Fixed the issue of lockVersion(AST-139876) - #15
Merged
Conversation
cx-anjali-deore
changed the title
cx-anjali-deore
changed the title
cx-anjali-deore
marked this pull request as draft
March 16, 2026 04:52
cx-anjali-deore
marked this pull request as ready for review
March 16, 2026 04:52
cx-umesh-waghode
approved these changes
Mar 16, 2026
cx-alon-rosenhek
pushed a commit
that referenced
this pull request
Jun 29, 2026
* feat: add Gradle parser feature branch * feat: update Gradle parser and add implementation plan * updated gradle-parser * added support for gradle libs.versions.toml * Add CLAUDE.md with architecture and contract notes Captures the Parser/factory dispatch model, per-ecosystem quirks, and the invariants (0-based line numbers, "latest" sentinel, PackageManager strings) that downstream AST-CLI relies on. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * updated readme file * docs: expand CLAUDE.md to meet JIRA epic template requirements Addresses all inline review comments from PR #20 review: - Rename Overview → Project Overview, add status line - Add Technology Stack section (Go 1.23, testify, x/mod, stdlib, no DB) - Add Repository Structure section with folder tree - Rename Commands → Development Setup; add prerequisites, clone step, coverage HTML command, and sample JSON output - Add API / Interfaces section with full struct definitions including clarification that StartIndex/EndIndex are 0-based byte offsets - Update Architecture to include Gradle parser (missed in original) - Replace commit hash reference (9e490aa) with PR #15 link - Rename Invariants → Project Rules (Invariants); add PackageManager string for gradle and the StartIndex/EndIndex byte-offset clarification - Rename Tests & fixtures → Testing Strategy; add fixture tree, coverage HTML command, and expected new-parser pattern - Add Known Issues / Limitations section (consolidates pypi, npm, maven, dotnet, and all-parsers limitations) - Add External Integrations section (AST-CLI contract fields) - Add Deployment section (N/A — library, not a service) - Add Performance Considerations section (Maven two-pass, Gradle catalog, no caching) - Add Security & Access section (XXE posture, no file-size limit, no network calls) - Add Logging section (library vs CLI behaviour) - Add Coding Standards section (gofmt/vet, pkg vs internal, naming) - Add Debugging Steps section (5 concrete steps) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * Add SBT (Scala Build Tool) manifest parser support Implement a production-grade SBT parser that extracts dependencies from all .sbt files (build.sbt, plugins.sbt, dependencies.sbt, etc.). The parser supports val/lazy val/def variable declarations, all SBT operators (%, %%, %%%), Seq blocks, addSbtPlugin syntax, dependency modifiers (exclude, excludeAll, intransitive, withSources, withJavadoc, cross, classifier), block and inline comments, scope annotations, dependencyOverrides, and duplicate package detection. Includes 29 unit tests at 97.8% coverage with test fixtures containing known-vulnerable packages (Log4Shell, Jackson, Struts2, commons-collections, SnakeYAML) for security scanning validation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix gradle 0-based line contract and harden parsers for downstream IDE integration - gradle: emit 0-based line numbers (was off-by-one, broke IDE decorations) - gradle: default empty catalog versions to "latest" (was causing 400 from realtime-scanner) - gradle: multi-line dependency locations with rawLines tracking - maven/dotnet/golang: strip trailing \r so byte offsets are correct on CRLF files - CLAUDE.md: strengthen 0-based contract, add SBT to parser list - plugins.sbt: add known-vulnerable packages so IDE decorations can be visually verified Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Merge Python parsers and fix Windows CRLF EndIndex bug Integrated Poetry, Setuptools (setup.cfg/setup.py), and enhanced PyPI parsers from Sumit's implementation with existing Gradle/SBT support. All Python parsers return PackageManager="pypi" per design spec. Added testdata fixtures and comprehensive test coverage. Key changes: - Added internal/parsers/{poetry,setuptools}/ with full test suites - Enhanced internal/parsers/pypi/ with support for 6 Python formats - Fixed pre-existing CRLF line ending bug affecting golang, dotnet, maven on Windows - Updated manifest-file-selector.go with SBT, Poetry, and Setuptools routing - Updated parser_factory.go with dispatchers for all Python ecosystems - Updated CLAUDE.md with complete architecture and design pattern documentation All parsers pass unit tests. Manifest-parser builds and runs successfully. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * gradle and sbt wildcard support * adding sha for checkout actions * Using correct sha for cehckout actions in release.yml * log removal and minor fixes * Support Android flavor/buildtype dependency configurations in Gradle parser Fixes AST-160218. The Gradle parser previously matched only a hardcoded list of configuration keywords, missing all dynamically-generated Android variants: freeImplementation, paidDebugImplementation, debugApi, kaptTest, etc. These are auto-generated by the Android Gradle Plugin from product flavors and build types and contain real dependencies that need scanning. Changed configKeywords from exact-match to suffix-based regex covering: - *Implementation, *Api, *CompileOnly, *RuntimeOnly (any flavor/buildtype) - *Kapt, *Ksp, *AnnotationProcessor (test/androidTest scopes) - classpath, lintChecks (exact, no variants) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * Changes test data location for pypi-parser tests * review comments implemented * replaced action with gh command --------- Co-authored-by: cx-anurag-dalke <120229307+cx-anurag-dalke@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
If the lock file has package version smaller than the version in package.json , we will send "latest" in scan request
Lock file version will be considered only when its equal or greater than the version in normal package.json file for a package
fixed issue of mysterious version number(which is root version of lock file ) returned by manifest parser for a package if the lock file does not have entry of that package. Now in this case latest will be returned as the version for scan request