snyk-delta

The snyk-delta tool that finds the difference in issues between two tests

This tool provides the means to get the delta between two Snyk Open Source snapshots. This is especially useful when you are running CLI-based scans, such as in your local environment, Git hooks, and so on.

snyk-delta compares snapshots to provide details about:

• New vulnerabilities not found in the baseline snapshot

• New license issues not found in the baseline snapshot

• Dependency delta between the two snapshots:

  • Direct dependencies added and removed

  • Indirect dependencies added and removed

  • Flag path(s) carrying new vulnerabilities

Prerequisites

• Snyk Enterprise plan (requires the Snyk API)

• Your Project to be monitored

• A SNYK_TOKEN, either exported to the environment or provided inline to snyk-delta, or the API token set with the snyk config command. Run snyk config get api to see if the API token is set. OAuth authentication is not supported by snyk-delta.

Installation

npm i -g snyk-delta

or

Download a binary of your choice from the release page

Usage

You can use this tool inline or as a standalone command.

Inline operations

Use snyk test --json --print-deps | snyk-delta

• You may point to a specific snapshot by specifying org+project coordinates: snyk test --json --print-deps | snyk-delta --baselineOrg xxx --baselineProject xxx

• Use --setPassIfNoBaseline if used with snyk-prevent_commit_status and the Project is not monitored. This preventssnyk-prevent_commit_status from failing: setPassIfNoBaseline default to false snyk test --json --print-deps | snyk-delta --baselineOrg xxx --baselineProject xxx --setPassIfNoBaseline true

The BaselineProject value is expected to be a UUID, not a name. Check the Snyk Web UI or API to retrieve those UUIDs.

Standalone operations

Use snyk-delta --baselineOrg xxx --baselineProject xxx --currentOrg xxx --currentProject xxx --setPassIfNoBaseline false

Usage as module

import { getDelta } from 'snyk-delta'

const jsonResultsFromSnykTest = Read from file or pipe snyk test command

const result = await getDelta(jsonResultsFromSnykTest);

The result is a number:

• 0: no new issue

• 1: new issue(s) or when using StrictMode and the unmonitored Project has issues (See more details in StrictMode.)

• 2: for errors like invalid auth

Details for issues will be listed on stdout.

Help for snyk-delta

Use -h to display help.

StrictMode

When snyk-delta compares test results, it tries to find the same Project monitored on the Snyk platform. If no monitored Project is found, snyk-delta returns all the issues found by the CLI scan, essentially acting as a pass-through.

The return code is 0 if no issue is found, and 1 if issues are found.

Caution

Use as a module requires a list of issues coming from the Snyk CLI. snyk-delta is not compatible with data coming straight from Snyk APIs.

all-projects

snyk-delta does not support the --all-projects option, but you can try using snyk_delta_all_projects.sh as a workaround until it does.

Troubleshooting for snyk-delta

If you have trouble, you can try the following:

• Run the Snyk test -d step first and ensure it works.

• If you get a 401 error, check to see that you have a valid SNYK_TOKEN or run snyk config get api . If you do not want to set the token in the environment, you can provide the SNYK_TOKEN as an inline command before the snyk-delta but after the | symbol: snyk test --json | SNYK_TOKEN={token} snyk-delta ….{other arguments}.

• If you are using the delta allprojects script, try removing that and testing the Projects individually.

• If no baseline is found, ensure there is an existing monitored Project first, and check the .git metadata if you are trying to match against an SCM-monitored Project.

If you need help, contact Snyk Support.