mirror of
https://github.com/anchore/syft.git
synced 2026-10-30 22:12:28 +01:00
Christopher Angelo PhillipsandAlex Goodman
c33fa32cf1
* fix(dotnet): resolve packages.lock dependencies within their target framework Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> * fix(dotnet): make packages.lock package metadata deterministic across target frameworks Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> * fix: parse packages lock tests Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> * fix: update lockfile parse to read into stable structure Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> * fix: remove stale comments Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> * test: new test for project entry case Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> * fix(dotnet): key packages.lock packages case-insensitively NuGet IDs are case-insensitive, and edge lookup already treated them that way, but package identity used the exact-case name. Two spellings of one ID and version across target frameworks became two packages, and type precedence never ran between them. - packages merge on the lowercased name + version, display name comes from the winning entry - a package listing itself (under any casing) no longer produces a self edge Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
68 lines
2.1 KiB
JSON
68 lines
2.1 KiB
JSON
{
|
|
"version": 1,
|
|
"dependencies": {
|
|
"net8.0": {
|
|
"MyLib": {
|
|
"type": "Direct",
|
|
"requested": "[1.0.0, )",
|
|
"resolved": "1.0.0",
|
|
"contentHash": "mylibhash==",
|
|
"dependencies": {
|
|
"log4net": "2.0.5",
|
|
"Newtonsoft.Json": "13.0.3"
|
|
}
|
|
},
|
|
"log4net": {
|
|
"type": "Transitive",
|
|
"resolved": "2.0.5",
|
|
"contentHash": "log4net205hash=="
|
|
},
|
|
"Newtonsoft.Json": {
|
|
"type": "Direct",
|
|
"requested": "[13.0.3, )",
|
|
"resolved": "13.0.3",
|
|
"contentHash": "newtonsoft1303hash=="
|
|
},
|
|
"Serilog": {
|
|
"type": "Transitive",
|
|
"resolved": "3.1.1",
|
|
"contentHash": "serilog311hash=="
|
|
}
|
|
},
|
|
"net8.0/win-x64": {
|
|
"runtime.win-x64.MyLib.Native": {
|
|
"type": "Transitive",
|
|
"resolved": "1.0.0",
|
|
"contentHash": "mylibnativehash==",
|
|
"dependencies": {
|
|
"log4net": "2.0.0",
|
|
"RUNTIME.WIN-X64.MYLIB.NATIVE": "1.0.0"
|
|
}
|
|
}
|
|
},
|
|
"netstandard2.0": {
|
|
"MyLib": {
|
|
"type": "Direct",
|
|
"requested": "[1.0.0, )",
|
|
"resolved": "1.0.0",
|
|
"contentHash": "mylibhash==",
|
|
"dependencies": {
|
|
"log4net": "1.2.15",
|
|
"newtonsoft.json": "13.0.3",
|
|
"Serilog": "3.1.1"
|
|
}
|
|
},
|
|
"log4net": {
|
|
"type": "Transitive",
|
|
"resolved": "1.2.15",
|
|
"contentHash": "log4net1215hash=="
|
|
},
|
|
"newtonsoft.json": {
|
|
"type": "Transitive",
|
|
"resolved": "13.0.3",
|
|
"contentHash": "newtonsoft1303hash=="
|
|
}
|
|
}
|
|
}
|
|
}
|