Affected tool
fprime-version-check / fprime.util.versioning.get_version in nasa/fprime-tools, devel at f5835682f34f10d8fbb97dc80b0d9cc66c38a375. Reporting here as requested by the tools repository README.
Reproduction
Create this requirements.txt:
# fprime-tools==3.0.0
fprime-tools==4.2.1
Run fprime-version-check fprime-tools requirements.txt.
Actual: a conflicting-versions error includes the commented-out version. Expected: v4.2.1.
The lookup selects any line containing the package string, including comments, unrelated names such as fprime-tools-plugin and other-fprime-tools, and another package's repository URL. If only one of those unrelated lines exists, it can incorrectly supply the requested version. Whitespace-separated trailing comments also remain in the returned version.
Proposed fix and checks
Match the requested name at the start of a requirement, with a package-name boundary. Remove whitespace-separated comments before parsing and trim the extracted version. Preserve existing pinned-version and direct-reference handling, duplicate-pin validation, extras, and URL fragments without a preceding whitespace separator.
Tests cover all three F Prime package names, missing-package and conflict errors, comments, prefix/suffix collisions, direct references, and the real CLI entry point. On unchanged production code, 23 new cases fail and 5 controls pass. With the focused fix, all 187 tests in the tools repository pass on Python 3.12.11/macOS.
No dependency changes or general replacement for pip's requirements parser are proposed.
Affected tool
fprime-version-check/fprime.util.versioning.get_versioninnasa/fprime-tools, devel atf5835682f34f10d8fbb97dc80b0d9cc66c38a375. Reporting here as requested by the tools repository README.Reproduction
Create this
requirements.txt:Run
fprime-version-check fprime-tools requirements.txt.Actual: a conflicting-versions error includes the commented-out version. Expected:
v4.2.1.The lookup selects any line containing the package string, including comments, unrelated names such as
fprime-tools-pluginandother-fprime-tools, and another package's repository URL. If only one of those unrelated lines exists, it can incorrectly supply the requested version. Whitespace-separated trailing comments also remain in the returned version.Proposed fix and checks
Match the requested name at the start of a requirement, with a package-name boundary. Remove whitespace-separated comments before parsing and trim the extracted version. Preserve existing pinned-version and direct-reference handling, duplicate-pin validation, extras, and URL fragments without a preceding whitespace separator.
Tests cover all three F Prime package names, missing-package and conflict errors, comments, prefix/suffix collisions, direct references, and the real CLI entry point. On unchanged production code, 23 new cases fail and 5 controls pass. With the focused fix, all 187 tests in the tools repository pass on Python 3.12.11/macOS.
No dependency changes or general replacement for pip's requirements parser are proposed.