microsoft / microsoft/component-detection
Wrong pip dependency version detection
@cobya is already working on this.
Since May 23, 2024.
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
Hello,
We observed an issue with wrong pip dependency version detection. Our requirements.txt file includes numpy==1.26.0b1
```
numpy==1.26.0b1 \
--hash=sha256:216b47882877ea5272f279c08bf7e42935728f35c6db2e4843b37db7b29ce016 \
--hash=sha256:c67eea90827e1e9aa220a3fc380ce8776428deba8ac9e7c931ce7b69e8dce115
```
But CG detector found 1.19.5
```
--- Component: ---
numpy 1.19.5 - pip
--- Found at: ---
//requirements.txt
```
some relevant warnings from the logs
```
##[warning]Root dependency numpy not found on pypi. Skipping package.
##[warning]Candidate version (numpy 1.25.2 - pip) for numpy already exists in map and the version is NOT valid.
##[warning]Version Resolution for numpy failed, assuming last valid version is used.
```
AB#2104780
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.