Apply allow-partial-results on Yarn V1 dependencies map construction #282
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
eranturgeman
had a problem deploying
to
frogbot
GitHub Actions
Failure
…ly-allow-partial-results-on-yarn-dep-tree-construction
eranturgeman
had a problem deploying
to
frogbot
GitHub Actions
Failure
This was referenced Nov 10, 2024
eyalbe4
requested changes
Nov 10, 2024
eyalbe4
added
improvement
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR introduces an improvement that applies 'allow-partial-results' ability on Yarn V1 dependencies map construction, so if we have some missing dependencies - it will not fail the entire map construction.
In more details:
Due to the output of 'yarn list' we manually build the dependencies map for Yarn V1 in 2 phases.
At the output's first level we get all dependencies (direct and indirect) with their locked versions.
At the output's second level (the children) we get all dependencies with caret version specifier (^).
Therefore a manual mapping between the versions is required for the final construction of the map and later the tree.
Sometime (for unknown reason that will be investigated further later, extra debug logs were added) we encounter a child dependency that we do now have at the first level of the map, and this causes the entire process to fail.
The current change states that if 'allow-partial-results' is enabled, and we encounter such a dependency - we just log the error and skip the matching for this problematic dependency.
This allow us to continue the process and to report the vulnerability, with a price that we might have some dependencies without impact paths (they will be reported in 'audit', just without stating their direct dependency) and will not get fixed in Frogbot.
This applies ONLY if 'partial results' is enabled. In any other case the flow remains unchanged
related changes:
jfrog/jfrog-cli-security#229
jfrog/frogbot#784