snyk 1.1002.0 → 1.1003.0

package/dist/cli/545.index.js

@@ -156848,6 +156848,7 @@ const requirements_parser_1 = __webpack_require__(13157);
 const debug = Debug("snyk");
 class PythonDepGraphBuilder {
     constructor(name, requirements, metadata) {
+        this.visitedMap = new Set();
         this.requirements = requirements;
         this.metadata = metadata;
         this.builder = new dep_graph_1.DepGraphBuilder({ name: "pip" }, { name });
@@ -156868,26 +156869,26 @@ class PythonDepGraphBuilder {
             return;
         }
         const nodeId = `${metadata.name}@${metadata.version}`;
-        this.builder.addPkgNode({ name: metadata.name, version: metadata.version }, nodeId);
-        this.builder.connectDep(root, nodeId);
-        for (const dep of metadata.dependencies) {
-            this.addDependenciesToDepGraph(nodeId, dep);
+        if (!this.visitedMap.has(nodeId)) {
+            this.visitedMap.add(nodeId);
+            this.builder.addPkgNode({ name: metadata.name, version: metadata.version }, nodeId);
+            for (const dep of metadata.dependencies) {
+                await this.addDependenciesToDepGraph(nodeId, dep);
+            }
         }
+        this.builder.connectDep(root, nodeId);
     }
     // find the best match for a dependency in found metadata files
     findMetadata(dep) {
-        const nameMatches = this.metadata.filter((meta) => meta.name.toLowerCase() === dep.name.toLowerCase());
-        if (nameMatches.length === 0) {
+        const nameMatches = this.metadata[dep.name.toLowerCase()];
+        if (!nameMatches || nameMatches.length === 0) {
             return null;
         }
-        nameMatches.sort((v1, v2) => {
-            return semver.rcompare(v1.version, v2.version);
-        });
         if (nameMatches.length === 1 || !dep.version) {
             return nameMatches[0];
         }
         for (const meta of nameMatches) {
-            if (semver.satisfies(meta.version, `${dep.specifier}${dep.version}`)) {
+            if (semver.satisfies(meta.version, `${dep.specifier}${dep.version}`, true)) {
                 return meta;
             }
         }
@@ -156901,7 +156902,7 @@ class PythonDepGraphBuilder {
 async function pipFilesToScannedProjects(filePathToContent) {
     const scanResults = [];
     const requirements = {};
-    const metadataItems = [];
+    const metadataItems = {};
     for (const filepath of Object.keys(filePathToContent)) {
         const fileBaseName = path.basename(filepath);
         if (fileBaseName === "requirements.txt") {
@@ -156910,16 +156911,25 @@ async function pipFilesToScannedProjects(filePathToContent) {
         else if (fileBaseName === "METADATA") {
             try {
                 const packageInfo = (0, metadata_parser_1.getPackageInfo)(filePathToContent[filepath]);
-                metadataItems.push(packageInfo);
+                if (!metadataItems[packageInfo.name.toLowerCase()]) {
+                    metadataItems[packageInfo.name.toLowerCase()] = [];
+                }
+                metadataItems[packageInfo.name.toLowerCase()].push(packageInfo);
             }
             catch (err) {
                 debug(err.message);
             }
         }
     }
-    if (metadataItems.length === 0) {
+    if (Object.keys(metadataItems).length === 0) {
         return scanResults;
     }
+    // pre-sort each package name by version, descending
+    for (const name of Object.keys(metadataItems)) {
+        metadataItems[name].sort((v1, v2) => {
+            return semver.rcompare(v1.version, v2.version);
+        });
+    }
     for (const requirementsFile of Object.keys(requirements)) {
         if (requirements[requirementsFile].length === 0) {
             continue;