search

google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev
https://google.github.io/osv-scanner/
Apache License 2.0
6.02k stars 337 forks source link

Transitive dependency support for Maven pom.xml #1002

Closed cuixq closed 1 month ago

cuixq commented 1 month ago

Issue https://github.com/google/osv-scanner/issues/35

In this PR, the new Maven extractor invokes Maven resolver to compute the transitive dependencies of a Maven pom.xml.

Since managed dependencies are not actually being depended on, they are not in the resolved dependency graph, and thus they are not included in the scan results.

codecov-commenter commented 1 month ago

Codecov Report

Attention: Patch coverage is 97.95918% with 1 lines in your changes are missing coverage. Please review.

Project coverage is 65.06%. Comparing base (804589a) to head (dc901f4). Report is 3 commits behind head on main.

Files Patch % Lines
internal/manifest/maven.go 97.95% 1 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #1002 +/- ## ========================================== + Coverage 64.47% 65.06% +0.59% ========================================== Files 148 149 +1 Lines 12088 12250 +162 ========================================== + Hits 7794 7971 +177 + Misses 3843 3832 -11 + Partials 451 447 -4 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.