Registry / devops / snyk-sbt-plugin

snyk-sbt-plugin

library3.1.0jsnpmunverified

A plugin for the Snyk CLI that provides dependency metadata for sbt (Scala Build Tool) projects. It scans build.sbt files to identify known vulnerabilities in dependencies. Current stable version is 3.1.0, released August 2025. The plugin supports Node 20 on Windows, Linux, and macOS, and works with sbt 0.13.x through 1.7.x (with or without sbt-dependency-graph plugin for older versions). Key differentiator: integrates Snyk's vulnerability scanning into Scala/SBT projects with automatic dependency tree extraction. v3.0.0 introduced breaking changes including dropping shell:true and updated shescape for argument escaping.

devops auth-security

npm install snyk-sbt-plugin

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SNYK-SBT-PLUGIN

snyk-sbt-plugin

devopsjavascriptv3.1.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

snykSbtPlugin

✓ import { snykSbtPlugin } from 'snyk-sbt-plugin'

✗ const snykSbtPlugin = require('snyk-sbt-plugin')

ESM-only since v3; CJS require yields undefined.

inspect

✓ import { inspect } from 'snyk-sbt-plugin'

✗ import inspect from 'snyk-sbt-plugin'

Named export, not default.

Types

✓ import type { SbtPluginResult } from 'snyk-sbt-plugin'

✗ import { SbtPluginResult } from 'snyk-sbt-plugin' (not a runtime value)

Use type-only import for TypeScript types to avoid bundling.

Scans an SBT project for vulnerabilities using the inspect function, logging dependency tree and vulnerability count.

import { inspect } from 'snyk-sbt-plugin'; import { promises as fs } from 'fs'; async function scanSbtProject(projectPath: string) { try { const result = await inspect(projectPath, 'sbt', { dev: false }); console.log('Scanned dependencies:', result.package.dependencies); console.log('Vulnerabilities:', result.vulnerabilities?.length ?? 0); } catch (error) { console.error('Scan failed:', error); } } scanSbtProject('/path/to/sbt/project');

Debug

Known issues

breakingDropping shell:true and bumping shescape after author fix in v3.0.0

fix

Update any scripts that relied on shell:true being set; the plugin no longer uses shell execution for child processes.

affects: >=3.0.0

gotchaOlder sbt versions (<=1.2) require sbt-dependency-graph plugin or coursier to be installed

fix

Install sbt-dependency-graph plugin or coursier following Snyk support documentation.

affects: >=0.0.0

deprecatedPlugin uses Node.js APIs; may not work with newer Node versions without updates

fix

Ensure you are using Node 20 as specified in supported OS table; future versions may require updates.

affects: >=3.0.0

Errors

Common errors & fixes

Error: spawn sbt ENOENT

sbt is not installed or not in PATH.

fix

Install sbt and ensure it is available in the system PATH.

Cannot find module 'snyk-sbt-plugin'

CJS require used for ESM-only package.

fix

Use ES module import: import { inspect } from 'snyk-sbt-plugin'

Error: No supported sbt project detected

Project does not contain a build.sbt file.

fix

Ensure the project path contains a build.sbt file.

Upgrade

Version history

3.1.0latest on npm

Audit

Dependencies

snykrequiredThis plugin is used as part of Snyk CLI; it is not standalone.

sbt-dependency-graphoptionalRequired for sbt versions 1.2 and older to extract dependency tree.

Agent activity

18 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/snyk/snyk-sbt-plugin ↗

packagehttps://www.npmjs.com/package/snyk-sbt-plugin ↗

homepagehttps://snyk.io ↗