-
Notifications
You must be signed in to change notification settings - Fork 2.8k
fix(python): Trim the end-of-range suffix for packages from requiremets.txt files #9618
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(python): Trim the end-of-range suffix for packages from requiremets.txt files #9618
Conversation
… comprehensive flag
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hello @raghur-orca
Thanks for your contribution!
left small comments
And update PR title and description, please
pkg/dependency/parser/python/pip/testdata/requirements_comma_ranges.txt
Outdated
Show resolved
Hide resolved
Co-authored-by: DmitriyLewen <[email protected]>
Co-authored-by: DmitriyLewen <[email protected]>
raghur-orca
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added all the changes to this PR.
pkg/dependency/parser/python/pip/testdata/requirements_comma_ranges.txt
Outdated
Show resolved
Hide resolved
pkg/dependency/parser/python/pip/testdata/requirements_comma_ranges.txt
Outdated
Show resolved
Hide resolved
|
@raghur-orca please fix linter and tests errors. |
DmitriyLewen
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for your contribution
|
Thanks for all the inputs, @DmitriyLewen 🙏 |
Description
When the --detection-priority comprehensive flag is used, Trivy takes the minimum version for a package (see docs).
However, if the package version is specified as a range, Trivy doesn’t trim the end-of-range suffix.
e.g for requests>=2.31.0,<3:
now: requests + 2.31.0,<3
correct: requests + 2.31.0
Related issues
--detection-priority comprehensiveflag. #9609Checklist