Skip to content
  • Oscar Tovar's avatar
    Upgrade semver_dialects gem from 2.0.2 to 3.0.0 · cf12d7d1
    Oscar Tovar authored
    This improves the accuracy of Continuous Vulnerability Scanning and
    License Scanning when comparing the version of a SBOM component to the
    advisory database and the license database, respectively.
    
    Additionally, this changes the error handling of raised errors from
    license scanning so that they're always sent to Sentry as recommended by
    the developer documentation. Previously, the messages were only logged
    which meant that after the log TTL passed, we'd be left with a very hard
    to debug situation as was the case with the initial update to v3.0.0.
    Sentry does not have the same restrictions, so this improves our ability
    to debug any increase in the error rate.
    
    Lastly, the error tracking now includes, the following information that
    provides more detail into what went wrong:
    
    * The version of the package being checked
    * The range of the licenses known - lowest and highest version strings
    * The package name and purl type
    
    This means that we can check the license exports directly to find invalid
    constraints in the exports instead of requiring access to the instance
    database.
    cf12d7d1