{"id":19054334,"url":"https://github.com/datadog/dd-dependency-sniffer","last_synced_at":"2025-08-27T11:16:08.935Z","repository":{"id":258646694,"uuid":"870695148","full_name":"DataDog/dd-dependency-sniffer","owner":"DataDog","description":"The Datadog Dependency Sniffer is a tool designed to scan and analyze the dependencies of a project, identifying the actual location of specific dependencies.","archived":false,"fork":false,"pushed_at":"2024-10-17T17:14:15.000Z","size":48,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-02-22T01:18:36.624Z","etag":null,"topics":["datadog","dependencies","software-composition-analysis"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DataDog.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-10-10T13:56:35.000Z","updated_at":"2024-10-17T17:13:00.000Z","dependencies_parsed_at":"2024-10-20T16:38:43.950Z","dependency_job_id":null,"html_url":"https://github.com/DataDog/dd-dependency-sniffer","commit_stats":null,"previous_names":["datadog/dd-dependency-sniffer"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/DataDog/dd-dependency-sniffer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DataDog%2Fdd-dependency-sniffer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DataDog%2Fdd-dependency-sniffer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DataDog%2Fdd-dependency-sniffer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DataDog%2Fdd-dependency-sniffer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DataDog","download_url":"https://codeload.github.com/DataDog/dd-dependency-sniffer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DataDog%2Fdd-dependency-sniffer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":272325396,"owners_count":24914642,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-27T02:00:09.397Z","response_time":76,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["datadog","dependencies","software-composition-analysis"],"created_at":"2024-11-08T23:37:54.689Z","updated_at":"2025-08-27T11:16:08.882Z","avatar_url":"https://github.com/DataDog.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Datadog Dependency Sniffer\n\nThe Datadog Dependency Sniffer is a tool designed to scan and analyze the dependencies of a project, identifying the\nactual location of specific dependencies in order to assist locating vulnerable dependencies discovered by Datadog's\n[SCA](https://www.datadoghq.com/product/software-composition-analysis/).\nIt effectively handles scenarios where dependencies might be shaded or relocated, providing accurate insights into the\nlibraries your project relies on.\n\n## Features\n\n- **Comprehensive Scanning**: Thoroughly scans project dependencies to identify both direct and transitive usage.\n- **Shading and Relocation Detection**: Accounts for shaded and relocated packages to provide more accurate results.\n- **Customizable Search Criteria**: Specify the dependency you want to search for using patterns.\n- **Cross-Platform Support**: Compatible with Windows, macOS, and Linux systems.\n- **Language support**: Current version targets Java/JVM dependencies in Maven and Gradle projects\n\n## Usage\n\nFirst ensure that you have the following software installed on your system:\n1. [Docker](https://docs.docker.com/engine/install/)\n2. [Bash](https://www.gnu.org/software/bash/)\n\nThe sniffer is capable of parsing and analyzing dependency tree reports from\nboth [Maven](https://maven.apache.org/plugins/maven-dependency-plugin/tree-mojo.html)\nand [Gradle](https://docs.gradle.org/current/userguide/viewing_debugging_dependencies.html). It relies on the following\nenvironment variables to provide access to your local dependencies:\n\n- **_M2_HOME_** (by default `$HOME/.m2`) pointing to your local Maven repository.\n- **_GRADLE_USER_HOME_** (by default `$HOME/.gradle`) pointing to your local Gradle repository.\n\nYou can download the provided script and run it:\n\n```shell\ncurl \"https://datadoghq.dev/dd-dependency-sniffer/run.sh\" -o run.sh\nchmod +x ./run.sh\n./run.sh --type [gradle|maven] --artifact $ARTIFACT_ID --package $PACKAGE_NAME $REPORT\n```\n\nOr run it directly with:\n\n```shell\ncurl -s \"https://datadoghq.dev/dd-dependency-sniffer/run.sh\" | bash -s -- --type [gradle|maven] --artifact $ARTIFACT_ID --package $PACKAGE_NAME $REPORT\n```\n\nThe options are as follows:\n\n- **_--type_**: Specify either `gradle` or `maven`.\n- **Filtering options (pick one)**:\n    - **_--artifact_**: Artifact ID of the Maven coordinates, e.g., `slf4j-api`.\n    - **_--package_**: Package name prefix of the library, e.g., `org.slf4j`.\n- **$REPORT**: Path of the dependency report provided by either Maven or Gradle.\n\nIt is recommended to start searching by the artifact ID and, if this approach is inconclusive, switch to package names\nfor greater accuracy.\n\n### Maven\n\nEnsure all dependencies are available in your local Maven repository and then execute the Maven dependency plugin\nreport, from your project run:\n\n```shell\n./mvnw install\n./mvnw org.apache.maven.plugins:maven-dependency-plugin:3.8.0:tree -DoutputType=json -DoutputFile=maven.json\n```\n\nRun the script:\n\n```shell\nrun.sh --type maven --artifact slf4j-api maven.json\n```\n\n### Gradle\n\nEnsure all dependencies are available in your local Gradle repository and then execute the Gradle dependencies task,\nfrom your project run:\n\n```shell\n./gradlew build\n./gradlew -q dependencies \u003e gradle.txt\n```\n\nRun the script:\n\n```shell\nrun.sh --type gradle --artifact slf4j-api gradle.txt\n```\n\n## Output\nOnce the script has been run, you will get an output similar to the following:\n\n```text\nThe artifact with id 'slf4j-api' has been found in 2 dependencies:\n\n1. 'nohttp-cli-0.0.11.jar' has matches in:\n        - META-INF/maven/org.slf4j/slf4j-api/pom.properties\n\n2. 'slf4j-api-2.0.16.jar' has matches in:\n        - META-INF/MANIFEST.MF\n        - META-INF/maven/org.slf4j/slf4j-api/pom.properties\n```\n\nIn this case the project had a direct dependency with `slf4j-api:2.0.16`, but it was also shaded in `nohttp-cli:0.0.11`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatadog%2Fdd-dependency-sniffer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdatadog%2Fdd-dependency-sniffer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatadog%2Fdd-dependency-sniffer/lists"}