Upgrade semver_dialects gem from 2.0.2 to 3.0.0
This improves the accuracy of Continuous Vulnerability Scanning and License Scanning when comparing the version of a SBOM component to the advisory database and the license database, respectively. Additionally, this changes the error handling of raised errors from license scanning so that they're always sent to Sentry as recommended by the developer documentation. Previously, the messages were only logged which meant that after the log TTL passed, we'd be left with a very hard to debug situation as was the case with the initial update to v3.0.0. Sentry does not have the same restrictions, so this improves our ability to debug any increase in the error rate. Lastly, the error tracking now includes, the following information that provides more detail into what went wrong: * The version of the package being checked * The range of the licenses known - lowest and highest version strings * The package name and purl type This means that we can check the license exports directly to find invalid constraints in the exports instead of requiring access to the instance database.
显示
- Gemfile 1 个添加, 1 个删除Gemfile
- Gemfile.checksum 1 个添加, 1 个删除Gemfile.checksum
- Gemfile.lock 2 个添加, 2 个删除Gemfile.lock
- app/models/concerns/enums/sbom.rb 2 个添加, 2 个删除app/models/concerns/enums/sbom.rb
- ee/app/models/package_metadata/package.rb 25 个添加, 8 个删除ee/app/models/package_metadata/package.rb
- ee/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher.rb 1 个添加, 1 个删除...ning/container_scanning/affected_version_range_matcher.rb
- ee/lib/gitlab/vulnerability_scanning/dependency_scanning/affected_version_range_matcher.rb 1 个添加, 1 个删除...ing/dependency_scanning/affected_version_range_matcher.rb
- ee/spec/lib/gitlab/vulnerability_scanning/advisory_scanner_spec.rb 1 个添加, 1 个删除...ib/gitlab/vulnerability_scanning/advisory_scanner_spec.rb
- ee/spec/lib/gitlab/vulnerability_scanning/container_scanning/affected_version_range_matcher_spec.rb 3 个添加, 3 个删除...container_scanning/affected_version_range_matcher_spec.rb
- ee/spec/lib/gitlab/vulnerability_scanning/dependency_scanning/affected_version_range_matcher_spec.rb 77 个添加, 16 个删除...ependency_scanning/affected_version_range_matcher_spec.rb
- ee/spec/models/package_metadata/package_spec.rb 38 个添加, 3 个删除ee/spec/models/package_metadata/package_spec.rb
加载中
想要评论请 注册 或 登录