# Test ## Usage `snyk test []` ## Description The `snyk test` command checks projects for open source vulnerabilities and license issues. The test command tries to auto-detect supported manifest files with dependencies and test those. ## Exit codes Possible exit codes and their meaning: **0**: success, no vulnerabilities found\ **1**: action_needed, vulnerabilities found\ **2**: failure, try to re-run command\ **3**: failure, no supported projects detected ## Configure the Snyk CLI You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API. See [Configure the Snyk CLI](https://docs.snyk.io/features/snyk-cli/configure-the-snyk-cli) ## Debug Use the `-d` option to output the debug logs. ## Options See also subsequent sections for options for specific build environments, package managers, languages, and `[]` which you specify last. ### `--all-projects` Auto-detect all projects in the working directory (including Yarn workspaces). For more information see the article [Does the Snyk CLI support monorepos or multiple manifest files?](https://support.snyk.io/hc/en-us/articles/360000910577-Does-the-Snyk-CLI-support-monorepos-or-multiple-manifest-files-) ### `--detection-depth=` Use with `--all-projects` or `--yarn-workspaces` to indicate how many sub-directories to search. `DEPTH` must be a number. Default: 4 (the current working directory and 3 sub-directories). Example: Limit search to the specified directory (or the current directory if no `` is specified) plus three levels of subdirectories. `--detection-depth=3` ### `--exclude=[,]...>` Can be used with `--all-projects` and `--yarn-workspaces` to indicate sub-directories and files to exclude. Must be comma separated. Note that the glob doesn't need to be an exact match and only need to be part of the path or the filename. Use the `--exclude` option with `--detection-depth` to ignore directories at any depth. Examples: Exclude any (sub-)folders or files containing `test` as part of the path or name: `--exclude=test` Exclude any (sub-)folders or files containing `fixtures` or `debug` as part of the path or name: `--exclude=fixtures,debug` ### `--prune-repeated-subdependencies`, `-p` Prune dependency trees, removing duplicate sub-dependencies. Continues to find all vulnerabilities, but may not find all of the vulnerable paths. ### `--print-deps` Print the dependency tree before sending it for analysis. ### `--remote-repo-url=` Set or override the remote URL for the repository that you would like to monitor. ### `--dev` Include development-only dependencies. Applicable only for some package managers, for example, `devDependencies` in npm or `:development` dependencies in Gemfile. Default: scan only production dependencies. ### `--org=` Specify the `` to run Snyk commands tied to a specific organization. The `` influences some features availability and private test limits. If you have multiple organizations, you can set a default from the CLI using: `$ snyk config set org=` Set a default to ensure all newly tested projects are tested under your default organization. If you need to override the default, use the `--org=` option. Default: `` that is the current preferred organization in your [Account settings](https://app.snyk.io/account) For more information see the article [How to select the organization to use in the CLI](https://support.snyk.io/hc/en-us/articles/360000920738-How-to-select-the-organization-to-use-in-the-CLI) ### `--file=` Specify a package file. When testing locally or monitoring a project, you can specify the file that Snyk should inspect for package information. When the file is not specified, Snyk tries to detect the appropriate file for your project. ### `--package-manager=` Specify the name of the package manager when the filename specified with the `--file=` option is not standard. This allows Snyk to find the file. Example: `$ snyk test --file=req.txt --package-manager=pip` ### `--ignore-policy` Ignore all set policies, the current policy in the `.snyk` file, org level ignores, and the project policy on snyk.io. ### `--trust-policies` Apply and use ignore rules from the Snyk policies your dependencies; otherwise ignore rules in the dependencies are only shown as a suggestion. ### `--show-vulnerable-paths=` Display the dependency paths from the top level dependencies down to the vulnerable packages. Does not affect output when using JSON `--json` output. Default: `some` (a few example paths shown). `false` is an alias for `none` Example: `--show-vulnerable-paths=none` ### `--project-name=` Specify a custom Snyk project name. ### `--target-reference=` Specify a reference which differentiates this project, for example, a branch name or version. Projects having the same reference can be grouped based on that reference. Only supported for Snyk Open Source. For more information see [Separating projects by branch or version](https://docs.snyk.io/snyk-cli/secure-your-projects-in-the-long-term/grouping-projects-by-branch-or-version) ### `--policy-path=` Manually pass a path to a `.snyk` policy file. ### `--json` Print results in JSON format. Example: `$ snyk test --json-file-output=vuln.json` ### `--json-file-output=` Save test output in JSON format directly to the specified file, regardless of whether or not you use the `--json` option. This is especially useful if you want to display the human-readable test output using stdout and at the same time save the JSON format output to a file. ### `--sarif` Return results in SARIF format. ### `--sarif-file-output=` Save test output in SARIF format directly to the \ file, regardless of whether or not you use the `--sarif` option. This is especially useful if you want to display the human-readable test output using stdout and at the same time save the SARIF format output to a file. ### `--severity-threshold=` Report only vulnerabilities at the specified level or higher. ### `--fail-on=` Fail only when there are vulnerabilities that can be fixed. - `all`: fail when there is at least one vulnerability that can be either upgraded or patched. - `upgradable`: fail when there is at least one vulnerability that can be upgraded. - `patchable`: fail when there is at least one vulnerability that can be patched. If vulnerabilities do not have a fix and this option is being used, tests pass. ## Options for Maven projects For more information about Maven CLI options see [Snyk for Java and Kotlin](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-java-gradle-maven) ### `--scan-all-unmanaged` Auto-detect maven jars, aars, and wars in given directory. To test individually use `--file=` **Note**: Custom-built jar files, even with open source dependencies, are out of scope. ### `--reachable` Analyze your source code to find which vulnerable functions and packages are called. Cannot be used with `--all-projects` ### `--reachable-timeout=` Specify the amount of time (in seconds) to wait for Snyk to gather reachability data. If it takes longer than ``, reachable vulnerabilities are not reported. This does not affect regular test or monitor output. Default: 300 (5 minutes). ## Options for Gradle projects For more information about Gradle CLI options see [Snyk for Java and Kotlin](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-java-gradle-maven) ### `--sub-project=`, `--gradle-sub-project=` For Gradle "multi project" configurations, test a specific sub-project. ### `--all-sub-projects` For "multi project" configurations, test all sub-projects. ### `--configuration-matching=` Resolve dependencies using only configuration(s) that match the specified Java regular expression Example: `^releaseRuntimeClasspath$` ### `--configuration-attributes=[,]...` Select certain values of configuration attributes to install dependencies and perform dependency resolution. Example: `buildtype:release,usage:java-runtime` ### `--reachable` Analyze your source code to find which vulnerable functions and packages are called. ### `--reachable-timeout=` Specify the amount of time (in seconds) to wait for Snyk to gather reachability data. If it takes longer than ``, reachable vulnerabilities are not reported. This does not affect regular test or monitor output. Default: 300 (5 minutes). ### `--init-script=` When monitoring a .NET project, use this option to add a custom prefix to the name of files inside a project along with any desired separators. Example: `snyk monitor --file=my-project.sln --project-name-prefix=my-group/` This is useful when you have multiple projects with the same name in other `.sln` files. ## Option for npm projects ### `--strict-out-of-sync=true|false` Control testing out-of-sync lockfiles. Default: true ## Options for Yarn projects ### `--strict-out-of-sync=true|false` Control testing out-of-sync lockfiles. Default: true ### `--yarn-workspaces` Detect and scan Yarn workspaces. You can specify how many sub-directories to search using `--detection-depth` and exclude directories and files using `--exclude`. Alternatively scan Yarn workspaces with other projects using `--all-projects` ## Option for CocoaPods projects ### `--strict-out-of-sync=true|false` Control testing out-of-sync lockfiles. Default: false ## Options for Python projects ### `--command=` Indicate which specific Python commands to use based on Python version. The default is `python` which executes your default python version. Run 'python -V' to find out what version it is. If you are using multiple Python versions, use this parameter to specify the correct Python command for execution. Default: `python` Example: `--command=python3` ### `--skip-unresolved=true|false` Allow skipping packages that are not found in the environment. ## Options for Go projects Currently the following options are not supported: `--fail-on=` ## Option for C/C++ projects ### `--unmanaged` Scan C/C++ source code for vulnerabilities. For more information see [Snyk for C/C++](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-c-c++) ## Options for build tools ### `-- []` Use a double dash (`--`) after the complete Snyk command to pass options (arguments, flags) that follow directly to the build tool, for example Gradle or Maven. The format is `snyk -- []` Example: `snyk test -- --build-cache` ## Examples for the snyk test command Test a project in the current folder for known vulnerabilities: `$ snyk test` Test a specific dependency for vulnerabilities: `$ snyk test ionic@1.6.5` Test the latest version of an npm package: `$ snyk test lodash` Test a public GitHub repository: `$ snyk test https://github.com/snyk-labs/nodejs-goof`