Skip to content
Merged
Show file tree
Hide file tree
Changes from 31 commits
Commits
Show all changes
78 commits
Select commit Hold shift + click to select a range
4114722
init commit for Quick fix
5byuri Feb 5, 2026
5df3fbd
quick safe
5byuri Feb 5, 2026
f70edd1
optional parameter via type
5byuri Feb 5, 2026
c28adf0
lodash example
5byuri Feb 5, 2026
d517e89
quickfix filterMajorVersions
5byuri Feb 5, 2026
46072e5
typ for npm object response
5byuri Feb 5, 2026
855294b
unmarshal
5byuri Feb 5, 2026
5ac2469
iterate through versions now
5byuri Feb 5, 2026
af4d0ab
fix struct
5byuri Feb 5, 2026
96579c4
fixxed types
5byuri Feb 5, 2026
1fb83db
iterate through every version
5byuri Feb 5, 2026
11a7839
drop -rc and return array number, next step is comparison algorithm
5byuri Feb 5, 2026
750bc72
will move to new function
5byuri Feb 5, 2026
8db9188
ugly filterMajor Version
5byuri Feb 5, 2026
6a0cf42
show recommended versions now
5byuri Feb 5, 2026
459494b
update types
5byuri Feb 6, 2026
18475c3
mergemainMerge remote-tracking branch 'origin/main' into Improve-Quic…
5byuri Feb 9, 2026
d5bdefa
walkDependencyTree
5byuri Feb 9, 2026
af066c2
walk dep
5byuri Feb 9, 2026
34aefed
walk direct dependency tree and store packages that haven't been stor…
5byuri Feb 11, 2026
24c38e4
code is not cleaner, but doing optional dependencies now too and sort…
5byuri Feb 11, 2026
12451c9
refactor code and do latetst check first
5byuri Feb 11, 2026
b7e39e2
polish quickfix algorithm
5byuri Feb 13, 2026
8da14dd
apply copilot review
5byuri Feb 13, 2026
830c345
apply licenese
5byuri Feb 13, 2026
456ae95
added check to make sure that input has a transitive path with and no…
5byuri Feb 13, 2026
bef95f7
return is fixed in full purl
5byuri Feb 13, 2026
97457a6
use semver and packageurl instead
5byuri Feb 17, 2026
3a8a019
resolveBestVersion added
5byuri Feb 17, 2026
7c57e7e
apply refactor and copilot suggestions
5byuri Feb 18, 2026
262fd97
improve recommended versions
5byuri Feb 18, 2026
f12051f
is valid semver replace with semver.isvalid
5byuri Feb 18, 2026
6a87fdd
resolve || case response and use the or case which is closest to the …
5byuri Feb 18, 2026
efa3656
added quickfix test
5byuri Feb 19, 2026
dd6f618
added test for split case, dand dependencymap
5byuri Feb 19, 2026
d445b61
merge mainMerge remote-tracking branch 'origin/main' into Improve-Qui…
5byuri Feb 19, 2026
69efdcd
resolve test
5byuri Feb 19, 2026
98e1778
normalize version if people have incomplete semver
5byuri Feb 19, 2026
ac300c3
not result to npm
5byuri Feb 19, 2026
3018dd4
fix license
5byuri Feb 19, 2026
698456b
iresolve ^ bette
5byuri Feb 20, 2026
967d230
hardcode remove
5byuri Feb 20, 2026
42a9a66
Debian get request prefix
5byuri Feb 24, 2026
c1d527f
remove hardcode
5byuri Feb 24, 2026
d308d8f
added resolver, decluttering, thanks tim
5byuri Feb 24, 2026
4262931
updated debian resolver, right now it fetches fetches Package.xz, so …
5byuri Feb 25, 2026
e9eb1f0
the resolver now gets dynamically detected
5byuri Feb 25, 2026
12a0f31
license
5byuri Feb 25, 2026
873f0da
move versioning to resolver
5byuri Mar 2, 2026
247f81e
ParseVersion should be resolver dependent and resolve to suite better
5byuri Mar 2, 2026
985c182
fix super redundant function
5byuri Mar 2, 2026
49ee1bf
simplify debian dependency parsing and fix version resolution
5byuri Mar 2, 2026
4464e87
remove old code, improve algorithm to parse string
5byuri Mar 2, 2026
fd95052
fix scoping issue and add tests
5byuri Mar 2, 2026
9293d96
fix npm response struct
5byuri Mar 3, 2026
9457595
urlEscape added, / gets turned in %20
5byuri Mar 3, 2026
ec72a22
fix license struct and improve debian resolve
5byuri Mar 3, 2026
f0a78e2
move dependency version extraction to resolver
5byuri Mar 4, 2026
55d1f85
timothy commit
5byuri Mar 4, 2026
24d9d06
code review push
5byuri Mar 5, 2026
acf999c
runresolvefixedversion wrapper that
5byuri Mar 5, 2026
9cf29c9
fix fx test
5byuri Mar 5, 2026
0926b9c
merge mainMerge remote-tracking branch 'origin/main' into Improve-Qui…
5byuri Mar 5, 2026
58bb714
merge mainMerge branch 'main' into HEAD
5byuri Mar 5, 2026
1552a80
create endpoint
5byuri Mar 9, 2026
f9d1fcf
return purl instead
5byuri Mar 9, 2026
701aff6
merge Merge branch 'Improve-Quick-Fix' of github.com:l3montree-dev/de…
5byuri Mar 9, 2026
700bafb
fix linter error
5byuri Mar 16, 2026
eeb2eaa
added missing dependncy for injection configuarion
5byuri Mar 16, 2026
eaf2f32
merged with main
timbastin Mar 20, 2026
3a30413
renames to fixedVersionResolver
timbastin Mar 20, 2026
c0f7377
using semver in npm resolver, removes writing package.json, adds benc…
timbastin Mar 20, 2026
006822c
reduced packagesXZ size to only 9mb memory by using arena approach an…
timbastin Mar 20, 2026
27bfc3e
optimized using token lookup and single arena slice
timbastin Mar 20, 2026
ea69fa5
corrects npm constraints
timbastin Mar 20, 2026
6f421d3
moves tests to dedicated files
timbastin Mar 20, 2026
1f5e63c
fixes tests
timbastin Mar 20, 2026
e80c89e
adds 12 hour caching of index entries
timbastin Mar 20, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 87 additions & 0 deletions cmd/devguard-cli/test/package_manager_functions.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,87 @@
// Copyright 2026 lars hermges @ l3montree GmbH

// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as
// published by the Free Software Foundation, either version 3 of the
// License, or (at your option) any later version.
Comment thread
5byuri marked this conversation as resolved.
Outdated
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see <https://www.gnu.org/licenses/>.

package main

import (
"fmt"
"net/http"
"strings"
"time"
)

type RegistryRequest struct {
Dependency string
Version string // empty string means "all versions"
}

var httpClient = &http.Client{
Timeout: 30 * time.Second,
}

Copy link

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

timeoutDetection and VersionExists are currently unused. With golangci-lint’s unused linter enabled, these unused functions will likely fail CI; please remove them or wire them into the code/tests.

Suggested change
var (
_ = timeoutDetection
_ = VersionExists
)

Copilot uses AI. Check for mistakes.
// get all versions if no version is specified
func GetNPMRegistry(pkg RegistryRequest) (*http.Response, error) {
var req *http.Response
var err error

normalizedVersion := strings.Trim(pkg.Version, "/") // remove quotes if present
Copy link

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment says this trims quotes, but strings.Trim(pkg.Version, "/") only removes slashes. Either update the normalization (likely align it with normalizeVersion in quickfix.go) or fix the comment so it matches the actual behavior.

Suggested change
normalizedVersion := strings.Trim(pkg.Version, "/") // remove quotes if present
normalizedVersion := strings.Trim(pkg.Version, "/") // remove leading/trailing slashes if present

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment says "remove quotes if present", but strings.Trim(pkg.Version, "/") removes slashes, not quotes. Either adjust the trimming to match the intended behavior (e.g., trim quotes/whitespace) or update the comment to avoid misleading future changes.

Suggested change
normalizedVersion := strings.Trim(pkg.Version, "/") // remove quotes if present
normalizedVersion := strings.Trim(pkg.Version, " \"'") // remove surrounding quotes/whitespace if present

Copilot uses AI. Check for mistakes.

if pkg.Version != "" {
req, err = httpClient.Get("https://registry.npmjs.org/" + pkg.Dependency + "/" + normalizedVersion)
} else {
req, err = httpClient.Get("https://registry.npmjs.org/" + pkg.Dependency)
}
Comment thread
5byuri marked this conversation as resolved.
Outdated

if err != nil {
if req != nil {
req.Body.Close()
}
Comment thread
5byuri marked this conversation as resolved.
Outdated
return nil, err
}

if req.StatusCode != 200 {
req.Body.Close()
return nil, fmt.Errorf("failed to fetch data for %s: %s", pkg.Dependency, req.Status)
}
return req, nil
}

func GetCratesRegistry(pkg RegistryRequest) (*http.Response, error) {
var req *http.Response
var err error

if pkg.Version != "" {
req, err = httpClient.Get("https://crates.io/api/v1/crates/" + pkg.Dependency + "/" + pkg.Version)
} else {
req, err = httpClient.Get("https://crates.io/api/v1/crates/" + pkg.Dependency)
Comment thread
5byuri marked this conversation as resolved.
Outdated
}

if err != nil {
if req != nil {
req.Body.Close()
}
Copy link

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This check may cause issues. If an error occurs during the HTTP request (err != nil), the req variable will be nil, causing a panic when trying to call req.Body.Close(). The nil check should come before attempting to close the body.

Copilot uses AI. Check for mistakes.
return nil, err
}

if req.StatusCode != 200 {
req.Body.Close()
return nil, fmt.Errorf("failed to fetch data for %s: %s", pkg.Dependency, req.Status)
}
return req, nil
}

// func getMavenRegistry(DirectDependency string, packageManager string) (*http.Response, error) {
// insert http request for maven registry here later
// }
Loading
Loading