Skip to content

Commit

Permalink
chore: upgrade package versions for JS API, mocha and nyc
Browse files Browse the repository at this point in the history
Signed-off-by: Ilona Shishov <[email protected]>
  • Loading branch information
IlonaShishov committed Jul 17, 2024
1 parent 8e113a9 commit 4347b1d
Show file tree
Hide file tree
Showing 4 changed files with 827 additions and 255 deletions.
42 changes: 40 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ In future releases, Red Hat plans to support other programming languages.
- For Golang projects, analyzing a `go.mod` file, you must have the `go` binary in your system’s `PATH` environment.
- For Python projects, analyzing a `requirements.txt` file, you must have the `python3/pip3` or `python/pip` binaries in your system’s `PATH` environment.
- For Gradle projects, analyzing a `build.gradle` file, you must have the `gradle` binary in your system's `PATH` environment.
- For base images in a `Dockerfile`.
- For base images in a `Dockerfile` or `Containerfile`, you must have `Java version 20` or later.

<br >**IMPORTANT:**
<br >Visual Studio Code by default executes binaries directly in a terminal found in your system's `PATH` environment.
Expand Down Expand Up @@ -265,8 +265,19 @@ The default path is `/tmp/redhatDependencyAnalyticsReport.html`.
)
```

For example, creating an alternative file to `requirements.txt`, like `requirements-dev.txt` or `requirements-test.txt` and adding the dev or test dependencies there instead.
For example, setting a dependency as test in the `build.gradle` file by placing it under one of the test configurations: `testImplementation`, `testCompileOnly`, `testRuntimeOnly`

```gradle
dependencies {
implementation group: 'org.springframework.boot', name: 'spring-boot-starter-web', version: '2.7.4'
testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test', version: '2.7.4'
testCompileOnly 'junit:junit:4.13.1'
testRuntimeOnly 'org.mockito:mockito-core:3.3.3'
}
```

For example, creating an alternative file to `requirements.txt`, like `requirements-dev.txt` or `requirements-test.txt` and adding the dev or test dependencies there instead.

- **Red Hat Dependency Analytics report**
<br >The Red Hat Dependency Analytics report is a temporary HTML file that exist if the **Red Hat Dependency Analytics Report** tab remains open.
Closing the tab removes the temporary HTML file.
Expand All @@ -286,6 +297,33 @@ The default path is `/tmp/redhatDependencyAnalyticsReport.html`.
Doing this allows Red Hat Dependency Analytics to install Python packages into a virtual environment to perform the analysis.
The benefit is having a clean Python environment not influenced by earlier installations, but the downside is a significantly slower analysis process.

## Known Issues

### Issue: Error when using options "Use Pip Dep Tree" and "Use Python Virtual Environment" simultaneously

In the `Python` ecosystem, when selecting both `Use Pip Dep Tree` and `Use Python Virtual Environment` options simultaneously, the application throws an error because pipdeptree is not configured in the virtual environment's Python interpreter.

Furthermore, there is no practical value in using both configurations together. The primary goal of the `Use Pip Dep Tree` option is to optimize performance for Python version 3.11 and higher. On the other hand, the `Use Python Virtual Environment` option naturally works much slower than running in a local environment because installations are performed within the virtual environment.

Since these options contradict each other, the expected function of the `Use Pip Dep Tree` option will be neutralized. It is recommended to use either one of these options, depending on your specific requirements, but not both simultaneously.

### Issue: Dependency Analysis limitations for dependency configrations in build.gradle Manifests

In the `Gradle` ecosystem, dependency analysis cannot be performed on dependencies with the `compileOnly` or `compileOnlyApi` configurations due to compilation issues originating from Gradle itself.

The support for each configuration is outlined in the table below:

| Configuration | Dependency Analysis Report | Component Analysis |
| ------------- | -------------------------- | ------------------ |
| Implementation | yes | yes |
| api | yes | yes |
| runtimeOnly | yes | yes |
| testImplementation | no | no |
| testCompileOnly | no | no |
| testRuntimeOnly | no | no |
| compileOnly | no | yes |
| compileOnlyApi | no | no |

## Using Red Hat Dependency Analytics for CI builds

You can automate the analysis of your application's vulnerabilities within the build and release pipeline.
Expand Down
Loading

0 comments on commit 4347b1d

Please sign in to comment.