Packages

go_over

1.1.0
4.0.0-rc2 4.0.0-rc1 retired 3.3.1 3.3.0 retired 3.2.2 retired 3.2.1 retired 3.2.0 3.1.0 retired 3.0.2 retired 3.0.1 retired 3.0.0 retired 2.4.2 retired 2.4.1 retired 2.4.0 retired 2.3.1 retired 2.3.0 2.2.1 2.2.0 2.1.0 2.0.0 1.1.0 1.0.0 0.5.0 0.4.0 0.3.1 0.3.0 0.2.0 0.1.0

A tool to audit Erlang & Elixir dependencies, to make sure your Gleam ✨ projects really sparkle!

HexDocs

Current section

Files

Jump to
Readme
28 Versions
12 Dependencies
Dependants
Files
Activity
go_over README.md
Raw

README.md 

# 🕵️‍♂️ go_over



[![Package Version](https://img.shields.io/hexpm/v/go_over)](https://hex.pm/packages/go_over)

[![Hex Docs](https://img.shields.io/badge/hex-docs-ffaff3)](https://hexdocs.pm/go_over/)

[![mit](https://img.shields.io/github/license/bwireman/delay?color=brightgreen)](https://github.com/bwireman/delay/blob/main/LICENSE)

[![gleam js](https://img.shields.io/badge/%20gleam%20%E2%9C%A8-js%20%F0%9F%8C%B8-yellow)](https://gleam.run/news/v0.16-gleam-compiles-to-javascript/)

[![gleam erlang](https://img.shields.io/badge/erlang%20%E2%98%8E%EF%B8%8F-red?style=flat&label=gleam%20%E2%9C%A8)](https://gleam.run)



A tool to audit Erlang & Elixir dependencies, to make sure your gleam projects really sparkle! ✨



🚨 _**NOTE**_: security advisories are _NOT_ currently monitored for gleam dependencies. The language, while excellent, is far too new and niche



# 🔽 Install



```sh

gleam add --dev go_over

```



## 📣 Also!



- add `.go-over/` to your `.gitignore`

- make sure `git` is installed



#### 🌸 Javascript



If running with Javascript install



```json

{

  "dependencies": {

    "sync-fetch": "^0.5.2",

    "yaml": "^2.4.3"

  }

}

```



Bun & Nodejs are supported



# ▶️ Usage



```sh

gleam run -m go_over

```



### 🎥 Obligatory Asciinema



![demo](https://raw.githubusercontent.com/bwireman/go-over/main/images/demo.gif)



### 🏴 Flags



Override config values if set



- `--force`: will force pulling new data even if the cached data is still valid

- `--format=<format>`: specify the output format of any warnings. `["minimal", "detailed", "json"]`

- `--outdated`: will _additionally_ check if newer versions of dependencies exist

- `--ignore-indirect`: will ignore all warnings for indirect dependencies



### ⚙️ Config



Optional settings that can be added to your project's `gleam.toml`



```toml

[go-over]

# disables caching if false

# default: true

cache = true

# sets output format for warnings ["minimal", "detailed", "json"]

# default: "minimal"

format = "minimal"

# will additionally check if newer versions of dependencies exist

# default: false

outdated = false

# will ignore all warnings for indirect dependencies

# default: false

ignore_indirect = false



[go-over.ignore]

# list of package names to skip when checking for advisories & warnings

# default: []

packages = ["example_package"]

# list of warning severities to skip when checking for advisories & warnings

# default: []

# (case insensitive)

severity = ["example_moderate"]

# list of advisory IDs to skip when checking for advisories & warnings

# default: []

ids = ["GHSA-xxxx-yyyy-zzzz"]

```



### ⌛ Caching



- Security advisory data is cached for **_six_** hours

- hex.pm retired package data is cached for **_one_** hour



# 🖌️ Other Art



- As I'm sure is no surprise this tool is inspired by (and all around worse than) [mirego/mix_audit](https://github.com/mirego/mix_audit). Please check it out!

- It also draws inspiration from [mix hex.audit](https://hexdocs.pm/hex/Mix.Tasks.Hex.Audit.html)



# ⚖️ License



- This tool uses [mirego/elixir-security-advisories](https://github.com/mirego/elixir-security-advisories) which is it self licensed with



  - `BSD-3-Clause license`

  - `CC-BY 4.0 open source license`.

  - See their [#license section](https://github.com/mirego/elixir-security-advisories?tab=readme-ov-file#license)



- Code original to this repo is Licensed under `MIT`