FoveaCentral/google_maps_geocoder

Rubygems' syntax yields false-positive Hakiri warnings

Closed this issue · 2 comments

ivanoblomov commented

Description

Avoiding "open-ended dependencies" using Rubygems' recommended syntax yields false-positive warnings on Hakiri.

Steps to Reproduce

  1. Run gem build using the syntax Rubygems recommends (to address open-ended dependencies):
    google_maps_geocoder.gemspec 
    s.add_runtime_dependency 'activesupport', '~> 4.1', '>= 4.1.11'
  2. Hakiri reports an attribute-restriction warning even though 1 specifies a patched version.
ivanoblomov commented

Emailed Hakiri a bug report:

If we address this “attribute restriction” warning…

https://hakiri.io/github/ivanoblomov/google_maps_geocoder/master/149994d7ce7fe241acde371d6f704103ac3f2a4a/warnings?name=Attribute+Restriction

By, say, restricting to 12.3.3 or higher with…

s.add_development_dependency 'rake', '>= 12.3.3'

Rubygems generates this warning when building the gem…

$ gem build
WARNING: open-ended dependency on rake (>= 12.3.3, development) is not recommended
if rake is semantically versioned, use:
add_development_dependency 'rake', '~> 12.3', '>= 12.3.3'

But, if we address that “open-ended dependency" warning by adding the recommended line, then Hakiri reports a false positive “attribute restriction" warning…

https://hakiri.io/github/ivanoblomov/google_maps_geocoder/master/4b5def920a9bfc21a778b7996abac1584a0af754/warnings?name=Attribute+Restriction

Shouldn’t Hakiri recognize Rubygems’ recommended syntax?

ivanoblomov commented

On June 5, 2020, Vasily@Hakiri said:

The behavior you are seeing is the result of a bug in Hakiri. The version parsing logic can result in false positives because the union of overlapping version branches is not performed correctly. Unfortunately, it's not a trivial fix and I don't have an ETA for when it will be done. The best way to go about it right now is to mark this issue as a false negative on Hakiri, so it unblocks your PRs.

I'll let you know once this bug is fixed.