google / google/osv-scanner

Fail to update Maven packages with properties in their names

Open
#1,238 2 comments 0 reactions 0 assignees View on GitHub
backlog bug guided remediation
Dominant language
Go
Stars
11k
Forks
792
Avg merge
1d 20h
Merged PRs (30d)
48

Description

If a Maven dependency uses a property in its `artifactId` or `groupId`, the writer does not find the original definition of the package and will end up creating a new section for the patch.

e.g. Starting with this:
```xml

foo


com.xyz
${artifact}
1.0.0

```
A patch to `com.xyz:foo` will end up looking like:
```xml

foo


com.xyz
${artifact}
1.0.0



com.xyz
foo
2.0.0

```
Which, in this case, does not actually override the version of the package (despite the override claiming it would).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.