Configuration

You can customize the tool’s behavior using a configuration file maven_check_versions.yml. The following settings can be adjusted:

SSL Verification: Enable or disable SSL verification for HTTP requests.
Cache Preferences: Control cache duration and behavior.
Repository Settings: Define base URLs, authentication, and paths for repositories.
Logging Preferences: Specify log levels and file paths.
Vulnerability Checking: Configure checks for known vulnerabilities in dependencies.

Cache Configuration

The tool supports multiple cache backends:

JSON (default): Stores cache data in a local JSON file specified by cache_file.
Redis: Uses a Redis server for caching.
Tarantool: Uses a Tarantool server for caching.
Memcached: Uses a Memcached server for caching.

Vulnerability Checking Configuration

To enable vulnerability checking, set oss_index_enabled to true in the vulnerability section of the configuration file. This feature uses the OSS Index service to identify known vulnerabilities in your dependencies. You will need to provide your OSS Index username and API token, which you can obtain by signing up for a free account at https://ossindex.sonatype.org/.

Example configuration:

Vulnerability scanning will:

Check all dependencies against OSS Index
Fail build if any vulnerability with CVSS ≥7.0 found
Skip checks for test components

vulnerability:
  oss_index_enabled: true
  oss_index_url: "https://ossindex.sonatype.org/api/v3/component-report"
  oss_index_user: "OSS_INDEX_USER"
  oss_index_token: "OSS_INDEX_TOKEN"
  oss_index_batch_size: 128
  oss_index_keep_safe: false
  fail_score: 7
  skip_no_versions: false
  skip_checks: [ "junit:junit:*" ]
  cache_backend: "json"

Configuration file

maven_check_versions.yml:

base:
  cache_off: false        # Disables caching of version check results
  cache_time: 600         # Cache expiration time in seconds (0 to disable expiration)
  cache_backend: "json"   # Cache backend to use: json, redis, tarantool, memcached

  # Redis cache backend settings
  redis_host: "localhost"                           # Redis host
  redis_port: 6379                                  # Redis port
  redis_key: "maven_check_versions_artifacts"       # Key for storing data in Redis
  redis_user: null                                  # Redis username (optional)
  redis_password: null                              # Redis password (optional)

  # Tarantool cache backend settings
  tarantool_host: "localhost"                       # Tarantool host
  tarantool_port: 3301                              # Tarantool port
  tarantool_space: "maven_check_versions_artifacts" # Tarantool space
  tarantool_user: null                              # Tarantool username (optional)
  tarantool_password: null                          # Tarantool password (optional)

  # Memcached cache backend settings
  memcached_host: "localhost"                       # Memcached host
  memcached_port: 11211                             # Memcached port
  memcached_key: "maven_check_versions_artifacts"   # Key for storing data in Memcached

  fail_mode: false        # Enables fail mode, terminating the script if version thresholds are exceeded
  fail_major: 0           # Major version difference threshold for failure
  fail_minor: 0           # Minor version difference threshold for failure

  search_plugins: false   # Includes Maven plugins in the dependency search process
  process_modules: false  # Processes modules listed in the POM file

  show_skip: false        # Logs dependencies that are skipped during processing
  show_search: false      # Logs information about search actions for dependencies

  empty_version: false    # Allows processing of dependencies without a specified version
  show_invalid: false     # Logs information about invalid dependencies
  skip_current: true      # Skips version checks for dependencies matching the current version

  threading: true        # Enables multi-threading for concurrent processing
  max_threads: 8          # Maximum number of threads to use when threading is enabled

  user: "USER"            # Username for basic authentication in repositories
  password: "PASSWORD"    # Password for basic authentication in repositories

# Configuration for vulnerability checks
vulnerability:
  oss_index_enabled: true                           # Enables OSS Index vulnerability checks
  oss_index_url: "https://ossindex.sonatype.org/api/v3/component-report"  # OSS Index API URL
  oss_index_user: "OSS_INDEX_USER"                  # OSS Index username
  oss_index_token: "OSS_INDEX_TOKEN"                # OSS Index API token
  oss_index_batch_size: 128                         # Batch size for OSS Index requests
  oss_index_keep_safe: false                        # Keeps safe dependencies in the cache

  fail_score: 0                                     # Fail if CVSS score exceeds this value
  cve_reference: false                              # Logs link for detailed information
  skip_no_versions: false                           # Skips dependencies without versions in vulnerability checks
  skip_checks: []                                   # List of dependencies to skip in vulnerability checks
                                                    # (e.g., ["group:artifact:version"])

  cache_backend: "json"                             # Cache backend to use: json, redis, tarantool, memcached

  # Redis cache backend settings for the vulnerability
  redis_host: "localhost"                                 # Redis host
  redis_port: 6379                                        # Redis port
  redis_key: "maven_check_versions_vulnerabilities"       # Key for storing data in Redis
  redis_user: null                                        # Redis username (optional)
  redis_password: null                                    # Redis password (optional)

  # Tarantool cache backend settings for the vulnerability
  tarantool_host: "localhost"                             # Tarantool host
  tarantool_port: 3301                                    # Tarantool port
  tarantool_space: "maven_check_versions_vulnerabilities" # Tarantool space
  tarantool_user: null                                    # Tarantool username (optional)
  tarantool_password: null                                # Tarantool password (optional)

  # Memcached cache backend settings for the vulnerability
  memcached_host: "localhost"                             # Memcached host
  memcached_port: 11211                                   # Memcached port
  memcached_key: "maven_check_versions_vulnerabilities"   # Key for storing data in Memcached

# Configuration for HTTP-based POM file access
pom_http:
  auth: false                                 # Enables authentication for HTTP-based POM file access
  user: "USER"                                # Username for authentication
  password: "PASSWORD"                        # Password for authentication

# Configuration for urllib3 library
urllib3:
  warnings: true                              # Enables or disables urllib3 warnings

# Configuration for requests library
requests:
  verify: true                                # Enables or disables SSL verification for requests

# List of POM files to process
pom_files:
  pom-name: "path/to/pom.xml"                 # Path to a POM file to process

# Repository configurations
repositories:
  "Central (repo1.maven.org)": "repo1_maven"  # Example repository mapping

# Configuration for repo1.maven repository
repo1_maven:
  base: "https://repo1.maven.org"             # Base URL of the repository
  path: "maven2"                              # Path suffix for the repository
  auth: false                                 # Enables authentication for this repository
  user: "USER"                                # Username for authentication
  password: "PASSWORD"                        # Password for authentication
  repo: "maven2"                              # Repository name
  service_rest: false                         # Enables REST service for this repository

Environment Variables

The tool supports environment variables to override configuration settings or provide credentials for external services. Below is a list of supported environment variables:

Configuration Overrides

These variables override settings from the maven_check_versions.yml file or command-line arguments. The format is CV_<KEY> where <KEY> corresponds to a configuration key in the base section.

Variable	Description	Example Value
`CV_CACHE_OFF`	Disables caching if set to `true`.	`true`
`CV_CACHE_TIME`	Sets cache expiration time in seconds.	`3600`
`CV_FAIL_MODE`	Enables fail mode if set to `true`.	`true`
`CV_FAIL_MAJOR`	Sets the major version threshold for failure.	`1`
`CV_FAIL_MINOR`	Sets the minor version threshold for failure.	`2`
`CV_SEARCH_PLUGINS`	Enables searching plugins if set to `true`.	`true`
`CV_PROCESS_MODULES`	Enables processing of modules if set to `true`.	`true`
`CV_SHOW_SKIP`	Logs skipped dependencies if set to `true`.	`true`
`CV_SHOW_SEARCH`	Logs search actions if set to `true`.	`true`
`CV_EMPTY_VERSION`	Allows empty versions if set to `true`.	`true`
`CV_SHOW_INVALID`	Logs invalid dependencies if set to `true`.	`true`
`CV_THREADING`	Enables multi-threading if set to `true`.	`true`
`CV_MAX_THREADS`	Sets the maximum number of threads to use when threading is enabled.	`8`
`CV_USER`	Specifies the username for repository authentication.	`my_username`
`CV_PASSWORD`	Specifies the password for repository authentication.	`my_password`

Other configuration sections

The format is CV_<SECTION>_<KEY> where <KEY> corresponds to a configuration key in the <SECTION> section.

Usage Example

To override cache settings:

export CV_CACHE_TIME=1800
maven_check_versions --pom_file path/to/pom.xml