Repository navigation
Batch: 3 dependency manifest fixes, one commit each - #40
Merged
Merged
Conversation
…it is written that way (#39) The two keys were decoded into struct fields, which encoding/json matches without regard to case, while npm 11.20.0 reads them as written. A DevDependencies key holding a string stopped the file from being decoded, so a package.json listing crypto-js under dependencies had no finding, was listed as not analyzed with a reason naming devDependencies, and made gate exit 1. A list under Dependencies, which npm pkg get dependencies does not print, gave a finding. The top level is now decoded into a map, whose keys are exact, and the value under each of the two keys is decoded on its own. The offset and key of a value of the wrong type are rebased onto the file, so the line and reason reported for a wrong-typed value under dependencies or devDependencies are the ones the existing tests expect. A repeated dependencies key now keeps its last list, as npm pkg get dependencies prints it, where the packages under both copies were read. Fixes #39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request lands 3 commits in
pkg/analyzer,pkg/scanner,pkg/reporter,internal/cli,docs,README.mdandCHANGELOG.md.Included
Verified on this exact tree
go version: go1.26.3 darwin/arm64go build ./...: exit 0go vet ./...: exit 0gofmt -lon the 77 tracked Go files: no outputgo test -race -p 4 -count=1 -v ./...: exit 0, 8 packages ok, 1 package with no test files, 305 tests passed (1028 including subtests), 0 failed, 0 skipped, counted from the--- PASS:,--- FAIL:and--- SKIP:linesTestChangelogEntriesandTestChangelogSaysWhereSARIFAndCSVCarryTheCryptoJSTextpassed in the test run abovegolangci-lint run: exit 1, 21 issues (errcheck 15, staticcheck 6), PRE-EXISTING: a detached worktree oforigin/mainprints the same 21, compared by path and messagegolangci-lint run --max-same-issues 0 --max-issues-per-linter 0: exit 1, 85 issues (errcheck 45, staticcheck 40) on this tree and the same 85 onorigin/main, compared by path and messagecryptoscan scan crypto-samples --format jsonwith the built binary and with a build oforigin/main: 110 findings from each, the same list when compared by id, file, line and severityNot included
None
Closes
How to merge
Rebase and merge, so that each change stays its own commit on
main.