Fork me on GitHub
#tools-deps
<
2022-11-11
>
simongray10:11:46

I recently made a security report using nvd-clojure and I got some terminal output that looks like this (showing mostly issues with transitive dependencies). Is there a one-liner I can use to quickly figure out which of my explicit dependencies result in one of these transitive dependencies? When I run clj -X:deps tree the output isn’t that easy to sort through (or grep for ancestors), so I spend a lot of time searching through it to figure things out. I’ve tried making a graph using tools.deps.graph which would be idea, except the output is a bitmap image which can’t be searched…

pavlosmelissinos12:11:38

With clj -X:deps tree :format :edn you can get the output as data, which might help a bit

pavlosmelissinos12:11:27

But it doesn't solve your other problem (some dependencies not appearing at all)

simongray12:11:37

yeah… anyway, I found that using grep -B 20 solves grepping the result pretty well, so that at least works ok

simongray12:11:20

and some of them can’t be found at all in the clj -X:deps tree output

Alex Miller (Clojure team)12:11:34

You might try clj-watson to get a little better output, not sure if it will address your concerns

simongray14:11:24

I turns out that it was because aliases are not considered when you use -X:deps , while they work with -SDeps . What’s up with that?

simongray14:11:40

(pointed out to me by the wonderful @U7PBP4UVA)

pavlosmelissinos16:11:30

Is there a way to figure out which :mvn/repos entry in deps.edn provides which dependency?

Alex Miller (Clojure team)16:11:32

not currently (and there's not necessarily only one answer)

Alex Miller (Clojure team)16:11:00

but this would be a useful thing to know

Alex Miller (Clojure team)16:11:34

You can see it during download so doing something like

clj -Sdeps '{:mvn/local-repo "tmp"}' -Stree
will show you in the output (and leave you the full lib set in ./tmp)

😎 1
pavlosmelissinos16:11:55

Oh, nice, that will do, thanks a lot. 🙂 My use case is a custom maven repo that I suspect is no longer useful, but I'd like a confirmation before I remove it. Your workaround is good enough but if this is something that you'd consider improving let me know if you'd like to have the question on http://ask.clojure.org and I'll post it.

Alex Miller (Clojure team)18:11:54

go for it, have been thinking it would be useful to have something like this for a while

👍 1