Skip to content

Commit

Permalink
Update docs: test dependencies not in the resolved graph (#1114)
Browse files Browse the repository at this point in the history
Update the documentation that the current Maven resolver does not handle
test dependencies.
  • Loading branch information
cuixq committed Jul 12, 2024
1 parent 45fb6f9 commit bbc546f
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions docs/supported_languages_and_lockfiles.md
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,9 @@ OSV-Scanner uses [deps.dev’s resolver library](https://pkg.go.dev/deps.dev/uti

After the dependency resolution, the OSV database is queried for the vulnerabilities associated with these dependencies as usual.

{: .note }
Test dependencies are not supported yet in the computed dependency graph for Maven pom.xml.

## Custom Lockfiles

If you have a custom lockfile that we do not support or prefer to do your own custom parsing, you can extract the custom lockfile information and create a custom intermediate file containing dependency information so that osv-scanner can still check for vulnerabilities.
Expand Down

0 comments on commit bbc546f

Please sign in to comment.