Snyk helps you find, fix and monitor for known vulnerabilities in your dependencies, both on an ad hoc basis and as part of your CI (Build) system.

| :information_source: This repository is only a plugin to be used with the Snyk CLI tool. To use this plugin to test and fix vulnerabilities in your project, install the Snyk CLI tool first. Head over to snyk.io to get started. | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

Snyk Maven CLI Plugin

This plugin provides dependency metadata for Maven projects that use mvn and have a pom.xml file. It is an internal component intended for use by our CLI tool.

If you are looking to add tasks to your Maven build process you should use our Maven Plugin.

Features

• Dependency Tree Analysis: Analyzes Maven dependency trees to build dependency graphs
• Test Scope Support: Optional inclusion of test-scoped dependencies
• Verbose Mode: Detailed dependency analysis with version resolution information
• Archive Scanning: Direct analysis of JAR/WAR files
• Artifact Fingerprinting: Generate cryptographic fingerprints for Maven artifacts

API Usage

The plugin exports an inspect function that analyzes Maven projects:

import { inspect } from 'snyk-mvn-plugin';

const result = await inspect(rootPath, targetFile, options);

Parameters

• rootPath (string): The root directory of the Maven project
• targetFile (string, optional): Path to the pom.xml file or archive to analyze
• options (MavenOptions, optional): Configuration options

Options

| Option | Type | Default | Description | |--------|------|---------|-------------| | dev | boolean | false | Include development dependencies | | scanAllUnmanaged | boolean | false | Scan all unmanaged archive files | | allProjects | boolean | false | Include all projects in multi-module builds | | mavenAggregateProject | boolean | false | Treat as Maven aggregate project | | mavenVerboseIncludeAllVersions | boolean | false | Include all dependency versions in verbose mode | | includeProvenance | boolean | false | Generate cryptographic fingerprints for artifacts to prove origin | | fingerprintAlgorithm | string | 'sha1' | Hash algorithm ('sha1', 'sha256', 'sha512') | | mavenRepository | string | - | Custom Maven repository path |

Package Provenance

The plugin can generate cryptographic fingerprints (hashes) for Maven artifacts to enhance security and integrity verification.

Prerequisites

• Maven repository must be accessible (local or custom path)
• Artifacts must be downloaded and available in the repository
• Supported file types: JAR, WAR, AAR, and other Maven artifacts

Configuration

Enable fingerprinting by setting includeProvenance: true:

const result = await inspect(rootPath, 'pom.xml', {
  includeProvenance: true,
  fingerprintAlgorithm: 'sha256',
  mavenRepository: '/path/to/custom/repo'
});

Supported Hash Algorithms

• sha1 - SHA-1 (160-bit) - Default
• sha256 - SHA-256 (256-bit)
• sha512 - SHA-512 (512-bit)

Output Format

When provenance is enabled, the dependency graph includes PURL (Package URL) identifiers with checksum qualifiers:

{
  "pkgs": [
    {
      "id": "com.example:[email protected]",
      "info": {
        "name": "com.example:artifact",
        "version": "1.0.0",
        "purl": "pkg:maven/com.example/[email protected]?checksum=sha256%3Aabc123def456789..."
      }
    }
  ],
  "graph": {
    "nodes": [
      {
        "nodeId": "com.example:artifact:jar:1.0.0",
        "pkgId": "com.example:[email protected]",
        "deps": []
      }
    ]
  }
}

PURL Format

Package URLs follow the standard format with checksum qualifiers:

• Without fingerprinting: pkg:maven/com.example/[email protected]
• With fingerprinting: pkg:maven/com.example/[email protected]?checksum=sha256%3Aabc123...
• With classifier: pkg:maven/com.example/[email protected]?checksum=sha256%3Aabc123...&classifier=sources

Error Handling

If fails for an artifact, the PURL will not include a checksum qualifier:

{
  "info": {
    "name": "com.example:missing-artifact",
    "version": "1.0.0",
    "purl": "pkg:maven/com.example/[email protected]"
  }
}

Example Timing Output

Timing information is available via debug logging (DEBUG=snyk-mvn-plugin or -d from cli):

=== Provenance Timing Summary ===
Total artifacts: 25
Successful: 23
Failed: 2
Total time: 1,234.56ms
Average time per artifact: 49.38ms
Fastest: 12.34ms
Slowest: 156.78ms
=====================================

Support

❌ Not supported ❓ No issues expected but not regularly tested ✅ Supported and verified with tests

Supported OS

| OS | Supported | | ------- | --------- | | Windows | ✅ | | Linux | ✅ | | OSX | ️✅ |

Supported Node versions

| Node | Supported | |------| --------- | | 20 | ✅ |

Supported Maven versions

This plugin supports Maven versions 3.*