|
| 1 | +## OPTIONS |
| 2 | + |
| 3 | +To see command-specific flags and usage, see `help` command, e.g. `snyk container --help`. |
| 4 | +For advanced usage, we offer language and context specific flags, listed further down this document. |
| 5 | + |
| 6 | +- `--all-projects`: |
| 7 | + (only in `test` and `monitor` commands) |
| 8 | + Auto-detect all projects in working directory |
| 9 | + |
| 10 | +- `--detection-depth`=<DEPTH>: |
| 11 | + (only in `test` and `monitor` commands) |
| 12 | + Use with --all-projects or --yarn-workspaces to indicate how many sub-directories to search. `DEPTH` must be a number. |
| 13 | + |
| 14 | + Default: 4 (the current working directory and 3 sub-directories) |
| 15 | + |
| 16 | +- `--exclude`=<DIRECTORY>[,<DIRECTORY>]...>: |
| 17 | + (only in `test` and `monitor` commands) |
| 18 | + Can be used with --all-projects and --yarn-workspaces to indicate sub-directories to exclude. Directories must be comma separated. |
| 19 | + |
| 20 | + If using with `--detection-depth` exclude ignores directories at any level deep. |
| 21 | + |
| 22 | +- `--prune-repeated-subdependencies`, `-p`: |
| 23 | + (only in `test` and `monitor` commands) |
| 24 | + Prune dependency trees, removing duplicate sub-dependencies. |
| 25 | + Will still find all vulnerabilities, but potentially not all of the vulnerable paths. |
| 26 | + |
| 27 | +- `--print-deps`: |
| 28 | + (only in `test` and `monitor` commands) |
| 29 | + Print the dependency tree before sending it for analysis. |
| 30 | + |
| 31 | +- `--remote-repo-url`=<URL>: |
| 32 | + Set or override the remote URL for the repository that you would like to monitor. |
| 33 | + |
| 34 | +- `--dev`: |
| 35 | + Include devDependencies. |
| 36 | + |
| 37 | + Default: scan only production dependencies |
| 38 | + |
| 39 | +- `--org`=<ORG_NAME>: |
| 40 | + Specify the <ORG_NAME> to run Snyk commands tied to a specific organization. This will influence where will new projects be created after running `monitor` command, some features availability and private tests limits. |
| 41 | + If you have multiple organizations, you can set a default from the CLI using: |
| 42 | + |
| 43 | + `$ snyk config set org`=<ORG_NAME> |
| 44 | + |
| 45 | + Setting a default will ensure all newly monitored projects will be created |
| 46 | + under your default organization. If you need to override the default, you can use the `--org`=<ORG_NAME> argument. |
| 47 | + |
| 48 | + Default: uses <ORG_NAME> that sets as default in your [Account settings](https://app.snyk.io/account) |
| 49 | + |
| 50 | +- `--file`=<FILE>: |
| 51 | + Sets a package file. |
| 52 | + |
| 53 | + When testing locally or monitoring a project, you can specify the file that Snyk should inspect for package information. When ommitted Snyk will try to detect the appropriate file for your project. |
| 54 | + |
| 55 | +- `--ignore-policy`: |
| 56 | + Ignores all set policies. The current policy in `.snyk` file, Org level ignores and the project policy on snyk.io. |
| 57 | + |
| 58 | +- `--trust-policies`: |
| 59 | + Applies and uses ignore rules from your dependencies' Snyk policies, otherwise ignore policies are only shown as a suggestion. |
| 60 | + |
| 61 | +- `--show-vulnerable-paths`=none|some|all: |
| 62 | + Display the dependency paths from the top level dependencies, down to the vulnerable packages. Doesn't affect output when using JSON `--json` output. |
| 63 | + |
| 64 | + Default: <some> (a few example paths shown) |
| 65 | + <false> is an alias for <none>. |
| 66 | + |
| 67 | +- `--project-name`=<PROJECT_NAME>: |
| 68 | + Specify a custom Snyk project name. |
| 69 | + |
| 70 | +- `--policy-path`=<PATH_TO_POLICY_FILE>`: |
| 71 | + Manually pass a path to a snyk policy file. |
| 72 | + |
| 73 | +- `--json`: |
| 74 | + Prints results in JSON format. |
| 75 | + |
| 76 | +- `--json-file-output`=<OUTPUT_FILE_PATH>: |
| 77 | + (only in `test` command) |
| 78 | + Save test output in JSON format directly to the specified file, regardless of whether or not you use the `--json` option. |
| 79 | + This is especially useful if you want to display the human-readable test output via stdout and at the same time save the JSON format output to a file. |
| 80 | + |
| 81 | +- `--severity-threshold`=low|medium|high: |
| 82 | + Only report vulnerabilities of provided level or higher. |
| 83 | + |
| 84 | +- `--fail-on`=all|upgradable|patchable: |
| 85 | + Only fail when there are vulnerabilities that can be fixed. |
| 86 | + |
| 87 | + <all> fails when there is at least one vulnerability that can be either upgraded or patched. |
| 88 | + <upgradable> fails when there is at least one vulnerability that can be upgraded. |
| 89 | + <patchable> fails when there is at least one vulnerability that can be patched. |
| 90 | + |
| 91 | + If vulnerabilities do not have a fix and this option is being used, tests will pass. |
| 92 | + |
| 93 | +- `--dry-run`: |
| 94 | + (only in `protect` command) |
| 95 | + Don't apply updates or patches during `protect` command run. |
| 96 | + |
| 97 | +- `--` \[<COMPILER_OPTIONS>\]: |
| 98 | + Pass extra arguments directly to Gradle or Maven. |
| 99 | + E.g. `snyk test -- --build-cache` |
| 100 | + |
| 101 | +Below are flags that are influencing CLI behavior for specific projects, languages and contexts: |
| 102 | + |
| 103 | +### Maven options |
| 104 | + |
| 105 | +- `--scan-all-unmanaged`: |
| 106 | + Auto detects maven jars and wars in given directory. Individual testing can be done with `--file`=<JAR_FILE_NAME> |
| 107 | + |
| 108 | +- `--reachable`: |
| 109 | + (only in `test` and `monitor` commands) |
| 110 | + Analyze your source code to find which vulnerable |
| 111 | + functions and packages are called. |
| 112 | + |
| 113 | +- `--reachable-timeout`=<TIMEOUT>: |
| 114 | + The amount of time (in seconds) to wait for Snyk to gather reachability data. If it takes longer than <TIMEOUT>, Reachable Vulnerabilities are not reported. This does not affect regular test or monitor output. |
| 115 | + |
| 116 | + Default: 300 (5 minutes). |
| 117 | + |
| 118 | +### Gradle options |
| 119 | + |
| 120 | +[More information about Gradle CLI options](https://snyk.co/ucT6P) |
| 121 | + |
| 122 | +- `--sub-project`=<NAME>, `--gradle-sub-project`=<NAME>: |
| 123 | + For Gradle "multi project" configurations, test a specific sub-project. |
| 124 | + |
| 125 | +- `--all-sub-projects`: |
| 126 | + For "multi project" configurations, test all sub-projects. |
| 127 | + |
| 128 | +- `--configuration-matching`=<CONFIGURATION_REGEX>: |
| 129 | + Resolve dependencies using only configuration(s) that match the provided Java regular expression, e.g. `^releaseRuntimeClasspath$`. |
| 130 | + |
| 131 | +- `--configuration-attributes`=<ATTRIBUTE>[,<ATTRIBUTE>]...: |
| 132 | + Select certain values of configuration attributes to resolve the dependencies. E.g. `buildtype:release,usage:java-runtime` |
| 133 | + |
| 134 | +### .Net & NuGet options |
| 135 | + |
| 136 | +- `--assets-project-name`: |
| 137 | + When monitoring a .NET project using NuGet `PackageReference` use the project name in project.assets.json, if found. |
| 138 | + |
| 139 | +- `--packages-folder`: |
| 140 | + Custom path to packages folder |
| 141 | + |
| 142 | +### npm options |
| 143 | + |
| 144 | +- `--strict-out-of-sync`=true|false: |
| 145 | + Control testing out of sync lockfiles. |
| 146 | + |
| 147 | + Default: true |
| 148 | + |
| 149 | +### Yarn options |
| 150 | + |
| 151 | +- `--strict-out-of-sync`=true|false: |
| 152 | + Control testing out of sync lockfiles. |
| 153 | + |
| 154 | + Default: true |
| 155 | + |
| 156 | +- `--yarn-workspaces`: |
| 157 | + (only in `test` and `monitor` commands) |
| 158 | + Detect and scan yarn workspaces. You can specify how many sub-directories to search using `--detection-depth` and exclude directories using `--exclude`. |
| 159 | + |
| 160 | +### CocoaPods options |
| 161 | + |
| 162 | +- `--strict-out-of-sync`=true|false: |
| 163 | + Control testing out of sync lockfiles. |
| 164 | + |
| 165 | + Default: false |
| 166 | + |
| 167 | +### Python options |
| 168 | + |
| 169 | +- `--command`=<COMMAND>: |
| 170 | + Indicate which specific Python commands to use based on Python version. The default is `python` which executes your systems default python version. Run 'python -V' to find out what version is it. If you are using multiple Python versions, use this parameter to specify the correct Python command for execution. |
| 171 | + |
| 172 | + Default: `python` |
| 173 | + Example: `--command=python3` |
| 174 | + |
| 175 | +- `--skip-unresolved`=true|false: |
| 176 | + Allow skipping packages that are not found in the environment. |
0 commit comments