Fix/ Bug in Resolving Package Version in Maven POM with Dependency Management #487

KunalSin9h · 2025-05-20T09:30:13Z

fixes #425

Screenshots:

For parent bom resolution

For simple pom.xml

Result of --resport-json

report.json

github-actions · 2025-05-20T09:34:27Z

vet Summary Report

This report is generated by vet

Policy Checks

✅ Vulnerability
✅ Malware
✅ License
❌ Popularity
❌ Maintenance
✅ Security Posture
✅ Threats

Malicious Package Analysis

Malicious package analysis was performed using SafeDep Cloud API

Malicious Package Analysis Report

Ecosystem	Package	Version	Status	Report
ECOSYSTEM_GO	github.com/felixge/httpsnoop	1.0.4	✅	🔗
ECOSYSTEM_GO	github.com/gogo/protobuf	1.3.2	✅	🔗
ECOSYSTEM_GO	google.golang.org/genproto	0.0.0-20241202173237-19429a94021a	✅	🔗
ECOSYSTEM_GO	github.com/tidwall/pretty	1.2.1	✅	🔗
ECOSYSTEM_GO	github.com/tidwall/match	1.1.1	✅	🔗
ECOSYSTEM_GO	github.com/tidwall/gjson	1.18.0	✅	🔗
ECOSYSTEM_GO	github.com/golang/groupcache	0.0.0-20241129210726-2c02b8208cf8	✅	🔗
ECOSYSTEM_GO	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	0.59.0	✅	🔗

ℹ️ 8 packages have been actively analyzed for malicious behaviour.
✅ No malicious packages found.

Note: Some of the package analysis jobs may still be running.Please check back later. Consider increasing the timeout for better coverage.

Changed Packages

✅ [Go] github.com/distribution/reference@0.6.0
✅ [Go] github.com/docker/distribution@2.8.3+incompatible
⚠️ [Go] github.com/tidwall/gjson@1.18.0
⚠️ [Go] github.com/go-git/gcfg@1.5.1-0.20230307220236-3a3c6141e376
⚠️ [Go] github.com/moby/locker@1.0.1
⚠️ [Go] github.com/deitch/magic@0.0.0-20240306090643-c67ab88f10cb
⚠️ [Go] github.com/secDre4mer/pkcs7@0.0.0-20240322103146-665324a4461d
⚠️ [Go] github.com/containerd/typeurl/v2@2.1.1
⚠️ [Go] github.com/edsrzf/mmap-go@1.1.0
✅ [Go] github.com/containerd/ttrpc@1.2.7
✅ [Go] github.com/AdaLogics/go-fuzz-headers@0.0.0-20230811130428-ced1acdcaa24
✅ [Go] github.com/containerd/continuity@0.4.4
✅ [Go] github.com/golang/groupcache@0.0.0-20241129210726-2c02b8208cf8
✅ [Go] github.com/spdx/gordf@0.0.0-20221230105357-b735bd5aac89
✅ [Go] github.com/moby/sys/signal@0.7.0
✅ [Go] github.com/Microsoft/hcsshim@0.11.7
⚠️ [Go] github.com/containerd/platforms@0.2.1
✅ [Go] github.com/containerd/cgroups@1.1.0
✅ [Go] google.golang.org/genproto@0.0.0-20241202173237-19429a94021a
✅ [Go] deps.dev/util/maven@0.0.0-20250307021655-d811e36f9cad
✅ [Go] github.com/opencontainers/image-spec@1.1.1
✅ [Go] github.com/go-git/go-billy/v5@5.6.2
⚠️ [Go] github.com/tidwall/jsonc@0.3.2
⚠️ [Go] github.com/tidwall/pretty@1.2.1
✅ [Go] github.com/go-git/go-git/v5@5.14.0
✅ [Go] deps.dev/api/v3@3.0.0-20250307021655-d811e36f9cad
⚠️ [Go] go.opencensus.io@0.24.0
✅ [Go] github.com/moby/sys/sequential@0.5.0
✅ [Go] go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@0.59.0
⚠️ [Go] github.com/felixge/httpsnoop@1.0.4
✅ [Go] github.com/containerd/stargz-snapshotter/estargz@0.16.3
✅ [Go] deps.dev/util/pypi@0.0.0-20250307021655-d811e36f9cad
✅ [Go] github.com/erikvarga/go-rpmdb@0.0.0-20240208180226-b97e041ef9af
⚠️ [Go] github.com/AdamKorcz/go-118-fuzz-build@0.0.0-20230306123547-8075edf89bb0
✅ [Go] github.com/groob/plist@0.1.1
⚠️ [Go] github.com/docker/go-events@0.0.0-20190806004212-e31b211e4f1c
✅ [Go] github.com/opencontainers/runtime-spec@1.1.0
✅ [Go] github.com/rust-secure-code/go-rustaudit@0.0.0-20250226111315-e20ec32e963c
✅ [Go] github.com/google/osv-scalibr@0.2.0
✅ [Go] github.com/moby/sys/userns@0.1.0
✅ [Go] github.com/jbenet/go-context@0.0.0-20150711004518-d14ea06fba99
✅ [Go] github.com/containerd/containerd@1.7.27
✅ [Go] go.etcd.io/bbolt@1.3.10
✅ [Go] golang.org/x/xerrors@0.0.0-20231012003039-104605ab7028
✅ [Go] www.velocidex.com/golang/regparser@0.0.0-20240404115756-2169ac0e3c09
⚠️ [Go] github.com/tidwall/match@1.1.1
✅ [Go] stdlib@1.24.2
✅ [Go] github.com/moby/sys/user@0.3.0
✅ [Go] deps.dev/util/resolve@0.0.0-20250310223405-f4cf91c9e684
✅ [Go] gopkg.in/warnings.v0@0.1.2
⚠️ [Go] github.com/vbatts/tar-split@0.11.6
✅ [Go] deps.dev/util/semver@0.0.0-20250307021655-d811e36f9cad
✅ [Go] github.com/opencontainers/selinux@1.11.0
✅ [Go] github.com/containerd/containerd/api@1.8.0
⚠️ [Go] github.com/saferwall/pe@1.5.6
⚠️ [Go] github.com/containerd/fifo@1.1.0
⚠️ [Go] github.com/gogo/protobuf@1.3.2
⚠️ [Go] github.com/containerd/log@0.1.0

Policy Violations

Packages Violating Policy

[Go] `github.com/tidwall/gjson@1.18.0` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/go-git/gcfg@1.5.1-0.20230307220236-3a3c6141e376` 🔗

➡️ Found in manifest go.mod
⚠️ Component popularity is low by Github stars count
⚡ Use an alternative package that is popular

[Go] `github.com/moby/locker@1.0.1` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/deitch/magic@0.0.0-20240306090643-c67ab88f10cb` 🔗

➡️ Found in manifest go.mod
⚠️ Component popularity is low by Github stars count
⚡ Use an alternative package that is popular

[Go] `github.com/secDre4mer/pkcs7@0.0.0-20240322103146-665324a4461d` 🔗

➡️ Found in manifest go.mod
⚠️ Component popularity is low by Github stars count
⚡ Use an alternative package that is popular

[Go] `github.com/containerd/typeurl/v2@2.1.1` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/edsrzf/mmap-go@1.1.0` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/containerd/platforms@0.2.1` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/tidwall/jsonc@0.3.2` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/tidwall/pretty@1.2.1` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `go.opencensus.io@0.24.0` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/felixge/httpsnoop@1.0.4` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/AdamKorcz/go-118-fuzz-build@0.0.0-20230306123547-8075edf89bb0` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/docker/go-events@0.0.0-20190806004212-e31b211e4f1c` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/tidwall/match@1.1.1` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/vbatts/tar-split@0.11.6` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/saferwall/pe@1.5.6` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/containerd/fifo@1.1.0` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/gogo/protobuf@1.3.2` 🔗

➡️ Found in manifest go.mod
⚠️ Component appears to be unmaintained

[Go] `github.com/containerd/log@0.1.0` 🔗

➡️ Found in manifest go.mod
⚠️ Component popularity is low by Github stars count
⚡ Use an alternative package that is popular

… methods

codecov · 2025-05-20T10:29:38Z

Codecov Report

Attention: Patch coverage is 68.11594% with 22 lines in your changes missing coverage. Please review.

Project coverage is 16.23%. Comparing base (5c7ab43) to head (ea4309a).
Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/parser/pomxml.go	74.46%	9 Missing and 3 partials ⚠️
pkg/parser/scalibr.go	54.54%	9 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #487      +/-   ##
==========================================
+ Coverage   16.01%   16.23%   +0.22%     
==========================================
  Files         158      160       +2     
  Lines       15955    16024      +69     
==========================================
+ Hits         2555     2602      +47     
- Misses      13200    13218      +18     
- Partials      200      204       +4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

pkg/parser/pomxml.go

KunalSin9h added 3 commits May 20, 2025 14:40

feat: pom.xml dependency resolver

2fd52e0

feat: manifest from packages

e090035

feat: disable osv-scalibr's native loggin

faf8444

KunalSin9h requested a review from abhisek May 20, 2025 09:30

KunalSin9h marked this pull request as ready for review May 20, 2025 09:30

KunalSin9h changed the title ~~Fix/maven pomxml~~ Fix/ Bug in Resolving Package Version in Maven POM with Dependency Management May 20, 2025

KunalSin9h added 3 commits May 20, 2025 15:22

fix: parser test, update total parsers count'

9d8a943

refactor: using manifest's NewPackageManifestFromLocal and AddPackage…

15abdd0

… methods

fix: tests, package enumertaion with new pom.xml parser

04c620f

fix: docker image with go 1.24.2

a41991d

KunalSin9h force-pushed the fix/maven-pomxml branch from 52ccb47 to a41991d Compare May 20, 2025 10:32

feat(test): pom parser

70b153d

abhisek reviewed May 20, 2025

View reviewed changes

pkg/parser/pomxml.go Outdated Show resolved Hide resolved

pkg/parser/pomxml.go Show resolved Hide resolved

pkg/parser/pomxml.go Outdated Show resolved Hide resolved

pkg/parser/pomxml.go Outdated Show resolved Hide resolved

abhisek reviewed May 20, 2025

View reviewed changes

pkg/parser/pomxml.go Outdated Show resolved Hide resolved

refactor: extracted commaon osv-scalibr's function in scalibr.go

941de1d

abhisek reviewed May 20, 2025

View reviewed changes

pkg/parser/pomxml.go Outdated Show resolved Hide resolved

refactor: setting scalibr logger in init function

ea4309a

abhisek approved these changes May 20, 2025

View reviewed changes

abhisek merged commit 826b8ea into main May 20, 2025
10 of 11 checks passed

abhisek deleted the fix/maven-pomxml branch May 20, 2025 12:40

abhisek mentioned this pull request May 20, 2025

pom.xml Parser is Broken #488

Closed

Fix/ Bug in Resolving Package Version in Maven POM with Dependency Management #487

Fix/ Bug in Resolving Package Version in Maven POM with Dependency Management #487

Uh oh!

Conversation

KunalSin9h commented May 20, 2025

Uh oh!

github-actions bot commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

vet Summary Report

Policy Checks

Malicious Package Analysis

Changed Packages

Packages Violating Policy

[Go] github.com/tidwall/gjson@1.18.0 🔗

[Go] github.com/go-git/gcfg@1.5.1-0.20230307220236-3a3c6141e376 🔗

[Go] github.com/moby/locker@1.0.1 🔗

[Go] github.com/deitch/magic@0.0.0-20240306090643-c67ab88f10cb 🔗

[Go] github.com/secDre4mer/pkcs7@0.0.0-20240322103146-665324a4461d 🔗

[Go] github.com/containerd/typeurl/v2@2.1.1 🔗

[Go] github.com/edsrzf/mmap-go@1.1.0 🔗

[Go] github.com/containerd/platforms@0.2.1 🔗

[Go] github.com/tidwall/jsonc@0.3.2 🔗

[Go] github.com/tidwall/pretty@1.2.1 🔗

[Go] go.opencensus.io@0.24.0 🔗

[Go] github.com/felixge/httpsnoop@1.0.4 🔗

[Go] github.com/AdamKorcz/go-118-fuzz-build@0.0.0-20230306123547-8075edf89bb0 🔗

[Go] github.com/docker/go-events@0.0.0-20190806004212-e31b211e4f1c 🔗

[Go] github.com/tidwall/match@1.1.1 🔗

[Go] github.com/vbatts/tar-split@0.11.6 🔗

[Go] github.com/saferwall/pe@1.5.6 🔗

[Go] github.com/containerd/fifo@1.1.0 🔗

[Go] github.com/gogo/protobuf@1.3.2 🔗

[Go] github.com/containerd/log@0.1.0 🔗

Uh oh!

codecov bot commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented May 20, 2025 •

edited

Loading

[Go] `github.com/tidwall/gjson@1.18.0` 🔗

[Go] `github.com/go-git/gcfg@1.5.1-0.20230307220236-3a3c6141e376` 🔗

[Go] `github.com/moby/locker@1.0.1` 🔗

[Go] `github.com/deitch/magic@0.0.0-20240306090643-c67ab88f10cb` 🔗

[Go] `github.com/secDre4mer/pkcs7@0.0.0-20240322103146-665324a4461d` 🔗

[Go] `github.com/containerd/typeurl/v2@2.1.1` 🔗

[Go] `github.com/edsrzf/mmap-go@1.1.0` 🔗

[Go] `github.com/containerd/platforms@0.2.1` 🔗

[Go] `github.com/tidwall/jsonc@0.3.2` 🔗

[Go] `github.com/tidwall/pretty@1.2.1` 🔗

[Go] `go.opencensus.io@0.24.0` 🔗

[Go] `github.com/felixge/httpsnoop@1.0.4` 🔗

[Go] `github.com/AdamKorcz/go-118-fuzz-build@0.0.0-20230306123547-8075edf89bb0` 🔗

[Go] `github.com/docker/go-events@0.0.0-20190806004212-e31b211e4f1c` 🔗

[Go] `github.com/tidwall/match@1.1.1` 🔗

[Go] `github.com/vbatts/tar-split@0.11.6` 🔗

[Go] `github.com/saferwall/pe@1.5.6` 🔗

[Go] `github.com/containerd/fifo@1.1.0` 🔗

[Go] `github.com/gogo/protobuf@1.3.2` 🔗

[Go] `github.com/containerd/log@0.1.0` 🔗

codecov bot commented May 20, 2025 •

edited

Loading