Directories
¶
| Path | Synopsis |
|---|---|
|
Package ecosystem encapsulates all language-specific behavior needed to detect and apply dependency-vulnerability bumps for a melange package.
|
Package ecosystem encapsulates all language-specific behavior needed to detect and apply dependency-vulnerability bumps for a melange package. |
|
golang
Package golang implements the Go ecosystem.Ecosystem: go.mod/go.sum parsing, v2+ module path normalization, replace-directive resolution, and bump decisioning.
|
Package golang implements the Go ecosystem.Ecosystem: go.mod/go.sum parsing, v2+ module path normalization, replace-directive resolution, and bump decisioning. |
|
java
Package java implements the Maven-based Java ecosystem.Ecosystem, backed by omnibump's MavenAnalyzer.
|
Package java implements the Maven-based Java ecosystem.Ecosystem, backed by omnibump's MavenAnalyzer. |
|
rust
Package rust implements the Rust/Cargo ecosystem.Ecosystem, backed by omnibump's RustAnalyzer.
|
Package rust implements the Rust/Cargo ecosystem.Ecosystem, backed by omnibump's RustAnalyzer. |
|
Package gobump is the bump orchestration for all ecosystems: vulnerability analysis per language and modroot, reconciling each language's bump pipeline steps, results, epoch and the pipeline plumbing.
|
Package gobump is the bump orchestration for all ecosystems: vulnerability analysis per language and modroot, reconciling each language's bump pipeline steps, results, epoch and the pipeline plumbing. |
|
Package goproxy provides pure helpers for interpreting the GOPROXY, GOPRIVATE and GONOPROXY environment variables the way the go command itself does.
|
Package goproxy provides pure helpers for interpreting the GOPROXY, GOPRIVATE and GONOPROXY environment variables the way the go command itself does. |
|
Package gorelease answers "what was the latest stable Go release at time T?" and "what is the latest stable Go release available now?", optionally constrained to a minor series (e.g.
|
Package gorelease answers "what was the latest stable Go release at time T?" and "what is the latest stable Go release available now?", optionally constrained to a minor series (e.g. |
|
Package goversion provides comparison helpers for bare Go language/directive version strings as they appear in go.mod `go` directives and melange `go-version` inputs (e.g., "1.24", "1.24.5", "1.25rc1").
|
Package goversion provides comparison helpers for bare Go language/directive version strings as they appear in go.mod `go` directives and melange `go-version` inputs (e.g., "1.24", "1.24.5", "1.25rc1"). |
|
Package logging carries a *slog.Logger through a context.Context, layered with attributes (file, package, stage, modroot, ...) as ctx flows deeper into a call chain.
|
Package logging carries a *slog.Logger through a context.Context, layered with attributes (file, package, stage, modroot, ...) as ctx flows deeper into a call chain. |
|
Package simulate validates a proposed set of Go module bumps by doing what the melange build's bump step will do, ahead of time: clone the upstream source at the exact tag, apply the bumps with the step's own semantics (gobump for `uses: go/bump`, omnibump for `uses: bump` - see Engine), then OSV-rescan the resolved module graph and raise versions until a fixpoint.
|
Package simulate validates a proposed set of Go module bumps by doing what the melange build's bump step will do, ahead of time: clone the upstream source at the exact tag, apply the bumps with the step's own semantics (gobump for `uses: go/bump`, omnibump for `uses: bump` - see Engine), then OSV-rescan the resolved module graph and raise versions until a fixpoint. |
Click to show internal directories.
Click to hide internal directories.