You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In this integration test case here, we are running the analysis on a PURL without dependency resolving -purl pkg:maven/io.micronaut/[email protected] --skip-deps. However, we check for two dependencies report files caffeine.json and slf4j.json.
The reason this test case is still passing is because it's reusing caffeine.json and slf4j.json from test cases that run before it.
The text was updated successfully, but these errors were encountered:
That's expected. If dependencies are manually specified in the configuration file, even if the --skip-deps is passed, those dependencies will be analyzed. --skip-deps only skips automatic dependency resolution.
I agree it would be expected if we are analyzing with a yaml config file. However, because we are providing a PURL, --skip-deps here would mean that at most one software component is analyzed. 🤔
I think this test case used to be a config file test case (which explains the different dependency report files checking). In this PR, it was changed to use a PURL instead (but the comparison for the dependency report files weren't updated).
In this integration test case here, we are running the analysis on a PURL without dependency resolving
-purl pkg:maven/io.micronaut/[email protected] --skip-deps
. However, we check for two dependencies report filescaffeine.json
andslf4j.json
.The reason this test case is still passing is because it's reusing
caffeine.json
andslf4j.json
from test cases that run before it.The text was updated successfully, but these errors were encountered: