snyk-nuget-plugin - npm Package Compare versions

Comparing version 1.11.3 to 1.12.0

dist/nuget-parser/csproj-parser.js

@@ -17,2 +17,3 @@ "use strict";
 const debugModule = require("debug");
+const framework_1 = require("./framework");
 const debug = debugModule('snyk');
@@ -41,3 +42,3 @@ function getTargetFrameworksFromProjFile(rootDir) {
                     }
-                    frameworks = _.compact(_.map(versions, toReadableFramework));
+                    frameworks = _.compact(_.map(versions, framework_1.toReadableFramework));
                     if (versions.length > 1 && frameworks.length < 1) {
@@ -55,19 +56,2 @@ debug('Could not find valid/supported .NET version in csproj file located at' + csprojPath);
 exports.getTargetFrameworksFromProjFile = getTargetFrameworksFromProjFile;
-function toReadableFramework(targetFramework) {
-    const typeMapping = {
-        net: '.NETFramework',
-        netcoreapp: '.NETCore',
-        netstandard: '.NETStandard',
-        v: '.NETFramework',
-    };
-    for (const type in typeMapping) {
-        if (new RegExp(type + /\d.?\d(.?\d)?$/.source).test(targetFramework)) {
-            return {
-                framework: typeMapping[type],
-                original: targetFramework,
-                version: targetFramework.split(type)[1],
-            };
-        }
-    }
-}
 function findFile(rootDir, filter) {
@@ -74,0 +58,0 @@ if (!fs.existsSync(rootDir)) {

dist/nuget-parser/index.js

@@ -22,2 +22,4 @@ "use strict";
 const errors_1 = require("../errors");
+const depsParser = require("dotnet-deps-parser");
+const framework_1 = require("./framework");
 const PARSERS = {
@@ -45,3 +47,5 @@ 'dotnet-core': {
     return __awaiter(this, void 0, void 0, function* () {
-        const fileContentPath = path.resolve(root || '.', targetFile || '.');
+        const safeRoot = root || '.';
+        const safeTargetFile = targetFile || '.';
+        const fileContentPath = path.resolve(safeRoot, safeTargetFile);
         let fileContent;
@@ -71,3 +75,11 @@ try {
                 // .csproj is in the same directory as packages.config or project.json
-                targetFramework = yield csproj_parser_1.getTargetFrameworksFromProjFile(path.resolve(fileContentPath, '../'));
+                const fileContentParentDirectory = path.resolve(fileContentPath, '../');
+                targetFramework = yield csproj_parser_1.getTargetFrameworksFromProjFile(fileContentParentDirectory);
+                // finally, for the .NETFramework project, try to assume the framework using dotnet-deps-parser
+                if (!targetFramework) {
+                    // currently only process packages.config files
+                    if (manifestType === 'packages.config') {
+                        targetFramework = yield getMinimumTargetFrameworkFromPackagesConfig(fileContent);
+                    }
+                }
             }
@@ -96,2 +108,13 @@ }
 exports.buildDepTreeFromFiles = buildDepTreeFromFiles;
+function getMinimumTargetFrameworkFromPackagesConfig(fileContent) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const extractedFrameworks = yield depsParser.extractTargetFrameworksFromProjectConfig(fileContent);
+        if (extractedFrameworks && extractedFrameworks.length > 0) {
+            const minimumFramework = extractedFrameworks.reduce((prev, curr) => prev < curr ? prev : curr);
+            return framework_1.toReadableFramework(minimumFramework);
+        }
+        return undefined;
+    });
+}
+exports.getMinimumTargetFrameworkFromPackagesConfig = getMinimumTargetFrameworkFromPackagesConfig;
 //# sourceMappingURL=index.js.map

package.json

@@ -37,2 +37,3 @@ {
     "debug": "^3.1.0",
+    "dotnet-deps-parser": "4.5.0",
     "jszip": "^3.1.5",
@@ -54,3 +55,3 @@ "lodash": "^4.17.14",
   },
-  "version": "1.11.3"
+  "version": "1.12.0"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

68574

increased by4.03%

Number of package files

37

increased by12.12%

Lines of code

904

increased by3.43%

Worsened metrics

Dependency count

7

increased by16.67%

Dependency changes

• + Addeddotnet-deps-parser@4.5.0

• + Added@types/events@3.0.3(transitive)

• + Added@types/node@22.7.5(transitive)

• + Added@types/xml2js@0.4.3(transitive)

• + Addedbuffer-from@1.1.2(transitive)

• + Addeddotnet-deps-parser@4.5.0(transitive)

• + Addedsource-map@0.6.1(transitive)

• + Addedsource-map-support@0.5.21(transitive)

• + Addedundici-types@6.19.8(transitive)

• + Addedxml2js@0.4.19(transitive)

• + Addedxmlbuilder@9.0.7(transitive)