JFrog Visual Studio Code ExtensionGeneralThe cost of remediating a vulnerability is akin to the cost of fixing a bug. The earlier you remediate a vulnerability in the release cycle, the lower the cost. JFrog Xray is instrumental in flagging components when vulnerabilities are discovered in production systems at runtime, or even sooner, during the development. The JFrog VS Code Extension adds JFrog Xray scanning of npm project dependencies to your VS Code IDE. It allows developers to view panels displaying vulnerability information about the components and their dependencies directly in their VS Code IDE. With this information, a developer can make an informed decision on whether to use a component or not before it gets entrenched into the organization’s product. Using JFrog Visual Studio Code ExtensionConnect to JFrog Xray by clicking on the green Connect View the project's dependency tree
The JFrog extension automatically triggers a scan of the project's npm dependencies whenever a change in the package-lock.json file is detected.
To invoke a scan manually, click on the Refresh View existing issues
View licenses directly from within the package.json:
View additional information about a dependency:
View dependency in package.json:
Search in tree:
To filter scan results, click on the Filter Building and Testing the SourcesTo build the extension sources, please follow these steps:
After the build finishes, you'll find the vsix file in the jfrog-vscode-extension directory. The vsix file can be loaded into VS-Code To run the tests: Code contributionsWe welcome community contribution through pull requests. Guidelines
|
button:
button or click on Start Xray Scan from within the package.json (above the dependencies section).
button.
