False positive on githubactions:S8544 "Python dependencies should be locked to verified versions"

SonarQube Cloud
,
1

Hi,

I’m using SonarQube cloud on Github.
This rule is labelled beta "The rule has been recently implemented and we haven’t gotten enough feedback from users yet, so there may be false positives or false negatives."

It seems to be a false positive as the warning is raised even though I’ve pinned the version:

pip install playwright==1.59.0 --only-binary :all:

image
image793×104 6.29 KB

Using dependencies without locking resolved versions is security-sensitive.

Please see public link:

Thanks,

Nicolas Baumann.

4

Hi @Nicolas_Baumann and thanks for the feedback!

You are right, the parser logic was incorrectly considering :all: as a package name, and thus raising an issue as there was no version specifier for it.

This will be fixed in the next release, thanks for letting us know and have a nice weekend!

Best wishes,

Teemu R.