Compare/contrast with nvd-clojure in README?

[clj-holmes]

Compare/contrast with nvd-clojure in README?

[mthbernardes]

Hey @seancorfield here are nvd-clojure gives the package name and CVEs. clj-watson produce more information regarding the vulnerable package like the dependency tree, the cvss of each vulnerability and the most important a suggested fix to each vulnerability.

[seancorfield]

Sounds like good information for your README, so others don't have to ask the same question.

Your README doesn't explain how to install clj-watson. Can it be used via git deps and -X or -T?

[seancorfield]

I tried a few invocations that failed with mysterious exceptions and reverted to -M -m which "worked" but produced no output:

(! 645)-> clojure -Sdeps '{:deps {io.github.clj-holmes/clj-watson {:git/sha "a1b37f23b04e8b95313a1ba6bfe4f0379607da3b"}}}' -M -m clj-watson.cli scan -p deps.edn
Downloading/Updating database.
Download/Update completed.

Since nvd-clojure finds CVEs in some of our dependencies, I'm guessing clj-watson doesn't check what dependencies are in aliases (and there's no way to tell it what aliases should be in effect)?

I'll take this to Slack and see if we can hammer it out interactively. I'm not sure whether our use case (monorepo, Polylith style) is supported by clj-watson and I can't tell from your README what is actually supposed to work.

[mthbernardes]

Since the discussion has migrated to clojurians slack I'll close this issue.