diff --git a/lib/util/vulnerability/utils.spec.ts b/lib/util/vulnerability/utils.spec.ts index 1d1935ad54..a69cf4bb3f 100644 --- a/lib/util/vulnerability/utils.spec.ts +++ b/lib/util/vulnerability/utils.spec.ts @@ -196,6 +196,8 @@ describe('util/vulnerability/utils', () => { describe('getFixedVersionConstraint()', () => { it.each([ + // checked in a case-insensitive manner + ['MAVEn', '[1.2.3,)'], ['Maven', '[1.2.3,)'], ['NuGet', '[1.2.3,)'], ['maven', '[1.2.3,)'], @@ -216,6 +218,8 @@ describe('util/vulnerability/utils', () => { ['NuGet', '> 1.2.3'], ['npm', '> 1.2.3'], ['Go', '> 1.2.3'], + // checked in a case-insensitive manner + ['gO', '> 1.2.3'], ])('returns correct range for %s', (ecosystem, expected) => { expect(getLastAffectedVersionConstraint('1.2.3', ecosystem)).toBe( expected, diff --git a/lib/util/vulnerability/utils.ts b/lib/util/vulnerability/utils.ts index 6ce93ca229..2de5395262 100644 --- a/lib/util/vulnerability/utils.ts +++ b/lib/util/vulnerability/utils.ts @@ -5,8 +5,6 @@ import { NugetDatasource } from '../../modules/datasource/nuget/index.ts'; * Ecosystems/datasources that use Maven-style inclusive ranges for fixed versions: `[version,)` */ const mavenStyleFixedEcosystems = new Set([ - 'Maven', - 'NuGet', MavenDatasource.id, NugetDatasource.id, ]); @@ -14,19 +12,19 @@ const mavenStyleFixedEcosystems = new Set([ /** * Ecosystems/datasources that use Maven-style exclusive ranges for last-affected versions: `(version,)` */ -const mavenStyleLastAffectedEcosystems = new Set(['Maven', MavenDatasource.id]); +const mavenStyleLastAffectedEcosystems = new Set([MavenDatasource.id]); /** * Formats a fixed version as an allowed-version constraint appropriate for the ecosystem. * * @param fixedVersion - The first version that contains the fix - * @param ecosystem - Ecosystem or datasource name (e.g., 'Maven', 'npm', 'maven', 'nuget'). Checked in a case-sensitive manner. + * @param ecosystem - Ecosystem or datasource name (e.g., 'maven', 'npm', 'nuget'). Checked in a case-insensitive manner. */ export function getFixedVersionConstraint( fixedVersion: string, ecosystem: string, ): string { - if (mavenStyleFixedEcosystems.has(ecosystem)) { + if (mavenStyleFixedEcosystems.has(ecosystem.toLowerCase())) { return `[${fixedVersion},)`; } return `>= ${fixedVersion}`; @@ -36,13 +34,13 @@ export function getFixedVersionConstraint( * Formats a last-affected version as an allowed-version constraint appropriate for the ecosystem. * * @param lastAffected - The last version known to be affected - * @param ecosystem - Ecosystem or datasource name. Checked in a case-sensitive manner. + * @param ecosystem - Ecosystem or datasource name. Checked in a case-insensitive manner. */ export function getLastAffectedVersionConstraint( lastAffected: string, ecosystem: string, ): string { - if (mavenStyleLastAffectedEcosystems.has(ecosystem)) { + if (mavenStyleLastAffectedEcosystems.has(ecosystem.toLowerCase())) { return `(${lastAffected},)`; } return `> ${lastAffected}`;