nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: google/osv-scanner
Pull request #161 (2023-01-22 22:52:24)

fix: exit with generic non-zero code when there is a general error
Addresses something I noticed in #94 - I was expecting it to require more hoop jumping but realised this should be a pretty robust/correct solution.

Right now there is only one primary cases where an error is printed but the actual error does not result in the function bailing out, though this will be expanded a little by the changes in #94.

(this'll need rebasing when #158 is landed)

G-Rath: Yeah those errors are really "soft panics" - I've resisted using the reporter because it would be a substantial API change (both in terms of the actual signatures + the fact that it means anyone using the parsers as a library would then-on have to pass this whole other structure, which feels very unwieldy).

If you feel really strongly about them, I'd recommend changing them to actual panics. 

Patch:
diff --git a/cmd/osv-scanner/main.go b/cmd/osv-scanner/main.go
index 53cd51e..3b545cb 100644
--- a/cmd/osv-scanner/main.go
+++ b/cmd/osv-scanner/main.go
@@ -22,7 +22,7 @@ func run(args []string, stdout, stderr io.Writer) int {
 	var r *output.Reporter
 
 	cli.VersionPrinter = func(ctx *cli.Context) {
-		r = output.NewReporter(stdout, stderr, "")
+		r = output.NewReporter(ctx.App.Writer, ctx.App.ErrWriter, "")
 		r.PrintText(fmt.Sprintf("osv-scanner version: %s\ncommit: %s\nbuilt at: %s\n", ctx.App.Version, commit, date))
 	}
 
@@ -128,7 +128,11 @@ func run(args []string, stdout, stderr io.Writer) int {
 		}
 
 		r.PrintError(fmt.Sprintf("%v\n", err))
+	}
 
+	// if we've been told to print an error, and not already exited with
+	// a specific error code, then exit with a generic non-zero code
+	if r != nil && r.HasPrintedError() {
 		return 127
 	}
 
diff --git a/internal/output/reporter.go b/internal/output/reporter.go
index 50679a8..cd744aa 100644
--- a/internal/output/reporter.go
+++ b/internal/output/reporter.go
@@ -9,9 +9,10 @@ import (
 )
 
 type Reporter struct {
-	stdout io.Writer
-	stderr io.Writer
-	format string
+	stdout          io.Writer
+	stderr          io.Writer
+	format          string
+	hasPrintedError bool
 }
 
 func NewReporter(stdout io.Writer, stderr io.Writer, format string) *Reporter {
@@ -34,6 +35,11 @@ func NewVoidReporter() *Reporter {
 // is outputting as JSON or not
 func (r *Reporter) PrintError(msg string) {
 	fmt.Fprint(r.stderr, msg)
+	r.hasPrintedError = true
+}
+
+func (r *Reporter) HasPrintedError() bool {
+	return r.hasPrintedError
 }
 
 // PrintText writes the given message to stdout, _unless_ the reporter is set


Test patch:
diff --git a/cmd/osv-scanner/main_test.go b/cmd/osv-scanner/main_test.go
index 26e4ff3..1bc3e01 100644
--- a/cmd/osv-scanner/main_test.go
+++ b/cmd/osv-scanner/main_test.go
@@ -160,7 +160,7 @@ func TestRun(t *testing.T) {
 		{
 			name:         "",
 			args:         []string{"", "./fixtures/locks-many-with-invalid"},
-			wantExitCode: 0,
+			wantExitCode: 127,
 			wantStdout: `
 				Scanning dir ./fixtures/locks-many-with-invalid
 				Scanned %%/fixtures/locks-many-with-invalid/Gemfile.lock file and found 1 packages
Repository: google/osv-scanner
Pull request #295 (2023-03-14 01:07:25)

Set version in source code
Set the release version in the source code. 

An alternative to setting the version directly in source code is to get package repositories to build their osv-scanner with goreleaser instead of go directly. While goreleaser is often already in most repositories, it is not as straightforward:

- Package repositories sometimes have their own guidelines for how to build go, e.g. Arch Linux go binaries must be built with hardened options which we currently do not do with goreleaser.
- goreleaser also expects to be in a git repository (to get version tags), but most build systems prefers downloading the source code in a tarball instead of checking out the repository. 


Patch:
diff --git a/cmd/osv-scanner/main.go b/cmd/osv-scanner/main.go
index b9a3ea6..b1d02f3 100644
--- a/cmd/osv-scanner/main.go
+++ b/cmd/osv-scanner/main.go
@@ -13,7 +13,8 @@ import (
 )
 
 var (
-	version = "dev"
+	// Update this variable when doing a release
+	version = "1.2.0"
 	commit  = "n/a"
 	date    = "n/a"
 )


Test patch:
diff --git a/cmd/osv-scanner/main_test.go b/cmd/osv-scanner/main_test.go
index dd824cf..2fa2487 100644
--- a/cmd/osv-scanner/main_test.go
+++ b/cmd/osv-scanner/main_test.go
@@ -4,10 +4,13 @@ package main
 import (
 	"bytes"
 	"fmt"
+	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
+
+	"github.com/go-git/go-git/v5"
 )
 
 func dedent(t *testing.T, str string) string {
@@ -115,7 +118,7 @@ func TestRun(t *testing.T) {
 			args:         []string{"", "--version"},
 			wantExitCode: 0,
 			wantStdout: `
-				osv-scanner version: dev
+				osv-scanner version: 1.2.0
 				commit: n/a
 				built at: n/a
 			`,
@@ -489,3 +492,14 @@ func TestRun_LockfileWithExplicitParseAs(t *testing.T) {
 		})
 	}
 }
+
+func TestMain(m *testing.M) {
+	// Temporarily make the fixtures folder a git repository to prevent gitignore files messing with tests.
+	_, err := git.PlainInit("./fixtures", false)
+	if err != nil {
+		panic(err)
+	}
+	code := m.Run()
+	os.RemoveAll("./fixtures/.git")
+	os.Exit(code)
+}
Repository: google/osv-scanner
Pull request #316 (2023-03-28 02:55:49)

Update changelog and version for v1.3.0


Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 92d27f9..de62b75 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,29 @@
+v1.3.0:
+===
+
+### Major Features:
+
+- [Feature #198](https://github.com/google/osv-scanner/pull/198) GoVulnCheck integration! Try it out when scanning go code by adding the `--experimental-call-analysis` flag.
+- [Feature #260](https://github.com/google/osv-scanner/pull/198) Support `-r` flag in `requirements.txt` files.
+- [Feature #300](https://github.com/google/osv-scanner/pull/300) Make `IgnoredVulns` also ignore aliases.
+- [Feature #304](https://github.com/google/osv-scanner/pull/304) OSV-Scanner now runs faster when there's multiple vulnerabilities.
+
+### Fixes
+- [Bug #249](https://github.com/google/osv-scanner/issues/249) Support yarn locks with quoted properties.
+- [Bug #232](https://github.com/google/osv-scanner/issues/232) Parse nested CycloneDX components correctly.
+- [Bug #257](https://github.com/google/osv-scanner/issues/257) More specific cyclone dx parsing.
+- [Bug #256](https://github.com/google/osv-scanner/issues/256) Avoid panic when parsing `file:` dependencies in `pnpm` lockfiles.
+- [Bug #261](https://github.com/google/osv-scanner/issues/261) Deduplicate packages that appear multiple times in `Pipenv.lock` files.
+- [Bug #267](https://github.com/google/osv-scanner/issues/267) Properly handle comparing zero versions in Maven.
+- [Bug #279](https://github.com/google/osv-scanner/issues/279) Trim leading zeros off when comparing numerical components in Maven versions.
+- [Bug #291](https://github.com/google/osv-scanner/issues/291) Check if PURL is valid before adding it to queries.
+- [Bug #293](https://github.com/google/osv-scanner/issues/293) Avoid infinite loops parsing Maven poms with syntax errors
+- [Bug #295](https://github.com/google/osv-scanner/issues/295) Set version in the source code, this allows version to be displayed in most package managers.
+- [Bug #297](https://github.com/google/osv-scanner/issues/297) Support Pipenv develop packages without versions.
+
+#### API Features
+- [Feature #310](https://github.com/google/osv-scanner/pull/310) Improve the OSV models to allow for 3rd party use of the library.
+
 v1.2.0:
 ===
 
diff --git a/cmd/osv-scanner/main.go b/cmd/osv-scanner/main.go
index b1d02f3..df386d3 100644
--- a/cmd/osv-scanner/main.go
+++ b/cmd/osv-scanner/main.go
@@ -14,7 +14,7 @@ import (
 
 var (
 	// Update this variable when doing a release
-	version = "1.2.0"
+	version = "1.3.0"
 	commit  = "n/a"
 	date    = "n/a"
 )


Test patch:
diff --git a/cmd/osv-scanner/main_test.go b/cmd/osv-scanner/main_test.go
index 2fa2487..7337da5 100644
--- a/cmd/osv-scanner/main_test.go
+++ b/cmd/osv-scanner/main_test.go
@@ -118,7 +118,7 @@ func TestRun(t *testing.T) {
 			args:         []string{"", "--version"},
 			wantExitCode: 0,
 			wantStdout: `
-				osv-scanner version: 1.2.0
+				osv-scanner version: 1.3.0
 				commit: n/a
 				built at: n/a
 			`,
Repository: google/osv-scanner
Pull request #321 (2023-03-30 02:54:53)

Release 1.3.1 changelog


Patch:
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index d8b4606..74d4300 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -66,4 +66,4 @@ jobs:
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.5.0
     with:
       base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
-      upload-assets: true # upload to a new release
+      upload-assets: false # upload to a new release
diff --git a/CHANGELOG.md b/CHANGELOG.md
index de62b75..758ba2f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+v1.3.1:
+===
+
+### Fixes
+- [Bug #319](https://github.com/google/osv-scanner/issues/319) Fix segmentation fault when parsing CycloneDX without dependencies. 
+
 v1.3.0:
 ===
 
diff --git a/cmd/osv-scanner/main.go b/cmd/osv-scanner/main.go
index df386d3..7d80646 100644
--- a/cmd/osv-scanner/main.go
+++ b/cmd/osv-scanner/main.go
@@ -14,7 +14,7 @@ import (
 
 var (
 	// Update this variable when doing a release
-	version = "1.3.0"
+	version = "1.3.1"
 	commit  = "n/a"
 	date    = "n/a"
 )


Test patch:
diff --git a/cmd/osv-scanner/main_test.go b/cmd/osv-scanner/main_test.go
index 7337da5..fd382a5 100644
--- a/cmd/osv-scanner/main_test.go
+++ b/cmd/osv-scanner/main_test.go
@@ -118,7 +118,7 @@ func TestRun(t *testing.T) {
 			args:         []string{"", "--version"},
 			wantExitCode: 0,
 			wantStdout: `
-				osv-scanner version: 1.3.0
+				osv-scanner version: 1.3.1
 				commit: n/a
 				built at: n/a
 			`,
Repository: google/osv-scanner
Pull request #367 (2023-05-05 00:47:46)

fix: don't panic on empty  files
Copied from G-Rath/osv-detector#191

Co-authored-by: Gareth Jones <Jones258@Gmail.com>

fixes: #364


Patch:
diff --git a/pkg/lockfile/fixtures/pnpm/empty.yaml b/pkg/lockfile/fixtures/pnpm/empty.yaml
index 338e41a..809b4b2 100644
--- a/pkg/lockfile/fixtures/pnpm/empty.yaml
+++ b/pkg/lockfile/fixtures/pnpm/empty.yaml
@@ -1,7 +1,1 @@
-lockfileVersion: 5.3
-
-specifiers:
-
-dependencies:
-
-packages:
+# this is an empty file!
diff --git a/pkg/lockfile/fixtures/pnpm/no-packages.yaml b/pkg/lockfile/fixtures/pnpm/no-packages.yaml
new file mode 100644
index 0000000..338e41a
--- /dev/null
+++ b/pkg/lockfile/fixtures/pnpm/no-packages.yaml
@@ -0,0 +1,7 @@
+lockfileVersion: 5.3
+
+specifiers:
+
+dependencies:
+
+packages:
diff --git a/pkg/lockfile/parse-pnpm-lock.go b/pkg/lockfile/parse-pnpm-lock.go
index 4e36794..75c3aa2 100644
--- a/pkg/lockfile/parse-pnpm-lock.go
+++ b/pkg/lockfile/parse-pnpm-lock.go
@@ -177,5 +177,10 @@ func ParsePnpmLock(pathToLockfile string) ([]PackageDetails, error) {
 		return []PackageDetails{}, fmt.Errorf("could not parse %s: %w", pathToLockfile, err)
 	}
 
+	// this will happen if the file is empty
+	if parsedLockfile == nil {
+		parsedLockfile = &PnpmLockfile{}
+	}
+
 	return parsePnpmLock(*parsedLockfile), nil
 }


Test patch:
diff --git a/pkg/lockfile/parse-pnpm-lock_test.go b/pkg/lockfile/parse-pnpm-lock_test.go
index 72638f4..05b379d 100644
--- a/pkg/lockfile/parse-pnpm-lock_test.go
+++ b/pkg/lockfile/parse-pnpm-lock_test.go
@@ -23,7 +23,7 @@ func TestParsePnpmLock_InvalidYaml(t *testing.T) {
 	expectPackages(t, packages, []lockfile.PackageDetails{})
 }
 
-func TestParsePnpmLock_NoPackages(t *testing.T) {
+func TestParsePnpmLock_Empty(t *testing.T) {
 	t.Parallel()
 
 	packages, err := lockfile.ParsePnpmLock("fixtures/pnpm/empty.yaml")
@@ -35,6 +35,18 @@ func TestParsePnpmLock_NoPackages(t *testing.T) {
 	expectPackages(t, packages, []lockfile.PackageDetails{})
 }
 
+func TestParsePnpmLock_NoPackages(t *testing.T) {
+	t.Parallel()
+
+	packages, err := lockfile.ParsePnpmLock("fixtures/pnpm/no-packages.yaml")
+
+	if err != nil {
+		t.Errorf("Got unexpected error: %v", err)
+	}
+
+	expectPackages(t, packages, []lockfile.PackageDetails{})
+}
+
 func TestParsePnpmLock_OnePackage(t *testing.T) {
 	t.Parallel()
Repository: google/osv-scanner
Pull request #387 (2023-05-17 04:38:08)

Add new line and fix test to avoid having to change version twice


Patch:
diff --git a/pkg/reporter/table_reporter.go b/pkg/reporter/table_reporter.go
index bb24bea..69d07db 100644
--- a/pkg/reporter/table_reporter.go
+++ b/pkg/reporter/table_reporter.go
@@ -39,7 +39,7 @@ func (r *TableReporter) PrintText(msg string) {
 
 func (r *TableReporter) PrintResult(vulnResult *models.VulnerabilityResults) error {
 	if len(vulnResult.Results) == 0 && !r.hasPrintedError {
-		fmt.Fprintf(r.stdout, "No vulnerabilities found")
+		fmt.Fprintf(r.stdout, "No vulnerabilities found\n")
 		return nil
 	}
 


Test patch:
diff --git a/cmd/osv-scanner/main_test.go b/cmd/osv-scanner/main_test.go
index 04b768d..978ddc4 100644
--- a/cmd/osv-scanner/main_test.go
+++ b/cmd/osv-scanner/main_test.go
@@ -117,11 +117,11 @@ func TestRun(t *testing.T) {
 			name:         "",
 			args:         []string{"", "--version"},
 			wantExitCode: 0,
-			wantStdout: `
-				osv-scanner version: 1.3.3
+			wantStdout: fmt.Sprintf(`
+				osv-scanner version: %s
 				commit: n/a
 				built at: n/a
-			`,
+			`, version),
 			wantStderr: "",
 		},
 		// one specific supported lockfile