dependency-check / dependency-check/dependency-check-sonar-plugin

Support Yarn

Open
#367 9 comments 3 reactions 0 assignees View on GitHub
enhancement lifecycle/frozen
Dominant language
Java
Stars
694
Forks
146
PR merge metrics
No merged PRs in 30d

Description

With the release of `Dependency-Check` [v6.1.0](https://github.com/jeremylong/DependencyCheck/releases) (and subsequent fixes in v6.1.1), Yarn auditing is supported natively.

In this plugin, the logs that I receive during my CI pipeline suggest that Yarn is not directly supported.

```txt
INFO: Sensor Dependency-Check [dependencycheck]
INFO: Process Dependency-Check report
INFO: Using JSON-Reportparser
INFO: No project configuration file, e.g. pom.xml, *.gradle, *.gradle.kts, package-lock.json found, therefore it isn't possible to correctly link dependencies with files.
```

Where the project's `sonar-project.properties` contains the value:

```txt
sonar.sources=src,yarn.lock
```

**Describe the solution you'd like**

This plugin should support Yarn now that `Dependency-Check` supports auditing with `yarn audit --verbose` with the file `yarn.lock`.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.