Skip to content

Conversation

@sschuberth
Copy link
Member

Please have a look at the individual commit messages for the details.

Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
@sschuberth sschuberth requested a review from a team as a code owner February 10, 2026 12:10
@sschuberth sschuberth enabled auto-merge (rebase) February 10, 2026 12:10
See [1]. This is not covered by the Semver4j library's `IvyProcessor`
because that matcher does not necessarily cover a strict range of
versions. The reason why [2] still passes is that the case is currently
covered by the `XRangeProcessor`.

This change also implements the case where "+" is not preceeded by "." and
prepares for using `IvyProcessor` only.

[1]: https://ant.apache.org/ivy/history/2.1.0/settings/version-matchers.html
[2]: https://github.com/oss-review-toolkit/ort/blob/9f8f6f0a808ba13fe0da5a6efa6349821153e186/model/src/test/kotlin/PackageCurationTest.kt#L435

Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
The check against `IVY_VERSION_RANGE_INDICATORS` (which did not actually
contain only *Ivy* indicators) was only needed because the Semver4j
library by default parses single versions into ranges (like "2" becomes
">= 2.0.0, < 3.0.0"), which made it unusable for checking for version
ranges by simply testing whether range parsing fails.

However, that behavior came from the `XRangeProcessor` being applied by
default, which is a syntax that ORT never officially supported for
package curations / configurations. Instead, ORT only ever supported Ivy
version ranges officially.

So simplify the code by explicitly only using `IvyProcessor` and
working on `String`s internally.

Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
@codecov
Copy link

codecov bot commented Feb 10, 2026

Codecov Report

❌ Patch coverage is 88.88889% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 57.77%. Comparing base (9f8f6f0) to head (38094e2).
⚠️ Report is 3 commits behind head on main.

Files with missing lines Patch % Lines
model/src/main/kotlin/utils/VersionUtils.kt 87.50% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##               main   #11411      +/-   ##
============================================
- Coverage     57.78%   57.77%   -0.01%     
  Complexity     1711     1711              
============================================
  Files           347      347              
  Lines         12904    12901       -3     
  Branches       1238     1236       -2     
============================================
- Hits           7456     7453       -3     
  Misses         5000     5000              
  Partials        448      448              
Flag Coverage Δ
test-ubuntu-24.04 42.49% <88.88%> (-0.02%) ⬇️
test-windows-2025 42.46% <88.88%> (-0.02%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.


"[3.3.0,)".getIvyVersionRanges().get() shouldBe listOf(
listOf(Range("3.3.0", Range.RangeOperator.GTE))
)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about adding a test for + syntax mentioned in the previous commit?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in a new commit.

import org.ossreviewtoolkit.model.SourceCodeOrigin
import org.ossreviewtoolkit.model.VcsInfo
import org.ossreviewtoolkit.model.VcsType
import org.ossreviewtoolkit.model.utils.hasIvyVersionRange
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit message:

While this renames a public function, it was decided to not mark this as
a breaking change, because it is an ORT utility function that so far has
only been used internally.

How can we know if someone is using it?

Copy link
Member Author

@sschuberth sschuberth Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How can we know if someone is using it?

We can't for sure. But as this was only made public recently in cdac3fc (and not taken into use in ort-config yet) I believe the risk is rather low.

Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
Strictly, an `Identifier` cannot *be* an Ivy version, but only *have*
one, so reflect this in the naming.

While this renames a public function, it was decided to not mark this as
a breaking change, because it is an ORT utility function that so far has
only been used internally and was only made public recently in cdac3fc.

Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants