fix: add maven package format version
fix: sanitise maven exec params

…pId and artifactId

* fix: adding the 'from' array to dependencies in maven

* fix: ensure root module is in 'from' array for multi-module dependencies

Many tools treat directories named 'test' as test directories and give them special treatment. Our lib/test directory is not a test directory - it holds code for 'snyk test'.

'yarn clean' is a prime example as it removes all directories named 'test' from a project's node_modules.

See: yarnpkg/yarn#2331
See: https:/Snyk/snyk/issues/64

Ensures that we execute commands inside a shell and not directly.
This makes it easier to run commands on windows without nasty hacks
(like conditionally appending '.cmd' to the command string.. which
doesn't always work).

We originally used child_process.exec which actually calls
child_process.spawn under the hood with the shell option set to true.

Later we switched to using child_process.spawn directly without
realising that the shell option for spawn defaults to false and
has to be manually set.

Check out the docs:
https://nodejs.org/dist/latest-v6.x/docs/api/child_process.html#child_process_child_process_spawn_command_args_options

Now that we require authentication for running `snyk test`, we don't
want to introduce this command to the test suite by default, as all
environments will need to run `snyk auth` in order to authenticate.

This also introduces extra explanation that snyk test requires auth.

Explain that some commands require authentication, and give guidance
about how to authenticate.

We use a local MAC address to randomise sha1 to sign the message. In case MAC address is unreadable (CI env, for example), we defaulted to a random number, causing a crash in crypto.

Using `Math.random` is probably as random as `uuid`, but `crypto.createHash('sha1').update(mac)` requires a Buffer or a String, and not a number.

chore: refactor lib/snyk-test/index.js for ease of future package manager additions.

Any alerts that are returned from an API call are
displayed in the CLI

Check that alerts can be registered and displayed via the
alerts module

The CLI command `snyk wizard` should not run when test limits
are reached.

If `snyk test` is run with `--show-vulnerable-paths=false`, the CLI now
displays a single entry for each unique vuln. Remediation advice is
also not displayed in this case, as it relates to the vulnerable path,
not the vuln.

It works with Python 2 and 3 apps with dependencies in a requirements
file. It does not support testing/monitoring Python packages.

…ort omitted dependencies in gradle

Taken from #87 by @TaopaiC

Object.assign is not available in Node 0.12

- handle underscores in requirements
- skip deps that do not match the current environment (sys_platform)

Suggested by @koczkatamas as #97

When testing a GitHub url without an explicit target file
the CLI won't know which package manager was used to perform
the test, so accept the package manager from the test response
if returned.

Gradle: use gradle wrapper script if present
SBT: distinguish between single and multi build configurations

projects with dev dependencies

Make the help functions more discoverable, particularly for
`snyk ignore`

- Ignore editable dependencies (local and VCS)

- Alpha local JAR support

- minor Jar related fixes

Note: this is an early access alpha feature

I noticed that analytics events are not sent from my machine, an Ubuntu
17.04 VM. Debugging the issue showed that macAdress() threw an
TypeError: Cannot read property 'indexOf' of undefined (ass curr, the
second param of reduce() callback is undefined)
Discussing it with @adrukh we decided that it's better to remove the
call to macAdress() and always use uuid.v4() instead of fixing the buggy
code.

to avoid the fetching of a placeholder `fs` package

No upgrade or patch available for tough-cookie (introduced via request)

More information about the vulnerability:
https://snyk.io/vuln/npm:tough-cookie:20170905

There is an unfortunate chicken-and-egg issue with a test fixture,
and the quickest way out is to disable 0.12 on Travis

for better handling of huge dependency trees