Scan third-party dependencies
This article walks you through the Semgrep Supply Chain configuration and customization options available.
Apache Maven
- To run a Semgrep Supply Chain scan, you must generate a dependency tree for Apache Maven.
Project directory structure
Semgrep Supply Chain requires a lockfile. Your code must use supported lockfile ecosystems and filenames.
Semgrep Supply Chain can correctly parse code files and lockfiles in subfolders as well. Code files that use the dependencies in the lockfile must be nested in the same directory as the lockfile. Lockfiles must all use the supported lockfile names.
In the following example, Semgrep Supply Chain assumes that all code files using the dependencies in my-project/running/lockfile.json
are nested in my-project/running/
or deeper directories.
/my-project
├───/running
│ ├───lockfile.json