snyk-nuget-plugin 2.7.7 → 2.7.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -11,4 +11,4 @@ Snyk helps you find, fix and monitor for known vulnerabilities in your dependenc
|
|
|
11
11
|
|
|
12
12
|
## Snyk NuGet CLI Plugin
|
|
13
13
|
|
|
14
|
-
The plugin provides dependency metadata for NuGet projects that manifest dependencies in `project.json`, `packages.config` or `project.assets.json` files.
|
|
14
|
+
The plugin provides dependency metadata for NuGet projects that manifest dependencies in `project.json`, `packages.config` or `project.assets.json` files.
|
|
@@ -74,13 +74,18 @@ async function publish(projectPath, targetFramework) {
|
|
|
74
74
|
}
|
|
75
75
|
// Define a temporary output dir to use for detecting .dlls to use for runtime version assembly detection.
|
|
76
76
|
const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), `snyk-nuget-plugin-publish-csharp-`));
|
|
77
|
+
// Changing the PublishDir a temporary directory.
|
|
77
78
|
// See https://learn.microsoft.com/en-us/dotnet/core/compatibility/sdk/7.0/solution-level-output-no-longer-valid#recommended-action
|
|
78
79
|
// about why we're not using `--output` for this.
|
|
79
|
-
args.push(`--property:PublishDir=${tempDir}`);
|
|
80
80
|
// Some projects can have <IsPublishable> turned to false, that won't allow `publish` command to generate the binary we
|
|
81
81
|
// need for resolution, so we're going to force <IsPublishable> to be true.
|
|
82
82
|
// See https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-publish#msbuild
|
|
83
|
-
|
|
83
|
+
// Some projects can have <PublishSingleFile> turned on, that won't generate the self-container binary we need,
|
|
84
|
+
// so we're disabling it during our scan.
|
|
85
|
+
// See https://learn.microsoft.com/en-us/dotnet/core/deploying/single-file/overview?tabs=cli
|
|
86
|
+
// Some projects can have <TreatWarningsAsErrors> tuned on, that will throw errors on any warning, making the project impossible to scan.
|
|
87
|
+
// Or, they can have a list of warning codes in <WarningsAsErrors> that will do the same thing as above. So we're disabling them.
|
|
88
|
+
args.push(`--p:PublishDir=${tempDir};IsPublishable=true;PublishSingleFile=false;TreatWarningsAsErrors=false;WarningsAsErrors=`);
|
|
84
89
|
// The path that contains either some form of project file, or a .sln one.
|
|
85
90
|
// See: https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-publish#arguments
|
|
86
91
|
args.push(`"${projectPath}"`);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dotnet.js","sourceRoot":"","sources":["../../../lib/nuget-parser/cli/dotnet.ts"],"names":[],"mappings":";;AAuCA,4BAWC;AAED,0BAYC;AAED,kBAQC;AAED,
|
|
1
|
+
{"version":3,"file":"dotnet.js","sourceRoot":"","sources":["../../../lib/nuget-parser/cli/dotnet.ts"],"names":[],"mappings":";;AAuCA,4BAWC;AAED,0BAYC;AAED,kBAQC;AAED,0BAkDC;AA9HD,qCAAqC;AACrC,yCAA+C;AAC/C,6BAA6B;AAC7B,2CAA2C;AAC3C,yBAAyB;AACzB,yBAAyB;AAEzB,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAElC,KAAK,UAAU,MAAM,CACnB,SAAiB,EACjB,OAAe,EACf,IAAc;IAEd,KAAK,CAAC,2BAA2B,SAAS,KAAK,OAAO,EAAE,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IACE,CAAC,CACC,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,QAAQ,IAAI,KAAK;YACjB,QAAQ,IAAI,KAAK,CAClB,EACD,CAAC;YACD,MAAM,IAAI,wBAAe,CACvB,UAAU,SAAS,uBAAuB,KAAK,EAAE,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QAC7C,MAAM,IAAI,wBAAe,CACvB,UAAU,SAAS,uBAAuB,OAAO,EAAE,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,QAAQ;IAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,OAAO,CAAC,WAAmB;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC;IACzB,MAAM,IAAI,GAAG;QACX,SAAS;QACT,kFAAkF;QAClF,kFAAkF;QAClF,aAAa;QACb,QAAQ;QACR,IAAI,WAAW,GAAG;KACnB,CAAC;IACF,MAAM,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO;AACT,CAAC;AAEM,KAAK,UAAU,GAAG,CACvB,WAAmB,EACnB,OAAiB;IAEjB,MAAM,OAAO,GAAG,QAAQ,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAEM,KAAK,UAAU,OAAO,CAC3B,WAAmB,EACnB,eAAwB;IAExB,MAAM,OAAO,GAAG,QAAQ,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACrC,sGAAsG;IACtG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElB,0DAA0D;IAC1D,qFAAqF;IACrF,oGAAoG;IACpG,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAEnC,yHAAyH;IACzH,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7B,CAAC;IAED,0GAA0G;IAC1G,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAC5B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC,CAC5D,CAAC;IAEF,iDAAiD;IACjD,mIAAmI;IACnI,iDAAiD;IAEjD,uHAAuH;IACvH,2EAA2E;IAC3E,iFAAiF;IAEjF,+GAA+G;IAC/G,yCAAyC;IACzC,4FAA4F;IAE5F,yIAAyI;IACzI,iIAAiI;IACjI,IAAI,CAAC,IAAI,CACP,kBAAkB,OAAO,2FAA2F,CACrH,CAAC;IAEF,0EAA0E;IAC1E,oFAAoF;IACpF,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC;IAE9B,MAAM,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAEvC,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
package/package.json
CHANGED