Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • It facilitates workflows by making critical component vulnerability information available to the software developer from within the IDE, preventing the need to use a separate application for such purpose.

  • It implements automatic vulnerability checking in the background that allows for immediate feedback to the user as she types. For example, a new component reference that is being typed into a project's requirements.txt, Pipfile, or pyproject.toml file will be automatically analyzed for security vulnerabilities.

  • It offers a transparent UX for developers, by seamlessly integrating with the IDE environment: it highlights project open source components found to have reported security vulnerabilities (CVEs), displays information on such vulnerabilities, and offers recommendations for fixing them.

Support for

...

Package Managers

WhiteSource Advise supports Python projects using the following package managers:

  • Pip (requirements.txt dependency files only)

...

  • Pipenv (Pipfile dependency files)

...

  • Poetry (project.toml dependency files).

Prerequisites

Ensure the following:

...

Configuring WhiteSource Advise

To configure WhiteSource Advise, do as follows:

Info

Changes made to the WhiteSource settings will only apply after running the next scan.

You can configure the WhiteSource settings on a global or a project level. See the following sections.

Global-Level Configuration

To configure WhiteSource Advise on a global level, do as follows:

  1. From the menu bar, select File > Settings. The Settings screen is displayed.

  2. Select Tools > WhiteSource.

  3. In Scan Results Settings, review the options and modify if necessary. See here for a list of all options.

  4. Click OK.

Project-Level Configuration

To configure WhiteSource Advise on a project-level, do as follows:

  1. From the menu bar, select File > Settings. The Settings screen is displayed.

  2. Select Tools > WhiteSource > Project Settings. The Project Settings screen is displayed.

  3. In Scan Results Settings, review the options and modify if necessary. See here for a list of all options.

  4. By default, all settings are inherited from the global-level configuration. To override the specific configuration on project level, clear the Inherit from global settings checkbox.

  5. Click OK.

Options Table

Option

Description

Default Setting

Only show issues for direct dependencies

When enabled, WhiteSource Advise will only return vulnerabilities for direct dependencies defined in your dependency file.

Unselected (not checked)

...