Narrow down VersionFilterAnalyzer scope

[nhumblot]

Context

The VersionFilterAnalyzer JavaDoc states the following:

This analyzer attempts to filter out erroneous version numbers collected. Initially, this will focus on JAR files that contain a POM version number that matches the file name - if identified all other version information will be removed.

Despite this intention, it analyzes all dependencies, whatever type they are. We would like to down its responsibility to what is stated in the JavaDoc.

Discussed during #8352

Acceptance criteria

• the VersionFilterAnalyzer extends AbstractFileTypeAnalyzer
• only jar files that contain a POM version number that matches the file name are analyzed by the analyzer

[jimin-fundamental]

Hi, I'm a first-time contributor and I understood what is the problem. Could you please assign this to me?

[nhumblot]

Hi there! 👋

Thank you so much for stepping up to contribute! 🎉

If you have any questions, run into roadblocks, or just want to share your progress as you work on the implementation, don’t hesitate to ask here. We’re all here to help and learn together. 🙂

Happy coding, and welcome to the project!

[chadlwilson]

Do we really want to do this? Is this really the limit of the testing/acceptance we intend to do?

Making the change here is a 'good first issue' only insofar as the code change is trivial, but assessing the impact of that change is likely very far from trivial and honestly not a good first tissue except to the extent of pushing all the actual thinking (assessing impact) to reviewers/maintainers. Has this been done to an adequate level?

If we feel enough enough analysis of impact (or knowledge) has been done already then that's ok I guess.

[jeremylong]

Currently, the only two analyzers that collect multiple versions are the assembly analyzer and the jar analyzer. The version filter analyzer was added because I kept seeing FP show up because the JAR analyzer would find multiple versions. You can see a lot of logic in the analyzer that is specific to JARs.

I'm okay with this change.

[chadlwilson]

Yeah, there’s lots of logic like this, but I wasn’t aware that it’s only possible with those two analyzers. I had thought that was possible with the PEAnalyzer and others as well, but I didn’t actually look so i assume you’re right.

[nhumblot]

Hi, sorry yes I should have added a bit more elements. I am planning to do a few checks in the review, especially by scanning some binaries we are already using in the tests, but in an e2e way, as a safety check. I had the implementation ready on my laptop but preferred to give the opportunity for someone else to contribute.

I will look at the PR and test within the PR.