Skip to content

Commit

Permalink
GITBOOK-8697: AL - Merged: Snyk Open Source: updated images
Browse files Browse the repository at this point in the history
  • Loading branch information
aluca3 authored and gitbook-bot committed Jan 15, 2025
1 parent b56a279 commit 30cd3d9
Show file tree
Hide file tree
Showing 11 changed files with 15 additions and 17 deletions.
Binary file added docs/.gitbook/assets/project_details_fixes.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ From Snyk Open Source, for each tab, both upgrade and patch, in the fix advice a
* Packages are listed and can be expanded to show the full list of vulnerabilities affecting the package.
* All the vulnerabilities found in your dependencies are displayed further down the page, together with contextual information that can help you prioritize the issues and start fixing them if required.

<figure><img src="../../../.gitbook/assets/Screenshot 2023-03-15 at 12.14.06.png" alt="Scan results on the Web UI"><figcaption><p>Scan results on the Web UI</p></figcaption></figure>
<figure><img src="../../../.gitbook/assets/projects_issues_scan_results.png" alt=""><figcaption><p>Example of project issues</p></figcaption></figure>

## View Fix Advice

Expand All @@ -30,11 +30,9 @@ The Fix Advice area appears on the Project details page. Snyk offers you one of
The summary area groups advice by package, and is displayed based on the best available fix. Advice in these summary lists includes these details for each package:

* All vulnerability names and severity details affecting that package
* The recommended fix, a link to the recommended fix for this package and its listed vulnerabilities: either the specific version to which to upgrade or the name of the patch
* The recommended fix, a link to the recommended fix for this package and its listed vulnerabilities: either the specific version to which to upgrade or the name of the patch.

<figure><img src="../../../.gitbook/assets/Screenshot 2021-10-12 at 14.08.13.png" alt="Upgrade issues tabs"><figcaption><p>Upgrade issues tabs</p></figcaption></figure>

<figure><img src="../../../.gitbook/assets/Screenshot 2021-10-12 at 14.10.00 (1).png" alt="Upgradable and patchable issues tabs"><figcaption><p>Upgradable and patchable issues tabs</p></figcaption></figure>
<figure><img src="../../../.gitbook/assets/project_details_fixes.png" alt=""><figcaption><p>Upgradable issues tab</p></figcaption></figure>

You can also find additional advice and details further down on the Project details page:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ After the plugin is installed, every time a developer requests a download of an

<figure><img src="../../../../.gitbook/assets/uuid-a2c354a2-21ca-bdfb-7862-a2ef26eec59e-en.png" alt="Results of a scan"><figcaption><p>Results of a scan</p></figcaption></figure>

<figure><img src="../../../../.gitbook/assets/image (33) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png" alt="Attributes showing results of a scan"><figcaption><p>Attributes showing results of a scan</p></figcaption></figure>
<figure><img src="../../../../.gitbook/assets/image (33) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png" alt="Example of results of a scan"><figcaption><p>Attributes displaying results of a scan</p></figcaption></figure>

By reviewing the results, you can evaluate the issues found in your artifact and determine a course of action.

Expand All @@ -104,6 +104,6 @@ Snyk continuously runs in the background on the Nexus instance, and whenever any

When the scan ends, you get an error message if the download was blocked, with a link to the full details for the known vulnerabilities found in that artifact, similar to the following example:

<figure><img src="../../../../.gitbook/assets/uuid-a2c354a2-21ca-bdfb-7862-a2ef26eec59e-en.png" alt="Error message example"><figcaption><p>Error message example</p></figcaption></figure>
<figure><img src="../../../../.gitbook/assets/uuid-a2c354a2-21ca-bdfb-7862-a2ef26eec59e-en.png" alt=""><figcaption><p>Error message example</p></figcaption></figure>

Click the link to view the number of vulnerabilities found in the artifact and their severities.
Original file line number Diff line number Diff line change
Expand Up @@ -29,9 +29,9 @@ The Fix this vulnerability option is not available in CLI monitor workflows.

For any **fixable** issue in a Project where **Fix this vulnerability** is available, Snyk can open a pull request against the repository to update to a secure version of the dependency.

Look for the **Fix this vulnerability** button on the issue card to determine whether Snyk can open a pull request against your Project. Examine the i**ssue cards** to see the specifics of fixability for an issue.
The **Fix this vulnerability** button on the issue card displays whether Snyk can open a pull request against your Project. Examine the issue cards to see the specifics of fixability for an issue.

<figure><img src="../../../.gitbook/assets/Fixable.png" alt="Fixable vulnerabiltiies"><figcaption><p>Fixable vulnerability</p></figcaption></figure>
<figure><img src="../../../.gitbook/assets/Fixable.png" alt=""><figcaption><p>Example of a fixable vulnerability</p></figcaption></figure>

### Partially fixable

Expand All @@ -43,13 +43,13 @@ You can view the **Partially fixed** vulnerabilities for an issue in the Detaile
The option to partially fix vulnerabilities is available only for JavaScript and TypeScript.
{% endhint %}

<figure><img src="../../../.gitbook/assets/partially fixable.png" alt="Partially fixable vulnerability"><figcaption><p>Partially fixable vulnerability</p></figcaption></figure>
<figure><img src="../../../.gitbook/assets/partially fixable.png" alt=""><figcaption><p>Example of a partially fixable vulnerability</p></figcaption></figure>

### No supported fix&#x20;

If there is **No supported fix** for the vulnerabilities or license issues, then the issue cards do not show any Fix options. An upgrade path where the only changes are in transitive dependencies is considered fixable only if the package manager supports it.

<figure><img src="../../../.gitbook/assets/no supported fix.png" alt="Vulnerability with no supported fix "><figcaption><p>Vulnerability with no supported fix </p></figcaption></figure>
<figure><img src="../../../.gitbook/assets/no supported fix.png" alt=""><figcaption><p>Example of a vulnerability with no supported fix </p></figcaption></figure>

## "**Fixed in" Available filters**

Expand All @@ -60,15 +60,15 @@ In the "Fixed in" Available filters, you can use the following filters:

You can view the **Fixed in** information for vulnerabilities on the issue card. This indicates the version of the package that no longer has the vulnerability.&#x20;

<figure><img src="../../../.gitbook/assets/Fixed in - Yes.png" alt="Fised in information on issues card"><figcaption><p>Fixed in information on issues card</p></figcaption></figure>
<figure><img src="../../../.gitbook/assets/Fixed in - Yes.png" alt=""><figcaption><p>Fixed in information on an issue card</p></figcaption></figure>

### Why is `Fixed in` showing when the issue is not fixable?

A direct dependency is fixable if a fixed, that is, secure, version of the package exists anywhere in the system. However, to be fixable, transitive dependencies must have a direct dependency that can be updated to the fixed version of the transitive dependency. An example follows of a transitive dependency.&#x20;

<figure><img src="../../../.gitbook/assets/fix-desc-4 (1) (1) (1) (1).png" alt="Transitive dependency shown as Fixed in"><figcaption><p>Transitive dependency shown as Fixed in</p></figcaption></figure>
<figure><img src="../../../.gitbook/assets/project_details_transitive_dependency_no_fix (2).png" alt=""><figcaption><p>Example of a transitive dependency</p></figcaption></figure>

The Detailed paths section (rounded blue rectangle in the image) shows that no remediation path is available. However, the issue card shows that the vulnerability is Fixed in the more recent version (top red rectangle in the image). Snyk does not have the ability to reach the level where the vulnerability exists in this specific Project, but the vulnerability does not match the definition of No supported fix.
Under **Detailed paths,** a mention is displayed that no remediation path is available. However, the issue card shows that the vulnerability is **Fixed in** the more recent version. Snyk does not have the ability to reach the level where the vulnerability exists in this specific Project, but the vulnerability does not match the definition of No supported fix.

### Fixing transitive dependencies

Expand All @@ -78,11 +78,11 @@ You cannot automatically fix transitive dependencies or open a Fix PR (see [Fix

To fix a transitive dependency like the one in this example, follow the link to the [Snyk Vulnerability Database](snyk-vulnerability-database.md):

<figure><img src="../../../.gitbook/assets/fix-desc-5.png" alt="LInk to Snyk Vulnerability Database for a transitive dependency"><figcaption><p>LInk to Snyk Vulnerability Database for a transitive dependency</p></figcaption></figure>
<figure><img src="../../../.gitbook/assets/project_details_linkto_snyk_vuln_database.png" alt="Link to Snyk Vulnerability Database for a transitive dependency"><figcaption><p>LInk to Snyk Vulnerability Database for a transitive dependency</p></figcaption></figure>

From the Snyk Vulnerability Database, you can see remediation advice for more fix information:

<figure><img src="../../../.gitbook/assets/fix-desc-6.png" alt="Vulnerability Database remediation advice"><figcaption><p>Vulnerability Database remediation advice</p></figcaption></figure>
<figure><img src="../../../.gitbook/assets/snyk_vuln_database_how_to_fix.png" alt=""><figcaption><p>Snyk Vulnerability Database remediation advice</p></figcaption></figure>

### Fixing transitive dependencies through direct dependencies

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,4 +24,4 @@ The steps to set up Artifactory Repository Manager follow.
3. Enter your username and password.
4. Select **Save**.

<figure><img src="../../../../.gitbook/assets/screenshot_2020-04-17_at_14.38.12.png" alt="Artifactory repository setup"><figcaption><p>Artifactoryrepository setup</p></figcaption></figure>
<figure><img src="../../../../.gitbook/assets/screenshot_2020-04-17_at_14.38.12.png" alt="Artifactory repository setup"><figcaption><p>Artifactory repository setup</p></figcaption></figure>

0 comments on commit 30cd3d9

Please sign in to comment.