• 设为首页
  • 点击收藏
  • 手机版
    手机扫一扫访问
    迪恩网络手机版
  • 关注官方公众号
    微信扫一扫关注
    公众号

snyk/snyk-maven-plugin: Test and monitor your projects for vulnerabilities with ...

原作者: [db:作者] 来自: 网络 收藏 邀请

开源软件名称(OpenSource Name):

snyk/snyk-maven-plugin

开源软件地址(OpenSource Url):

https://github.com/snyk/snyk-maven-plugin

开源编程语言(OpenSource Language):

Java 83.5%

开源软件介绍(OpenSource Introduction):

Snyk Logo

Snyk Maven Plugin

Maven Release Vulnerabilities

Tests and monitors your Maven dependencies for vulnerabilities. This plugin is officially maintained by Snyk.

Installation

  1. Get your Snyk API token.

  2. Add the Snyk Maven Plugin to your pom.xml and configure it as needed.

<!-- Example Plugin Configuration -->
<build>
  <plugins>
    <plugin>
      <groupId>io.snyk</groupId>
      <artifactId>snyk-maven-plugin</artifactId>
      <version>2.0.0</version>
      <inherited>false</inherited>
      <executions>
        <execution>
          <id>snyk-test</id>
          <goals>
            <goal>test</goal>
          </goals>
        </execution>
        <execution>
          <id>snyk-monitor</id>
          <goals>
            <goal>monitor</goal>
          </goals>
        </execution>
      </executions>
      <configuration>
        <apiToken>${env.SNYK_TOKEN}</apiToken>
        <args>
          <arg>--all-projects</arg>
        </args>
      </configuration>
    </plugin>
  </plugins>
</build>

Supported Versions

  • Java 8 and above.
  • Maven 3.2.5 and above.

Goals

test

Default Phase: test

Scans your project's dependencies and provides a list of vulnerabilities if any are found.

monitor

Default Phase: install

Takes a snapshot of your project's dependency tree and monitors it on snyk.io. You'll be alerted when new relevant vulnerabilities, updates or patches are disclosed.

Configuration

You can configure the following parameters inside the <configuration> section. All parameters are optional.

apiToken [string]

⚠️ Do NOT include your API token directly in your pom.xml. Use a variable instead.

You must provide a Snyk API token to access Snyk's services. You can do so by:

  • Providing apiToken in your configuration using a variable.
  • Providing a SNYK_TOKEN environment variable.
  • Authenticating via snyk auth using the Snyk CLI before using this plugin.

skip [boolean]

Default: false

Skip this execution entirely.

When running mvn, you can also use -Dsnyk.skip to enable this behavior.

args [array<string>]

This plugin uses Snyk CLI so you can pass any supported arguments using <args>. See the example below.

For a list of supported arguments, see Snyk CLI Reference.

<!-- Example Arguments Configuration -->
<configuration>
  <args>
    <arg>--severity-threshold=high</arg>
    <arg>--scan-all-unmanaged</arg>
    <arg>--json</arg>
  </args>
</configuration>

cli [object]

Lets you configure the Snyk CLI that's used by this plugin.

By default, the CLI will be automatically downloaded and updated for you.

See CLI Configuration.

CLI Configuration

⚠️ For most use cases you don't need to set any <cli> options.

You can configure the CLI in three different modes:

Follow the link for each mode to see which parameters are available.

<!-- Example CLI Configuration -->
<configuration>
  <cli>
    <updatePolicy>daily</updatePolicy>
  </cli>
</configuration>

Auto-Download and Update

updatePolicy [string]

Default: daily

How often to download the latest CLI release. Can be one of the following:

  • daily - On the first execution of the day.
  • always - On every execution.
  • never - Never update after the initial download.
  • interval:<minutes> - On the execution after more than <minutes> has passed since the last update. e.g. interval:60 will update after an hour.

downloadDestination [string]

Default: OS-specific, see below.

Where to place the downloaded executable. By default, this is OS-specific as follows:

  • Linux - $XDG_DATA_HOME/snyk/snyk-linux or ~/.local/share/snyk/snyk-linux
  • macOS - ~/Library/Application Support/Snyk/snyk-macos
  • Windows - %APPDATA%\Snyk\snyk-win.exe

Custom CLI Executable

executable [string]

Example: ~/.local/share/snyk/snyk-linux

Path to a pre-installed Snyk CLI executable. You can find executables on the Snyk CLI Releases page.

Specific CLI Version

version [string]

Example: 1.542.0

Specify if you want to use a specific version. You can find versions on the Snyk CLI Releases page.

Setting this option will trigger a download of the CLI on every execution.

Demonstration

To try out this plugin, see the demo project.

Migrating from Snyk Maven Plugin v1 to v2

All plugin parameters from v1 should be moved to the <args> object, to keep them in line with the CLI usage. For example:

  • org => <arg>--org=my-org-name</arg>
  • failOnSeverity => <arg>--severity-threshold=low|medium|high</arg>
  • failOnAuthError => Use <skip>true</skip> to skip plugin execution.
  • includeProvidedDependencies => provided dependencies are always included.

For a list of supported arguments, see Configuration.


Made with


鲜花

握手

雷人

路过

鸡蛋
该文章已有0人参与评论

请发表评论

全部评论

专题导读
上一篇:
tomdz/sphinx-maven: Maven site plugin that uses Sphinx发布时间:2022-08-17
下一篇:
eclipse/lemminx-maven: lemminx-maven发布时间:2022-08-17
热门推荐
阅读排行榜

扫描微信二维码

查看手机版网站

随时了解更新最新资讯

139-2527-9053

在线客服(服务时间 9:00~18:00)

在线QQ客服
地址:深圳市南山区西丽大学城创智工业园
电邮:jeky_zhao#qq.com
移动电话:139-2527-9053

Powered by 互联科技 X3.4© 2001-2213 极客世界.|Sitemap