It is also possible to set the IQ_SERVER environment variable if that is required by your organisation. If your org uses a secrets manager these may already be set for you. The IQ_USERNAME and IQ_TOKEN environment variables will be used for authentication. It's preferable to set your environment variables for authentication, and use a. You can enter your password which will be stored in cleartext, or you can leave this blank and be prompted for a password on start-up: If you are a commercial Sonatype Nexus Lifecycle user, switch the data source to iqServer and enter your IQ endpoint and credentials.
Install directly from the VSCode extension interface:Ĭonfiguration can be done in VSCode's extension settings: Preferences > Settings > Sonatype Explorer.Poetry poetry.lock Supports development dependency exclusion.NPM/Yarn ( npm install or yarn install required) Supports development dependency exclusion.Maven ( pom.xml and maven required) Supports development dependency exclusion.Note: Android projects are not currently supported.gradlew.bat will take precedence over system gradle Gradle ( adle and gradle required) Supports development dependency exclusion.Conan (any conan formatted *.lock files).Good news for polyglots - the extension allows you to view violations across multiple ecosystems at once across the following formats: Drill down into all of your dependencies to examine each package version for violations to determine whether you should upgrade or move to a different version at a glance. Sonatype's VSCode extension allows you to surface and remediate issues in your Workspace dependencies without ever leaving your development environment.Īny developer can use the extension for free against our publicly available OSS Index vulnerability database while our commercial users can connect to Sonatype's Nexus IQ Server to evaluate against organizational policy.
0 kommentar(er)
