Add expectations to semver_dialects based on discrepancies with vrange
Why are we doing this work
When doing Generation expectations for version matching us... (#435473 - closed) we surfaced discrepancies between the semver_dialects
gem
(used by Continuous Vulnerability Scanning) and the vrange
Go package (used by Dependency Scanning CI jobs) for affected version ranges of the GitLab Advisory DB and versions of the affected packages.
Before doing Add version matching edge cases to the semver_d... (#386070 - closed), we need to do the following:
- Identify discrepancies that are true bugs.
- Add the corresponding test cases as rspec examples,
rspec examples should be grouped so that there's at least one MR per package type. This will allow us to do #386070 (closed) one package type at a time, and possibly create dedicated issues.
Relevant links
Non-functional requirements
-
Documentation: -
Feature flag: -
Performance: -
Testing: This issue is all about adding specs to semver_dialects
.
Implementation plan
- Add specs to
semver_dialects
based on what's been surfaced in https://gitlab.com/gitlab-org/vulnerability-research/foss/semver_dialects/-/merge_requests/21+. - Create 1 MR per supported package type.
Verification steps
Not applicable.
Edited by Fabien Catteau