Repository navigation
fix: read the venv with uv pip list so the repo installed from its own directory has a version (TC-7405) - #495
Merged
tmihalac merged 1 commit intoNov 5, 2026
Conversation
…own directory has a version (TC-7405) The pyyaml 5.3 case (CVE-2020-14343) still failed the integration test on PR 492 with false_positive: "Version check completed - 1 package(s) matched but none are vulnerable ... stdlib:None (unknown)". pyyaml has only setup.py, so `uv pip install .` installs pyyaml itself into transitive_env, and `uv pip freeze` prints it as "pyyaml @ file:///..." without a version. parse_python_venv skipped such lines, so the version check found no pyyaml and fell back to the stdlib check. It now runs `uv pip list --format=freeze`, which prints "pyyaml==5.3". Verified with real uv: freeze prints "pyyaml @ file:///tmp/...", list prints "pyyaml==5.3". The real-uv pyyaml test now also checks parse_python_venv. Co-Authored-By: Claude Opus 5.5 <[email protected]> (cherry picked from commit e9aca6c)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Follow-up to #493 and #494 (TC-7405). This commit was pushed to the #494 branch after #494 had merged, so it is not on
main.The pyyaml 5.3 case (CVE-2020-14343) still failed the Tekton integration test on the 0.0.5 backport #492, with label
false_positive:Cause
pyyaml has only
setup.py, souv pip install .installs pyyaml itself intotransitive_env.parse_python_venvread the venv withuv pip freeze, which prints that package aspyyaml @ file:///...with no version. The parser skipsname @ urllines, so the version check found no pyyaml ("NO MATCH [nvd]: pyyaml not found in dependencies") and fell back to the stdlib check.Change
parse_python_venvrunsuv pip list --format=freeze, which printspyyaml==5.3. Thepackage_matchers.pydocstring is updated to match.Verification
uv pip freezeprintspyyaml @ file:///tmp/..., anduv pip list --format=freezeprintspyyaml==5.3.src/vuln_analysis/utils/tests/test_lock_file_parsers.py. It fails before the change ({}) and passes after it ({"pyyaml": "5.3"}).test_python_dep_tree_real_uv.pynow also checksparse_python_venvon the real venv, and it passes.test_lock_file_parsers.py,test_python_build_tree.py,test_python_dep_tree_real_uv.py,tests/test_version_check.py,tests/test_package_identifier.py).The same fix is on #492 (0.0.5) as
34e6c6ef.🤖 Generated with Claude Code