Skip to content

Conversation

@ruromero
Copy link
Collaborator

@ruromero ruromero commented Jun 9, 2025

Description

Refactor how the Gradle dependencies are resolved because as the full tree is available in both component and stack analysis we can use the right trees instead of just the api / implementation listings. This helps resolving the correct versions.

With that it is also possible to include the correct scope (required / optional) to the sbom

Related issues (if any):

Checklist

  • I have followed this repository's contributing guidelines.
  • I will adhere to the project's code of conduct.

Additional information

Also includes a fix for running the unit tests.

@ruromero ruromero requested a review from Strum355 June 9, 2025 16:14
ruromero added 2 commits June 10, 2025 10:45
Signed-off-by: Ruben Romero Montes <[email protected]>
@ruromero ruromero merged commit 58ddf98 into guacsec:main Jun 10, 2025
4 checks passed
@ruromero ruromero deleted the fix/gradle-deps branch June 10, 2025 14:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add scope to Gradle SBOM Yarn doesn't parse the versions properly Gradle component version resolution

2 participants