
Security News
OpenGrep Restores Fingerprinting in JSON and SARIF Outputs
OpenGrep has restored fingerprint and metavariable support in JSON and SARIF outputs, making static analysis more effective for CI/CD security automation.
ApexLink is a SFDX CLI plugin & Java library for static analysis of Salesforce Apex code aimed at improving developer productivity. The core library is useful for any number of analysis problems while the CLI plugin acts as a demo of current capability.
To install the CLI plugin (from npm)
sfdx plugins:install apexlink
Check the installation was successful with
sfdx plugins
This should show apexlink in the plugin list.
To perform a simple validity check use:
sfdx apexlink:check <directory>
This parses and performs semantic checks on the code and reports any errors, such as types not being found. The library contains a pretty comprehensive set of platform types that it validates against.
More complex validations can be performed that support namespaced packages and multiple source directories, see the command help for more details. This command does not require an sfdx project, if you omit the directory it will search the current directory for metadata.
You can use the check command to report on unused fields, properties and methods of Apex classes.
sfdx apexlink:check --zombies <directory>
This analysis currently may return false positives for:
The check command can also report Apex class dependencies with:
sfdx apexlink:check --depends --json <directory>
If you omit the --json the dependency default format is CSV. Understanding dependencies is useful when analysing cold start behaviours but it also provides the support for identifying unused methods and fields.
$ npm install -g apexlink
$ sfdx COMMAND
running command...
$ sfdx (-v|--version|version)
apexlink/0.9.1 darwin-x64 node-v12.16.2
$ sfdx --help [COMMAND]
USAGE
$ sfdx COMMAND
...
sfdx apexlink:check [--zombie] [--depends] [--namespaces <string>] [--verbose] [--json] [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]
Validate Apex code in current or passed directories
USAGE
$ sfdx apexlink:check [--zombie] [--depends] [--namespaces <string>] [--verbose] [--json] [--loglevel
trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]
ARGUMENTS
DIRECTORY directory to search for metadata files, defaults to current directory
OPTIONS
--depends output map of type dependencies
rather than issues, CSV or JSON
format
--json show output in json format (disables
--verbose)
--loglevel=(trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL) [default: warn] logging level for
this command invocation
--namespaces=namespaces comma separated list of dependent
package namespaces (without spaces)
--verbose show progress messages
--zombie show warnings for unused fields &
methods
EXAMPLES
$ sfdx apexlink:check
$ sfdx apexlink:check --verbose $HOME/myproject
$ sfdx apexlink:check --zombie --namespaces ns1,ns2 $HOME/myproject
See code: src/commands/apexlink/check.ts
FAQs
SFDX CLI plugin for Apexlink Salesforce metadata analysis library
The npm package apexlink receives a total of 22 weekly downloads. As such, apexlink popularity was classified as not popular.
We found that apexlink demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
OpenGrep has restored fingerprint and metavariable support in JSON and SARIF outputs, making static analysis more effective for CI/CD security automation.
Security News
Security experts warn that recent classification changes obscure the true scope of the NVD backlog as CVE volume hits all-time highs.
Security Fundamentals
Attackers use obfuscation to hide malware in open source packages. Learn how to spot these techniques across npm, PyPI, Maven, and more.