search

eclipse / steady

Analyses your Java applications for open-source dependencies with known vulnerabilities, using both static analysis and testing to determine code context and usage for greater accuracy. https://eclipse.github.io/steady/
Apache License 2.0
519 stars 123 forks source link

JSON format dependency list (BOM) #508

Closed zhaolida98 closed 2 years ago

zhaolida98 commented 2 years ago

Hi, I am trying to analyze a massive of maven projects using eclipse steady plugin. I need both the dependency list and the CVE list. But steady:report only provides CVE lists and their related dependencies. If I want to get the full BOM, I have to go to the webpage, which is a nightmare for batch operation. I am wondering are there any configurations that I missed that can help me get the full BOM list? If not, is there any possibility you can provide the feature to generate an aggregate dependency list report locally? Preferring JSON format. :smile:

zhaolida98 commented 2 years ago

solved, actually, I can get the list through the internal API. get deps: {backend_url}/apps/{group}/{artifact}/{version}/deps get vulns: {backend_url}/apps/{group}/{artifact}/{version}/vulndeps