-
Notifications
You must be signed in to change notification settings - Fork 99
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update SPDX Expression Parsing #719
Conversation
Couple questions, but this is looking good so far, thanks! 🍻 |
22b3072
to
310ae5f
Compare
👋 I just pushed a pretty major overhaul of this PR. It should be ready for review now. Highlights:
That said, there could be surprises here and I'm no TypeScript expert 😂 so please do review this carefully 🙇 cc @hmaurer @bteng22 @mrysav |
…w spdx pkg - TODO: update tests
310ae5f
to
f60d593
Compare
@@ -41,6 +41,7 @@ | |||
"zod": "^3.22.3" | |||
}, | |||
"devDependencies": { | |||
"@types/jest": "^29.5.12", | |||
"@types/node": "^20", | |||
"@types/spdx-expression-parse": "^3.0.4", | |||
"@types/spdx-satisfies": "^0.1.1", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
moved Jest back into dev dependencies where I think it belongs 👍
validityCache.set(license, found) | ||
} else { | ||
invalidLicenseChanges.unresolved.push(change) | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
☝️ the library is very strict about invalid SPDX inputs, so instead of just bucketing these as "unresolved" based on an error bubble up, we'll now check validity specifically as a pre-step when classifying and resolving licenses 👍
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🤔 due to this change, we may be able to ditch the try...catch
blocks entirely
const got: boolean = spdx.satisfiesAny(unit.candidate, unit.licenses) | ||
test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.licenses}")`, () => { | ||
expect(got).toBe(unit.expected) | ||
}) | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
oh nice change! 😍
From a code review/testing perspective, I'm pretty happy with this right now. My plan is to do a little bit of manual testing to validate that the linked issues really are resolved, and then I'll get this approved, merged, and released. |
I'm glad I didn't rush through this, because this PR doesn't resolve any of the issues that were linked above. That's not to say it's a bad PR or that we shouldn't merge it, but it doesn't address the fundamental causes of the behaviors that people have run into. I'll break it down issue by issue:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Despite the fact that this doesn't fix any outstanding bugs, I do still think it moves us in the right direction. The remaining bugs will have to be addressed by other work in the future.
…113) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | action | patch | `v4.3.3` -> `v4.3.4` | --- ### Release Notes <details> <summary>actions/dependency-review-action (actions/dependency-review-action)</summary> ### [`v4.3.4`](https://github.com/actions/dependency-review-action/releases/tag/v4.3.4) [Compare Source](https://github.com/actions/dependency-review-action/compare/v4.3.3...v4.3.4) #### What's Changed - Include all added dependencies in scorecard entries by [@​elireisman](https://github.com/elireisman) in [actions/dependency-review-action#783 - Update SPDX Expression Parsing by [@​febuiles](https://github.com/febuiles) in [actions/dependency-review-action#719 - This PR is a significant refactor of SPDX expression parsing that *may* fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version. **Full Changelog**: actions/dependency-review-action@v4.3.3...v4.3.4 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjAuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQyMC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==--> Signed-off-by: Renovate Bot <[email protected]> Co-authored-by: renovate-gsuquet[bot] <173481049+renovate-gsuquet[bot]@users.noreply.github.com>
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | action | patch | `v4.3.3` -> `v4.3.4` | | [defenseunicorns/uds-common](https://github.com/defenseunicorns/uds-common) | | minor | `v0.7.1` -> `v0.9.0` | | [defenseunicorns/uds-common](https://github.com/defenseunicorns/uds-common) | action | minor | `v0.7.1` -> `v0.9.0` | | [defenseunicorns/zarf](https://github.com/defenseunicorns/zarf) | | minor | `v0.35.0` -> `v0.36.1` | | [github/codeql-action](https://github.com/github/codeql-action) | action | patch | `v3.25.11` -> `v3.25.13` | | [mattermost/mattermost-plugin-ai](https://github.com/mattermost/mattermost-plugin-ai) | | patch | `0.8.2` -> `0.8.3` | | [renovatebot/pre-commit-hooks](https://github.com/renovatebot/pre-commit-hooks) | repository | minor | `37.426.2` -> `37.440.4` | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | action | minor | `v2.8.1` -> `v2.9.0` | Note: The `pre-commit` manager in Renovate is not supported by the `pre-commit` maintainers or community. Please do not report any problems there, instead [create a Discussion in the Renovate repository](https://github.com/renovatebot/renovate/discussions/new) if you have any questions. --- ### Release Notes <details> <summary>actions/dependency-review-action (actions/dependency-review-action)</summary> ### [`v4.3.4`](https://github.com/actions/dependency-review-action/releases/tag/v4.3.4) [Compare Source](https://github.com/actions/dependency-review-action/compare/v4.3.3...v4.3.4) #### What's Changed - Include all added dependencies in scorecard entries by [@​elireisman](https://github.com/elireisman) in [actions/dependency-review-action#783 - Update SPDX Expression Parsing by [@​febuiles](https://github.com/febuiles) in [actions/dependency-review-action#719 - This PR is a significant refactor of SPDX expression parsing that *may* fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version. **Full Changelog**: actions/dependency-review-action@v4.3.3...v4.3.4 </details> <details> <summary>defenseunicorns/uds-common (defenseunicorns/uds-common)</summary> ### [`v0.9.0`](https://github.com/defenseunicorns/uds-common/releases/tag/v0.9.0) [Compare Source](https://github.com/defenseunicorns/uds-common/compare/v0.8.2...v0.9.0) ##### ⚠ BREAKING CHANGES - update doug ci credential for new identity config req ##### Bug Fixes - update doug ci credential for new identity config req ([71340f7](https://github.com/defenseunicorns/uds-common/commit/71340f7d4fc0cd8fd6c44335b54e0b12769965d1)) ### [`v0.8.2`](https://github.com/defenseunicorns/uds-common/releases/tag/v0.8.2) [Compare Source](https://github.com/defenseunicorns/uds-common/compare/v0.8.1...v0.8.2) ##### Miscellaneous - add additional install step to playwright install ([#​183](https://github.com/defenseunicorns/uds-common/issues/183)) ([41855e4](https://github.com/defenseunicorns/uds-common/commit/41855e42bd73c67109ed42935f1e67ab7305ddda)) - **deps:** update uds common support dependencies ([#​179](https://github.com/defenseunicorns/uds-common/issues/179)) ([e1a0d5a](https://github.com/defenseunicorns/uds-common/commit/e1a0d5acba2c0cc083af6ac2823d9cf068008453)) - fix the Zarf package renovate regex to the correct versionTemplate ([#​181](https://github.com/defenseunicorns/uds-common/issues/181)) ([272b502](https://github.com/defenseunicorns/uds-common/commit/272b502fa2f36b3703f9cdcbdbfb579ce437a0d7)) ### [`v0.8.1`](https://github.com/defenseunicorns/uds-common/releases/tag/v0.8.1) [Compare Source](https://github.com/defenseunicorns/uds-common/compare/v0.8.0...v0.8.1) ##### Miscellaneous - add cgr identity assume to setup action ([#​180](https://github.com/defenseunicorns/uds-common/issues/180)) ([2ec74fb](https://github.com/defenseunicorns/uds-common/commit/2ec74fbe496c5cdcc88cd3f424951f11271fe5d6)) - fix version matching for UDS packages ([#​176](https://github.com/defenseunicorns/uds-common/issues/176)) ([e068b6a](https://github.com/defenseunicorns/uds-common/commit/e068b6a255cc856e313485826a2140a3977c6b03)) ### [`v0.8.0`](https://github.com/defenseunicorns/uds-common/releases/tag/v0.8.0) [Compare Source](https://github.com/defenseunicorns/uds-common/compare/v0.7.1...v0.8.0) ##### Features - **compliance:** add support for extra options on compliance validate ([#​170](https://github.com/defenseunicorns/uds-common/issues/170)) ([d191505](https://github.com/defenseunicorns/uds-common/commit/d19150566784e51f7c8d31b7d37b6915cdacc410)) ##### Bug Fixes - chainguard creds/renovate match ([#​173](https://github.com/defenseunicorns/uds-common/issues/173)) ([49401cc](https://github.com/defenseunicorns/uds-common/commit/49401cc5c8000a661c6e1bc9e10e42fa6f6e2389)) ##### Miscellaneous - add cgr.dev renovate rule ([#​171](https://github.com/defenseunicorns/uds-common/issues/171)) ([68497f9](https://github.com/defenseunicorns/uds-common/commit/68497f95ffdccf5802da81f2f0c9a8f7f8fe912c)) - **deps:** update uds common support dependencies ([#​164](https://github.com/defenseunicorns/uds-common/issues/164)) ([6c50f47](https://github.com/defenseunicorns/uds-common/commit/6c50f47ecd9c75483ab70953d5c31682362377c2)) - **deps:** update uds common support dependencies ([#​169](https://github.com/defenseunicorns/uds-common/issues/169)) ([b6a4232](https://github.com/defenseunicorns/uds-common/commit/b6a4232cb030f3ea7e66041306b5cfcd9a488a98)) - update CODEOWNERS with more specific permissions ([#​175](https://github.com/defenseunicorns/uds-common/issues/175)) ([f2b7220](https://github.com/defenseunicorns/uds-common/commit/f2b722051014d64d350bd34ea087e6ffb3daf428)) </details> <details> <summary>defenseunicorns/zarf (defenseunicorns/zarf)</summary> ### [`v0.36.1`](https://github.com/zarf-dev/zarf/releases/tag/v0.36.1) [Compare Source](https://github.com/defenseunicorns/zarf/compare/v0.36.0...v0.36.1) 🚨 Important 🚨: Zarf will be moving from github.com/defenseunicorns/zarf to github.com/zarf-dev/zarf ##### What's Changed - test: simplifying e2e test checks by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2721 - fix: fix link to CONTRIBUTING.md in PR template by [@​daveworth](https://github.com/daveworth) in [zarf-dev/zarf#2726 - refactor: compile local cluster service format regexp just once by [@​matiasinsaurralde](https://github.com/matiasinsaurralde) in [zarf-dev/zarf#2727 ##### New Contributors - [@​daveworth](https://github.com/daveworth) made their first contribution in [zarf-dev/zarf#2726 - [@​matiasinsaurralde](https://github.com/matiasinsaurralde) made their first contribution in [zarf-dev/zarf#2727 **Full Changelog**: zarf-dev/zarf@v0.36.0...v0.36.1 ### [`v0.36.0`](https://github.com/defenseunicorns/zarf/releases/tag/v0.36.0) [Compare Source](https://github.com/defenseunicorns/zarf/compare/v0.35.0...v0.36.0) #### What's Changed - refactor: remove unused constants and variables by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2633 - docs: fixed wrong link in zarf site nerd notes page by [@​joelmccoy](https://github.com/joelmccoy) in [zarf-dev/zarf#2639 - chore: s3 cleanup by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2632 - refactor: change UpdateZarfAgentValues to rolling restart by [@​lucasrod16](https://github.com/lucasrod16) in [zarf-dev/zarf#2644 - chore: make less by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2648 - fix: docs links by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2650 - refactor: remove use of reflections by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2634 - refactor: remove use of message.Fatal in tools by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2602 - refactor: remove k8s package by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2627 - feat: add context to pull and data injections by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2654 - test: move creator tests into one file by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2658 - test: site and links by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2656 - chore: run unit tests on main by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2653 - fix(docs): update help docs for zarf connect to add clarity by [@​chaospuppy](https://github.com/chaospuppy) in [zarf-dev/zarf#2662 - chore!: remove logging from init package by [@​lucasrod16](https://github.com/lucasrod16) in [zarf-dev/zarf#2625 - chore: patch CVE-2024-6104 by [@​lucasrod16](https://github.com/lucasrod16) in [zarf-dev/zarf#2669 - chore: patch CVE-2024-35255 by [@​lucasrod16](https://github.com/lucasrod16) in [zarf-dev/zarf#2670 - chore: patch CVE-2024-6257 by [@​lucasrod16](https://github.com/lucasrod16) in [zarf-dev/zarf#2671 - docs: data injection by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2668 - feat: flux HelmRepo & OCIRepo support in Zarf Agent by [@​cmwylie19](https://github.com/cmwylie19) in [zarf-dev/zarf#2005 - refactor: make lint use more accessible data type by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2660 - fix: remove helpers v1 by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2679 - refactor: test and cleanup injector by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2629 - refactor: remove use message.Fatal in cmd package by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2664 - ci: cleanup windows github action by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2673 - refactor: remove message.Fatal and spinner.Fatal by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2676 - ci: add merge groups by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2680 - ci: remove dependency review merge queue and add label merge queue by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2688 - refactor: remove warnings property from packager by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2687 - refactor: remove sbom view files property from packager by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2695 - fix: remove ignore label when adopting resource by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2699 - fix: revert fix: remove ignore label when adopting resource by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2711 - ci: run e2e tests by [@​AustinAbro321](https://github.com/AustinAbro321) in [zarf-dev/zarf#2710 - refactor: test and refactor split file by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2708 - refactor: remove unused message functions and verbose logging by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2712 - refactor: connect command list printing by [@​phillebaba](https://github.com/phillebaba) in [zarf-dev/zarf#2703 - docs: add contributing doc to root and add tsc by [@​salaxander](https://github.com/salaxander) in [zarf-dev/zarf#2706 - fix: remove unpinned image warning in lint for cosign signatures by [@​jasonwashburn](https://github.com/jasonwashburn) in [zarf-dev/zarf#2681 #### New Contributors - [@​joelmccoy](https://github.com/joelmccoy) made their first contribution in [zarf-dev/zarf#2639 - [@​chaospuppy](https://github.com/chaospuppy) made their first contribution in [zarf-dev/zarf#2662 - [@​jasonwashburn](https://github.com/jasonwashburn) made their first contribution in [zarf-dev/zarf#2681 **Full Changelog**: zarf-dev/zarf@v0.35.0...v0.36.0 </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v3.25.13`](https://github.com/github/codeql-action/compare/v3.25.12...v3.25.13) [Compare Source](https://github.com/github/codeql-action/compare/v3.25.12...v3.25.13) ### [`v3.25.12`](https://github.com/github/codeql-action/compare/v3.25.11...v3.25.12) [Compare Source](https://github.com/github/codeql-action/compare/v3.25.11...v3.25.12) </details> <details> <summary>mattermost/mattermost-plugin-ai (mattermost/mattermost-plugin-ai)</summary> ### [`v0.8.3`](https://github.com/mattermost/mattermost-plugin-ai/releases/tag/v0.8.3) [Compare Source](https://github.com/mattermost/mattermost-plugin-ai/compare/v0.8.2...v0.8.3) Fixes build system producing incorrect packages. No functional changes from v0.8.2 </details> <details> <summary>renovatebot/pre-commit-hooks (renovatebot/pre-commit-hooks)</summary> ### [`v37.440.4`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.440.4) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.440.0...37.440.4) See https://github.com/renovatebot/renovate/releases/tag/37.440.4 for more changes ### [`v37.440.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.440.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.439.0...37.440.0) See https://github.com/renovatebot/renovate/releases/tag/37.440.0 for more changes ### [`v37.439.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.439.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.438.4...37.439.0) See https://github.com/renovatebot/renovate/releases/tag/37.439.0 for more changes ### [`v37.438.4`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.438.4) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.438.2...37.438.4) See https://github.com/renovatebot/renovate/releases/tag/37.438.4 for more changes ### [`v37.438.2`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.438.2) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.438.0...37.438.2) See https://github.com/renovatebot/renovate/releases/tag/37.438.2 for more changes ### [`v37.438.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.438.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.437.3...37.438.0) See https://github.com/renovatebot/renovate/releases/tag/37.438.0 for more changes ### [`v37.437.3`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.437.3) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.437.2...37.437.3) See https://github.com/renovatebot/renovate/releases/tag/37.437.3 for more changes ### [`v37.437.2`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.437.2) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.437.0...37.437.2) See https://github.com/renovatebot/renovate/releases/tag/37.437.2 for more changes ### [`v37.437.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.437.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.434.3...37.437.0) See https://github.com/renovatebot/renovate/releases/tag/37.437.0 for more changes ### [`v37.434.3`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.434.3) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.434.2...37.434.3) See https://github.com/renovatebot/renovate/releases/tag/37.434.3 for more changes ### [`v37.434.2`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.434.2) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.434.0...37.434.2) See https://github.com/renovatebot/renovate/releases/tag/37.434.2 for more changes ### [`v37.434.0`](https://github.com/renovatebot/pre-commit-hooks/compare/37.433.2...37.434.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.433.2...37.434.0) ### [`v37.433.2`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.433.2) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.433.1...37.433.2) See https://github.com/renovatebot/renovate/releases/tag/37.433.2 for more changes ### [`v37.433.1`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.433.1) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.433.0...37.433.1) See https://github.com/renovatebot/renovate/releases/tag/37.433.1 for more changes ### [`v37.433.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.433.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.432.0...37.433.0) See https://github.com/renovatebot/renovate/releases/tag/37.433.0 for more changes ### [`v37.432.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.432.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.431.7...37.432.0) See https://github.com/renovatebot/renovate/releases/tag/37.432.0 for more changes ### [`v37.431.7`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.431.7) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.431.6...37.431.7) See https://github.com/renovatebot/renovate/releases/tag/37.431.7 for more changes ### [`v37.431.6`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.431.6) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.431.5...37.431.6) See https://github.com/renovatebot/renovate/releases/tag/37.431.6 for more changes ### [`v37.431.5`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.431.5) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.431.4...37.431.5) See https://github.com/renovatebot/renovate/releases/tag/37.431.5 for more changes ### [`v37.431.4`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.431.4) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.431.2...37.431.4) See https://github.com/renovatebot/renovate/releases/tag/37.431.4 for more changes ### [`v37.431.2`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.431.2) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.431.0...37.431.2) See https://github.com/renovatebot/renovate/releases/tag/37.431.2 for more changes ### [`v37.431.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.431.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.430.0...37.431.0) See https://github.com/renovatebot/renovate/releases/tag/37.431.0 for more changes ### [`v37.430.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.430.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.429.1...37.430.0) See https://github.com/renovatebot/renovate/releases/tag/37.430.0 for more changes ### [`v37.429.1`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.429.1) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.429.0...37.429.1) See https://github.com/renovatebot/renovate/releases/tag/37.429.1 for more changes ### [`v37.429.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.429.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.428.3...37.429.0) See https://github.com/renovatebot/renovate/releases/tag/37.429.0 for more changes ### [`v37.428.3`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.428.3) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.428.2...37.428.3) See https://github.com/renovatebot/renovate/releases/tag/37.428.3 for more changes ### [`v37.428.2`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.428.2) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.428.1...37.428.2) See https://github.com/renovatebot/renovate/releases/tag/37.428.2 for more changes ### [`v37.428.1`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.428.1) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.428.0...37.428.1) See https://github.com/renovatebot/renovate/releases/tag/37.428.1 for more changes ### [`v37.428.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.428.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.427.0...37.428.0) See https://github.com/renovatebot/renovate/releases/tag/37.428.0 for more changes ### [`v37.427.0`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.427.0) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.426.5...37.427.0) See https://github.com/renovatebot/renovate/releases/tag/37.427.0 for more changes ### [`v37.426.5`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.426.5) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.426.4...37.426.5) See https://github.com/renovatebot/renovate/releases/tag/37.426.5 for more changes ### [`v37.426.4`](https://github.com/renovatebot/pre-commit-hooks/releases/tag/37.426.4) [Compare Source](https://github.com/renovatebot/pre-commit-hooks/compare/37.426.2...37.426.4) See https://github.com/renovatebot/renovate/releases/tag/37.426.4 for more changes </details> <details> <summary>step-security/harden-runner (step-security/harden-runner)</summary> ### [`v2.9.0`](https://github.com/step-security/harden-runner/releases/tag/v2.9.0) [Compare Source](https://github.com/step-security/harden-runner/compare/v2.8.1...v2.9.0) ##### What's Changed Release v2.9.0 by [@​h0x0er](https://github.com/h0x0er) and [@​varunsh-coder](https://github.com/varunsh-coder) in [step-security/harden-runner#435 This release includes: - Enterprise Tier - Telemetry Upload Enhancement: For the enterprise tier, this change helps overcome size constraints, allowing for more reliable telemetry uploads from the Harden-Runner agent to the StepSecurity backend API. No configuration change is needed to enable this. - Harden-Runner Agent Authentication: The Harden-Runner agent now uses a per-job key to authenticate to the StepSecurity backend API to submit telemetry. This change prevents the submission of telemetry data anonymously for a given job, improving the integrity of the data collection process. No configuration change is needed to enable this. - README Update: A Table of Contents has been added to the README file to improve navigation. This makes it easier for users to find the information they need quickly. - Dependency Update: Updated the `braces` npm package dependency to a non-vulnerable version. The vulnerability in `braces` did not affect the Harden Runner Action **Full Changelog**: step-security/harden-runner@v2...v2.9.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View the [repository job log](https://developer.mend.io/github/defenseunicorns/uds-package-mattermost). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQzOC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzdXBwb3J0LWRlcHMiXX0=--> --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Wayne Starr <[email protected]> Release-As: v9.10.1-uds.0
…#688) [![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | action | patch | `v4.3.3` -> `v4.3.4` | --- ### Release Notes <details> <summary>actions/dependency-review-action (actions/dependency-review-action)</summary> ### [`v4.3.4`](https://github.com/actions/dependency-review-action/releases/tag/v4.3.4) [Compare Source](https://github.com/actions/dependency-review-action/compare/v4.3.3...v4.3.4) #### What's Changed - Include all added dependencies in scorecard entries by [@​elireisman](https://github.com/elireisman) in [actions/dependency-review-action#783 - Update SPDX Expression Parsing by [@​febuiles](https://github.com/febuiles) in [actions/dependency-review-action#719 - This PR is a significant refactor of SPDX expression parsing that *may* fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version. **Full Changelog**: actions/dependency-review-action@v4.3.3...v4.3.4 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View the [repository job log](https://developer.mend.io/github/xmldom/xmldom). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQzOC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Context
Since we introduced SPDX licenses around 2022, we've had issues dealing with SPDX expression validations due to the library we use for checking whether one expression satisfies another one.
Folks reached out to the maintainer in 2022 to fix some of these changes, but set a clear direction that does not fit our purposes anymore. The
@onebeyond/spdx-license-satisfies
is a fork of the original project, created by people who encountered the same issues as us.Changes
This PR moves the Action away from
spdx-satisfies.js
and uses@onebeyond/spdx-license-satisfies
instead to check whether an SPDX license satisfies an expression or not: TheMIT
license satisfies the expressionMIT OR GPL-2.0
, but it does not satisfyMIT AND GPL-2.0
.In the process of making these changes I:
spdx.ts
.spdx.ts
noting the things we still need to support.tsconfig.json
to fix a duplicate entry in the compiler options.