dependency-check / dependency-check/DependencyCheck
golang: checker doesn't take into account replace directives
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Describe the bug**
For golang projects checker doesn't take into account "replace" directives in go.mod.
**Version of dependency-check used**
6.1.5
**To Reproduce**
Steps to reproduce the behavior:
1. Create test golang project with dependency on github.com/grpc-ecosystem/go-grpc-middleware v1.0.0 in go.mod file.
2. Run checker. CVE-2017-7860 issue exists in report. As expected.
3. Update github.com/grpc-ecosystem/go-grpc-middleware v1.0.0 to github.com/grpc-ecosystem/go-grpc-middleware v1.2.2 in "require" section of go.mod
4. Run checker. CVE-2017-7860 issue doesn't exist. As expected.
5. Change github.com/grpc-ecosystem/go-grpc-middleware v1.2.2 back to github.com/grpc-ecosystem/go-grpc-middleware v1.0.0 in "require" section of go.mod
6. Run checker. CVE-2017-7860 issue exists in report. As expected
7. Add "replace" directive: replace github.com/grpc-ecosystem/go-grpc-middleware => github.com/grpc-ecosystem/go-grpc-middleware v1.2.2
8. Run checker. CVE-2017-7860 issue STILL exists in report, but should not. This shows that checker doesn't take into account "replace" directives and checks 1.0.0 version instead of 1.2.2.
Test project (branches for each case with reports):
https://github.com/Exalax/depcheck-replace-issue/tree/master - go-grpc-middleware 1.0.0 (base state)
https://github.com/Exalax/depcheck-replace-issue/tree/upgrade - go-grpc-middleware 1.2.2 (upgrade via require section)
https://github.com/Exalax/depcheck-replace-issue/tree/replace - go-grpc-middleware 1.2.2 (upgrade via replace section)
**Expected behavior**
When go.mod file has "replace" directives which updates dependency version, checker must check these updated dependencies.
Instead of it, checker still checks dependencies from "require" go.mod section
Contributor guide
Assessment
This issue has not been assessed yet.