Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(dependency): Improve Python site-packages scanning #4823

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

JigyasuRajput
Copy link
Contributor

Description

Fixes #4330

This PR enhances the scanning of the site-packages directory by improving dependency resolution and addressing limitations of the previous approach.

Changes:

  • Replaced METADATA-based scanning with a more robust dependency resolution mechanism.
  • Implemented an iterative depth-first search (DFS) approach for resolving package dependencies, ensuring better handling of indirect dependencies.
  • Improved cycle detection to prevent infinite loops in dependency resolution.
  • Refactored the dependency graph logic for better efficiency and maintainability.

Why this is needed:

  • The previous method relied on reading the METADATA file, which might not always provide complete dependency information.
  • Unlike requirements.txt scanning (which uses pip), site-packages scanning did not properly track indirect dependencies.
  • These changes ensure a more accurate and complete vulnerability scan of installed Python packages.

Testing:

  • All unit tests pass successfully.
  • The new dependency resolution logic was validated using sample package structures.

@JigyasuRajput
Copy link
Contributor Author

Hey everyone!
If anyone has time, I'd appreciate a review on this PR. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

feat: improved scannning a python site-packages directory
1 participant