snyk / snyk-nuget-plugin

Basic Snyk CLI plugin for .NET support.
Other
5 stars 14 forks source link

feat: [SUP-2193] Runtime asembly gathering re-write for `v2` parser #193

Closed dotkas closed 10 months ago

dotkas commented 10 months ago

As the open beta is gaining traction, we've discovered some inconveniences in the way we gather the dependencies from runtimepacks that caused erroneous side-effects.

The published list of .deps.json does not only contain assembly versions for the finished package, but also for any potential version that the .NET standard could encounter in a compatible environment, see this.

As we were traversing the entire list of targets, that could mean that versions with the same name would be overwritten, defeating the purpose, if System.Net.Http was encountered multiple places with different versions.

This rewrite now only looks for a specific runtimepack in the list of targets and returns only those versions, instead of everything.

Technically a breaking change, but as its beta we'll keep the major intact, as this is bound to happen more times while we test the beta amongst our customers.

Change overview

snyksec commented 10 months ago

:tada: This PR is included in version 2.2.0 :tada:

The release is available on:

Your semantic-release bot :package::rocket: