Which qls file should I use if I have to do the dependency scanning for maven project language java

[rprakash0604]

Which qls file should I use if I have to do the dependency scanning for maven project language java ?

[imDarshanGK]

Hi @rprakash0604,
You should use the maven-qls file for dependency scanning in a Maven Java project. Make sure to integrate it with your scanning tool, like SonarQube, and follow its configuration.

[rprakash0604]

can you please let me know the path/location of maven-qls file ?

[imDarshanGK]

@rprakash0604
The maven-qls file is usually found in the CodeQL repository under the ql directory. You can clone or download the repository to access it.

[smowton]

The Java suite files are located here: https://github.com/github/codeql/tree/main/java/ql/src/codeql-suites

java-code-scanning.qls is the default suite on Code Scanning; security-extended and security-and-quality offer successively more queries that are less accurate or address a less-severe issue, ultimately including non-security issues.