Bump manifest-parser for uv support (AST-173749) - #1551
Open
cx-atish-jadhav wants to merge 4 commits into
Open
Conversation
Update dependency github.com/Checkmarx/manifest-parser from v0.1.4 to v0.1.4-prerelease in go.mod and refresh corresponding checksums in go.sum. No other modules or code changes included.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the
manifest-parserdependency to pick up uv Python support (v0.1.4→v0.1.4-prerelease). Jira: AST-173001.This is a dependency-only change —
go.mod/go.sum, no source changes.Why no code changes are needed
uv support was intentionally designed so ast-cli requires nothing beyond the version bump:
pyproject.toml, which is already in ast-cli's OSS-realtime supported-file allowlist (validateSupportedManifestFile).uv.lockis a resolver-only sibling (likepoetry.lock) and is never scanned standalone, so it does not need adding tosupportedFilenames.PackageManagerchange. uv packages report"pypi"— identical to every other Python parser — sopkgToRequest/createPackageMapneed no new mapping entry;pypialready passes through unchanged.RunOssRealtimeScanparses the manifest at its original on-disk path, so a siblinguv.locknext topyproject.tomlis picked up by the new parser logic automatically.What the bump brings in (from manifest-parser #27)
[dependency-groups]inpyproject.toml.uv.lockversion resolution (pluspoetry.lock/uv.lockprecedence handling).===, and trailing-comment handling.Verification
go build ./...passes clean.Note for reviewers
This points at
v0.1.4-prerelease. Once manifest-parser #27 merges and a final version is tagged, this pin should be updated to that release before/at merge.🤖 Generated with Claude Code