Replace directive is based on the to be replaced module path not the one which replacing it about nancy HOT 4 CLOSED

Very interesting. To make sure I'm following correctly, this example implies an odd mismatch of path and version.

We would expect nancy to produce a purl path/version like:
github.com/golang-jwt/jwt/v4 4.1.0
but instead we are getting:
github.com/dgrijalva/jwt-go 4.1.0
No such release exists, so of course we find zarro boogs in the phantom release.

I think I see a solution -> when we encounter a replace directive, we need to also re-read the Path (not only the Version) from the replace block to cover this case where both the version AND the path are being replaced.

from nancy.

Yes, you followed it correctly.
I would also expect the github.com/golang-jwt/jwt/v4 4.1.0 in the coordinates of the report, not the github.com/dgrijalva/jwt-go 4.1.0.

The example was there so we could have a common understanding about the issue, and to help reproduce/check if the future fix is sufficient.

from nancy.

@SzekeresB Thanks for verifying. Could you give a quick look over PR #257 ?

from nancy.

@bhamail I looked it over. The PR is looks good for me, (but I'm not familiar with nancy's code). I even checked your branch out, built it and run some dependency check with it. The reports now looks good for me (I don't see anything odd with them).

Thanks for the fast fix!

from nancy.