Found while regenerating goldens for #423. Not caused by that PR, and not blocking it.
What happens
scan-swiftpm pins the fixture repository with --ref, but the fixture's own Package.resolved does not pin every dependency. swift-http-types is absent from it, so swiftpm-native resolves it live and the golden records whatever version the version range currently selects. This run moved it 1.6.0 → 1.7.0 with no Bomly change:
- "id": "pkg:swift/github.com/apple/swift-http-types@1.6.0",
+ "id": "pkg:swift/github.com/apple/swift-http-types@1.7.0",
Confirmed by cloning bomly-dev/example-swift-swiftpm and checking Package.resolved: no pin entry for that identity.
Why it matters
The golden fails whenever Apple publishes a new swift-http-types release, on a pull request that did not touch Swift — the same class of failure Codex raised about the SBOM export case running against a mutable main, which #423 fixed by pinning to a tag. Here the repository ref is already pinned; the gap is inside the fixture.
Options
- Commit a complete
Package.resolved in bomly-dev/example-swift-swiftpm so every transitive dependency is pinned. Most faithful to how the detector is meant to be exercised, and fixes it at the source.
- Normalize the version of unpinned Swift dependencies in
normalizeJSON. Cheaper, but it hides exactly the field the case exists to assert.
- Check whether the other build-tool-backed native detectors (
pub-native, sbt-native) have the same exposure — they resolve through their own toolchains and may not pin either.
The first option is the one worth taking; the third should be checked regardless.
Found while regenerating goldens for #423. Not caused by that PR, and not blocking it.
What happens
scan-swiftpmpins the fixture repository with--ref, but the fixture's ownPackage.resolveddoes not pin every dependency.swift-http-typesis absent from it, soswiftpm-nativeresolves it live and the golden records whatever version the version range currently selects. This run moved it 1.6.0 → 1.7.0 with no Bomly change:Confirmed by cloning
bomly-dev/example-swift-swiftpmand checkingPackage.resolved: no pin entry for that identity.Why it matters
The golden fails whenever Apple publishes a new
swift-http-typesrelease, on a pull request that did not touch Swift — the same class of failure Codex raised about the SBOM export case running against a mutablemain, which #423 fixed by pinning to a tag. Here the repository ref is already pinned; the gap is inside the fixture.Options
Package.resolvedinbomly-dev/example-swift-swiftpmso every transitive dependency is pinned. Most faithful to how the detector is meant to be exercised, and fixes it at the source.normalizeJSON. Cheaper, but it hides exactly the field the case exists to assert.pub-native,sbt-native) have the same exposure — they resolve through their own toolchains and may not pin either.The first option is the one worth taking; the third should be checked regardless.