Fix: Enhance root dependency detection for requirements.txt #2031
Conversation
d49cdbc to
75f17f7
Compare
|
Can you please run the linter ( |
|
Thank you @malice00 |
|
@bandhan-majumder could you work with @OfekShimko and test this PR by creating a series of before and after SBOMs for comparison with custom-json-diff? It won't be easy since python repos are a PITA to build correctly requiring multiple container images. |
|
that's true. I will work to test this PR with before and after SBOMs diff. |
|
Probably doesn't need mentioning, but I'd rather be safe than sorry -- @bandhan-majumder add those SBOMs in the project as well (at least the after ones, although failure-tests are also a good thing) and add them to our test suite! |
|
Thank you! Let me know if I can assist in any way |
|
We are blocked since custom-json-diff is reporting too many differences. For some reason, the html export isn't working. Give us some more time. |
|
@OfekShimko apologies. could you kindly rebase from master and resolve the conflicts? |
Signed-off-by: Shimko <oshimko@paloaltonetworks.com>
Signed-off-by: Shimko <oshimko@paloaltonetworks.com>
82d9afe to
4e58737
Compare
|
@prabhu sure, done :) |
|
@OfekShimko It is still showing conflicts for some reason. Any ideas? |
|
@prabhu now it should be OK 👍🏽 |
This change allows cdxgen to correctly identify root packages and preserve their relationship to the parent component, for requirements.txt files, resulting in a more accurate dependency graph.