid #ddd;
+            border-radius: 6px;
+            padding: 12px;
+            overflow-x: auto;
+            font-size: 12px;
+            line-height: 1.5;
+            max-height: 400px;
+            overflow-y: auto;
+        }
+        .copy-json-btn {
+            position: absolute;
+            top: 6px;
+            right: 6px;
+            font-size: 12px;
+            padding: 4px 10px;
+            background: #e8e8e8;
+            color: #333;
+            border: 1px solid #ccc;
+            border-radius: 4px;
+            margin: 0;
+        }
+        .copy-json-btn:hover { background: #ddd; }
+        .clean-packages {
+            color: #666;
+            font-size: 14px;
+            padding: 0 16px 12px;
+        }
+        @media (max-width: 600px) {
+            body { padding: 10px; }
+            h1 { font-size: 22px; }
+            textarea { min-height: 150px; font-size: 13px; }
+        }
+    </style>
+</head>
+<body>
+    <h1>Python Vulnerability Lookup</h1>
+    <p>Paste a <code>pyproject.toml</code> or <code>requirements.txt</code> to check packages for known vulnerabilities via <a href="https://osv.dev">OSV.dev</a>.</p>
+
+    <div style="margin-bottom: 12px;">
+        <label for="pathInput" style="font-weight: 600; display: block; margin-bottom: 4px;">Or load from a GitHub repo or URL:</label>
+        <div style="display: flex; gap: 8px;">
+            <input type="text" id="pathInput" placeholder="simonw/datasette or https://..." style="flex: 1; padding: 8px 12px; border: 2px solid #ddd; border-radius: 6px; font-size: 14px;">
+            <button id="fetchBtn" onclick="fetchFromPath()">Fetch</button>
+        </div>
+        <div style="font-size: 13px; color: #666; margin-top: 4px;">
+            Examples: <code>simonw/datasette</code>, <code>https://github.com/simonw/datasette</code>, or a direct URL to a requirements.txt/pyproject.toml
+        </div>
+    </div>
+
+    <textarea id="input" placeholder="Paste your pyproject.toml or requirements.txt here..."></textarea>
+    <br>
+    <button id="checkBtn" onclick="checkVulnerabilities()">Check Vulnerabilities</button>
+
+    <div id="status"></div>
+    <div id="results"></div>
+
+    <script>
+    function parseRequirementsTxt(text) {
+        const packages = [];
+        for (let line of text.split('\n')) {
+            line = line.replace(/#.*$/, '').trim();
+            if (!line || line.startsWith('-')) continue;
+            const m = line.match(/^([a-zA-Z0-9_.-]+)\s*(?:\[.*?\])?\s*(?:==\s*([^\s;,]+))?/);
+            if (m) {
+                packages.push({ name: m[1], version: m[2] || null });
+            }
+        }
+        return packages;
+    }
+
+    function extractArrayItems(text) {
+        // Extract strings from a TOML array that may span multiple lines
+        const items = [];
+        const re = /"([^"]+)"|'([^']+)'/g;
+        let m;
+        while ((m = re.exec(text)) !== null) {
+            items.push(m[1] || m[2]);
+        }
+        return items;
+    }
+
+    function parsePep508(dep) {
+        const m = dep.match(/^([a-zA-Z0-9_.-]+)\s*(?:\[.*?\])?\s*(?:==\s*([^\s;,]+))?/);
+        if (m) return { name: m[1], version: m[2] || null };
+        return null;
+    }
+
+    function findTomlArrays(text, startIdx) {
+        // From startIdx, find the [ and matching ], handling nested brackets
+        const open = text.indexOf('[', startIdx);
+        if (open === -1) return null;
+        let depth = 0;
+        for (let i = open; i < text.length; i++) {
+            if (text[i] === '[') depth++;
+            else if (text[i] === ']') {
+                depth--;
+                if (depth === 0) return text.slice(open, i + 1);
+            }
+        }
+        return null;
+    }
+
+    function parsePyprojectToml(text) {
+        const packages = [];
+        const seen = new Set();
+
+        function addDeps(depStrings) {
+            for (const s of depStrings) {
+                const parsed = parsePep508(s);
+                if (parsed) {
+                    const key = parsed.name.toLowerCase();
+                    if (!seen.has(key)) {
+                        seen.add(key);
+                        packages.push(parsed);
+                    }
+                }
+            }
+        }
+
+        // Find [project] dependencies
+        const depsMatch = text.match(/^dependencies\s*=\s*/m);
+        if (depsMatch) {
+            const arr = findTomlArrays(text, depsMatch.index + depsMatch[0].length - 1);
+            if (arr) addDeps(extractArrayItems(arr));
+        }
+
+        // Find all array assignments that look like dependency lists in optional-dependencies,
+        // dependency-groups, or similar sections
+        const arrayAssignRe = /^([a-zA-Z0-9_-]+)\s*=\s*\[/gm;
+        let match;
+        while ((match = arrayAssignRe.exec(text)) !== null) {
+            // Skip the main dependencies we already handled
+            if (match[1] === 'dependencies') continue;
+            // Check if this is inside a relevant section
+            const before = text.slice(0, match.index);
+            const lastSection = before.match(/\[([^\]]+)\]\s*$/m);
+            if (lastSection) {
+                const section = lastSection[1].toLowerCase();
+                if (section.includes('dependencies') || section.includes('dependency-groups')) {
+                    const arr = findTomlArrays(text, match.index + match[0].length - 1);
+                    if (arr) addDeps(extractArrayItems(arr));
+                }
+            }
+        }
+
+        // Also handle dependency-groups style: group = ["dep1", "dep2"]
+        // where section header is [dependency-groups]
+        return packages;
+    }
+
+    function detectAndParse(text) {
+        text = text.trim();
+        if (text.includes('[project]') || text.includes('[dependency-groups]') || text.includes('[tool.')) {
+            return parsePyprojectToml(text);
+        }
+        return parseRequirementsTxt(text);
+    }
+
+    function showStatus(msg, type) {
+        const el = document.getElementById('status');
+        el.textContent = msg;
+        el.className = 'visible ' + type;
+    }
+
+    function hideStatus() {
+        document.getElementById('status').className = '';
+    }
+
+    function severityClass(severity) {
+        if (!severity) return 'severity-unknown';
+        const s = severity.toLowerCase();
+        if (s === 'critical') return 'severity-critical';
+        if (s === 'high') return 'severity-high';
+        if (s === 'moderate') return 'severity-moderate';
+        if (s === 'low') return 'severity-low';
+        return 'severity-unknown';
+    }
+
+    function getSeverity(vuln) {
+        return vuln.database_specific?.severity || null;
+    }
+
+    function getAffectedRange(vuln) {
+        if (!vuln.affected) return '';
+        for (const a of vuln.affected) {
+            if (a.package?.ecosystem === 'PyPI' && a.ranges) {
+                for (const r of a.ranges) {
+                    const events = r.events || [];
+                    const introduced = events.find(e => e.introduced)?.introduced;
+                    const fixed = events.find(e => e.fixed)?.fixed;
+                    if (introduced && fixed) return `${introduced} \u2013 fixed in ${fixed}`;
+                    if (introduced) return `introduced in ${introduced}`;
+                }
+            }
+        }
+        return '';
+    }
+
+    const jsonStore = {};
+
+    function copyJson(btn) {
+        const key = btn.getAttribute('data-json-key');
+        const json = jsonStore[key];
+        navigator.clipboard.writeText(json).then(() => {
+            btn.textContent = 'Copied!';
+            setTimeout(() => { btn.textContent = 'Copy'; }, 2000);
+        });
+    }
+
+    async function checkVulnerabilities() {
+        const input = document.getElementById('input').value;
+        document.getElementById('results').innerHTML = '';
+
+        if (!input.trim()) {
+            showStatus('Please paste a pyproject.toml or requirements.txt above.', 'error');
+            return;
+        }
+
+        const packages = detectAndParse(input);
+        if (packages.length === 0) {
+            showStatus('No packages found. Check that you pasted a valid pyproject.toml or requirements.txt.', 'error');
+            return;
+        }
+
+        showStatus(`Found ${packages.length} package${packages.length > 1 ? 's' : ''}. Querying OSV.dev...`, 'info');
+        await runVulnCheck(packages);
+    }
+
+    function renderResults(packages, packageVulns, vulnDetails) {
+        const resultsDiv = document.getElementById('results');
+        resultsDiv.innerHTML = '';
+
+        const withVulns = packages.filter((_, i) => packageVulns[i].length > 0);
+        const clean = packages.filter((_, i) => packageVulns[i].length === 0);
+        const totalVulnCount = packageVulns.reduce((sum, ids) => sum + ids.length, 0);
+
+        // Summary
+        const summary = document.createElement('div');
+        summary.className = 'summary';
+        if (withVulns.length === 0) {
+            summary.textContent = `No known vulnerabilities found across ${packages.length} package${packages.length > 1 ? 's' : ''}.`;
+        } else {
+            summary.innerHTML = `Found <strong>${totalVulnCount} vulnerabilit${totalVulnCount === 1 ? 'y' : 'ies'}</strong> across <strong>${withVulns.length} package${withVulns.length > 1 ? 's' : ''}</strong>. ${clean.length} package${clean.length !== 1 ? 's' : ''} clean.`;
+        }
+        resultsDiv.appendChild(summary);
+
+        // Packages with vulnerabilities
+        for (let i = 0; i < packages.length; i++) {
+            const pkg = packages[i];
+            const ids = packageVulns[i];
+            if (ids.length === 0) continue;
+
+            const section = document.createElement('div');
+            section.className = 'package-section';
+
+            const header = document.createElement('div');
+            header.className = 'package-header has-vulns';
+            header.innerHTML = `${pkg.name}` +
+                (pkg.version ? ` <span class="version-tag">${pkg.version}</span>` : '') +
+                ` <span class="vuln-count">${ids.length} vulnerabilit${ids.length === 1 ? 'y' : 'ies'}</span>`;
+            section.appendChild(header);
+
+            for (const id of ids) {
+                const vuln = vulnDetails[id];
+                if (!vuln) continue;
+
+                const item = document.createElement('div');
+                item.className = 'vuln-item';
+
+                const severity = getSeverity(vuln);
+                const sevClass = severityClass(severity);
+                const range = getAffectedRange(vuln);
+                const aliases = (vuln.aliases || []).join(', ');
+
+                let html = `<div class="vuln-title">
+                    <span class="severity-badge ${sevClass}">${severity || 'Unknown'}</span>
+                    <span class="vuln-id"><a href="https://osv.dev/vulnerability/${encodeURIComponent(vuln.id)}" target="_blank" rel="noopener">${vuln.id}</a></span>
+                </div>`;
+                if (vuln.summary) {
+                    html += `<div class="vuln-summary">${escapeHtml(vuln.summary)}</div>`;
+                }
+                if (aliases) {
+                    html += `<div class="vuln-aliases">Aliases: ${escapeHtml(aliases)}</div>`;
+                }
+                if (range) {
+                    html += `<div class="vuln-affected">Affected: ${escapeHtml(range)}</div>`;
+                }
+
+                // Raw JSON details
+                const jsonStr = JSON.stringify(vuln, null, 2);
+                const jsonKey = `vuln-${vuln.id}`;
+                jsonStore[jsonKey] = jsonStr;
+                html += `<details class="raw-json">
+                    <summary>View raw JSON</summary>
+                    <div class="json-container">
+                        <button class="copy-json-btn" data-json-key="${escapeHtml(jsonKey)}" onclick="copyJson(this)">Copy</button>
+                        <pre>${escapeHtml(jsonStr)}</pre>
+                    </div>
+                </details>`;
+
+                item.innerHTML = html;
+                section.appendChild(item);
+            }
+
+            resultsDiv.appendChild(section);
+        }
+
+        // Clean packages
+        if (clean.length > 0) {
+            const cleanSection = document.createElement('div');
+            cleanSection.className = 'package-section';
+            const cleanHeader = document.createElement('div');
+            cleanHeader.className = 'package-header clean';
+            cleanHeader.textContent = `${clean.length} package${clean.length !== 1 ? 's' : ''} with no known vulnerabilities`;
+            cleanSection.appendChild(cleanHeader);
+
+            const list = document.createElement('div');
+            list.className = 'clean-packages';
+            list.textContent = clean.map(p => p.name + (p.version ? ` ${p.version}` : '')).join(', ');
+            cleanSection.appendChild(list);
+            resultsDiv.appendChild(cleanSection);
+        }
+    }
+
+    function escapeHtml(str) {
+        const div = document.createElement('div');
+        div.textContent = str;
+        return div.innerHTML;
+    }
+
+    function resolveGitHubRawUrls(path) {
+        // Direct URL to a file
+        if (path.startsWith('http://') || path.startsWith('https://')) {
+            // GitHub repo URL like https://github.com/owner/repo
+            const ghMatch = path.match(/^https?:\/\/github\.com\/([^/]+\/[^/]+)\/?$/);
+            if (ghMatch) {
+                const repo = ghMatch[1];
+                return {
+                    repo,
+                    urls: [
+                        `https://raw.githubusercontent.com/${repo}/refs/heads/main/pyproject.toml`,
+                        `https://raw.githubusercontent.com/${repo}/refs/heads/main/requirements.txt`,
+                        `https://raw.githubusercontent.com/${repo}/refs/heads/master/pyproject.toml`,
+                        `https://raw.githubusercontent.com/${repo}/refs/heads/master/requirements.txt`,
+                    ]
+                };
+            }
+            // Direct URL to a raw file
+            return { repo: null, urls: [path] };
+        }
+        // owner/repo shorthand
+        if (path.match(/^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/)) {
+            return {
+                repo: path,
+                urls: [
+                    `https://raw.githubusercontent.com/${path}/refs/heads/main/pyproject.toml`,
+                    `https://raw.githubusercontent.com/${path}/refs/heads/main/requirements.txt`,
+                    `https://raw.githubusercontent.com/${path}/refs/heads/master/pyproject.toml`,
+                    `https://raw.githubusercontent.com/${path}/refs/heads/master/requirements.txt`,
+                ]
+            };
+        }
+        return { repo: null, urls: [] };
+    }
+
+    async function fetchFromPath(path) {
+        if (!path) {
+            path = document.getElementById('pathInput').value.trim();
+        }
+        if (!path) {
+            showStatus('Please enter a GitHub repo or URL.', 'error');
+            return;
+        }
+
+        // Update URL bar and title
+        const url = new URL(window.location);
+        url.searchParams.set('path', path);
+        history.replaceState(null, '', url);
+        document.title = `Python Vulnerability Lookup: ${path}`;
+
+        document.getElementById('pathInput').value = path;
+
+        const fetchBtn = document.getElementById('fetchBtn');
+        const checkBtn = document.getElementById('checkBtn');
+        fetchBtn.disabled = true;
+        checkBtn.disabled = true;
+
+        const { repo, urls } = resolveGitHubRawUrls(path);
+        if (urls.length === 0) {
+            showStatus('Could not parse that path. Use owner/repo, a GitHub URL, or a direct file URL.', 'error');
+            fetchBtn.disabled = false;
+            checkBtn.disabled = false;
+            return;
+        }
+
+        showStatus(`Fetching dependency files${repo ? ` from ${repo}` : ''}...`, 'info');
+
+        try {
+            const results = await Promise.all(urls.map(async u => {
+                try {
+                    const resp = await fetch(u);
+                    if (resp.ok) return { url: u, text: await resp.text() };
+                } catch {}
+                return null;
+            }));
+
+            const found = results.filter(Boolean);
+            if (found.length === 0) {
+                showStatus('No pyproject.toml or requirements.txt found at that location.', 'error');
+                fetchBtn.disabled = false;
+                checkBtn.disabled = false;
+                return;
+            }
+
+            // Combine all found files, parse each and merge packages
+            const allPackages = [];
+            const seen = new Set();
+            const fileNames = [];
+
+            for (const { url, text } of found) {
+                const fileName = url.split('/').pop();
+                fileNames.push(fileName);
+                const pkgs = detectAndParse(text);
+                for (const p of pkgs) {
+                    const key = p.name.toLowerCase();
+                    if (!seen.has(key)) {
+                        seen.add(key);
+                        allPackages.push(p);
+                    }
+                }
+            }
+
+            if (allPackages.length === 0) {
+                showStatus(`Found ${fileNames.join(' and ')} but no packages could be extracted.`, 'error');
+                fetchBtn.disabled = false;
+                checkBtn.disabled = false;
+                return;
+            }
+
+            // Show combined content in textarea
+            document.getElementById('input').value = found.map(f => `# ${f.url.split('/').pop()}\n${f.text}`).join('\n\n');
+
+            showStatus(`Found ${allPackages.length} package${allPackages.length > 1 ? 's' : ''} from ${fileNames.join(' and ')}. Querying OSV.dev...`, 'info');
+
+            // Run the vulnerability check directly with these packages
+            await runVulnCheck(allPackages);
+
+        } catch (err) {
+            showStatus(`Error: ${err.message}`, 'error');
+        } finally {
+            fetchBtn.disabled = false;
+            checkBtn.disabled = false;
+        }
+    }
+
+    async function runVulnCheck(packages) {
+        const resultsDiv = document.getElementById('results');
+        resultsDiv.innerHTML = '';
+        const btn = document.getElementById('checkBtn');
+        btn.disabled = true;
+
+        try {
+            const queries = packages.map(p => {
+                const q = { package: { name: p.name, ecosystem: 'PyPI' } };
+                if (p.version) q.version = p.version;
+                return q;
+            });
+
+            const batchResp = await fetch('https://api.osv.dev/v1/querybatch', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ queries })
+            });
+
+            if (!batchResp.ok) throw new Error(`API returned ${batchResp.status}`);
+            const batchData = await batchResp.json();
+
+            const vulnIds = new Set();
+            const packageVulns = [];
+            for (let i = 0; i < packages.length; i++) {
+                const result = batchData.results[i];
+                const ids = (result.vulns || []).map(v => v.id);
+                packageVulns.push(ids);
+                ids.forEach(id => vulnIds.add(id));
+            }
+
+            const totalVulns = vulnIds.size;
+            if (totalVulns > 0) {
+                showStatus(`Found ${totalVulns} vulnerabilit${totalVulns === 1 ? 'y' : 'ies'}. Fetching details...`, 'info');
+            }
+
+            const vulnDetails = {};
+            if (totalVulns > 0) {
+                const fetches = [...vulnIds].map(async id => {
+                    const resp = await fetch(`https://api.osv.dev/v1/vulns/${encodeURIComponent(id)}`);
+                    if (resp.ok) vulnDetails[id] = await resp.json();
+                });
+                await Promise.all(fetches);
+            }
+
+            hideStatus();
+            renderResults(packages, packageVulns, vulnDetails);
+        } catch (err) {
+            showStatus(`Error: ${err.message}`, 'error');
+        } finally {
+            btn.disabled = false;
+        }
+    }
+
+    // Check URL params on load
+    const params = new URLSearchParams(window.location.search);
+    const pathParam = params.get('path');
+    if (pathParam) {
+        document.getElementById('pathInput').value = pathParam;
+        fetchFromPath(pathParam);
+    }
+    </script>
+</body>
+</html>

From 63d2b482d3132f7740a1ccd73730d9eeaf0055e2 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 29 Mar 2026 18:45:24 +0000
Subject: [PATCH 2/2] Submit fetch form on Enter key in path input

https://claude.ai/code/session_01FofeT3UVvJGdSBqi4vkQg6
---
 python-vulnerability-lookup.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python-vulnerability-lookup.html b/python-vulnerability-lookup.html
index d5b9769..dca0dee 100644
--- a/python-vulnerability-lookup.html
+++ b/python-vulnerability-lookup.html
@@ -194,7 +194,7 @@ <h1>Python Vulnerability Lookup</h1>
     <div style="margin-bottom: 12px;">
         <label for="pathInput" style="font-weight: 600; display: block; margin-bottom: 4px;">Or load from a GitHub repo or URL:</label>
         <div style="display: flex; gap: 8px;">
-            <input type="text" id="pathInput" placeholder="simonw/datasette or https://..." style="flex: 1; padding: 8px 12px; border: 2px solid #ddd; border-radius: 6px; font-size: 14px;">
+            <input type="text" id="pathInput" placeholder="simonw/datasette or https://..." style="flex: 1; padding: 8px 12px; border: 2px solid #ddd; border-radius: 6px; font-size: 14px;" onkeydown="if(event.key==='Enter'){event.preventDefault();fetchFromPath()}">
             <button id="fetchBtn" onclick="fetchFromPath()">Fetch</button>
         </div>
         <div style="font-size: 13px; color: #666; margin-top: 4px;">
