-
Notifications
You must be signed in to change notification settings - Fork 480
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
BUG: osv-scanner panic: runtime error: index out of range [0] with length 0 #4171
Comments
I also can't reproduce it locally with Scorecard go run main.go --repo Zxilly/go-size-analyzer --checks Vulnerabilities I've seen this panic before in our weekly cron infrastructure, but I've never been able to reproduce it locally. |
So I created a PR to produce the stack info while we met the error. Please review it at #4172 |
Can this be closed given that #4172 has been merged? |
@AdamKorcz It is only helpful to identify the real bug, did not resolve it. |
I had assumed this was a different panic, and was occurring in the cron. But looking again at your Scorecard Action, I see now what it is. The latest scorecard action currently is v2.3.3 which uses v5.0.0-rc2 of scorecard. If you use that tag locally to analyze the repo you can reproduce it. Cherry picking #4172 shows the stack trace. osv-scanner is struggling to parse your pnpm lockfile. This was fixed in osv-scanner v1.7.3, which is why we're not seeing it at scorecard HEAD. This will be picked up at the next scorecard action release. Click for trace
|
@spencerschrock Is there a plan for the next release of |
The original estimate was by the end of June but we missed it slightly. The PRs should be wrapping up in this repo in the next day or two, and v5 could be cut then. Which would take another day or two for the next scorecard-action to be cut |
Describe the bug
osv-scanner panics on https://scorecard.dev/viewer/?uri=github.com/Zxilly/go-size-analyzer, but I can't reproduce it while run it locally with
osv-scanner -r .
Reproduction steps
Failed to reproduce.
Expected behavior
Process correctly.
The text was updated successfully, but these errors were encountered: