# Test ## Usage `snyk test []` ## Description The `snyk test` command checks projects for open source vulnerabilities and license issues. The test command tries to auto-detect supported manifest files with dependencies and test those. ## Exit codes Possible exit codes and their meaning: **0**: success, no vulnerabilities found\ **1**: action_needed, vulnerabilities found\ **2**: failure, try to re-run command\ **3**: failure, no supported projects detected ## Configure the Snyk CLI You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API. See [Configure the Snyk CLI](https://docs.snyk.io/features/snyk-cli/configure-the-snyk-cli) ## Debug Use the `-d` option to output the debug logs. ## Options See also subsequent sections for options for specific build environments, package managers, languages, and `[]` which you specify last. ### `--all-projects` Auto-detect all projects in the working directory (including Yarn workspaces). For more information see the article [Does the Snyk CLI support monorepos or multiple manifest files?](https://support.snyk.io/hc/en-us/articles/360000910577-Does-the-Snyk-CLI-support-monorepos-or-multiple-manifest-files-) ### `--detection-depth=` Use with `--all-projects` or `--yarn-workspaces` to indicate how many subdirectories to search. `DEPTH` must be a number, 1 or greater; zero (0) is the current directory. Default: 4 , the current working directory (0) and 4 subdirectories. Example: `--detection-depth=3` limits search to the specified directory (or the current directory if no `` is specified) plus three levels of subdirectories; zero (0) is the current directory. ### `--exclude=[,]...>` Use with `--all-projects` and `--yarn-workspaces` to indicate subdirectories and files to exclude. The `--exclude` argument must be a comma separated list of directory or file names and cannot contain a path. Note that the glob does need to be an exact match and needs only to be part of the path or the filename. Use the `--exclude` option with `--detection-depth` to ignore directories at any depth. Examples: Exclude any folders, subfolders, or files containing `test` as part of the path or name:\ `--exclude=test` Exclude any folders, subfolders, or files containing `fixtures` or `debug` as part of the path or name:\ `--exclude=fixtures,debug` ### `--prune-repeated-subdependencies`, `-p` Prune dependency trees, removing duplicate sub-dependencies. Continues to find all vulnerabilities, but may not find all of the vulnerable paths. ### `--print-deps` Print the dependency tree before sending it for analysis. ### `--remote-repo-url=` Set or override the remote URL for the repository that you would like to monitor. ### `--dev` Include development-only dependencies. Applicable only for some package managers, for example, `devDependencies` in npm or `:development` dependencies in Gemfile. Default: scan only production dependencies. ### `--org=` Specify the `` to run Snyk commands tied to a specific organization. The `` influences some features availability and private test limits. If you have multiple organizations, you can set a default from the CLI using: `$ snyk config set org=` Set a default to ensure all newly tested projects are tested under your default organization. If you need to override the default, use the `--org=` option. Default: `` that is the current preferred organization in your [Account settings](https://app.snyk.io/account) For more information see the article [How to select the organization to use in the CLI](https://support.snyk.io/hc/en-us/articles/360000920738-How-to-select-the-organization-to-use-in-the-CLI) ### `--file=` Specify a package file. When testing locally or monitoring a project, you can specify the file that Snyk should inspect for package information. When the file is not specified, Snyk tries to detect the appropriate file for your project. ### `--package-manager=` Specify the name of the package manager when the filename specified with the `--file=` option is not standard. This allows Snyk to find the file. Example: `$ snyk test --file=req.txt --package-manager=pip` ### `--unmanaged` For C++ only, scan all files for known open source dependencies. For options you can use with `--unmanaged` see [Options for scanning using `--unmanaged`](https://docs.snyk.io/snyk-cli/commands/test#options-for-scanning-using-unmanaged)`` For more information see [Snyk for C/C++](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-c-c++) ### `--ignore-policy` Ignore all set policies, the current policy in the `.snyk` file, org level ignores, and the project policy on snyk.io. ### `--trust-policies` Apply and use ignore rules from the Snyk policies your dependencies; otherwise ignore rules in the dependencies are only shown as a suggestion. ### `--show-vulnerable-paths=` Display the dependency paths from the top level dependencies down to the vulnerable packages. Not supported with `--json-file-output`. Default: `some` (a few example paths shown). `false` is an alias for `none` Example: `--show-vulnerable-paths=none` ### `--project-name=` Specify a custom Snyk project name. ### `--target-reference=` Specify a reference which differentiates this project, for example, a branch name or version. Projects having the same reference can be grouped based on that reference. Only supported for Snyk Open Source. For more information see [Separating projects by branch or version](https://docs.snyk.io/snyk-cli/secure-your-projects-in-the-long-term/grouping-projects-by-branch-or-version) ### `--policy-path=` Manually pass a path to a `.snyk` policy file. ### `--json` Print results in JSON format. Example: `$ snyk test --json` ### `--json-file-output=` Save test output in JSON format directly to the specified file, regardless of whether or not you use the `--json` option. This is useful if you want to display the human-readable test output using stdout and at the same time save the JSON format output to a file. Example: `$ snyk test --json-file-output=vuln.json` ### `--sarif` Return results in SARIF format. ### `--sarif-file-output=` Save test output in SARIF format directly to the \ file, regardless of whether or not you use the `--sarif` option. This is especially useful if you want to display the human-readable test output using stdout and at the same time save the SARIF format output to a file. ### `--severity-threshold=` Report only vulnerabilities at the specified level or higher. ### `--fail-on=` Fail only when there are vulnerabilities that can be fixed. - `all`: fail when there is at least one vulnerability that can be either upgraded or patched. - `upgradable`: fail when there is at least one vulnerability that can be upgraded. - `patchable`: fail when there is at least one vulnerability that can be patched. If vulnerabilities do not have a fix and this option is being used, tests pass. ## Options for Maven projects For more information about Maven CLI options see [Snyk for Java and Kotlin](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-java-gradle-maven) ### `--scan-all-unmanaged` Auto-detect maven jars, aars, and wars in given directory. To test individually use `--file=` **Note**: Custom-built jar files, even with open source dependencies, are out of scope. ### `--reachable` Analyze your source code to find which vulnerable functions and packages are called. Cannot be used with `--all-projects` ### `--reachable-timeout=` Specify the amount of time (in seconds) to wait for Snyk to gather reachability data. If it takes longer than ``, reachable vulnerabilities are not reported. This does not affect regular test or monitor output. Default: 300 (5 minutes). ## Options for Gradle projects For more information about Gradle CLI options see [Snyk for Java and Kotlin](https://docs.snyk.io/products/snyk-open-source/language-and-package-manager-support/snyk-for-java-gradle-maven) ### `--sub-project=`, `--gradle-sub-project=` For Gradle "multi project" configurations, test a specific sub-project. ### `--all-sub-projects` For "multi project" configurations, test all sub-projects. ### `--configuration-matching=` Resolve dependencies using only configuration(s) that match the specified Java regular expression Example: `^releaseRuntimeClasspath$` ### `--configuration-attributes=[,]...` Select certain values of configuration attributes to install dependencies and perform dependency resolution. Example: `buildtype:release,usage:java-runtime` ### `--reachable` Analyze your source code to find which vulnerable functions and packages are called. ### `--reachable-timeout=` Specify the amount of time (in seconds) to wait for Snyk to gather reachability data. If it takes longer than ``, reachable vulnerabilities are not reported. This does not affect regular test or monitor output. Default: 300 (5 minutes). ### `--init-script=` When monitoring a .NET project, use this option to add a custom prefix to the name of files inside a project along with any desired separators. Example: `snyk monitor --file=my-project.sln --project-name-prefix=my-group/` This is useful when you have multiple projects with the same name in other `.sln` files. ## Option for npm projects ### `--strict-out-of-sync=true|false` Control testing out-of-sync lockfiles. Default: true ## Options for Yarn projects ### `--strict-out-of-sync=true|false` Control testing out-of-sync lockfiles. Default: true ### `--yarn-workspaces` Detect and scan Yarn workspaces. You can specify how many sub-directories to search using `--detection-depth` and exclude directories and files using `--exclude`. Alternatively scan Yarn workspaces with other projects using `--all-projects` ## Option for CocoaPods projects ### `--strict-out-of-sync=true|false` Control testing out-of-sync lockfiles. Default: false ## Options for Python projects ### `--command=` Indicate which specific Python commands to use based on Python version. The default is `python` which executes your default python version. Run 'python -V' to find out what version it is. If you are using multiple Python versions, use this parameter to specify the correct Python command for execution. Default: `python` Example: `--command=python3` ### `--skip-unresolved=true|false` Allow skipping packages that are not found in the environment. ## Options for Go projects Currently the following options are not supported: `--fail-on=` ## Options for scanning using `--unmanaged` ### `` [`--org=`](test.md#org-less-than-org\_id-greater-than) `` ### `` [`--json`](test.md#json) `` ### [--json-file-output=\](test.md#json-file-output-less-than-output_file_path-greater-than) ### `--target-dir` Scan the path specified in the argument instead of the current directory. Alternatively, run `snyk test --unmanaged` ### `--max-depth` `Usage: --max-depth=1` Specify the maximum level of archive extraction. Use 0 to disable archive extraction completely. ## Options for build tools ### `-- []` Use a double dash (`--`) after the complete Snyk command to pass options (arguments, flags) that follow directly to the build tool, for example Gradle or Maven. The format is `snyk -- []` Example: `snyk test -- --build-cache` ## Examples for the snyk test command Test a project in the current folder for known vulnerabilities: `$ snyk test` Test a specific dependency for vulnerabilities: `$ snyk test ionic@1.6.5` Test the latest version of an npm package: `$ snyk test lodash` Test a public GitHub repository: `$ snyk test https://github.com/snyk-labs/nodejs-goof`