{"id":900708,"xmlId":"org.jetbrains.security.package-checker","name":"Package Checker","description":"<p>\n      This plugin checks your third-party dependencies for known vulnerabilities.\n      It suggests a safe version, if available, to make your code more secure.\n      It also scans source code for vulnerable API calls to highlight the most critical problems.\n    </p>\n    <p>The following package managers and build files are supported:</p>\n    <ul>\n      <li>Amper build system (<code>module.yaml</code>, <code>module.amper</code>, <code>project.yaml</code>, <code>project.amper</code>, and module template files)</li>\n      <li>Gradle (<code>build.gradle</code>, <code>build.gradle.kts</code>)</li>\n      <li>Maven (<code>pom.xml</code>, <code>pom-4.0.0.xml</code>, <code>pom.*</code>, <code>*.pom</code>)</li>\n      <li>npm, pnpm and Yarn (<code>package.json</code>)</li>\n      <li>PyPI (<code>setup.py</code>, <code>requirements.txt</code>)</li>\n      <li>Poetry and Pipenv (<code>pyproject.toml</code>, <code>Pipfile</code>)</li>\n      <li>Go Modules (<code>go.mod</code>)</li>\n      <li>Composer (<code>composer.json</code>)</li>\n      <li>JPS - JetBrains Project System (<code>*.iml</code>)</li>\n      <li>sbt (<code>build.sbt</code>), provided by the <a href=\"https://plugins.jetbrains.com/plugin/1347-scala\">Scala plugin</a></li>\n    </ul>\n    <p>The plugin provides the following security inspections:</p>\n    <ul>\n        <li>\n          <a href=\"https://www.jetbrains.com/help/inspectopedia/VulnerableLibrariesLocal.html\">Vulnerable declared dependency</a>\n          scans packages defined in your code (such as packages added to a supported build file).\n        </li>\n        <li>\n          <a href=\"https://www.jetbrains.com/help/inspectopedia/VulnerableLibrariesGlobal.html\">Vulnerable imported dependency</a>\n          detects packages that are not defined in the source code (such as transitive dependencies).\n        </li>\n        <li>\n          <a href=\"https://www.jetbrains.com/help/inspectopedia/VulnerableCodeUsages.html\">Vulnerable API usage</a>\n          shows vulnerable methods and functions in Java source code (out of the box) and in Kotlin source code (if you have the\n          <a href=\"https://plugins.jetbrains.com/plugin/6954-kotlin\">Kotlin plugin</a>\n          installed).\n        </li>\n        <li>\n          <a href=\"https://www.jetbrains.com/help/inspectopedia/MaliciousLibrariesLocal.html\">Malicious dependencies</a>\n          detects malicious NPM and PyPI dependencies in your project to prevent your software from being compromised.\n        </li>\n    </ul>\n    <p>\n      Vulnerable API inspections are language-specific and provided as part of the corresponding language plugins:\n      <a href=\"https://www.jetbrains.com/help/inspectopedia/NpmVulnerableApiCode.html\">JavaScript and TypeScript</a>,\n      <a href=\"https://www.jetbrains.com/help/inspectopedia/PyVulnerableApiCodeInspection.html\">Python</a>,\n      and <a href=\"https://www.jetbrains.com/help/inspectopedia/GoVulnerableCodeUsages.html\">Go</a>.\n    </p>\n    <p>\n      Here is a list of the plugins required to support the related functionality:\n      <a href=\"https://plugins.jetbrains.com/plugin/13112-gradle\">Gradle</a>,\n      <a href=\"https://www.jetbrains.com/help/idea/maven-support.html\">Maven</a>,\n      <a href=\"https://plugins.jetbrains.com/plugin/22069-javascript-and-typescript\">JavaScript and TypeScript</a>,\n      <a href=\"https://plugins.jetbrains.com/plugin/631-python\">Python</a>,\n      <a href=\"https://plugins.jetbrains.com/plugin/9568-go\">Go</a>,\n      <a href=\"https://plugins.jetbrains.com/plugin/6610-php\">PHP</a>,\n      and <a href=\"https://plugins.jetbrains.com/plugin/1347-scala\">Scala</a>.\n    </p>\n    <p>\n      Problems identified by Package Checker are reported on the <i>Problems | Vulnerable Dependencies</i> tab.\n      The plugin also provides the <i>Analyze | Vulnerable Dependencies</i> action.\n    </p>\n    <p>\n      Package Checker doesn't send information about packages to the JetBrains server in cleartext form.\n      It sends only hashed names of packages.\n      We never log or process hashes we don't have in our database, and we don't analyze your proprietary or confidential packages.\n    </p>\n    <p>Vulnerability data provided by <a href=\"https://www.mend.io/?utm_source=JetBrains\">Mend.io</a> and <a href=\"https://osv.dev/\">OSV.dev</a>.</p>\n    <p>Plugin source code © 2024, JetBrains s.r.o..</p>\n<h2>Getting started</h2>\nPackage Checker doesn't require any special configuration. It is bundled with all supported IDEs. See our tutorials for more useful information: <a href=\"https://www.jetbrains.com/guide/java/tutorials/package-checker/\">Package Checker: Find and fix vulnerabilities inside IntelliJ IDEA Ultimate</a>.","organization":"JetBrains s.r.o.","tags":["Security","Code Editing","Maven"],"version":"252.28238.22","dependencies":["intellij.platform.vcs.impl","intellij.json.backend"],"optionalDependencies":["org.jetbrains.idea.maven","org.jetbrains.plugins.go","com.jetbrains.php","JavaScript","org.intellij.groovy","com.intellij.modules.python","com.intellij.gradle","intellij.packageChecker.maven","org.jetbrains.plugins.gradle","com.intellij.java","org.jetbrains.amper","intellij.packageChecker.java","org.jetbrains.idea.gradle.dsl","intellij.gradle.dependencyUpdater"],"since":"252.28238","until":"252.*","size":652113,"vendor":"JetBrains"}