plugin.xml

<idea-plugin>
    <id>org.jboss.tools.intellij.analytics</id>
    <name>Red Hat Dependency Analytics</name>
    <version>1.3.0</version>
    <vendor email="developers@redhat.com" url="https://www.redhat.com">Red-Hat</vendor>

    <description><![CDATA[
      <img src="https://raw.githubusercontent.com/redhat-developer/intellij-dependency-analytics/main/src/main/resources/images/trusted_content_icon.png"
     width="32" height="32"/>

<h2>Overview</h2>
<p>
    Red Hat Dependency Analytics (RHDA) plugin gives you awareness to security concerns within your software supply
    chain while you build your application.

<p>
    <b>NOTE:</b>
    <br>The Red Hat Dependency Analytics plugin is an online service hosted and maintained by Red Hat.
    <br>Dependency Analytics only accesses your manifest files to analyze your application dependencies before
    displaying the vulnerability report.
<p>
    <b>IMPORTANT:</b>
    <br>Dependency Analytics supports multiple package managers:
    <li>Maven (mvn)</li>
    <li>NPM (npm)</li>
    <li>PNPM (pnpm)</li>
    <li>Yarn Berry and Classic (yarn)</li>
    <li>Gradle Kotlin and Groovy (gradle)</li>
    <li>Golang (go mod)</li>
    <li>Python (pip) ecosystems</li>
    <li>Rust (cargo) - TOML plugin required</li>
    <li>Base images in Dockerfile</li>
    <br>In future releases, Red Hat plans to support other package managers.</br>
<p>

<h2>Quick Start</h2>
<p>
    <b>Prerequisites:</b>
<ul>
    <li>You must have the package manager binary for your ecosystem available in your IDE's
        <code>PATH</code> environment. See the <b>Configuration</b> section below for the full list
        of supported package managers, their manifest files, and binary path settings.
    </li>
</ul>
<p>
    <b>Procedure</b>
<ol>
    <li>Install <a href="https://www.jetbrains.com/idea/download/" rel="noopener noreferrer" target="_blank">IntelliJ
        IDEA</a> on your workstation.
    </li>
    <li>After the installation finishes, open the IntelliJ IDEA application.</li>
    <li>From the menu, click <b>Settings</b>, and click <b>Plugins</b>.</li>
    <li>Search the <b>Marketplace</b> for <i>Red Hat Dependency Analytics</i>.</li>
    <li>Click the <b>INSTALL</b> button to install the plugin.</li>
    <li>To start scanning your application for security vulnerabilities, and view the vulnerability report, you can do
        one of the following:
        <ul>
            <li>Open a manifest file, hover over a dependency marked by the inline Component Analysis, indicated by the
                wavy-red line under a dependency, and click <b>Detailed Vulnerability Report</b>.
            </li>
            <li>Right click on a manifest file in the <b>Project</b> window, and click <b>Dependency Analytics
                Report</b>.
            </li>
            <li>For JS/TS monorepos or Cargo workspaces, right click in the <b>Project</b> window and click
                <b>Batch Workspace Analysis Report</b> to analyze all packages at once.
            </li>
        </ul>
    </li>
</ol>
<p>

<h2>Configuration</h2>
<p>
    The Red Hat Dependency Analytics plugin has some configurable parameters that allows you to customize its behavior
    according to your preferences.
<p>
    <b>Procedure</b>
<ol>
    <li>Open the IntelliJ IDEA application.</li>
    <li>Click <b>Settings</b> from the menu, and click <b>Tools</b>.</li>
    <li>Click the <b>Red Hat Dependency Analytics</b>.</li>
</ol>
<img src="https://raw.githubusercontent.com/redhat-developer/intellij-dependency-analytics/main/src/main/resources/images/settings.png"
     alt="Red Hat Dependency Analytics plugin settings">
<p>
    <b>Configurable parameters</b>
<ul>
    <li>
        <b>Maven</b> (<code>pom.xml</code>):
        <br>Set the full path of the Maven executable, which allows Exhort to locate and execute the <code>mvn</code>
        command to resolve dependencies forMaven projects.
        <br>Path of the <code>JAVA_HOME</code> directory is required by the <code>mvn</code> executable.
        <br>If the paths are not provided, your IDE's <code>PATH</code> and <code>JAVA_HONE</code> environments will be
        used to locate the executables.
    </li>

    <li>
        <b>Maven Wrapper</b>:
        <br><code>preferWrapper</code> : Configure whether to use Maven wrapper. There are three options available
        <br><code>true</code>: Always use the wrapper regardless of Build,Execution,Deployment › Build Tools > Maven: Maven home path setting
        <br><code>false</code>: Never use the wrapper regardless of Build,Execution,Deployment › Build Tools > Maven: Maven home path setting
        <br><code>fallback</code>: Use IntelliJ's Build,Execution,Deployment › Build Tools > Maven: Maven home path setting (default behavior)
    </li>

    <li>
        <b>Node</b> (<code>package.json</code>):
        <br>Set the full path of the Node executable, which allows Exhort to locate and execute one of the corresponding <code>npm</code>, <code>pnpm</code> or <code>yarn</code> command
        to resolve dependencies for Node projects.
        <br>Path of the directory containing the <code>node</code> executable is required by one of the corresponding package manager <code>npm</code>, <code>pnpm</code> or <code>yarn</code>
        executable.
        <br>If the paths are not provided, your IDE's <code>PATH</code> environment will be used to locate the
        executables.
        <br>It also requires a corresponding lock file to be present in order to analyze package.json files.
    </li>
    <li>
        <b>Golang</b> (<code>go.mod</code>):
        <br>Set the full path of the Go executable, which allows Exhort to locate and execute the <code>go</code>
        command to resolve dependencies for Go projects.
        <br>If the path is not provided, your IDE's <code>PATH</code> environment will be used to locate the executable.
        <br>When option <code>Strictly match package version</code> is selected, the resolved dependency versions will
        be compared to the versions specified in the manifest file, and users will be alerted if any mismatch is
        detected.
    </li>
    <li>
        <b>Rust</b> (<code>Cargo.toml</code>):
        <br>Set the full path of the Cargo executable, which allows Exhort to locate and run the <code>cargo</code>
        command to resolve dependencies for Rust projects.
        <br>If the path is not provided, your IDE's <code>PATH</code> environment will be used to locate the executable.
    </li>
    <li>
        <b>Python</b> (<code>requirements.txt</code>):
        <br>Set the full paths of the Python and the package installer for Python executables, which allows Exhort to
        locate and execute the <code>pip3</code> commands to resolve dependencies for Python projects.
        <br>Python 2 executables <code>python</code> and <code>pip</code> can be used instead, if the <code>Use python
        2.x</code> option is selected.
        <br>If the paths are not provided, your IDE's <code>PATH</code> environment will be used to locate the
        executables.
        <br>When option <code>Strictly match package version</code> is selected, the resolved dependency versions will
        be compared to the versions specified in the manifest file, and users will be alerted if any mismatch is
        detected.
        <br>Python virtual environment can be applied, when selecting the <code>Use python virtual environment</code>
        option.
        <br>If selecting option <code>Allow alternate package version</code> while using virtual environment, the
        dependency versions specified in the manifest file will be ignored, and dependency versions will be resolved
        dynamically instead. This feature cannot be enabled when <code>Strictly match package version</code> is
        selected.
    </li>
    <li>
        <b>Gradle</b> (<code>build.gradle</code>, <code>build.gradle.kts</code>):
        <br>Set the full path of the Gradle executable, which allows Exhort to locate and run the <code>gradle</code>
        command to resolve dependencies for Gradle projects.
        <br>By not setting a path to the gradle binary, IntelliJ IDEA uses its default path environment to locate
        the file.
    </li>
    <li>
        <b>Image</b> (<code>Dockerfile</code>):
        <br>Set the full path of the Syft executable, which allows Exhort to locate and execute the <code>syft</code>
        command to generate Software Bill of Materials for the base images.
        <br>Optionally, set the full path of the Docker or Podman executable. Syft will attempt to find the images in
        the Docker or Podman daemon with the executable. Otherwise, Syft will try direct remote registry access.
        <br>Set the full path of the Skopeo executable, which allows Exhort to locate and execute the
        <code>skopeo</code> command to determine the image digests.
        <br>If the paths are not provided, your IDE's <code>PATH</code> environment will be used to locate the
        executables.
        <br>If a Syft configuration file is used and not at the default <a
            href="https://github.com/anchore/syft/blob/469b4c13bbc52c43bc5216924b6ffd9d6d47bbd6/README.md#configuration"
            rel="noopener noreferrer" target="_blank">paths</a>, set the full path to the configuration file in
        configuration.
        <br>If an <a
            href="https://github.com/containers/skopeo/blob/3eacbe5ae2fe859f872a02bf28c16371fb1de7b8/docs/skopeo-inspect.1.md#options"
            rel="noopener noreferrer" target="_blank">authentication file</a> is applied for <code>skopeo inspect</code>,
        set the full path to the file in configuration.
        <br>If platform is not specified in the <code>Dockerfile</code> for multi-platform images and a default platform
        should be applied, set the default platform in the configuration. Otherwise, set the full path of the Docker or
        Podman executable, then Exhort will use the executable to determine the image platform based on the OS and
        architecture of the container runtime.
    </li>
    <li>
        <b>Inline Vulnerability Severity Alerts</b>:
        <br>You can set the vulnerability severity alert level to <code>Error</code> or <code>Warning</code> for inline
        notifications of detected vulnerabilities.
    </li>
    <li>
        <b>Manifest Exclusion Patterns</b>:
        <br>You can exclude manifest files from component analysis using glob patterns. This is useful for excluding
        third-party dependencies, test files, or other manifests that should not be analyzed.
        <br>Enter one pattern per line. Examples: <code>**/node_modules/**/package.json</code> to exclude all
        package.json files in node_modules directories, or <code>test/**/pom.xml</code> to exclude all Maven files
        in test directories.
    </li>
</ul>
<p>

<h2>Features</h2>
<p>
<ul>
    <li>
        <b>Component analysis</b>
        <br>Upon opening a supported manifest file (see <b>Configuration</b> section for the full list), a scan
        starts the analysis
        process.
        <br>The scan provides immediate inline feedback on detected security vulnerabilities for your application's
        dependencies.
        <br>Such dependencies are appropriately underlined in red, and hovering over it gives you a short summary of
        the security concern.
        <br>The summary has the full package name, version number, the amount of known security vulnerabilities, and the
        highest severity status of said vulnerabilities.
        <img src="https://raw.githubusercontent.com/redhat-developer/intellij-dependency-analytics/main/src/main/resources/images/component-analysis.gif"
             alt="Animated screenshot showing the inline reporting feature of Dependency Analytics">
    </li>
    <li>
        <b>Dockerfile scanning</b>
        <br>Upon opening a <code>Dockerfile</code>, a vulnerability scan starts analyzing the images within the
        Dockerfile.
        <br>After the analysis finishes, you can view any recommendations and remediation by clicking the <i>More
        actions...</i> menu from the highlighted image name.
        <br>Any recommendations for an alternative image does not replace the current image.
        <br>
        <br>You must have the <a href="https://github.com/anchore/syft#installation"
        rel="noopener noreferrer" target="_blank">syft</a> and <a href="https://www.redhat.com/en/topics/containers/what-is-skopeo"
        rel="noopener noreferrer" target="_blank">skopeo</a> binaries installed on your workstation to use the
        Dockerfile scanning feature.
        <br> You can specify a specific path to these binaries, and others by settings the following parameters as
        environment variables or system properties:
        <ul>
            <li><code>TRUSTIFY_DA_SYFT_PATH</code> : Specify the absolute path of <code>syft</code> executable.</li>
            <li><code>TRUSTIFY_DA_SYFT_CONFIG_PATH</code> : Specify the absolute path to the Syft configuration file.</li>
            <li><code>TRUSTIFY_DA_SKOPEO_PATH</code> : Specify the absolute path of <code>skopeo</code> executable.</li>
            <li><code>TRUSTIFY_DA_SKOPEO_CONFIG_PATH</code> : Specify the absolute path to the authentication file used by
            the <code>skopeo inspect</code> command.</li>
            <li><code>TRUSTIFY_DA_DOCKER_PATH</code> : Specify the absolute path of <code>docker</code> executable.</li>
            <li><code>TRUSTIFY_DA_PODMAN_PATH</code> : Specify the absolute path of <code>podman</code> executable.</li>
            <li><code>TRUSTIFY_DA_IMAGE_PLATFORM</code> : Specify the platform used for multi-arch images.</li>
        </ul>
        <img src="https://raw.githubusercontent.com/redhat-developer/intellij-dependency-analytics/main/src/main/resources/images/image-analysis.gif"
             alt="Animated screenshot showing the inline reporting feature of Image Analysis">
    </li>
    <li>
        <b>Excluding dependencies with <code>trustify-da-ignore</code></b>
        <br>You can exclude a package from analysis by marking the package for exclusion.
        <br>
        <br>If you wish to ignore vulnerabilities for a dependency in a <code>pom.xml</code> file, you must add <code>trustify-da-ignore</code>
        as a comment against the dependency, group id, artifact id, or version scopes of that particular dependency in
        the manifest file.
        <br>For example:
        <code>
            <br>&lt;dependency&gt; &lt;!--trustify-da-ignore--&gt;
            <br>&nbsp;&nbsp;&lt;groupId&gt;...&lt;/groupId&gt;
            <br>&nbsp;&nbsp;&lt;artifactId&gt;...&lt;/artifactId&gt;
            <br>&nbsp;&nbsp;&lt;version&gt;...&lt;/version&gt;
            <br>&lt;/dependency&gt;
        </code>
        <br>
        <br>If you wish to ignore vulnerabilities for a dependency in a <code>package.json</code> file, you must add
        <code>trustify-da-ignore</code> as an attribute-value pair.
        <br>For example:
        <code>
            <br>{
            <br>&nbsp;&nbsp;"name": "sample",
            <br>&nbsp;&nbsp;"version": "1.0.0",
            <br>&nbsp;&nbsp;"description": "",
            <br>&nbsp;&nbsp;"main": "index.js",
            <br>&nbsp;&nbsp;"keywords": [],
            <br>&nbsp;&nbsp;"author": "",
            <br>&nbsp;&nbsp;"license": "ISC",
            <br>&nbsp;&nbsp;"dependencies": {
            <br>&nbsp;&nbsp;&nbsp;&nbsp;"dotenv": "^8.2.0",
            <br>&nbsp;&nbsp;&nbsp;&nbsp;"express": "^4.17.1",
            <br>&nbsp;&nbsp;&nbsp;&nbsp;"jsonwebtoken": "^8.5.1",
            <br>&nbsp;&nbsp;&nbsp;&nbsp;"mongoose": "^5.9.18"
            <br>&nbsp;&nbsp;},
            <br>&nbsp;&nbsp;"trustify-da-ignore": [
            <br>&nbsp;&nbsp;&nbsp;&nbsp;"jsonwebtoken"
            <br>&nbsp;&nbsp;]
            <br>}
        </code>
        <br>
        <br>If you wish to ignore vulnerabilities for a dependency in a <code>go.mod</code> file, you must add
        <code>trustify-da-ignore</code> as a comment against the dependency in the manifest file.
        <br>For example:
        <code>
            <br>require (
            <br>&nbsp;&nbsp;golang.org/x/sys v1.6.7 // trustify-da-ignore
            <br>)
        </code>
        <br>
        <br>If you wish to ignore vulnerabilities for a dependency in a <code>requirements.txt</code> file, you must add
        <code>trustify-da-ignore</code> as a comment against the dependency in the manifest file.
        <br>For example:
        <code>
            <br>requests==2.28.1 # trustify-da-ignore
        </code>
        <br>If you wish to ignore vulnerabilities for a dependency in a <code>Cargo.toml</code> file, you must add
        <code>trustify-da-ignore</code> as a comment against the dependency in the manifest file.
        <br>For example:
        <code>
            <br>[dependencies]
            <br>serde = "1.0" # trustify-da-ignore
            <br>tokio = { version = "1.0", features = ["full"] } # trustify-da-ignore
        </code>
    </li>
    <li>
        <b>Excluding developmental or test dependencies</b>
        <br>Red Hat Dependency Analytics does not analyze dependencies marked as <code>dev</code> or <code>test</code>,
        these dependencies are ignored.
        <br>
        <br>For example, setting <code>test</code> in the <code>scope</code> tag within a <code>pom.xml</code> file:
        <code>
            <br>&lt;dependency&gt;
            <br>&nbsp;&nbsp;&lt;groupId&gt;...&lt;/groupId&gt;
            <br>&nbsp;&nbsp;&lt;artifactId&gt;...&lt;/artifactId&gt;
            <br>&nbsp;&nbsp;&lt;version&gt;...&lt;/version&gt;
            <br>&nbsp;&nbsp;&lt;scope&gt;test&lt;/scope&gt;
            <br>&lt;/dependency&gt;
        </code>
        <br>
        <br>For example, setting <code>devDependencies</code> attributte in the <code>package.json</code> file:
        <code>
            <br>{
            <br>&nbsp;&nbsp;"name": "sample",
            <br>&nbsp;&nbsp;"version": "1.0.0",
            <br>&nbsp;&nbsp;"description": "",
            <br>&nbsp;&nbsp;"main": "index.js",
            <br>&nbsp;&nbsp;"keywords": [],
            <br>&nbsp;&nbsp;"author": "",
            <br>&nbsp;&nbsp;"license": "ISC",
            <br>&nbsp;&nbsp;"dependencies": {
            <br>&nbsp;&nbsp;&nbsp;&nbsp;"dotenv": "^8.2.0",
            <br>&nbsp;&nbsp;&nbsp;&nbsp;"express": "^4.17.1",
            <br>&nbsp;&nbsp;&nbsp;&nbsp;"jsonwebtoken": "^8.5.1",
            <br>&nbsp;&nbsp;&nbsp;&nbsp;"mongoose": "^5.9.18"
            <br>&nbsp;&nbsp;},
            <br>&nbsp;&nbsp;"devDependencies": {
            <br>&nbsp;&nbsp;&nbsp;&nbsp;"axios": "^0.19.0"
            <br>&nbsp;&nbsp;}
            <br>}
        </code>
        <br>
        <br>For example, setting <code>exclude</code> attribute in the <code>go.mod</code> file:
        <code>
            <br>exclude golang.org/x/sys v1.6.7
            <br>exclude (
            <br>&nbsp;&nbsp;golang.org/x/sys v1.6.7
            <br>)
        </code>
        <br>
        <br>You can create an alternative file to <code>requirements.txt</code>, for example, a <code>requirements-dev.txt</code>
        or a <code>requirements-test.txt</code> file where you can add the development or test dependencies there.
    </li>
    <li>
        <b>Red Hat Dependency Analytics Report</b>
        <br>The Red Hat Dependency Analytics Report is a temporary HTML file that exists if the <b>Red Hat Dependency
        Analytics Report</b> tab remains open.
        <br>Closing the tab removes the temporary HTML file.
    </li>
    <li>
        <b>Excluding manifest files with patterns</b>
        <br>You can exclude specific manifest files from component analysis using configurable glob patterns. This
        feature allows you to avoid analyzing third-party dependencies, test files, or other manifests that are not
        relevant to your security analysis.
        <br>Patterns are configured in the plugin settings under <b>Tools > Red Hat Dependency Analytics > Manifest
        Exclusion Patterns</b>.
        <br>Examples: <code>**/node_modules/**/package.json</code>, <code>test/**/pom.xml</code>,
        <code>vendor/**/*.go.mod</code>, <code>target/**/Cargo.toml</code>
        <br>Right-click on any manifest file and select <b>Exclude from Component Analysis</b> to quickly add an
        exclusion pattern for that specific file.
    </li>
</ul>
<p>

<h2>Know more about the Red Hat Dependency Analytics platform</h2>
<p>
    The goal of this project is to significantly enhance a developer's experience by providing helpful vulnerability
    insights for their applications.
<ul>
    <li><a href="https://github.com/redhat-developer/intellij-dependency-analytics" rel="noopener noreferrer"
           target="_blank">GitHub Repository</a></li>
</ul>
<p>

<h2>Data and telemetry</h2>
<p>
    The Red Hat Dependency Analytics plugin for IntellJ IDEA collects anonymous <a
        href="https://github.com/redhat-developer/intellij-dependency-analytics/blob/main/USAGE_DATA.md"
        rel="noopener noreferrer" target="_blank">usage data</a> and sends it to Red Hat servers to help improve our
    products and services.
    <br>Read our <a href="https://developers.redhat.com/article/tool-data-collection"
                    rel="noopener noreferrer" target="_blank">privacy statement</a> to learn more.
    <br>This plugin respects the settings of the <code>Telemetry by Red Hat</code> plugin, which you can learn more
    about <a href="https://plugins.jetbrains.com/plugin/16209-telemetry-by-red-hat"
             rel="noopener noreferrer" target="_blank">here</a>.
<p>

<h2>Support, feedback & questions</h2>
<p>
    There are two ways you can contact us:
<ul>
    <li>You can reach out to us at <code>rhda-support@redhat.com</code> with any questions, feedback, and general
        support.
    </li>
    <li>You can also file a <a href="https://github.com/redhat-developer/intellij-dependency-analytics/issues"
                               rel="noopener noreferrer" target="_blank">GitHub Issue</a>.
    </li>
</ul>

<h2>License</h2>
<p>
    EPL-2.0, See <a href="https://github.com/redhat-developer/intellij-dependency-analytics/blob/main/LICENSE"
                    rel="noopener noreferrer" target="_blank">LICENSE</a> for more information.

  ]]></description>

    <change-notes><![CDATA[
  <p><b>1.3.0</b></p>
  <p>Added Reports Save Directory configuration option to permanently save dependency analysis reports to a user-specified directory.</p>
  <p>Added support for Rust.</p>
  <p><b>1.2.0</b></p>
  <p>Now integrates with RHTPA.</p>
  <p>Support exhortignore and trustify-da-ignore</p>
  <p>Default to MVS = true for go.</p>
  <p>Do not include go toolchain entries.</p>
  <p>Remove go qualifiers from sbom.</p>
  <p>Support customized maven user settings file and local repository.</p>
  <p>Removed Go and Docker plugin dependencies. Golang projects now work with IntelliJ Community Edition.</p>
  <p>Add support for user-configurable patterns/globs for excluding manifests from Component Analysis.</p>
  <p><b>1.1.0</b></p>
  <p>Added support for Gradle manifest files.</p>
  <p>Added support for Yarn.</p>
  <p>Added support for PNPM.</p>
  <p>Added support for Proxy setting(Static Proxy Configuration).</p>
  <p>Enable using the Maven Wrapper.</p>
  <p>No restart needed after installation.</p>
  <p>Require a lock file to be present in order to analyze package.json files.</p>
  <p><b>1.0.0</b></p>
  <p>Added support for base image vulnerability scanning in Dockerfiles.</p>
  <p>Bumped Telemetry plugin to 1.1.0.</p>
  <p>Added support for Python, Golang, and Node manifest files.</p>
  <p>Golang projects can only be analyzed with IntelliJ Ultimate Edition.</p>
  <p>Fixed an issue with Python and Golang manifest files where packages did not have underlining for inline recommendations and remediations.</p>
  <p>Fixed an issue with the ignore flags for dependencies which was causing an invalid Dependency Analytics report.</p>
  <p>Added a vulnerability severity alert level setting for the user to receive inline notifications for errors or warnings.</p>
  <p><b>0.9.0</b></p>
  <p>Enable component analysis for Golang (<code>go mod</code>) and Python (<code>pip</code>).</p>
  <p>Added version quick-fix for Vulnerable artifacts in component analysis( Currently only for Maven pom.xml).</p>      
  <p><b>0.7.0</b></p>
  <p>Initial release for the new Red Hat Dependency Analytics service.</p>
  <p>Based on exhort-java-api.</p>
  <p>Perform analysis with the new Red Hat Dependency Analytics backend.</p>
  <p>Support for Python and Golang is temporarily disabled, and will be re-enabled later.</p>
  <p><b>0.6.0</b></p>
  <p>Various dependency bumps.</p>
  <p>Various maintenance resolutions.</p>
  <p>Bump Java 8 to Java 11.</p>
  <p>Fix break introduced with 2022.3.</p>
  <p><b>0.5.0</b></p>
  <p>Analysis report generation fixes.</p>
  <p><b>0.4.0</b></p>
  <p>Security fixes.</p>
  <p>Fix NPE when opening editor.</p>
  <p><b>0.3.0</b></p>
  <p>Stack Analysis capability is implemented to see detailed analysis of stack.</p>
  <p>Support for Golang dependencies in Component Analysis.</p>
  <p><b>0.2.0</b></p>
  <p>Latest ca-lsp-server is now automatically downloaded</p>
  <p>Opt-in telemetry</p>
  <p><b>0.1.1</b></p>
  <p>Based on ca-lsp-server v0.4.20</p>
  <p><b>0.0.4</b></p>
  <p>Based on ca-lsp-server v0.2.2</p>
  <p><b>0.0.3</b></p>
  <p>Bug fixes</p>
  <ul>
    <li><a href="https://github.com/redhat-developer/intellij-dependency-analytics/issues/3">Files not analyzed at startup</a></li>
  </ul>
  <p><b>0.0.2</b></p>
  <p>Based on ca-lsp-server v0.1.56</p>
  <p><b>0.0.1</b></p>
  <p>Initial release</p>
  ]]>
    </change-notes>

    <!-- please see http://www.jetbrains.org/intellij/sdk/docs/basics/getting_started/build_number_ranges.html for description -->
    <idea-version since-build="242.0"/>

    <!-- please see http://www.jetbrains.org/intellij/sdk/docs/basics/getting_started/plugin_compatibility.html
         on how to target different products -->
    <depends>com.intellij.modules.lang</depends>
    <depends>com.intellij.modules.json</depends>
    <depends>com.intellij.java</depends>
    <depends>org.toml.lang</depends>
    <depends>org.jetbrains.idea.maven</depends>
    <depends>com.redhat.devtools.intellij.telemetry</depends>

    <extensions defaultExtensionNs="com.intellij">
        <notificationGroup id="Red Hat Dependency Analytics" displayType="BALLOON"/>
        <fileEditorProvider implementation="org.jboss.tools.intellij.report.AnalyticsReportEditorProvider"/>
        <editorTabTitleProvider implementation="org.jboss.tools.intellij.report.AnalyticsReportEditorTabTitleProvider"
                                order="first"/>

        <applicationConfigurable
                parentId="tools"
                instance="org.jboss.tools.intellij.settings.ApiSettingsConfigurable"
                id="org.jboss.tools.intellij.settings.ApiSettingsConfigurable"
                displayName="Red Hat Dependency Analytics"/>

        <localInspection language="XML" shortName="MavenCAInspection"
                         displayName="Red Hat Dependency Analytics component analysis"
                         groupName="Maven" enabledByDefault="true" level="ERROR"
                         implementationClass="org.jboss.tools.intellij.componentanalysis.maven.MavenCAInspection"/>
        <externalAnnotator language="XML"
                           implementationClass="org.jboss.tools.intellij.componentanalysis.maven.MavenCAAnnotator"/>

        <localInspection language="JSON" shortName="NpmCAInspection"
                         displayName="Red Hat Dependency Analytics component analysis"
                         groupPath="JavaScript and TypeScript" groupName="Imports and dependencies"
                         enabledByDefault="true" level="ERROR"
                         implementationClass="org.jboss.tools.intellij.componentanalysis.npm.NpmCAInspection"/>
        <externalAnnotator language="JSON"
                           implementationClass="org.jboss.tools.intellij.componentanalysis.npm.NpmCAAnnotator"/>

        <fileType name="rhda-requirements"
                  language="rhda-requirements"
                  fileNames="requirements.txt"
                  implementationClass="org.jboss.tools.intellij.componentanalysis.pypi.requirements.filetype.RequirementsFileType"/>
        <lang.parserDefinition language="rhda-requirements"
                               implementationClass="org.jboss.tools.intellij.componentanalysis.pypi.requirements.psi.RequirementsParserDefinition"/>
        <localInspection language="rhda-requirements" shortName="PipCAInspection"
                         displayName="Red Hat Dependency Analytics component analysis"
                         groupName="Python" enabledByDefault="true" level="ERROR"
                         implementationClass="org.jboss.tools.intellij.componentanalysis.pypi.PipCAInspection"/>
        <externalAnnotator language="rhda-requirements"
                           implementationClass="org.jboss.tools.intellij.componentanalysis.pypi.PipCAAnnotator"/>

        <fileType name="rhda-build-gradle"
                  language="rhda-build-gradle"
                  fileNames="build.gradle"
                  implementationClass="org.jboss.tools.intellij.componentanalysis.gradle.build.filetype.BuildGradleFileType"/>
        <lang.parserDefinition language="rhda-build-gradle"
                               implementationClass="org.jboss.tools.intellij.componentanalysis.gradle.build.psi.BuildGradleParserDefinition"/>
        <localInspection language="rhda-build-gradle" shortName="GradleCAInspection"
                         displayName="Red Hat Dependency Analytics component analysis"
                         groupName="Gradle" enabledByDefault="true" level="ERROR"
                         implementationClass="org.jboss.tools.intellij.componentanalysis.gradle.GradleCAInspection"/>
        <externalAnnotator language="rhda-build-gradle"
                           implementationClass="org.jboss.tools.intellij.componentanalysis.gradle.GradleCAAnnotator"/>

        <fileType name="rhda-go-mod"
                  language="rhda-go-mod"
                  fileNames="go.mod"
                  implementationClass="org.jboss.tools.intellij.componentanalysis.golang.build.filetype.GoModFileType"/>
        <lang.parserDefinition language="rhda-go-mod"
                               implementationClass="org.jboss.tools.intellij.componentanalysis.golang.build.psi.GoModParserDefinition"/>
        <localInspection language="rhda-go-mod" shortName="GoCAInspection"
                         displayName="Red Hat Dependency Analytics component analysis"
                         groupPath="Go modules" groupName="General" enabledByDefault="true" level="ERROR"
                         implementationClass="org.jboss.tools.intellij.componentanalysis.golang.GoCAInspection"/>
        <externalAnnotator language="rhda-go-mod"
                           implementationClass="org.jboss.tools.intellij.componentanalysis.golang.GoCAAnnotator"/>
        <fileType name="rhda-dockerfile"
                  language="rhda-dockerfile"
                  fileNames="Dockerfile"
                  implementationClass="org.jboss.tools.intellij.image.build.filetype.DockerfileFileType"/>
        <lang.parserDefinition language="rhda-dockerfile"
                               implementationClass="org.jboss.tools.intellij.image.build.psi.DockerfileParserDefinition"/>
        <!-- Override file type detection so Dockerfiles always use our custom parser
             instead of the bundled TextMate Docker grammar. The TextMate file type
             implements PlainTextLikeFileType which causes IntelliJ to skip
             ExternalAnnotator execution, preventing vulnerability analysis. -->
        <fileTypeOverrider implementation="org.jboss.tools.intellij.image.build.filetype.DockerfileFileTypeOverrider"/>

        <localInspection language="rhda-dockerfile" shortName="DockerfileInspection"
                         displayName="Red Hat Dependency Analytics dockerfile analysis"
                         groupName="Dockerfile" enabledByDefault="true" level="ERROR"
                         implementationClass="org.jboss.tools.intellij.image.DockerfileInspection"/>
        <externalAnnotator language="rhda-dockerfile"
                           implementationClass="org.jboss.tools.intellij.image.DockerfileAnnotator"/>

        <!-- Cargo.toml support for Rust projects (requires TOML bundle plugin) -->
        <localInspection language="TOML" shortName="CargoCAInspection"
                         displayName="Red Hat Dependency Analytics component analysis"
                         groupName="Rust" enabledByDefault="true" level="ERROR"
                         implementationClass="org.jboss.tools.intellij.componentanalysis.cargo.CargoCAInspection"/>

        <externalAnnotator language="TOML"
                           implementationClass="org.jboss.tools.intellij.componentanalysis.cargo.CargoCAAnnotator"/>

        <!-- pyproject.toml support for Python projects (requires TOML bundle plugin) -->
        <localInspection language="TOML" shortName="PyprojectCAInspection"
                         displayName="Red Hat Dependency Analytics component analysis"
                         groupName="Python" enabledByDefault="true" level="ERROR"
                         implementationClass="org.jboss.tools.intellij.componentanalysis.pypi.PyprojectCAInspection"/>

        <externalAnnotator language="TOML"
                           implementationClass="org.jboss.tools.intellij.componentanalysis.pypi.PyprojectCAAnnotator"/>
    </extensions>

    <!-- Action for running SA added in Editor window, Navigation Bar and Project View-->
    <actions>
        <group id="saAnalysis-group">
            <action id="saAnalysis" text="Dependency Analytics Report"
                    class="org.jboss.tools.intellij.stackanalysis.SaAction"
                    icon="/images/report-icon.png"/>

            <separator/>

            <add-to-group group-id="EditorPopupMenu" anchor="first"/>
            <add-to-group group-id="NavBarToolBar" anchor="first"/>
            <add-to-group group-id="ProjectViewPopupMenu" anchor="first"/>
        </group>

        <group id="saBatchAnalysis-group">
            <action id="saBatchAnalysis" text="Batch Workspace Analysis Report"
                    class="org.jboss.tools.intellij.stackanalysis.SaBatchAction"
                    icon="/images/report-icon.png"/>

            <separator/>

            <add-to-group group-id="EditorPopupMenu" anchor="first"/>
            <add-to-group group-id="NavBarToolBar" anchor="first"/>
            <add-to-group group-id="ProjectViewPopupMenu" anchor="first"/>
        </group>

        <group id="generateSbom-group">
            <action id="generateSbom" text="Generate SBOM"
                    class="org.jboss.tools.intellij.stackanalysis.GenerateSbomAction"
                    icon="/images/report-icon.png"/>
            <separator/>

            <add-to-group group-id="EditorPopupMenu" anchor="first"/>
            <add-to-group group-id="NavBarToolBar" anchor="first"/>
            <add-to-group group-id="ProjectViewPopupMenu" anchor="first"/>
        </group>

        <group id="imageAnalysis-group">
            <action id="imageAnalysis" text="Image Analytics Report"
                    class="org.jboss.tools.intellij.image.ImageReportAction"
                    icon="/images/report-icon.png"/>
            <separator/>

            <add-to-group group-id="EditorPopupMenu" anchor="first"/>
            <add-to-group group-id="NavBarToolBar" anchor="first"/>
            <add-to-group group-id="ProjectViewPopupMenu" anchor="first"/>
        </group>
    </actions>

</idea-plugin>