fix: don't overwrite workspace.dependencies from members

aquasecurity · Jan 26, 2024 · 7b31975 · 7b31975
1 parent 5bc74fd
commit 7b31975
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/pkg/fanal/analyzer/language/rust/cargo/cargo.go b/pkg/fanal/analyzer/language/rust/cargo/cargo.go
@@ -211,7 +211,9 @@ func (a cargoAnalyzer) parseCargoTOML(fsys fs.FS, filePath string) (map[string]s
 			log.Logger.Warnf("Unable to parse %q: %s", memberPath, err)
 			continue
 		}
-		maps.Copy(dependencies, memberDeps)
+		// Member dependencies shouldn't overwrite dependencies from root cargo.toml file
+		maps.Copy(memberDeps, dependencies)
+		dependencies = memberDeps
 	}
 
 	deps := make(map[string]string)

diff --git a/pkg/fanal/analyzer/language/rust/cargo/cargo_test.go b/pkg/fanal/analyzer/language/rust/cargo/cargo_test.go
@@ -445,10 +445,9 @@ func Test_cargoAnalyzer_Analyze(t *testing.T) {
 								},
 							},
 							{
-								ID:       "regex@1.10.2",
-								Name:     "regex",
-								Version:  "1.10.2",
-								Indirect: true,
+								ID:      "regex@1.10.2",
+								Name:    "regex",
+								Version: "1.10.2",
 								Locations: []types.Location{
 									{
 										StartLine: 50,