Skip to content

1.3.1

Choose a tag to compare

View all tags
@oscarvalenzuelab oscarvalenzuelab released this 20 Oct 06:55
· 50 commits to main since this release
v1.3.1
e1cd019
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release v1.3.1

Added

Hybrid Discovery Strategy

  • Primary: Hash-based discovery (SWHIDs + Software Heritage) for comprehensive source inventory
  • Secondary: Manifest parsing (UPMEX integration) to validate findings and add missing packages
  • Tertiary: GitHub API and SCANOSS fingerprinting for additional coverage
  • Individual testing capabilities for each discovery method

Comprehensive Manifest Parsing

Direct manifest file analysis supporting 15+ ecosystems:

  • Python: setup.py, pyproject.toml, setup.cfg, requirements.txt, Pipfile
  • JavaScript/Node.js: package.json, yarn.lock, package-lock.json
  • Java/Maven: pom.xml, gradle.build
  • Go: go.mod, go.sum
  • Rust: Cargo.toml, Cargo.lock
  • Ruby: Gemfile, gemspec files
  • PHP: composer.json, composer.lock
  • .NET: *.csproj, packages.config, *.nuspec

Enhanced Package Metadata Extraction

  • License detection with confidence scoring
  • Version extraction from multiple sources (tags, releases, manifest files)
  • PURL (Package URL) generation across ecosystems
  • Official organization detection and prioritization

Security

Fixed URL Substring Sanitization Vulnerabilities

  • Replaced vulnerable substring-based URL validation with proper URL parsing
  • Enhanced hostname validation using urlparse() for accurate domain matching
  • Prevents URL validation bypass attacks (e.g., evil.com/github.com/fake)
  • Addresses CodeQL security alerts #1-#25 for incomplete URL substring sanitization
  • Applied across all modules: extractor.py, orchestrator.py, purl.py, providers.py

Improved

Performance Optimization

  • Software Heritage made optional by default
  • Use --use-swh flag to enable Software Heritage integration
  • Prevents timeout issues on large codebases
  • Faster execution for most common use cases

Enhanced Documentation

  • 4-tier discovery strategy explanation
  • API key setup instructions for GitHub, SCANOSS, SerpAPI
  • Emphasis on "no API keys required" approach for basic functionality
  • Updated usage examples and configuration options

Fixed

Python Version Compatibility

  • Added fallback support for Python < 3.11
  • Graceful handling of tomllib import (Python 3.11+ only)
  • Fallback to tomli library for older Python versions
  • Maintains backward compatibility with Python 3.9+

UPMEX Integration Issues

  • Resolved import and dependency conflicts
  • Created a direct manifest parser instead of UPMEX archive-based tool
  • Handles raw manifest files in source directories
  • Supports recursive manifest discovery with depth control

Changed

Discovery Method Prioritization

  • Implemented a proper hybrid approach
  • Hash-based discovery prioritized over manifest parsing
  • Manifest parsing is used for validation and enhancement of hash-based results
  • Software Heritage integration is now optional (disabled by default)
  • Intelligent result merging and deduplication
Assets 2
Loading