Skip to content

Commit b252f38

Browse files
facutuescaruyadorno
authored andcommitted
tools: update undici CPE in vuln checking script
This changes the search method for `undici` on the NVD database. Before, since `undici` did not have a CPE assigned, the search was by keyword. Now that a CPE was assigned, it is used to query for new vulnerabilities. PR-URL: #44128 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Mohammed Keyvanzadeh <[email protected]>
1 parent 960a209 commit b252f38

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

tools/dep_checker/dependencies.py

+3-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,9 @@ def get_cpe(self) -> Optional[str]:
4747
version=vp.get_libuv_version(), cpe=CPE(vendor="libuv_project", product="libuv")
4848
),
4949
"undici": Dependency(
50-
version=vp.get_undici_version(), cpe=None, keyword="undici", npm_name="undici"
50+
version=vp.get_undici_version(),
51+
cpe=CPE(vendor="nodejs", product="undici"),
52+
npm_name="undici",
5153
),
5254
"OpenSSL": Dependency(
5355
version=vp.get_openssl_version(), cpe=CPE(vendor="openssl", product="openssl")

0 commit comments

Comments
 (0)