scala language

[itaysk]

related https://github.com/albuch/sbt-dependency-check

[james-luther]

I would love to see Scala language support added also :-)

[timonbimon]

+1 :)

[knqyf263]

Please let us know if someone knows how to generate a list of dependencies in sbt. Something like this.

[knqyf263]

Nice! Could you look into it? Does it generate something like a lock file?

[nikpivkin]

This plugin has a couple of commands that generate files:

dependencyTree - builds a dependency tree

default:sbt-test_2.12:0.1.0-SNAPSHOT [S]
  +-com.outr:scribe_2.12:3.11.5 [S]
  | +-com.lihaoyi:sourcecode_2.12:0.3.0 [S]
  | +-com.outr:moduload_2.12:1.1.6 [S]
  | | +-org.scala-lang.modules:scala-collection-compat_2.12:2.10.0 [S]
  | | +-org.scala-lang.modules:scala-collection-compat_2.12:2.8.1 (evicted by:..
  | | 
  | +-com.outr:perfolation_2.12:1.2.9 [S]
  | +-org.scala-lang.modules:scala-collection-compat_2.12:2.10.0 [S]
  | 
  +-dev.zio:zio-streams_2.12:2.0.15 [S]
  | +-dev.zio:zio_2.12:2.0.15 [S]
  |   +-dev.zio:izumi-reflect_2.12:2.3.8 [S]
  |   | +-dev.zio:izumi-reflect-thirdparty-boopickle-shaded_2.12:2.3.8 [S]
  |   | 
  |   +-dev.zio:zio-internal-macros_2.12:2.0.15 [S]
  |   +-dev.zio:zio-stacktracer_2.12:2.0.15 [S]
  |   
  +-dev.zio:zio_2.12:2.0.15 [S]
    +-dev.zio:izumi-reflect_2.12:2.3.8 [S]
    | +-dev.zio:izumi-reflect-thirdparty-boopickle-shaded_2.12:2.3.8 [S]
    | 
    +-dev.zio:zio-internal-macros_2.12:2.0.15 [S]
    +-dev.zio:zio-stacktracer_2.12:2.0.15 [S]

dependencyList - list of all transitive dependencies for the project

com.lihaoyi:sourcecode_2.12:0.3.0
com.outr:moduload_2.12:1.1.6
com.outr:perfolation_2.12:1.2.9
com.outr:scribe_2.12:3.11.5
default:sbt-test_2.12:0.1.0-SNAPSHOT
dev.zio:izumi-reflect-thirdparty-boopickle-shaded_2.12:2.3.8
dev.zio:izumi-reflect_2.12:2.3.8
dev.zio:zio-internal-macros_2.12:2.0.15
dev.zio:zio-stacktracer_2.12:2.0.15
dev.zio:zio-streams_2.12:2.0.15
dev.zio:zio_2.12:2.0.15
org.scala-lang.modules:scala-collection-compat_2.12:2.10.0

The plugin does not have an option to output the dependency tree in a machine-readable format. But there is hack, thedependencyBrowseTreeHTML command generates files for visualization in the browser, among which there is json.

[
  {
    "text": "default:sbt-test_2.12:0.1.0-SNAPSHOT",
    "children": [
      {
        "text": "com.outr:scribe_2.12:3.11.5",
        "children": [
          { "text": "com.lihaoyi:sourcecode_2.12:0.3.0", "children": [] },
          {
            "text": "com.outr:moduload_2.12:1.1.6",
            "children": [
              {
                "text": "org.scala-lang.modules:scala-collection-compat_2.12:2.10.0",
                "children": []
              },
              {
                "text": "org.scala-lang.modules:scala-collection-compat_2.12:2.8.1 (evicted by 2.10.0)",
                "children": []
              }
            ]
          },
          { "text": "com.outr:perfolation_2.12:1.2.9", "children": [] },
          {
            "text": "org.scala-lang.modules:scala-collection-compat_2.12:2.10.0",
            "children": []
          }
        ]
      },
      {
        "text": "dev.zio:zio-streams_2.12:2.0.15",
        "children": [
          {
            "text": "dev.zio:zio_2.12:2.0.15",
            "children": [
              {
                "text": "dev.zio:izumi-reflect_2.12:2.3.8",
                "children": [
                  {
                    "text": "dev.zio:izumi-reflect-thirdparty-boopickle-shaded_2.12:2.3.8",
                    "children": []
                  }
                ]
              },
              {
                "text": "dev.zio:zio-internal-macros_2.12:2.0.15",
                "children": []
              },
              { "text": "dev.zio:zio-stacktracer_2.12:2.0.15", "children": [] }
            ]
          }
        ]
      },
      {
        "text": "dev.zio:zio_2.12:2.0.15",
        "children": [
          {
            "text": "dev.zio:izumi-reflect_2.12:2.3.8",
            "children": [
              {
                "text": "dev.zio:izumi-reflect-thirdparty-boopickle-shaded_2.12:2.3.8",
                "children": []
              }
            ]
          },
          { "text": "dev.zio:zio-internal-macros_2.12:2.0.15", "children": [] },
          { "text": "dev.zio:zio-stacktracer_2.12:2.0.15", "children": [] }
        ]
      }
    ]
  }
]

Does any of this work for us?

[knqyf263]

Do they generate files or just write to stdout? Trivy usually determines file types based on file names.

[nikpivkin]

Generate files (the toFile subtask), but the file name is specified by the user, except for the dependencyBrowseTreeHTML command

[knqyf263]

Thanks. Are there any de facto standards, such as file names used in the document?