snyk / snyk-nuget-plugin

Basic Snyk CLI plugin for .NET support.
Other
5 stars 14 forks source link

fix: [OSM-887] Fixing depGraph build error on version definition in `.props` #198

Closed dotkas closed 9 months ago

dotkas commented 9 months ago

I'd erroneously relied on the fact that the version defined in project.assets.json would be the same as the package name used in project.deps.json after a successful publish. This was not the case.

dotnet does version normalization when doing dotnet restore, but the same logic is not applied when doing dotnet publish.

I've not found another place where dotnet stores the non-normalized version for easy access, so I've changed the logic that looks for this package away from explicitly looking for a full version, as previous:

https://github.com/snyk/snyk-nuget-plugin/blob/675b208d373d7c7dce2f214929043e641c93b52d/lib/nuget-parser/parsers/dotnet-core-v2-parser.ts#L118

And instead looks for the first element containing the project name. I guess more beta-testing will tell if this was a good idea or not.

snyksec commented 9 months ago

:tada: This PR is included in version 2.3.2 :tada:

The release is available on:

Your semantic-release bot :package::rocket: