fix(conda): strip pip "~=" and "!=" operators from dependency names - #11057
Open
sueun-dev wants to merge 1 commit into
Open
fix(conda): strip pip "~=" and "!=" operators from dependency names#11057sueun-dev wants to merge 1 commit into
sueun-dev wants to merge 1 commit into
Conversation
environment.yml pip: entries use PEP 440 operators. parseDependency separated the name from the version by replacing >, < and =, but not ~ or !, so django~=5.0.6 parsed to the name "django~" and flask!=2.0 to "flask!". The analyzer copies the name verbatim, so the SBOM and name-keyed vulnerability matching used the corrupted name. Add ~ and ! to the replacer so the name comes out clean, matching how > and < are handled; like the other range operators, ~=/!= record no pinned version.
Contributor
|
Hi @sueun-dev ! Please open a discussion before submitting a PR, where you describe the issue and include steps to reproduce it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
environment.ymlcan carry apip:subsection whose entries use PEP 440 version operators.parseDependencyseparates the name from the version by replacing>,<and=with spaces, but not~or!, so the operator character stays glued to the name:The analyzer copies the parsed name verbatim, so the SBOM ends up with
django~/flask!, and vulnerability matching (which keys on the name) finds nothing for those packages.This adds
~and!to the replacer so the name comes out clean, the same way>and<already are. Like the other range operators,~=/!=record no pinned version — they are ranges, not pins.Tested with a new
pip:fixture (django~=5.0.6,flask!=2.0,requests==2.31.0) added to the parser table test: it fails on main (namesdjango~,flask!) and passes with the change.go test ./pkg/dependency/parser/conda/...and the conda analyzer tests pass.Related issues
None.
Checklist