Java Parameters

maven.ignoredScopes 

Define which exact scope names to ignore.

By default, the Unified Agent ignores direct dependencies with scope 'test' and 'provided'.
This value can be overridden to ignore specific scopes.

N/A

N/A

"provided" and "test"

Note: by default, the Mend UI will not show Maven dependencies with scope “test” and “provided” even if they appear in scan results. You can configure this in the Mend UI > Admin > Maven Dependency Resolution Settings.

-maven.ignoredScopes

maven.resolveDependencies 

Whether to resolve Maven dependencies, requires "pom.xml".

In case the project is a Maven project, the resolution will start.

The Maven resolution will not start resolution.

True
(except for when resolveAllDependencies=false

-maven.resolveDependencies

maven.ignoreSourceFiles  

When using the dependency resolver, it will only include pom.xml dependencies, not source files and packages.

NOTE: Only relevant when fileSystemScan is true.

Will ignore files from scan, those which have extensions such as:".java", ".class","pom.xml".

Will not ignore the mentioned file extensions.

False

maven.aggregateModules  

Combines all pom modules into a single Mend project with an aggregated dependency flat list (no hierarchy).

Will create a single project for all modules, to be displayed as a flat list.

A project will be created for each module and displayed as a hierarchical tree.

False

-maven.aggregateModules

maven.ignorePomModules  

Whether to ignore dependency resolving of a pom.xml file containing a 'pom' value inside a packaging tag, i.e., '<packaging>pom</packaging>'.

The dependency resolver will ignore all dependencies specified inside a pom.xml file that contains a packaging tag with 'pom' value ('<packaging>pom</packaging>')

The dependency resolver will not ignore all dependencies specified inside a pom.xml file that contains a packaging tag with 'pom' value ('<packaging>pom</packaging>')

True

No

maven.runPreStep 

Whether to run "mvn clean install" command on found pom.xml folder

Will run the "mvn clean install" command

Will not run the "mvn clean install" command

False

No

maven.ignoreMvnTreeErrors 

If the command `mvn dependency:tree` fails, we try to resolve the partial output (of the command) if it exists and parse all the direct dependencies from the pom.xml file.

The scan will end with success and will send a flat list (direct only).

• If failErrorLevel = DEFAULTthe scan stops parsing the current maven project, ending with success and sending a flat list (direct only). The scan then moves to the next resolution process, e.g. another maven project.

• However, if failErrorLevel = ALL the scan will terminate with an error

False

No

maven.environmentPath 

Path to the Maven installation in case it does not match the M2_HOME environment variable

N/A

N/A

No default

No

maven.m2RepositoryPath 

Path to .m2 folder, in case it is not available in the default location.

N/A

N/A

No default

No

maven.downloadMissingDependencies 

Allows users to disable downloading missing dependencies in Maven.

In case there is a missing dependency jar/binary in the repository, the code will try to download the missing dependency.

The downloading of missing dependencies will be disabled.

True

No

maven.additionalArguments 

Provides any parameters starting with '-' or '--', and Unified Agent should add these to the end of the Maven commands.

Example values:

• -s=path/to/settings.xml

• -s=path/to/settings.xml --threads=2.0C

N/A

N/A

No default

No

maven.projectNameFromDependencyFile 

Whether a project name will be taken from the dependency file.

The project name will be taken from the pom.xml's 'artifactId' field. Works only when the maven resolver is the only active resolver.

If the Unified Agent identifies any additional resolvers besides Maven that are set to True, an error is generated.

The project name will be taken from the CLI/configuration file.

False

No

maven.allowPartialTree

Allow the scan to finish even if maven dependencies resolution is incomplete.
Note that this means accepting maven’s dependency resolution as is - this may result in incorrect detection of transitive dependency versions, which in turn may lead to false positive or false negative vulnerability alerts.

The scan runs even if maven dependency resolution cannot fully resolve the dependency tree (which maven may overlook).

In case maven dependency resolution is incomplete, the dependency resolution finishes with an error and the scan fails.

False

No

gradle.ignoredConfigurations

Enables you to determine which dependency configurations to ignore in the scan.

The format is according to the following:

• Exact configuration names to ignore.
  Values must be space-delimited.

For example: gradle.ignoredConfigurations= testCompileOnly testRuntimeOnly

ignores configurations named “testCompileOnly” and “testRuntimeOnly”.

• Configurations can use regular expressions.

For example:gradle.ignoredConfigurations=.*test.* ignores all configuration names that contain the string "test".
NOTE: This parameter was previously named gradle.ignoredScopes

N/A

N/A

No default

No

gradle.resolveDependencies 

Whether to resolve Gradle dependencies. Requires build.gradle or build.gradle.kts.

Resolves Gradle dependencies

Will not resolve Gradle dependencies

True
(except for when resolveAllDependencies=false

-gradle.resolveDependencies

gradle.ignoreSourceFiles 

When using the dependency resolver, it will include only package dependencies, not source files.

NOTE: Only relevant when fileSystemScan is true.

The scan includes only package dependencies, not source files.

When using the dependency resolver, it will include package dependencies, plus source files.

False

No

gradle.aggregateModules 

Whether to create a single project for all modules.

Creates a single project for all modules.

A project will be created for each module. The name of the project will be equal to the name of the module (if so, projectName will be ignored).

False

-gradle.aggregateModules

gradle.preferredEnvironment 

When set to 'wrapper', the Unified Agent will run the 'gradlew' wrapper command. If set to 'gradle', it will use the built-in gradle command.

N/A

N/A

wrapper

No

gradle.additionalArguments 

Enables users to add additional arguments to the Unified Agent's existing commands. The existing commands are gradle dependencies or gradle wrapper dependencies.  This works the following way:

Users can provide any parameters starting with '-' or '--', and Unified Agent will add these at the end 

For example:

• -Pbranch=dev -PbuildWithSources=false

• --no-daemon --info

• -Pbranch=dev -PbuildWithSources=false --no-daemon --info

N/A

N/A

No default

No

gradle.includedConfigurations

Enables you to determine which dependency configurations to include in the scan.

The format is according to the following:

• Exact configuration names to include.

Values should be space-delimited.
For example:

gradle.includedConfigurations= compileOnly testCompileOnly

Includes configurations named “compileOnly” and “testCompileOnly”.

• Configurations can include regular expressions.

For example:

gradle.includedConfigurations=.*Only.*

Includes all configuration names that contain the string "Only"
NOTE: This parameter was previously named gradle.includedScopes 

N/A

N/A

No default

No

gradle.excludeModules 

Enables excluding specific modules in the Gradle scan. 

The format is according to the following:

• Exact modules to exclude. Values should be space delimited. For example: gradle.excludeModules= Dev Prod - exclude scopes named 'Dev' and 'Prod'.

• Regular expressions. For example: gradle.excludeModules=.*Dev.* excludes all module names that contain (anywhere in their name) the string "Dev".

N/A

N/A

No default

No

gradle.includeModules 

Enables including specific modules in the Gradle scan.

The format is according to the following:

• Exact modules to include. Values must be space delimited. For example: gradle.includeModules= Dev Prod - include modules named 'Dev' and 'Prod'.

• Regular expressions. For example: gradle.includeModules=.*Dev.* includes all module names that contains these characters.

N/A

N/A

No default

No

gradle.innerModulesAsDependencies

When set to false, this parameter ignores and excludes all the modules dependencies from the resolution scan.

Includes all the modules dependencies from the resolution scan."

Ignores and excludes all the modules dependencies from the resolution scan.

True

No

ant.resolveDependencies 

Whether to scan Apache Ant-based projects.

In cases where the 'ant.pathIdIncludes' parameter is not provided, the Unified Agent will look for the following extensions in your project: jar, war, ear, par, rar, dll, exe, ko, so, msi, zip, tar, tar.gz, swc, swf.

Scans Apache Ant-based projects.

Will not scan Apache Ant-based projects.

True
(except for when resolveAllDependencies=false

No

ant.pathIdIncludes 

Regular expression or comma/space-delimited list of path ids (specified in the build.xml file) to include in the scan.

NOTE: In order for this parameter's value to have an impact on the scan, the parameter 'ant.resolveDependencies' must be set to True.

N/A

N/A

The default value is ".*"

No

ant.external.parameters 

List of key=value (separated by comma), these values are equal to the ANT <property> XML tag.

N/A

N/A

No default

No