search

rm-hull / nvd-clojure

National Vulnerability Database dependency checker for Clojure projects
MIT License
275 stars 36 forks source link

Clojure CLI tools deps.edn support? #31

Closed wwiillson closed 3 years ago

wwiillson commented 5 years ago

Support for tools deps? (see #12)

rm-hull commented 5 years ago

Can you be more specific in what you mean?

wwiillson commented 5 years ago

Would be cool if we could run the checks from a project using the deps.edn format from Clojure CLI tools.

seanpoulter commented 4 years ago

I'm also interested in this feature. Has anyone found a tool to scan deps.edn or ClojureScript dependencies?

manuviswam commented 3 years ago

I'm also looking for the same. Did anyone find a tool to scan deps.edn dependencies?

dotemacs commented 3 years ago

You can use this library/plugin with Clojure CLI right now.

In your deps.edn, add:

 :aliases   {:nvd {:extra-deps {lein-nvd/lein-nvd {:mvn/version "1.4.1"}
                                org.slf4j/slf4j-nop {:mvn/version "1.7.30"}}
                   :main-opts ["-m" "nvd.task.check"]}}

On the command line run it:

$ clj -M:nvd

The only issue that I've noticed is that nvd.task.check/make-classpath is not playing nicely with > Java 8, due to the way classpath is generated. But that's a separate issue, but one that you should be aware when trying the above.

dotemacs commented 3 years ago

The only issue that I've noticed is that nvd.task.check/make-classpath is not playing nicely with > Java 8, due to the way classpath is generated. But that's a separate issue, but one that you should be aware when trying the above.

Took care of that in #56

dotemacs commented 3 years ago

Considering that #57 & #58 were merged and that the README shows how to use this library with Clojure CLI tools deps.edn, maybe this issue is no longer relevant and can be closed?

rm-hull commented 3 years ago

@dotemacs agreed.