google / google/osv-scalibr

Support for non-versioned dependencies?

Open
#307 6 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
643
Forks
198
Avg merge
2d 17h
Merged PRs (30d)
29

Description

I just noticed that the requirements.txt extractor silently ignores all Python packages listed in `requirements.txt` without a version.

I see in the tests that this is intentional. We have some use cases where returning the package list without versions (and also producing unversioned purls) would be useful. Could this be a configurable behavior?

I'm happy to submit a patch to support this in Python, I just wanted to check if you'd consider it.

Contributor guide

Open the contributing guide

Research direction

Start with the Python requirements.txt extractor and the tests that currently verify unversioned packages are ignored. Determine how extractor behavior is configured, then define the expected handling for unversioned packages and purls; done means the configurable behavior is covered by tests without changing the existing default.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.