Repository navigation
fix(deps): resolve pylock name-only deps, nuget exact ranges and pnpm aliases - #1
Merged
Merged
Conversation
PEP 751 allows an entry in `[[packages.dependencies]]` to contain only the keys that identify a package unambiguously, so `version` may be omitted when the name is unique in the lock file. The parser built the dependency ID from the (empty) version, so it never matched the package ID and the edge was silently dropped from the dependency graph. The package then showed up under `pylock.toml` instead of under its parent, and the generated SBOM was incomplete. Resolve name-only selectors against the packages listed in the lock file. Selectors that are ambiguous (several entries share the name, e.g. different versions per environment) or that don't match any package are skipped with a debug message rather than pointing at an arbitrary entry. The pylock analyzer cache version is bumped so cached results are re-analyzed. Closes aquasecurity#11411 Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
NuGet Central Package Management accepts version ranges in the `Version` attribute. `[4.7.0]` (and the equal-bounds form `[4.7.0,4.7.0]`) pins exactly one version, but the parser kept the brackets. The resulting version could not be parsed by the NuGet comparer, so advisories never matched and no vulnerability was reported for the package. Strip the brackets when a range specifies exactly one version, and only then: ranges that don't (`[8.0.32,9)`, `[1.0,)`, `(,2.0]`, ...) as well as malformed values (`[]`, `[1.0`) and unresolved variables (`[$(Version)]`) keep their current behavior. The packages-props analyzer cache version is bumped so cached results are re-analyzed. Closes aquasecurity#11447 Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Two kinds of entries in the `importers` section were not matched against the `snapshots` keys, so the packages were reported as indirect dev dependencies and their production subtrees were marked as dev too. Without `--include-dev-deps` they and their vulnerabilities disappeared from the result. 1. Alias form (`<name>@<version>`): produced by npm aliases (`"my-mkdirp": "npm:mkdirp@0.5.1"`) and by workspace packages injected by `pnpm --config.inject-workspace-packages=true deploy`. `snapshots` are keyed by the aliased name, so the alias is now resolved to it. 2. `optionalDependencies`: they were not read at all. `pnpm install --prod` installs them, unlike dev dependencies, so they are production dependencies. Closes aquasecurity#11389 Closes aquasecurity#11434 Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Rewrite the README in the house style used across the maintainer's other projects: - centred header with the logo, an emoji title, a one-line tagline and flat-square shields.io badges - section headings prefixed with an emoji, sentence case - an ASCII diagram of targets and scanners, plus real (trimmed) scan output - emoji-first tables for targets, install channels and common flags - bold-lead feature bullets, blockquote callouts and a "Toolbox" strip - centred footer with the documentation links The content is unchanged: the same targets, scanners, install channels, integrations, canary warning, Aqua section and code of conduct links are still there. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
- add the centred italic caption line that sits under the badge row - add the `### Requirements` table before `### Get Trivy`, as the other projects in this style do before their setup section Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
- more personal voice in the intro, disclaimer and footer CTA - "What's inside" scanner table in the style of the profile's project table - new "Tuning" and "Disclaimer" sections, with a copy-paste CI gate - link scanner pages by their real /guide/scanner/... paths Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Four dependency-parser fixes for open issues, plus a README restyle.
1.
fix(python)— name-only dependencies inpylock.toml(aquasecurity#11411)PEP 751 allows a dependency entry to carry only the keys needed to identify a
[[packages]]entry, soversionmay be omitted when the name is unique. The parser built the ID from the empty version, never matched the package and silently dropped the edge.Name-only selectors are resolved against the packages in the lock file. Ambiguous names (several versions, e.g. per
marker) and unknown names are skipped with a debug message instead of picking an arbitrary entry. Analyzer cache version bumped.2.
fix(nuget)— exact-version ranges in*Packages.props(aquasecurity#11447)Version="[4.7.0]"(and[4.7.0,4.7.0]) pins exactly one version, but the brackets were kept, so the NuGet comparer failed and no advisory ever matched:Only ranges that really specify one version are unwrapped. Non-exact ranges (
[8.0.32,9),[1.0,),(,2.0]), malformed values ([],[1.0) and unresolved variables ([$(Version)]) keep their current behavior — covered by tests. Analyzer cache version bumped.3.
fix(pnpm)— aliased direct dependencies inimporters(aquasecurity#11389)Importer versions written as
<name>@<version>(npm aliases and workspace packages injected bypnpm deploy) never matched thesnapshotskey, so the package and its whole production subtree were reported asindirect+Dev: trueand disappeared without--include-dev-deps.mkdirp@0.5.1("my-mkdirp": "npm:mkdirp@0.5.1")repro-shared@file:///…@xmldom/xmldom@0.8.13(only reachable through the above)Versions that merely contain
@(e.g.git+ssh://git@github.com/...) are not treated as aliases.4.
fix(pnpm)— directoptionalDependencies(aquasecurity#11434)The v9 parser read only
dependenciesanddevDependenciesfrom importers, so optional dependencies (whichpnpm install --proddoes install) were marked as dev. They are now production dependencies.5.
docs(readme)— restyleThe README is rewritten in the house style of the maintainer's other projects: centred header with logo, emoji title and flat-square badges, emoji-prefixed headings, ASCII target/scanner diagram with real (trimmed) output, emoji-first tables for targets, install channels and flags, bold-lead feature bullets, blockquote callouts, a toolbox strip and a centred footer. All existing content (targets, scanners, integrations, canary warning, Aqua section, code of conduct) is preserved; only the layout changed.
Related issues
Checklist
Notes for reviewers
go test ./pkg/dependency/parser/python/... ./pkg/dependency/parser/nodejs/... ./pkg/dependency/parser/nuget/...— all green.versionconstants were bumped for the two cached analyzers (pylock,packagesprops) so existing caches are invalidated.