🤖 Dependabot's core logic for creating update PRs.
This report presents the forensic synthetic code analysis of dependabot/dependabot-core, a Ruby project with 5,708 GitHub stars. SynthScan v2.0 examined 522,685 lines of code across 2313 source files, recording 1518 pattern matches distributed across 17 syntactic categories. The overall adjusted score of 4.0 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1518 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …toolchain/lib/dependabot/rust_toolchain/file_parser.rb | 89 | def parse_plaintext_toolchain(content) = content.strip | CODE |
| LOW | …rust_toolchain/update_checker/latest_version_finder.rb | 33 | def apply_post_fetch_latest_versions_filter(releases) | CODE |
| LOW | …rust_toolchain/update_checker/latest_version_finder.rb | 42 | def apply_post_fetch_lowest_security_fix_versions_filter(releases) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_fetcher.rb | 107 | def terraform_file_local_module_details(file) | CODE |
| LOW | …aform/lib/dependabot/terraform/requirements_updater.rb | 116 | def update_registry_requirement(req) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_updater.rb | 83 | def updated_terraform_file_content(file) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_updater.rb | 139 | def update_registry_declaration(new_req, old_req, updated_content) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_updater.rb | 268 | def update_lockfile_declaration(updated_manifest_files) # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComple | CODE |
| LOW | terraform/lib/dependabot/terraform/file_updater.rb | 378 | def provider_declaration_regex(updated_content) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_updater.rb | 433 | def lockfile_declaration_regex(provider_source) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_updater.rb | 474 | def handle_helper_subprocess_failed_error(error) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_parser.rb | 125 | def build_terraform_dependency(file, name, source, details) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_parser.rb | 161 | def build_provider_dependency(file, name, details = {}) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_parser.rb | 187 | def deprecated_provider_error(file) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_parser.rb | 204 | def build_terragrunt_dependency(file, source) | CODE |
| LOW | terraform/lib/dependabot/terraform/file_parser.rb | 259 | def registry_source_details_from(source_string) | CODE |
| LOW | …/terraform/file_updater/provider_cli_config_builder.rb | 109 | def normalize_provider_source(source_address, name) | CODE |
| LOW | …/terraform/file_updater/provider_cli_config_builder.rb | 139 | def generate_provider_dev_overrides_config(provider_sources) | CODE |
| LOW | …ot/terraform/update_checker/latest_version_resolver.rb | 43 | def filter_versions_in_cooldown_period_from_provider(versions) | CODE |
| LOW | …ot/terraform/update_checker/latest_version_resolver.rb | 69 | def filter_versions_in_cooldown_period_from_module(versions) | CODE |
| LOW | …rn/spec/dependabot/npm_and_yarn/update_checker_spec.rb | 1488 | def contain_exactly_including_metadata(*expected) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb | 551 | def path_dependency_details_from_manifest(file) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb | 603 | def path_dependency_details_from_npm_lockfile(parsed_lockfile) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb | 615 | def convert_dependency_path_to_name(path, value) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb | 650 | def fetch_lerna_packages_from_path(path) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb | 706 | def recursive_find_directories(glob, prefix = "") | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb | 725 | def fetch_package_json_if_present(workspace) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb | 861 | def fetch_file_from_parent_directories(filename) | CODE |
| LOW | …nd_yarn/lib/dependabot/npm_and_yarn/metadata_finder.rb | 119 | def install_scripts_for_version(version) | CODE |
| LOW | …and_yarn/lib/dependabot/npm_and_yarn/update_checker.rb | 161 | def latest_resolvable_previous_version(updated_version) | CODE |
| LOW | …and_yarn/lib/dependabot/npm_and_yarn/update_checker.rb | 611 | def log_npmrc_cooldown_conflicts(existing, npmrc_days) | CODE |
| LOW | …and_yarn/lib/dependabot/npm_and_yarn/update_checker.rb | 651 | def merge_cooldown_with_npmrc_floor(existing, npmrc_days) | CODE |
| LOW | …and_yarn/lib/dependabot/npm_and_yarn/update_checker.rb | 679 | def parse_min_release_age_line(line, filename) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb | 422 | def updated_yarn_lock_content(yarn_lock) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb | 429 | def updated_pnpm_lock_content(pnpm_lock) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb | 490 | def workspace_package_json_updates(file) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb | 495 | def updated_package_json_content(file) | CODE |
| LOW | …m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb | 508 | def updated_pnpm_workspace_content(file) | CODE |
| LOW | npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb | 422 | def parse_alias_package_requirement(requirement) | CODE |
| LOW | npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb | 446 | def extract_real_name_from_alias_key(name) | CODE |
| LOW | npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb | 505 | def version_from_git_revision(requirement, git_revision) | CODE |
| LOW | …nd_yarn/lib/dependabot/npm_and_yarn/package_manager.rb | 193 | def find_engine_constraints_as_requirement(name) | CODE |
| LOW | …nd_yarn/lib/dependabot/npm_and_yarn/package_manager.rb | 483 | def ensure_valid_package_manager(name) | CODE |
| LOW | npm_and_yarn/lib/dependabot/npm_and_yarn/requirement.rb | 124 | def convert_js_constraint_to_ruby_constraint(req_string) | CODE |
| LOW | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 134 | def parse_npm_from_npm_or_yarn_rc(file, separator = "=") | CODE |
| LOW | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 146 | def parse_registry_from_npmrc_yarnrc(file, separator = "=", scope = nil) | CODE |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 184 | def parse_npm_from_yarnrc_yml(file) | CODE |
| LOW | …yarn/lib/dependabot/npm_and_yarn/dependency_grapher.rb | 162 | def inject_ephemeral_lockfile(ephemeral_lockfile) | CODE |
| LOW | …/npm_and_yarn/dependency_grapher/lockfile_generator.rb | 248 | def extract_network_error_host(message) | CODE |
| LOW | …t/npm_and_yarn/file_fetcher/path_dependency_builder.rb | 124 | def replace_yarn_lockfile_paths(dependencies_hash) | CODE |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 62 | def updated_yarn_lock_content(yarn_lock) | CODE |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 225 | def run_yarn_berry_top_level_updater(top_level_dependency_updates:, yarn_lock:) | CODE |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 273 | def pin_berry_versions_if_needed(top_level_dependency_updates, yarn_lock) | CODE |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 289 | def pin_berry_version_if_needed(dep, yarn_lock, parsed_lockfile) | CODE |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 337 | def run_yarn_berry_subdependency_updater(yarn_lock:) | CODE |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 398 | def run_yarn_top_level_updater(top_level_dependency_updates:) | CODE |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 420 | def run_yarn_subdependency_updater(yarn_lock:) | CODE |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 457 | def handle_yarn_lock_updater_error(error, yarn_lock) | CODE |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 564 | def write_temporary_dependency_files(yarn_lock, update_package_json: true) | CODE |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 640 | def post_process_yarn_lockfile(lockfile_content) | CODE |
| 1023 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …npm_and_yarn/file_updater/npm_lockfile_updater_spec.rb | 1224 | # Create an updater with the correct optional dependency | COMMENT |
| MEDIUM | …npm_and_yarn/file_updater/npm_lockfile_updater_spec.rb | 1473 | # Create a simple updater instance to test the private method | COMMENT |
| MEDIUM | …nd_yarn/lib/dependabot/npm_and_yarn/package_manager.rb | 57 | # Define a type alias for the expected class interface | COMMENT |
| MEDIUM⚡ | …t/npm_and_yarn/update_checker/latest_version_finder.rb | 89 | # This method is for latest_version_from_registry | COMMENT |
| MEDIUM | …pec/dependabot/python/pip_compile_file_matcher_spec.rb | 50 | # This file is autogenerated by pip-compile | COMMENT |
| MEDIUM | …thon/spec/dependabot/python/dependency_grapher_spec.rb | 44 | # This file is autogenerated by pip-compile | COMMENT |
| MEDIUM | …thon/spec/dependabot/python/dependency_grapher_spec.rb | 508 | # This file is autogenerated by pip-compile | COMMENT |
| MEDIUM | …thon/spec/dependabot/python/dependency_grapher_spec.rb | 987 | # This file is autogenerated by pip-compile | COMMENT |
| MEDIUM | …thon/spec/dependabot/python/dependency_grapher_spec.rb | 1007 | # This file is autogenerated by pip-compile | COMMENT |
| MEDIUM | …thon/spec/dependabot/python/dependency_grapher_spec.rb | 1027 | # This file is autogenerated by pip-compile | COMMENT |
| MEDIUM | …t/python/file_updater/pip_compile_file_updater_spec.rb | 84 | expect(updated_files.first.content).to include("# This file is autogen") | CODE |
| MEDIUM | …t/python/file_updater/pip_compile_file_updater_spec.rb | 102 | expect(updated_files.first.content).to include("# This file is autogen") | CODE |
| MEDIUM | …t/python/file_updater/pip_compile_file_updater_spec.rb | 129 | expect(file.content).to include("# This file is autogen") | CODE |
| MEDIUM | …t/python/file_updater/pip_compile_file_updater_spec.rb | 168 | .not_to include("# This file is autogen") | CODE |
| MEDIUM | …t/python/file_updater/pip_compile_file_updater_spec.rb | 181 | .to include("# This file is autogen") | CODE |
| MEDIUM | …t/python/file_updater/pip_compile_file_updater_spec.rb | 264 | expect(updated_files.first.content).to include("# This file is autogen") | CODE |
| MEDIUM | …t/python/file_updater/pip_compile_file_updater_spec.rb | 349 | expect(updated_files.first.content).to include("# This file is autogen") | CODE |
| MEDIUM | …t/python/file_updater/pip_compile_file_updater_spec.rb | 720 | # This file is autogenerated by pip-compile | COMMENT |
| MEDIUM | …t/python/file_updater/pip_compile_file_updater_spec.rb | 750 | # This file is autogenerated by pip-compile | COMMENT |
| MEDIUM | …ndabot/python/file_parser/python_requirement_parser.rb | 97 | marker = /^# This file is autogenerated by pip-compile with [pP]ython (?<version>\d+.\d+)$/m | CODE |
| MEDIUM | …/dependabot/python/file_parser/pipfile_files_parser.rb | 88 | # Create a DependencySet where each element has no requirement. Any | COMMENT |
| MEDIUM | …ependabot/python/file_parser/pyproject_files_parser.rb | 266 | # Create a DependencySet where each element has no requirement. Any | COMMENT |
| MEDIUM | …ependabot/python/file_parser/pyproject_files_parser.rb | 366 | # Create a hash with type and url from the source definition | COMMENT |
| MEDIUM | cargo/spec/dependabot/cargo/update_checker_spec.rb | 859 | # Create a mock VersionResolver instance | COMMENT |
| MEDIUM | cargo/spec/dependabot/cargo/update_checker_spec.rb | 879 | # Create a mock VersionResolver instance | COMMENT |
| MEDIUM | cargo/spec/dependabot/cargo/update_checker_spec.rb | 898 | # Create a mock VersionResolver instance | COMMENT |
| MEDIUM | …pendabot/cargo/update_checker/version_resolver_spec.rb | 810 | # Create a new resolver instance to avoid stubbing the subject | COMMENT |
| MEDIUM | …pendabot/cargo/update_checker/version_resolver_spec.rb | 851 | # Create a temporary directory to test file writing | COMMENT |
| MEDIUM | …ib/dependabot/cargo/update_checker/version_resolver.rb | 51 | # Initialize instance variables with proper T.let declarations | COMMENT |
| MEDIUM | …pec/dependabot/maven/shared/shared_requirement_spec.rb | 13 | # Define a concrete subclass inside the describe block to avoid superclass mismatch | COMMENT |
| MEDIUM | maven/lib/dependabot/maven/file_updater.rb | 167 | # Create the dependency element with the required fields, adding the appropriate indentation as text nodes | COMMENT |
| MEDIUM | …ependabot/maven/file_parser/maven_dependency_parser.rb | 29 | # Create a directory structure that maintains relative relationships | COMMENT |
| MEDIUM | …ependabot/maven/file_parser/maven_dependency_parser.rb | 118 | # Create the base directory structure with the required depth | COMMENT |
| MEDIUM | …dependabot/composer/update_checker/version_resolver.rb | 90 | # Initialize instance variables with T.let for strict typing | COMMENT |
| MEDIUM | updater/spec/support/dummy_pkg_helpers.rb | 7 | # This module provides some shortcuts for working with our two mock RubyGems packages: | COMMENT |
| MEDIUM | …ter/spec/dependabot/updater/update_type_helper_spec.rb | 9 | # Create a test class that includes the module | COMMENT |
| MEDIUM | …/spec/dependabot/updater/group_update_creation_spec.rb | 16 | # Create a test class that includes the module to test it | COMMENT |
| MEDIUM | updater/lib/github_api/dependency_submission.rb | 8 | # This class provides a data object that can be submitted to a repository's dependency submission | COMMENT |
| MEDIUM | updater/lib/dependabot/dependency_change_builder.rb | 14 | # This class is responsible for generating a DependencyChange for a given | COMMENT |
| MEDIUM | updater/lib/dependabot/update_graph_processor.rb | 17 | # This class is responsible for iterating the list of directories within a repository that the job specifies | COMMENT |
| MEDIUM | updater/lib/dependabot/dependency_snapshot.rb | 15 | # This class is the input for a Dependabot::Updater process with Dependabot::DependencyChange | COMMENT |
| MEDIUM | updater/lib/dependabot/dependency_group_engine.rb | 9 | # This class implements our strategy for keeping track of and matching dependency | COMMENT |
| MEDIUM | updater/lib/dependabot/dependency_change.rb | 15 | # This class provides methods for presenting the change set which can be used | COMMENT |
| MEDIUM | updater/lib/dependabot/notices_helpers.rb | 30 | # Create a deprecation notice if the version manager is deprecated | COMMENT |
| MEDIUM | updater/lib/dependabot/service.rb | 15 | # This class provides an output adapter for the Dependabot Service which manages | COMMENT |
| MEDIUM | updater/lib/dependabot/updater/error_handler.rb | 9 | # This class is responsible for determining how to present a Dependabot::Error | COMMENT |
| MEDIUM | updater/lib/dependabot/updater/error_handler.rb | 14 | # This class is a coarse abstraction of some shared logic that has several flags | COMMENT |
| MEDIUM | updater/lib/dependabot/updater/error_handler.rb | 71 | # This method handles errors where there is a dependency in the current | COMMENT |
| MEDIUM | updater/lib/dependabot/updater/error_handler.rb | 129 | # This method handles errors where there is no dependency in the current | COMMENT |
| MEDIUM | …ib/dependabot/updater/dependency_group_change_batch.rb | 7 | # This class is responsible for aggregating individual DependencyChange objects | COMMENT |
| MEDIUM | updater/lib/dependabot/updater/group_update_creation.rb | 12 | # This module contains the methods required to build a DependencyChange for | COMMENT |
| MEDIUM | updater/lib/dependabot/updater/group_update_creation.rb | 154 | # Create a single Dependabot::DependencyChange that aggregates everything we've updated | COMMENT |
| MEDIUM | updater/lib/dependabot/updater/operations.rb | 13 | # This module is responsible for determining which Operation a Job is requesting | COMMENT |
| MEDIUM | …ater/lib/dependabot/updater/group_update_refreshing.rb | 6 | # This module contains the methods required to refresh (upsert or recreate) | COMMENT |
| MEDIUM | …ater/operations/refresh_version_update_pull_request.rb | 7 | # This class implements our strategy for 'refreshing' an existing Pull Request | COMMENT |
| MEDIUM | …pdater/operations/refresh_group_update_pull_request.rb | 9 | # This class implements our strategy for refreshing a single Pull Request which | COMMENT |
| MEDIUM | …ter/operations/refresh_security_update_pull_request.rb | 7 | # This class implements our strategy for 'refreshing' an existing Pull Request | COMMENT |
| MEDIUM | …ater/operations/create_security_update_pull_request.rb | 7 | # This class implements our strategy for updating a single, insecure dependency | COMMENT |
| MEDIUM | …ater/operations/create_security_update_pull_request.rb | 188 | # Create a update job error to prevent dependabot-api from creating a | COMMENT |
| MEDIUM | …ndabot/updater/operations/group_update_all_versions.rb | 7 | # This class is responsible for coordinating the creation and upkeep of Pull Requests for | COMMENT |
| 28 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …etUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Run.cs | 0 | <project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj | STRING |
| HIGH | …Updater/NuGetUpdater.Cli.Test/EntryPointTests.Graph.cs | 0 | <project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj | STRING |
| HIGH | …etUpdater/NuGetUpdater.Core.Test/TemporaryDirectory.cs | 0 | <project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj | STRING |
| HIGH | …uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs | 0 | <project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj | STRING |
| HIGH | …pdater.Core.Test/Run/EndToEndTests.InsecureHttpFeed.cs | 0 | <project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj | STRING |
| HIGH | …GetUpdater/NuGetUpdater.Core.Test/Run/EndToEndTests.cs | 0 | <project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj | STRING |
| HIGH | …etUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Run.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup> | STRING |
| HIGH | …Updater/NuGetUpdater.Cli.Test/EntryPointTests.Graph.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup> | STRING |
| HIGH | …uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup> | STRING |
| HIGH | …Updater.Core.Test/Discover/SdkProjectDiscoveryTests.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup> | STRING |
| HIGH | …GetUpdater/NuGetUpdater.Core.Test/Run/EndToEndTests.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup> | STRING |
| HIGH | …ter.Core.Test/Discover/DiscoveryWorkerTests.Project.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup> | STRING |
| HIGH | …etUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Run.cs | 0 | { "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{ | STRING |
| HIGH | …/NuGetUpdater/NuGetUpdater.Core.Test/TestHttpServer.cs | 0 | { "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{ | STRING |
| HIGH | …uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs | 0 | { "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{ | STRING |
| HIGH | …Updater.Core.Test/Update/PackagesConfigUpdaterTests.cs | 0 | { "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{ | STRING |
| HIGH | …r/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs | 0 | { "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{ | STRING |
| HIGH | …r/NuGetUpdater.Core.Test/Analyze/VersionFinderTests.cs | 0 | { "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{ | STRING |
| HIGH | …etUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Run.cs | 0 | <configuration> <packagesources> <clear /> <add key="private_feed" value="{feedurl}" allowinsecureconnections="true" /> | STRING |
| HIGH | …r/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs | 0 | <configuration> <packagesources> <clear /> <add key="private_feed" value="{feedurl}" allowinsecureconnections="true" /> | STRING |
| HIGH | …r/NuGetUpdater.Core.Test/Analyze/VersionFinderTests.cs | 0 | <configuration> <packagesources> <clear /> <add key="private_feed" value="{feedurl}" allowinsecureconnections="true" /> | STRING |
| HIGH | …uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs | 0 | <project toolsversion="15.0" defaulttargets="build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> <import | STRING |
| HIGH | …Updater.Core.Test/Update/PackagesConfigUpdaterTests.cs | 0 | <project toolsversion="15.0" defaulttargets="build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> <import | STRING |
| HIGH | …GetUpdater/NuGetUpdater.Core.Test/Run/EndToEndTests.cs | 0 | <project toolsversion="15.0" defaulttargets="build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> <import | STRING |
| HIGH | …uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs | 0 | { "version": 1, "isroot": true, "tools": { "microsoft.botsay": { // some comment "version": "1.1.0", "commands": [ "bots | STRING |
| HIGH | …dater.Core.Test/Files/DotNetToolsJsonBuildFileTests.cs | 0 | { "version": 1, "isroot": true, "tools": { "microsoft.botsay": { // some comment "version": "1.1.0", "commands": [ "bots | STRING |
| HIGH | …er/NuGetUpdater.Core.Test/Utilities/JsonHelperTests.cs | 0 | { "version": 1, "isroot": true, "tools": { "microsoft.botsay": { // some comment "version": "1.1.0", "commands": [ "bots | STRING |
| HIGH | …uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs | 0 | <configuration> <packagesources> <clear /> <add key="private_feed" value="{http.baseurl.trimend('/')}/index.json" allowi | STRING |
| HIGH | …Updater.Core.Test/Update/PackagesConfigUpdaterTests.cs | 0 | <configuration> <packagesources> <clear /> <add key="private_feed" value="{http.baseurl.trimend('/')}/index.json" allowi | STRING |
| HIGH | …r/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs | 0 | <configuration> <packagesources> <clear /> <add key="private_feed" value="{http.baseurl.trimend('/')}/index.json" allowi | STRING |
| HIGH | …uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net9.0</targetframework> </propertygroup> <itemgroup> | STRING |
| HIGH | …GetUpdater/NuGetUpdater.Core.Test/Run/EndToEndTests.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net9.0</targetframework> </propertygroup> <itemgroup> | STRING |
| HIGH | …ter.Core.Test/Discover/DiscoveryWorkerTests.Project.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net9.0</targetframework> </propertygroup> <itemgroup> | STRING |
| HIGH | …ter.Core.Test/Discover/DiscoveryWorkerTests.Project.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> <managepackageversionscentra | STRING |
| HIGH | …Updater.Core.Test/Discover/SdkProjectDiscoveryTests.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> <managepackageversionscentra | STRING |
| HIGH | …NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs | 0 | <project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> <managepackageversionscentra | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …toolchain/lib/dependabot/rust_toolchain/requirement.rb | 101 | # Check if version satisfies exact requirement | COMMENT |
| LOW | …toolchain/lib/dependabot/rust_toolchain/requirement.rb | 113 | # Check if version satisfies >= requirement | COMMENT |
| LOW | …toolchain/lib/dependabot/rust_toolchain/requirement.rb | 141 | # Check if version satisfies > requirement | COMMENT |
| LOW | …toolchain/lib/dependabot/rust_toolchain/requirement.rb | 166 | # Check if version satisfies <= requirement | COMMENT |
| LOW | …toolchain/lib/dependabot/rust_toolchain/requirement.rb | 191 | # Check if version satisfies < requirement | COMMENT |
| LOW | …rust_toolchain/update_checker/latest_version_finder.rb | 129 | # Check if a version string is in major.minor format (e.g., "1.72" vs "1.72.0") | COMMENT |
| LOW | terraform/lib/dependabot/terraform/file_updater.rb | 230 | # Check if the architecture is present in the original lockfile | COMMENT |
| LOW | …ot/terraform/update_checker/latest_version_resolver.rb | 101 | # Check if the release is within the cooldown period | COMMENT |
| LOW | …ependabot/terraform/package/package_details_fetcher.rb | 65 | # Check if releases is an array and not empty | COMMENT |
| LOW | npm_and_yarn/lib/dependabot/npm_and_yarn.rb | 425 | # Check if sub dependency is using local path and raise a resolvability error | COMMENT |
| LOW | npm_and_yarn/lib/dependabot/npm_and_yarn/version.rb | 81 | # Check if version is a string before attempting to match | COMMENT |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 883 | # Check if the error message contains any group patterns and raise the corresponding error class | COMMENT |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 886 | # Check if defined yarn error codes contained in the error message | COMMENT |
| LOW | …/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb | 209 | # Check if this registry has already been defined in .npmrc as a scoped registry | COMMENT |
| LOW | …ndabot/npm_and_yarn/update_checker/library_detector.rb | 63 | # Check if the project is listed on npm. If it is, it's a library | COMMENT |
| LOW | …ndabot/npm_and_yarn/package/package_details_fetcher.rb | 210 | # Check if engines is a hash and fetch the node requirement | COMMENT |
| LOW | …c/dependabot/hex/file_updater/lockfile_updater_spec.rb | 423 | # Check if private registry is reachable (may be down with 503) | COMMENT |
| LOW | conda/lib/dependabot/conda/file_fetcher.rb | 78 | # Check if all packages are fully qualified (no manageable packages) | COMMENT |
| LOW | conda/lib/dependabot/conda/file_fetcher.rb | 96 | # Check if there are any manageable packages (simple specs or pip) | COMMENT |
| LOW | conda/lib/dependabot/conda/file_parser.rb | 89 | # Check if environment has fully qualified packages (Tier 2) | COMMENT |
| LOW | conda/lib/dependabot/conda/conda_registry_client.rb | 61 | # Check if a specific version exists for a package | COMMENT |
| LOW | conda/lib/dependabot/conda/version.rb | 178 | # Check if segment contains an embedded pre-release marker | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 242 | # Check if segment is dev pre-release | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 248 | # Check if segment is alpha pre-release | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 254 | # Check if segment is beta pre-release | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 260 | # Check if segment is rc pre-release | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 266 | # Check if segment is post-release | COMMENT |
| LOW | …ependabot/conda/update_checker/requirements_updater.rb | 220 | # Check if version is too high (unfixable) | COMMENT |
| LOW | …ependabot/conda/update_checker/requirements_updater.rb | 324 | # Check if lower bound is too high (unfixable) | COMMENT |
| LOW | …ependabot/conda/update_checker/requirements_updater.rb | 372 | # Check if this individual constraint is satisfied by new version | COMMENT |
| LOW | cargo/lib/dependabot/cargo/file_fetcher.rb | 248 | # Check if this Cargo manifest uses workspace dependencies | COMMENT |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 238 | # Check if any delimiter-separated part is a SHA | COMMENT |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 240 | # Check if removing delimiters reveals a SHA (e.g., "va_b_018a_a_6b_0d3") | COMMENT |
| LOW | pre_commit/lib/dependabot/pre_commit/file_updater.rb | 208 | # Check if this line contains the dependency in additional_dependencies context | COMMENT |
| LOW | composer/lib/dependabot/composer/helpers.rb | 69 | # Check if the composer name does not follow the Composer V2 naming conventions. | COMMENT |
| LOW | composer/lib/dependabot/composer/helpers.rb | 76 | # Check if the composer.json file contains "require" entries that don't follow | COMMENT |
| LOW | rakelib/support/ecosystem_scaffolder.rb | 177 | # Check if file exists and handle based on overwrite mode | COMMENT |
| LOW | …ort/infrastructure_updaters/github_workflow_updater.rb | 34 | # Check if ecosystem already exists | COMMENT |
| LOW | …ort/infrastructure_updaters/github_workflow_updater.rb | 49 | # Check if this is a key line (not indented, ends with colon) | COMMENT |
| LOW | …ort/infrastructure_updaters/github_workflow_updater.rb | 75 | # Check if ecosystem already exists | COMMENT |
| LOW | …ort/infrastructure_updaters/github_workflow_updater.rb | 91 | # Check if this is a key line (not indented, ends with colon) | COMMENT |
| LOW | updater/spec/support/dummy_pkg_helpers.rb | 88 | # Check if the version is not supported | COMMENT |
| LOW | updater/lib/dependabot/update_graph_command.rb | 72 | # Check if the error is a known "run halting" state we should handle | COMMENT |
| LOW | updater/lib/dependabot/update_files_command.rb | 108 | # Check if the error is a known "run halting" state we should handle | COMMENT |
| LOW | updater/lib/dependabot/job.rb | 392 | # Check if the dependency was vulnerable in its previous version | COMMENT |
| LOW | updater/lib/dependabot/updater/group_update_creation.rb | 187 | # Check if dependency has already been handled | COMMENT |
| LOW | updater/lib/dependabot/updater/group_update_creation.rb | 190 | # Check if this is a group update | COMMENT |
| LOW | updater/lib/dependabot/updater/group_update_creation.rb | 323 | # Check if this up-to-date dependency has security advisories but no fix | COMMENT |
| LOW | updater/lib/dependabot/updater/group_update_creation.rb | 336 | # Check if this is a security update with vulnerability audit explanation | COMMENT |
| LOW | updater/lib/dependabot/updater/group_update_creation.rb | 694 | # Check if vulnerability audit was performed and has explanations | COMMENT |
| LOW | bun/lib/dependabot/bun.rb | 181 | # Check if sub dependency is using local path and raise a resolvability error | COMMENT |
| LOW | bun/lib/dependabot/bun/version.rb | 81 | # Check if version is a string before attempting to match | COMMENT |
| LOW | bun/lib/dependabot/bun/file_updater/npmrc_builder.rb | 93 | # Check if this registry has already been defined in .npmrc as a scoped registry | COMMENT |
| LOW | …/lib/dependabot/bun/update_checker/library_detector.rb | 63 | # Check if the project is listed on npm. If it is, it's a library | COMMENT |
| LOW | …/lib/dependabot/bun/package/package_details_fetcher.rb | 203 | # Check if engines is a hash and fetch the node requirement | COMMENT |
| LOW | vcpkg/lib/dependabot/vcpkg/metadata_finder.rb | 31 | # Check if this is a Git dependency with a specific source | COMMENT |
| LOW | vcpkg/lib/dependabot/vcpkg/file_updater.rb | 223 | # Check if this is a default registry update based on metadata | COMMENT |
| LOW | uv/lib/dependabot/uv/file_updater/lock_file_updater.rb | 232 | # Check if reference has escaped newlines like "\n" + | COMMENT |
| LOW | common/spec/dependabot/file_fetchers/base_spec.rb | 1483 | # Write file with UTF-8 BOM prefix | COMMENT |
| LOW | common/lib/dependabot/command_helpers.rb | 241 | # Check if the process is still alive | COMMENT |
| 25 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …aform/lib/dependabot/terraform/requirements_updater.rb | 21 | # A requirements hash is a basic description of a dependency at a certain | COMMENT |
| LOW | …aform/lib/dependabot/terraform/requirements_updater.rb | 41 | # requirement: nil, | COMMENT |
| LOW | terraform/lib/dependabot/terraform/file_updater.rb | 61 | # previous_requirements = [{requirement: "0.9.1"}, {requirement: "0.11.0"}] | COMMENT |
| LOW | terraform/lib/dependabot/terraform/file_parser.rb | 361 | # "consul" => [ | COMMENT |
| LOW | …_yarn/lib/dependabot/npm_and_yarn/constraint_helper.rb | 221 | end | COMMENT |
| LOW | …bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb | 481 | # on a added dependency which hasn't been published yet under the same | COMMENT |
| LOW | …abot/npm_and_yarn/file_updater/npm_lockfile_updater.rb | 561 | # TODO: Move this logic to the version resolver and check if a new | COMMENT |
| LOW | …t/npm_and_yarn/update_checker/vulnerability_auditor.rb | 41 | # @param security_advisories [Array<Dependabot::SecurityAdvisory>] advisories for the dependency | COMMENT |
| LOW | …m_and_yarn/helpers/lib/npm6/peer-dependency-checker.ts | 61 | const dryRun = true; | COMMENT |
| LOW | npm_and_yarn/helpers/lib/yarn/helpers.ts | 1 | // eslint-disable-next-line @typescript-eslint/no-require-imports | COMMENT |
| LOW | npm_and_yarn/helpers/lib/yarn/helpers.ts | 21 | // link, run lifecycle scripts, cleanup, then save new manifest (package.json). | COMMENT |
| LOW | deno/lib/dependabot/deno.rb | 21 | # Deno's import map has no dev/prod distinction (no devDependencies equivalent), | COMMENT |
| LOW | …pendabot/docker/update_checker_digest_cooldown_spec.rb | 1 | # typed: false | COMMENT |
| LOW | docker/lib/dependabot/docker/update_checker.rb | 121 | # Patterns that identify structurally obvious version components in tag | COMMENT |
| LOW | docker/lib/dependabot/docker/update_checker.rb | 1361 | # Returns true when the candidate tag and current tag reference the exact | COMMENT |
| LOW | bin/dry-run.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | bin/dry-run.rb | 21 | # Package managers: | COMMENT |
| LOW | python/spec/dependabot/python/update_checker_spec.rb | 2181 | describe "with cooldown options" do | COMMENT |
| LOW | python/lib/dependabot/python/dependency_grapher.rb | 81 | end | COMMENT |
| LOW | …dabot/python/dependency_grapher/requirements_layers.rb | 21 | # directory collapsing onto the first `.txt` alphabetically. | COMMENT |
| LOW | …b/dependabot/python/package/package_details_fetcher.rb | 101 | fetch_from_html_registry(index_url) | COMMENT |
| LOW | …b/dependabot/python/package/package_details_fetcher.rb | 121 | # }, | COMMENT |
| LOW | …b/dependabot/python/package/package_details_fetcher.rb | 181 | # It provides an HTML listing of available package versions following PEP 503 (Simple Repository API). | COMMENT |
| LOW | conda/lib/dependabot/conda/version.rb | 1 | # typed: strict | COMMENT |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 141 | private | COMMENT |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 161 | # suffix_compatible?("1.0.0.jdk8", "1.0.0.jre8") # => false (JDK → JRE downgrade) | COMMENT |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 181 | COMMENT | |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 201 | # @example Invalid inputs | COMMENT |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 221 | # @example Standard delimiter-separated SHAs | COMMENT |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 241 | git_sha?(version.gsub(/[-._]/, "")) | COMMENT |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 321 | # This method allows upgrades from unstable versions (pre-releases or snapshots) | COMMENT |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 341 | COMMENT | |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 401 | # | COMMENT |
| LOW | …n/lib/dependabot/maven/shared/shared_version_finder.rb | 441 | # remainder according to the following rules: | COMMENT |
| LOW | …ib/dependabot/maven/file_parser/repositories_finder.rb | 201 | parent_pom(pom, urls) | COMMENT |
| LOW | …abot/pre_commit/additional_dependency_checkers/base.rb | 1 | # typed: strong | COMMENT |
| LOW | …abot/pre_commit/additional_dependency_checkers/base.rb | 21 | # def latest_version | COMMENT |
| LOW | …dependabot/composer/update_checker/version_resolver.rb | 301 | return lower_bound unless latest_allowable_version | COMMENT |
| LOW | updater/spec/dependabot/updater_spec.rb | 21 | # | COMMENT |
| LOW | updater/lib/dependabot/api_client.rb | 1 | # typed: strong | COMMENT |
| LOW | updater/lib/dependabot/dependency_group_engine.rb | 1 | # typed: strict | COMMENT |
| LOW | updater/lib/dependabot/dependency_change.rb | 1 | # typed: strong | COMMENT |
| LOW | updater/lib/dependabot/job.rb | 321 | COMMENT | |
| LOW | updater/lib/dependabot/updater/error_handler.rb | 1 | # typed: strong | COMMENT |
| LOW | …ater/lib/dependabot/updater/security_update_helpers.rb | 241 | sig { params(notice: Dependabot::Notice).void } | COMMENT |
| LOW | …ater/lib/dependabot/updater/security_update_helpers.rb | 261 | # block was in effect for this dependency check (presence), not that it | COMMENT |
| LOW | …b/dependabot/updater/pattern_specificity_calculator.rb | 1 | # typed: strong | COMMENT |
| LOW | …pdater/operations/refresh_group_update_pull_request.rb | 1 | # typed: strict | COMMENT |
| LOW | …ter/operations/refresh_security_update_pull_request.rb | 1 | # typed: strong | COMMENT |
| LOW | …ndabot/updater/operations/group_update_all_versions.rb | 1 | # typed: strong | COMMENT |
| LOW | …ater/lib/dependabot/job/dependency_group_definition.rb | 1 | # typed: strong | COMMENT |
| LOW | …ater/lib/dependabot/job/existing_group_pull_request.rb | 1 | # typed: strong | COMMENT |
| LOW | bun/lib/dependabot/bun/constraint_helper.rb | 221 | end | COMMENT |
| LOW | …t/bun/update_checker/subdependency_version_resolver.rb | 181 | # We shouldn't update bundled sub-dependencies as they have been bundled | COMMENT |
| LOW | …dependabot/bun/update_checker/vulnerability_auditor.rb | 41 | # @param dependency [Dependabot::Dependency] the dependency to check | COMMENT |
| LOW | bun/helpers/lib/npm6/peer-dependency-checker.js | 61 | // existing dependency name and version in npm install | COMMENT |
| LOW | bun/helpers/lib/yarn/helpers.js | 1 | const { Add } = require("@dependabot/yarn-lib/lib/cli/commands/add"); | COMMENT |
| LOW | bun/helpers/lib/yarn/helpers.js | 21 | // If everything is up to date, it'll save a new lockfile and return true, | COMMENT |
| LOW | …pendabot/vcpkg/update_checker/security_fix_resolver.rb | 21 | # vcpkg offers three levers, tried in this order: | COMMENT |
| LOW | uv/spec/dependabot/uv/update_checker_spec.rb | 821 | # Current version: 2.0.0 | COMMENT |
| 38 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | python/helpers/test/test_parser.py | 25 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 27 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 71 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 73 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 87 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 89 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 120 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 122 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 136 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 138 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 187 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parser.py | 189 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parse_setup.py | 24 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parse_setup.py | 26 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parse_setup.py | 83 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | python/helpers/test/test_parse_setup.py | 85 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …ependabot/pull_request_creator/branch_name_template.rb | 29 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | …ependabot/pull_request_creator/branch_name_template.rb | 33 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | …ependabot/pull_request_creator/branch_name_template.rb | 75 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | …ependabot/pull_request_creator/branch_name_template.rb | 78 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | …ependabot/pull_request_creator/branch_name_template.rb | 100 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | …ependabot/pull_request_creator/branch_name_template.rb | 104 | # --------------------------------------------------------------- | COMMENT |
| MEDIUM | julia/lib/dependabot/julia/registry_client.rb | 269 | # ============================================================================ | COMMENT |
| MEDIUM | julia/lib/dependabot/julia/registry_client.rb | 271 | # ============================================================================ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | NEW_ECOSYSTEMS.md | 63 | # Step 1: Generate the ecosystem structure | COMMENT |
| LOW | NEW_ECOSYSTEMS.md | 66 | # Step 2: Update supporting infrastructure | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 77 | # Step 1: Check dependabot.yml configuration | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 81 | # Step 2: Check .npmrc | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 87 | # Step 3: Check .yarnrc | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 92 | # Step 4: Check yarnrc.yml | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 191 | # Step 1: Extract global registry and auth token | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 195 | # Step 2: Fallback to any scoped registry and auth token if global is missing | COMMENT |
| LOW | docker/lib/dependabot/docker/tag.rb | 195 | # NOTE: This method only checks for the presence of an 8-digit date-like segment in the version part. | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 86 | # Step 1: Compare epochs (numerically) | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 90 | # Step 2: Compare version parts (segment by segment with fillvalue) | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 94 | # Step 3: Compare local parts (if present) | COMMENT |
| LOW⚡ | …ependabot/conda/update_checker/requirements_updater.rb | 93 | # Step 1: Check for equality match first (e.g., "==1.21.0" or bare "1.21.0") | COMMENT |
| LOW⚡ | …ependabot/conda/update_checker/requirements_updater.rb | 96 | # Step 2: Handle range requirements (e.g., ">=3.10,<3.12") | COMMENT |
| LOW⚡ | …ependabot/conda/update_checker/requirements_updater.rb | 99 | # Step 3: Handle single constraint (e.g., ">=3.10") | COMMENT |
| LOW | …mit/python_additional_dependencies_integration_spec.rb | 303 | # Step 1: Parse dependencies | COMMENT |
| LOW | …mit/python_additional_dependencies_integration_spec.rb | 316 | # Step 2: Check for updates (mocked) | COMMENT |
| LOW | …mit/python_additional_dependencies_integration_spec.rb | 337 | # Step 3: Update the file | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 37 | # Step 1: Check dependabot.yml configuration | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 41 | # Step 2: Check .npmrc | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 47 | # Step 3: Check .yarnrc | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 52 | # Step 4: Check yarnrc.yml | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 144 | # Step 1: Extract global registry and auth token | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 148 | # Step 2: Fallback to any scoped registry and auth token if global is missing | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | npm_and_yarn/lib/dependabot/npm_and_yarn/helpers.rb | 158 | # For conversion reading properly from npm 6 lockfile we need to check if detected version is npm 6 | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 77 | # Step 1: Check dependabot.yml configuration | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 81 | # Step 2: Check .npmrc | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 87 | # Step 3: Check .yarnrc | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 92 | # Step 4: Check yarnrc.yml | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 191 | # Step 1: Extract global registry and auth token | COMMENT |
| LOW⚡ | …nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb | 195 | # Step 2: Fallback to any scoped registry and auth token if global is missing | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 86 | # Step 1: Compare epochs (numerically) | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 90 | # Step 2: Compare version parts (segment by segment with fillvalue) | COMMENT |
| LOW⚡ | conda/lib/dependabot/conda/version.rb | 94 | # Step 3: Compare local parts (if present) | COMMENT |
| LOW⚡ | …ependabot/conda/update_checker/requirements_updater.rb | 93 | # Step 1: Check for equality match first (e.g., "==1.21.0" or bare "1.21.0") | COMMENT |
| LOW⚡ | …ependabot/conda/update_checker/requirements_updater.rb | 96 | # Step 2: Handle range requirements (e.g., ">=3.10,<3.12") | COMMENT |
| LOW⚡ | …ependabot/conda/update_checker/requirements_updater.rb | 99 | # Step 3: Handle single constraint (e.g., ">=3.10") | COMMENT |
| LOW | …mit/python_additional_dependencies_integration_spec.rb | 303 | # Step 1: Parse dependencies | COMMENT |
| LOW | …mit/python_additional_dependencies_integration_spec.rb | 316 | # Step 2: Check for updates (mocked) | COMMENT |
| LOW | …mit/python_additional_dependencies_integration_spec.rb | 337 | # Step 3: Update the file | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 37 | # Step 1: Check dependabot.yml configuration | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 41 | # Step 2: Check .npmrc | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 47 | # Step 3: Check .yarnrc | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 52 | # Step 4: Check yarnrc.yml | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 144 | # Step 1: Extract global registry and auth token | COMMENT |
| LOW⚡ | bun/lib/dependabot/bun/registry_helper.rb | 148 | # Step 2: Fallback to any scoped registry and auth token if global is missing | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | terraform/lib/dependabot/terraform/update_checker.rb | 32 | # Other sources (mercurial, path dependencies) just return `nil` | COMMENT |
| MEDIUM | npm_and_yarn/lib/dependabot/npm_and_yarn/version.rb | 28 | "canary", # Canary version, often used for cutting-edge builds | CODE |
| LOW | …cker/lib/dependabot/shared/utils/credentials_finder.rb | 68 | # If credentials have been generated from AWS we can just return them | COMMENT |
| LOW | hex/lib/dependabot/hex/file_fetcher.rb | 105 | # used. We can just return an empty array of subapp files. | COMMENT |
| LOW⚡ | …ependabot/cargo/update_checker/requirements_updater.rb | 112 | # If there's an exact version, just return that | COMMENT |
| LOW⚡ | …ependabot/cargo/update_checker/requirements_updater.rb | 117 | # If a ~, ^, or * range needs to be updated, just return that | COMMENT |
| LOW | …ependabot/cargo/update_checker/requirements_updater.rb | 143 | # For pre-release versions, just use the full version string | COMMENT |
| LOW | maven/lib/dependabot/maven/update_checker.rb | 101 | # never going to take any action as a result, though, we just return | COMMENT |
| LOW | …dabot/composer/file_fetcher/path_dependency_builder.rb | 29 | # Current we just return `nil` if a path dependency can't be built. | COMMENT |
| LOW | …ndabot/composer/update_checker/requirements_updater.rb | 123 | # how to update it, so we just return the existing requirement. | COMMENT |
| MEDIUM | …er/lib/dependabot/updater/group_dependency_selector.rb | 25 | # - Provides comprehensive observability for debugging | COMMENT |
| MEDIUM | bun/lib/dependabot/bun/version.rb | 28 | "canary", # Canary version, often used for cutting-edge builds | CODE |
| LOW | gradle/lib/dependabot/gradle/update_checker.rb | 30 | # The above is hard. Currently we just return the latest version and | COMMENT |
| LOW | gradle/lib/dependabot/gradle/update_checker.rb | 60 | # never going to take any action as a result, though, we just return | COMMENT |
| LOW | common/lib/dependabot/registry_client.rb | 10 | # This is not used to support full response caching currently, we just use it to ensure we detect unreachable | COMMENT |
| MEDIUM | …ib/dependabot/pull_request_creator/pr_name_prefixer.rb | 229 | # Definitely not using Angular commits if < 30% match angular commits | COMMENT |
| MEDIUM | …c/dependabot/bazel/file_parser/starlark_parser_spec.rb | 616 | # The parser should be robust enough to not crash | COMMENT |
| LOW | go_modules/lib/dependabot/go_modules/requirement.rb | 114 | # Before we hit a wildcard we just return the existing part | COMMENT |
| LOW | opentofu/lib/dependabot/opentofu/update_checker.rb | 33 | # Other sources (mercurial, path dependencies) just return `nil` | COMMENT |
| LOW | …bundler/file_updater/gemspec_dependency_name_finder.rb | 34 | nil # If we can't evaluate the expression just return nil | CODE |
| LOW | …ib/dependabot/bundler/file_updater/lockfile_updater.rb | 316 | # Instead, we just return the default-ordered content just | COMMENT |
| LOW | …ndabot/bundler/file_updater/ruby_requirement_setter.rb | 98 | nil # If we can't evaluate the expression just return nil | CODE |
| LOW | …ndabot/bundler/update_checker/latest_version_finder.rb | 82 | # In that case, skip cooldown and just return all versions. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | rakelib/support/ecosystem_infrastructure_updater.rb | 44 | puts "Error: Ecosystem '#{@ecosystem_name}' not found. Please scaffold it first." | CODE |
| MEDIUM | …support/test/ecosystem_infrastructure_updater_tests.rb | 22 | # First, scaffold a test ecosystem | COMMENT |
| MEDIUM | …support/test/ecosystem_infrastructure_updater_tests.rb | 24 | result = run_command("cd #{original_dir} && bundle exec rake ecosystem:scaffold[test_infra_eco,skip]") | CODE |
| MEDIUM | …support/test/ecosystem_infrastructure_updater_tests.rb | 157 | # Test combined create task (scaffold + update_infrastructure) | COMMENT |
| MEDIUM | rakelib/support/test/ecosystem_scaffold_tests.rb | 8 | # Tests for ecosystem scaffold rake task | COMMENT |
| MEDIUM | rakelib/support/test/ecosystem_scaffold_tests.rb | 25 | result = run_command("cd #{original_dir} && bundle exec rake ecosystem:scaffold[test_eco_temp,skip]") | CODE |
| MEDIUM | common/lib/dependabot/git_commit_checker.rb | 192 | # #apply_cooldown, so this method stays a thin orchestration step. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …yarn/spec/dependabot/npm_and_yarn/file_updater_spec.rb | 562 | "git+https://dummy-token@github.com/jonschlinkert/is-number.git#0c6b15a88bc10cd47f67a09506399dfc9ddc07 | CODE |
| LOW | …yarn/spec/dependabot/npm_and_yarn/file_updater_spec.rb | 567 | "is-number@https://dummy-token@github.com/" \ | CODE |
| LOW | …yarn/spec/dependabot/npm_and_yarn/file_updater_spec.rb | 2191 | "git+https://dummy-token@github.com/jonschlinkert/" \ | CODE |
| LOW | npm_and_yarn/helpers/test/yarn/helpers.test.ts | 22 | "is-number@https://dummy-token@github.com/jonschlinkert/is-number.git#master"; | CODE |
| LOW | npm_and_yarn/helpers/test/yarn/helpers.test.ts | 28 | "https://dummy-token@github.com/jonschlinkert/is-number.git#master" | CODE |
| LOW | common/spec/dependabot/shared_helpers_spec.rb | 502 | "password" => "fake-token" | CODE |
| LOW | common/spec/dependabot/shared_helpers_spec.rb | 520 | expect(configured_git_credentials).to eq("https://x-access-token:fake-token@github.com\n") | CODE |
| LOW⚡ | common/spec/dependabot/shared_helpers_spec.rb | 531 | "password" => "v1.fake-token" | CODE |
| LOW⚡ | common/spec/dependabot/shared_helpers_spec.rb | 537 | "password" => "fake-token" | CODE |
| LOW⚡ | common/spec/dependabot/shared_helpers_spec.rb | 543 | expect(configured_git_credentials).to eq("https://x-access-token:fake-token@github.com\n") | CODE |
| LOW | common/spec/dependabot/shared_helpers_spec.rb | 554 | "password" => "fake-token" | CODE |
| LOW | common/spec/dependabot/shared_helpers_spec.rb | 576 | expect(configured_git_credentials).to eq("https://x-access-token:fake-token@private.com\n") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …ependabot/bundler/file_updater/requirement_replacer.rb | 295 | nodes.first.loc.begin.begin.join(nodes.last.loc.expression) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/helpers/lib/parser.py | 219 | except Exception as e: | CODE |
| LOW | python/helpers/lib/parser.py | 348 | except Exception as e: | CODE |
| MEDIUM | python/helpers/lib/parser.py | 59 | def parse_requirement(entry, pyproject_path, requirement_type=None): | CODE |
| LOW | uv/helpers/lib/parser.py | 213 | except Exception as e: | CODE |
| LOW | uv/helpers/lib/parser.py | 342 | except Exception as e: | CODE |
| MEDIUM | uv/helpers/lib/parser.py | 35 | def parse_requirement(entry, pyproject_path, requirement_type=None): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …dependabot/hex/update_checker/version_resolver_spec.rb | 128 | # In this example, updating `credo` would add its sub-dependency, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/helpers/lib/parser.py | 174 | CODE | |
| LOW | python/helpers/lib/parser.py | 226 | CODE | |
| LOW | uv/helpers/lib/parser.py | 168 | CODE | |
| LOW | uv/helpers/lib/parser.py | 220 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bin/dry-run.rb | 12 | # Usage: | COMMENT |
| LOW | …ependabot/pre_commit/additional_dependency_checkers.rb | 12 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/helpers/test/test_parse_setup.py | 17 | CODE | |
| LOW | python/helpers/test/test_parse_requirements.py | 17 | CODE |