tests.test_vulnerable_deps module

Tests for vulnerability advisory collection (uv audit + GitHub Advisory DB).

tests.test_vulnerable_deps.test_config_default_sources_mirror_advisory_source_enum()

VulnerableDepsConfig.sources default must list every AdvisorySource.

The default is spelled out as a literal in repomatic.config rather than derived from AdvisorySource, because the module boundary forbids the derivation: config is a low-level module that vulnerable_deps imports, so config cannot import the enum back without a circular dependency. This test is the enforcement that keeps the literal in step with the enum’s members and their declaration order.

tests.test_vulnerable_deps.test_fetch_dependabot_alerts_parses_each_entry()

Each alert maps to one VulnerablePackage tagged with GHSA source.

tests.test_vulnerable_deps.test_fetch_dependabot_alerts_skips_entries_without_fix()

Alerts lacking first_patched_version are filtered out.

tests.test_vulnerable_deps.test_fetch_dependabot_alerts_degrades_to_empty(patch_kwargs)

Network/auth failures and unparsable responses degrade to an empty list.

tests.test_vulnerable_deps.lock_with_raspberry(tmp_path)

Create a uv.lock containing a single ‘raspberry’ package.

tests.test_vulnerable_deps.test_collect_unions_uv_audit_and_ghsa(lock_with_raspberry)

Same package, different advisories: both kept, sources distinct.

tests.test_vulnerable_deps.test_collect_dedupes_when_advisory_id_matches(lock_with_raspberry)

Same package + same advisory ID across sources: merged into one entry.

tests.test_vulnerable_deps.test_collect_skips_ghsa_when_repo_missing(lock_with_raspberry)

No repo argument means the GHSA source is skipped entirely.

tests.test_vulnerable_deps.test_collect_respects_sources_filter(lock_with_raspberry)

Only the explicitly requested sources are queried.

tests.test_vulnerable_deps.test_collect_backfills_current_version_across_case_difference(tmp_path)

GHSA reports GitPython, lock stores gitpython — backfill must match.

tests.test_vulnerable_deps.test_format_vulnerability_table_includes_sources_column()

The rendered table credits each advisory’s source(s).

tests.test_vulnerable_deps.test_format_vulnerability_table_links_each_source_to_its_url()

Each source name in the Sources column links to its own advisory page.

tests.test_vulnerable_deps.test_collect_keeps_distinct_per_source_urls(lock_with_raspberry)

Merging same advisory from two sources retains both URLs.

tests.test_vulnerable_deps.test_parse_uv_audit_json_maps_fields()

A preview report maps onto VulnerablePackage, preferring display_id.

tests.test_vulnerable_deps.test_parse_uv_audit_json_no_vulnerabilities()

A valid report with zero findings is an empty list, not a fallback.

tests.test_vulnerable_deps.test_parse_uv_audit_json_raises_on_unusable_output(output)

Unusable JSON raises so the scanner fails loud, never silently empty.

tests.test_vulnerable_deps.test_collect_dedupes_across_sources_via_alias(lock_with_raspberry)

A PYSEC from uv audit and its aliased GHSA from Dependabot merge.

tests.test_vulnerable_deps.test_fix_restores_the_lock_when_the_upgrade_moves_nothing(tmp_path)

An unreachable fix must leave uv.lock byte-identical.

uv writes the --exclude-newer-package overrides it is handed into the lock’s [options] table even when the resolution does not move, so a vulnerability capped out of reach by another dependency would otherwise dirty the file with a lone metadata line. That is enough for the fix-vulnerable-deps job to open a pull request carrying no fix and an empty report.

tests.test_vulnerable_deps.test_uv_version_parses(stdout, expected)

uv --version output is parsed into a comparable Version.

tests.test_vulnerable_deps.test_run_uv_audit_parses_json(lock_with_raspberry)

A recent uv yields JSON that is parsed into records.

tests.test_vulnerable_deps.test_run_uv_audit_rejects_old_uv(lock_with_raspberry)

An older uv (no JSON audit output) fails loud rather than scanning nothing.

tests.test_vulnerable_deps.test_run_uv_audit_raises_on_unknown_schema(lock_with_raspberry)

A recent uv emitting an unrecognized schema version fails loud.