Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

scan and report dependency groups of vulnerabilities #655

Merged
merged 20 commits into from
Dec 11, 2023
Merged

scan and report dependency groups of vulnerabilities #655

Changes from 1 commit
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
5e3e396
scan and report dependency groups of vulnerabilities
cuixq Sep 28, 2023
04ab40b
lint
cuixq Nov 15, 2023
7f1b8d9
Merge branch 'main' into group
cuixq Nov 15, 2023
75b86f3
Merge branch 'google:main' into group
cuixq Nov 16, 2023
cc9b3ad
make dependency groups a slice of string
cuixq Nov 15, 2023
81584d5
lint
cuixq Nov 16, 2023
b1e5ec0
no need to deep reflect PackageInfo
cuixq Nov 21, 2023
8e3dc4f
Merge branch 'main' into group
cuixq Nov 22, 2023
4912b30
make license allowlist matching case insensitive (#672)
josieang Nov 23, 2023
3e0ba51
refactor: upgrade golangci-lint (#673)
G-Rath Nov 23, 2023
0b0fa42
fix(deps): update osv-scanner minor (#652)
renovate-bot Nov 23, 2023
c1214c4
make dependency groups a slice of string
cuixq Nov 15, 2023
5bf495e
add method IsDevGroup for Ecosystem
cuixq Nov 27, 2023
53c3016
Merge branch 'google:main' into group
cuixq Nov 27, 2023
a23817f
addressing comments
cuixq Nov 15, 2023
a9a213e
lint
cuixq Nov 27, 2023
f414b44
fix window tests
cuixq Nov 28, 2023
a5cd81e
only check ecosystem for empty PackageDetails
cuixq Dec 8, 2023
f7dce24
Merge branch 'main' into group
cuixq Dec 8, 2023
11d7a28
Merge branch 'main' into group
cuixq Dec 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
only check ecosystem for empty PackageDetails
  • Loading branch information
@cuixq
cuixq committed Dec 8, 2023
commit a5cd81edcb38e3150f57212813faa72cedcfb2da
5 changes: 2 additions & 3 deletions pkg/lockfile/dpkg-status.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,9 +121,8 @@ func (e DpkgStatusExtractor) Extract(f DepFile) ([]PackageDetails, error) {
pkg := parseDpkgPackageGroup(group)

// PackageDetails does not contain any field that represent a "not installed" state
// To manage this state and avoid false positives, empty struct means "not installed" so skip it
if pkg.Name == "" && pkg.Version == "" && pkg.Commit == "" &&
pkg.Ecosystem == "" && pkg.CompareAs == "" && len(pkg.DepGroups) == 0 {
// To manage this state and avoid false positives, empty ecosystem means "not installed" so skip it
if pkg.Ecosystem == "" {
continue
}

Expand Down