You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We currently have three ways of handling API version queries:
For semver versions: We first match against the affected version range (using normalization) and then apply generic version matching (affected versions match) to refine the results.
For non-semver versions with comparison support: We pull all related packages from db, check their affected versions, and then compare them with the affected version ranges.
For non-semver versions without comparison support: We only pull packages that contain the currently queried version within their affected versions (using affected_fuzz).
Both semver version query and range comparison query methods match against affected versions and affected ranges, and providing the best coverage. We should use the range comparison method for all non-semver ecosystems, as it offers accurate results (also it doesn't slow down much):
Alpine
AlmaLinux
Bioconductor
CRAN
Debian
Chainguard
GHC
Hackage
Maven
NuGet
openSUSE
Packagist
Pub
PyPI
Red Hat
Rocky Linux
RubyGems
SUSE
Ubuntu
Wolfi
We could also potentially apply the version comparison method to the semver ecosystem to unify our query methods and simplify our code logic. This needs more testing to assess its impact on performance and accuracy.
semver version (unsure for this one)
The text was updated successfully, but these errors were encountered:
We currently have three ways of handling API version queries:
affected_fuzz
).Both semver version query and range comparison query methods match against affected versions and affected ranges, and providing the best coverage. We should use the range comparison method for all non-semver ecosystems, as it offers accurate results (also it doesn't slow down much):
We could also potentially apply the version comparison method to the semver ecosystem to unify our query methods and simplify our code logic. This needs more testing to assess its impact on performance and accuracy.
The text was updated successfully, but these errors were encountered: