DGarcia579270 (Community Member) asked a question.
is there any way to check out the entire dependency tree (maven) for java applications within veracode?
Many developers in our organization, doesn't know very well how to deal with vulnerabilities on transitive dependencies.
Their first approach is to update individual libraries (often transitive dependencies) that are included on their applications because they include others (direct dependencies, such as a the framework) which most of the times are safe acording to veracode.
Without this information (dependency tree) some teams ends up with transitive dependencies that were not intended to work with an old version of the framework
.png){kind=logo}
Hello @DGarcia579270 (Community Member) ,
For our Agent-Based scanning, we have a library Identification that uses a set of coordinates from the dependency graph, which is outlined in this help center article Understanding Agent-Based Scanning Evidence Collection.
The coordinates for the languages (one being Maven) are able to uniquely identify the libraries used in your project. If you are looking to see the dependency tree in another form, Veracode doesn't display it in another way.
Jason
Veracode Support Engineer