Open jghal opened 1 year ago
Hi @jghal,
Thank you for using Frogbot!
Some of the vulnerabilities Frogbot found when scanning the pull request are transitive (indirect) dependencies. When creating pull requests with fixes for Maven projects, Frogbot only fixes vulnerabilities on direct dependencies. Upgrading transitive dependencies cannot be done directly in most cases. Please let us know if you have follow-up questions or comments.
Thanks for that explanation. Perhaps the output of create-fix-pull-requests
could include this extra context to avoid confusion.
Describe the bug
I have self-hosted Gitlab and Artifactory, and am trying to integrate frogbot in a Java repo built with Maven. I have the
scan-pull-request
working on a branch MR, and it shows multiple vulnerabilities with a fix version. For exampleRunning the
create-fix-pull-request
command doesn't seem to be finding any of these vulnerabilities (with fixed versions)Current behavior
When I try to run the
create-fix-pull-requests
command locally from a working copy of the branch (new repo, the master branch is empty still), it says there are no vulnerable dependencies with fix versions. But when I pull the scan report via thexray/api/v1/scan/graph
that's in the frogbot output, the JSON response includes multiple fixed versions.Reproduction steps
No response
Expected behavior
The set of vulnerable dependencies with fixed versions identified in the
scan-pull-request
command should have MR's opened to update to the identified fixed version.JFrog Frogbot version
2.6.1
Package manager info
Maven 3.8.6, pom.xml
Git provider
GitLab
JFrog Frogbot configuration yaml file
No response
Operating system type and version
alpine:3.17
JFrog Xray version
3.47.3