mirror of
https://github.com/anchore/syft.git
synced 2026-11-05 08:56:41 +01:00
* fix: fetch Dart package versions from sdk entries Packages that are provided by an SDK, mainly Flutter, will have their version set to 0.0.0 in Dart's pubspec.lock file. Their actual version is linked to that SDK, which is defined either as a version range or a minimum supported version, rather than an explicit, single version. The pubspec.lock file has a dedicated section to define those SDK version range constraints, which is already stored internally when parsing the file itself. The solution now is to look up such a package's SDK name, retrieve the defined version range / lower version boundary, and set the minimum supported version as the package's new version. Signed-off-by: Sven Gregori <sven@craplab.fi> * Ignore Dart package if SDK version cannot be fetched Signed-off-by: Sven Gregori <sven@craplab.fi> * fix linting issues Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Sven Gregori <sven@craplab.fi> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>