Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: snyk/snyk-gradle-plugin
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v4.9.2
Choose a base ref
...
head repository: snyk/snyk-gradle-plugin
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v5.0.0
Choose a head ref
  • 1 commit
  • 32 files changed
  • 1 contributor

Commits on Apr 23, 2025

  1. feat: module artifacts with classifier (#299) 

    BREAKING CHANGE: node IDs changed to uniquely identify all
dependencies.

There can be multiple module artifacts. At the moment we assume
there can only by one artifact per resolved dependency. This
is the most common arrangement, however there can be multiple
artifacts when several 'classifiers' or different 'types' are
referenced. For example if both the test and sources jar files
are required.

Loop over each module artifact and use the classifier in the
node id, always appending ':type' where 'jar' is the default
type and optionally appending ':classifier'.

In order to find vulnerabilities against the resolved dependency
the package identity remains the same,
'groupid:artifactid@version'.

The net effect here is that we now correctly identify artifacts
and create a node per artifact.

One fix that has occurred by only considering those dependencies
with an artifact is that those dependencies without artifacts
are excluded. This can happen when using 'platform' dependencies.
These are constraints that don't require dependencies but control
the versions of dependencies required either directly or
transitively. They are analogous to maven boms and
dependencyManagement.
    @gitphill
    gitphill authored Apr 23, 2025
    Configuration menu
    Copy the full SHA
    77ef7ec View commit details
    Browse the repository at this point in the history
Loading