sonatype-nexus-community / oysteR

Create purls from the filtered sands of your dependencies, powered by OSS Index
https://sonatype-nexus-community.github.io/oysteR/
Apache License 2.0
40 stars 9 forks source link

Modify generate_purls to better handle missing versions. #51

Closed JosiahParry closed 3 years ago

JosiahParry commented 3 years ago

When a package is missing a version OSS Index is searched for all package versions. This can lead to false positive vulnerability reports. This PR adds a warning in the event of missing package versions

This pull request makes the following changes:

There should be no breaking changes or changes to existing behavior.

cc @bhamail / @DarthHater / @brittanybelle / @adrianpowell / @csgillespie

csgillespie commented 3 years ago

Thanks @JosiahParry

Just merged it into dev and I'll tidy up. You've fallen back to your bad ways and started using <- ;)

I'm also not sure what * does in sonatype, so I've pinged @DarthHater