google
Support a --no-resolve flag to avoid resolving transitive dependencies during scanning
Transitive dependencies cannot be fixed. If I want to use only the direct dependencies of the Maven project pom without using transitive dependencies, how can I pass parameters?
Transitive scanning for Maven is disabled in the offline mode - does this help with your use case?
Can a parameter be added to control this? Because not only Maven projects, but also projects in other languages need to be scanned.
I may not understand your comment above - projects in other languages are also scanned with the offline mode. Can you explain a bit more on what parameter you want?
I may not understand your comment above - projects in other languages are also scanned with the offline mode. Can you explain a bit more on what parameter you want?
That is, if I want to perform a direct dependency scan on a JAVA project, I can only use offline mode, and there is no parameter to control the offline mode. But non-JAVA projects can be scanned in online mode. My question is, can I add a parameter when passing parameters? If -r = false, it is a direct dependency, and -r = true is a transitive dependency scan.
I don't think we have parameters to control what projects to be scanned offline.
Re "Transitive dependencies cannot be fixed", we're currently actively working on fixing this part via Java support for https://google.github.io/osv-scanner/experimental/guided-remediation/.
That said, this issue seems to be requesting a --no-resolve flag of some sort, so I'll rename the issue title to capture this better.
As @cuixq mentioned earlier, --offline should work for this use case, but it disables both resolution and OSV.dev API usage which may not be ideal.
Re "Transitive dependencies cannot be fixed", we're currently actively working on fixing this part via Java support for https://google.github.io/osv-scanner/experimental/guided-remediation/.
That said, this issue seems to be requesting a
--no-resolveflag of some sort, so I'll rename the issue title to capture this better.
Good, this is what I need。 --no-resolve flag. Because transitive dependencies can be scanned but hard to be repaired
This issue has not had any activity for 60 days and will be automatically closed in two weeks
See https://github.com/google/osv-scanner/blob/main/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}