search

snyk / snyk-nuget-plugin

Basic Snyk CLI plugin for .NET support.
Other
5 stars 14 forks source link

fix: [OSM-887] Fix runtime assembly collection bug #199

Closed dotkas closed 9 months ago

dotkas commented 9 months ago

Our logic had a bug that it would take the first target in project.deps.json that had a dependencies group:

https://github.com/snyk/snyk-nuget-plugin/blob/675b208d373d7c7dce2f214929043e641c93b52d/lib/nuget-parser/runtime-assembly.ts#L46-L50

As I erroneously assumed that would always be the target we're interested in traversing. That was wrong. Since we're always publishing to a specific runtime we can assume that a runtime identifier is also present, since:

There will always at least one target in the [appname].deps.json file: the platform neutral list of runtime and compilation dependencies. In cases of a platform specific application there would be two targets: a compilation target, and a runtime target.

So we've updated the logic to look for this instead. New test added, all existing tests passing.

snyksec commented 9 months ago

:tada: This PR is included in version 2.3.3 :tada:

The release is available on:

Your semantic-release bot :package::rocket: