Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(java): add test scope support for pom.xml files #7414

Merged
merged 5 commits into from
Sep 3, 2024
Merged

feat(java): add test scope support for pom.xml files #7414

merged 5 commits into from
Sep 3, 2024

Conversation

DmitriyLewen
Copy link
Contributor

Description

Add test scope support and mark these dependencies as Dev.
To show these deps - use --include-dev-deps flag.

Related issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@DmitriyLewen DmitriyLewen self-assigned this Aug 28, 2024
@DmitriyLewen DmitriyLewen marked this pull request as ready for review August 28, 2024 09:25
knqyf263
knqyf263 reviewed Aug 29, 2024
View reviewed changes
Copy link
Collaborator

@knqyf263 knqyf263 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to update the document?

@knqyf263 knqyf263 self-requested a review August 29, 2024 10:07
@DmitriyLewen
Copy link
Contributor Author

Yeah. You are right. Thanks!

Add info about scopes in e3cfe72

knqyf263
knqyf263 reviewed Aug 30, 2024
View reviewed changes
Copy link
Collaborator

@knqyf263 knqyf263 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the table also needs to be updated like npm.

trivy/docs/docs/coverage/language/java.md

Line 18 in e3cfe72

| pom.xml | Maven repository [^1] | Exclude | ✓ | ✓[^7] | - |

@DmitriyLewen
Copy link
Contributor Author

You are right again.
Updated in a162fa1

knqyf263
knqyf263 reviewed Aug 30, 2024
View reviewed changes
docs/docs/coverage/language/java.md Outdated
| Artifact | Internet access | Dev dependencies | [Dependency graph][dependency-graph] | Position | [Detection Priority][detection-priority] |
|------------------|:---------------------:|:------------------:|:------------------------------------:|:--------:|:----------------------------------------:|
| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - | - | Not needed |
| pom.xml | Maven repository [^1] | [Include](#scopes) | ✓ | ✓[^7] | - |
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You changed from "Exclude" to "Include", but IMO, it should describe the default behavior. Actually, Node.js says "Excluded" although it supports --include-dev-deps. If you think "Include" is better, we need to change Node.js and other ecosystems for consistency.

Suggested change
| pom.xml | Maven repository [^1] | [Include](#scopes) | ✓ | ✓[^7] | - |
| pom.xml | Maven repository [^1] | [Exclude](#scopes) | ✓ | ✓[^7] | - |

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm…
This is a very controversial situation, but I would probably agree with you that we should specify the default behavior in this table.
Updated in 117555f

@knqyf263 knqyf263 added this pull request to the merge queue Sep 3, 2024
Merged via the queue into aquasecurity:main with commit 2d97700 Sep 3, 2024
17 checks passed
@aqua-bot aqua-bot mentioned this pull request Sep 3, 2024
Merged
@DmitriyLewen DmitriyLewen mentioned this pull request Sep 10, 2024
Open
@DmitriyLewen DmitriyLewen deleted the feat/pom-test-scope branch September 12, 2024 03:29
DmitriyLewen added a commit to DmitriyLewen/trivy that referenced this pull request Sep 12, 2024
@DmitriyLewen
Revert "feat(java): add test scope support for pom.xml files (aqu…
5bcca16 
…asecurity#7414)"

This reverts commit 2d97700.
@DmitriyLewen DmitriyLewen mentioned this pull request Sep 12, 2024
Merged
9 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@knqyf263 knqyf263 knqyf263 approved these changes

Assignees

@DmitriyLewen DmitriyLewen

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

feat(java): detect and mark as Dev dependencies with test scope from pom.xml files
2 participants
@DmitriyLewen @knqyf263