gsadmin/renovate
1
0
Fork 0
mirror of https://github.com/renovatebot/renovate.git synced 2026-10-24 14:34:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(vulnerability): check in case-insensitive manner (#42457)

Browse Source
This commit is contained in:
Jamie Tanna
2026-04-08 08:58:25 +01:00
committed by GitHub
parent 2efa5514bb
commit bc514206b5
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/util/vulnerability/utils.spec.ts
+4
View File
@@ -196,6 +196,8 @@ describe('util/vulnerability/utils', () => {
describe('getFixedVersionConstraint()', () => {
it.each([
// checked in a case-insensitive manner
['MAVEn', '[1.2.3,)'],
['Maven', '[1.2.3,)'],
['NuGet', '[1.2.3,)'],
['maven', '[1.2.3,)'],
@@ -216,6 +218,8 @@ describe('util/vulnerability/utils', () => {
['NuGet', '> 1.2.3'],
['npm', '> 1.2.3'],
['Go', '> 1.2.3'],
// checked in a case-insensitive manner
['gO', '> 1.2.3'],
])('returns correct range for %s', (ecosystem, expected) => {
expect(getLastAffectedVersionConstraint('1.2.3', ecosystem)).toBe(
expected,
lib/util/vulnerability/utils.ts
+5 -7
View File
@@ -5,8 +5,6 @@ import { NugetDatasource } from '../../modules/datasource/nuget/index.ts';
* Ecosystems/datasources that use Maven-style inclusive ranges for fixed versions: `[version,)`
*/
const mavenStyleFixedEcosystems = new Set([
'Maven',
'NuGet',
MavenDatasource.id,
NugetDatasource.id,
]);
@@ -14,19 +12,19 @@ const mavenStyleFixedEcosystems = new Set([
/**
* Ecosystems/datasources that use Maven-style exclusive ranges for last-affected versions: `(version,)`
*/
const mavenStyleLastAffectedEcosystems = new Set(['Maven', MavenDatasource.id]);
const mavenStyleLastAffectedEcosystems = new Set([MavenDatasource.id]);
/**
* Formats a fixed version as an allowed-version constraint appropriate for the ecosystem.
*
* @param fixedVersion - The first version that contains the fix
* @param ecosystem - Ecosystem or datasource name (e.g., 'Maven', 'npm', 'maven', 'nuget'). Checked in a case-sensitive manner.
* @param ecosystem - Ecosystem or datasource name (e.g., 'maven', 'npm', 'nuget'). Checked in a case-insensitive manner.
*/
export function getFixedVersionConstraint(
fixedVersion: string,
ecosystem: string,
): string {
if (mavenStyleFixedEcosystems.has(ecosystem)) {
if (mavenStyleFixedEcosystems.has(ecosystem.toLowerCase())) {
return `[${fixedVersion},)`;
}
return `>= ${fixedVersion}`;
@@ -36,13 +34,13 @@ export function getFixedVersionConstraint(
* Formats a last-affected version as an allowed-version constraint appropriate for the ecosystem.
*
* @param lastAffected - The last version known to be affected
* @param ecosystem - Ecosystem or datasource name. Checked in a case-sensitive manner.
* @param ecosystem - Ecosystem or datasource name. Checked in a case-insensitive manner.
*/
export function getLastAffectedVersionConstraint(
lastAffected: string,
ecosystem: string,
): string {
if (mavenStyleLastAffectedEcosystems.has(ecosystem)) {
if (mavenStyleLastAffectedEcosystems.has(ecosystem.toLowerCase())) {
return `(${lastAffected},)`;
}
return `> ${lastAffected}`;