GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Docs
  • Reference
  • Open dashboard

This view

  • Original page
  • New address

GeezerVison is showing docs.deepsource.com — Core analyzers | DeepSource Docs

Core analyzers

Configuration reference for all DeepSource analyzers, including code analysis, coverage, and vulnerability scanning.

This page documents the configuration options for every DeepSource analyzer. Each analyzer can be enabled and configured through the dashboard under Settings > Code Review — no configuration file is needed.

Dashboard configuration (default)

DeepSource auto-detects languages in your repository, and all analysis settings are managed through Settings > Code Review in the dashboard. No .deepsource.toml file is needed for new repositories.

TOML configuration (optional)

If your repository contains a .deepsource.toml file, DeepSource reads it and uses it to configure analysis. You can disable TOML-based configuration for a repository under Settings > Preferences.

Supported languages

AnalyzerSupported versionsStatus
Go≤1.26GA
Rust≤1.93GA
Java8–25GA
Scala2.x, 3.xGA
C#1–14GA
JavaScriptUp to ES2025, TypeScript up to 6.0GA
PHP7.0–8.5GA
Python2.7, 3.x (up to 3.12)GA
Ruby2.0–3.3GA
C & C++C99–C17, C++98–C++23GA
Swift5.1–5.9GA
Kotlin1.0–2.1GA
DockerN/AGA
ShellN/AGA
SQLN/AGA
TerraformN/AGA

TOML file reference

If your repository contains a .deepsource.toml file, DeepSource reads it and uses it to configure analysis. The file supports the following top-level fields:

version

  • Type: Integer
  • Presence: mandatory
  • Description: The version of the configuration file format. Currently, the only supported value is 1.
version = 1

exclude_patterns

  • Type: Array of Strings
  • Presence: optional
  • Description: Glob patterns to exclude files from analysis (e.g. test fixtures, generated code, vendor directories).
exclude_patterns = [
  "migrations/**",
  "**/examples/**",
  "vendor/**"
]

test_patterns

  • Type: Array of Strings
  • Presence: optional
  • Description: Glob patterns to identify test files. Helps reduce false positives by distinguishing application code from test code.
test_patterns = [
  "tests/**",
  "test_*.py",
  "**/*_test.go"
]

analyzers

  • Type: Array of Tables
  • Presence: mandatory (at least one analyzer)
  • Description: Each entry defines an analyzer to run. Every entry supports name (String, mandatory), enabled (Boolean, optional, defaults to true), dependency_file_paths (Array of Strings, optional), and meta (Table, optional — analyzer-specific options documented below).

code_formatters

  • Type: Array of Tables
  • Presence: optional
  • Description: Each entry defines a code formatter to run on pull requests. Supports name (String, mandatory) and enabled (Boolean, optional). See the Code Formatters reference for available formatters.

The code_formatters key replaces the legacy transformers key. Both are supported for backward compatibility.

Complete example

version = 1

exclude_patterns = [
  "vendor/**"
]

test_patterns = [
  "tests/**"
]

[[analyzers]]
name = "python"
enabled = true

  [analyzers.meta]
  runtime_version = "3.x.x"

Python

Analyzer shortcode: python

Code Analysis

The Python analyzer detects bugs, anti-patterns, security issues, and style violations in Python 2 and Python 3 code. It also supports type checking via mypy.

Configuration options

OptionTypeDefaultDescription
runtime_versionString"3.x.x"Python runtime version ("2.x.x" or "3.x.x")
max_line_lengthInteger88Maximum allowed line length (min 79)
skip_doc_coverageArray["module", "magic", "init"]Artifacts to skip for doc coverage (module, magic, init, class, nonpublic)
type_checkerStringNoneType checking analyzer ("mypy")
additional_builtinsArrayNoneAdditional built-in names from user or third-party modules
cyclomatic_complexity_thresholdString"medium"Risk threshold: low, medium, high, very-high, critical

Example

[[analyzers]]
name = "python"
enabled = true

  [analyzers.meta]
  runtime_version = "3.x.x"

For coverage tool setup, see Code coverage > Python. For supported vulnerability target files, see Vulnerability scanning > Python.

Go

Analyzer shortcode: go

Code Analysis

The Go analyzer detects bugs, anti-patterns, and security issues in Go code. It automatically resolves dependencies via supported package managers.

Configuration options

OptionTypeDefaultDescription
import_rootStringNoneRepository placed at $GOPATH/src/{import_root}. Required if not using Go Modules.
import_pathsArrayNoneOverride auto-detected import paths
skip_doc_coverageArrayNoneArtifacts to skip for doc coverage (file)
dependencies_vendoredBooleanfalseSkip dependency installation if vendored
build_tagsArrayNoneBuild tags for conditional compilation
cgo_enabledBooleantrueWhether packages use CGo
cyclomatic_complexity_thresholdString"medium"Risk threshold: low, medium, high, very-high, critical

import_path (String) is deprecated. Use import_root and let the analyzer auto-detect import_paths instead.

Example

[[analyzers]]
name = "go"
enabled = true

  [analyzers.meta]
  import_root = "github.com/your-org/your-repo"

Dependency Installation

The Go analyzer automatically identifies your package manager and installs dependencies:

File namePackage Manager
go.modgo modules
Gopkg.lockdep
GLOCKFILEglock
Godeps/Godeps.jsongodep
dependencies.tsvgodeps
glide.lockglide
vendor.conftrash
trash.yamltrash
vendor/manifestgvt
vendor/vendor.jsongovendor
No dependency fileNo deps installed

If dependencies_vendored is set to true, dependency installation is skipped.

For coverage tool setup, see Code coverage > Go. For supported vulnerability target files, see Vulnerability scanning > Go.

JavaScript

Analyzer shortcode: javascript

Code Analysis

The JavaScript analyzer detects bugs, anti-patterns, and security issues in JavaScript and TypeScript code. It supports React, Vue, Angular, Ember, Meteor, and AngularJS frameworks.

Configuration options

OptionTypeDefaultDescription
pluginsArrayNoneFrameworks: react, vue, ember, meteor, angular, angularjs
dependency_file_pathsArrayNonePaths to directories with package.json or tsconfig.json
environmentArray["nodejs", "browser"]Global variable environments: nodejs, browser, jest, mocha, jasmine, jquery, mongo, cypress, vitest
globalsArrayNoneCustom global variables
module_systemString"es-modules"Module system: commonjs, es-modules, amd
dialectString"typescript"JavaScript dialect: typescript, flow
skip_doc_coverageArray[]Artifacts to skip: function-declaration, function-expression, arrow-function-expression, class-declaration, class-expression, method-definition
style_guideStringNoneStyle guide: airbnb, google, standard
cyclomatic_complexity_thresholdString"high"Risk threshold: low, medium, high, very-high, critical

If you use frameworks like React with ES6 modules, set module_system to "es-modules".

The analyzer auto-detects nodejs, browser, jest, mocha, jasmine, and cypress. If your project uses jQuery or MongoDB, mention them explicitly.

Example

[[analyzers]]
name = "javascript"
enabled = true

  [analyzers.meta]
  plugins = ["react"]
  environment = ["nodejs", "browser"]

ESLint Rules & Plugins

The analyzer supports all ESLint core JavaScript rules and the following plugins:

  • Node — eslint-plugin-node
  • TypeScript — @typescript-eslint/eslint-plugin
  • React — eslint-plugin-react, @babel/eslint-plugin
  • Vue — eslint-plugin-vue
  • Flow — eslint-plugin-flowtype
  • Ember — eslint-plugin-ember
  • Meteor — eslint-plugin-meteor
  • Angular — @angular-eslint/eslint-plugin, @angular-eslint/eslint-plugin-template
  • AngularJS — eslint-plugin-angular
  • Security — eslint-plugin-security

Custom plugins and other third-party plugins are not supported. If a rule is explicitly disabled in your ESLint config, DeepSource respects that and does not raise similar issues.

Dependency Metric Calculation

DeepSource uses package-lock.json and yarn.lock to calculate direct and indirect dependencies. Lock files are not modified.

If you have a lock file but zero dependencies are reported, it may be because:

  • You have not installed peerDependencies correctly
  • You are using a private node package

For coverage tool setup, see Code coverage > JavaScript. For supported vulnerability target files, see Vulnerability scanning > JavaScript.

Java

Analyzer shortcode: java

The Java analyzer supports Gradle, Maven, and Bazel projects.

Configuration options

OptionTypeDefaultDescription
runtime_versionString—Java runtime version (OpenJDK 8–25). Required. Alias: java_version
skip_doc_coverageArray["test"]Artifacts to skip: test, class, constructor, nonpublic
cyclomatic_complexity_thresholdString"medium"Risk threshold: low, medium, high, very-high, critical

If runtime_version is not specified or is the wrong version, analysis may show incorrect results. Specify the Java version you use in CI for best results.

If skip_doc_coverage is set, it overrides defaults. Include "test" explicitly if you still want to skip test documentation.

Example

[[analyzers]]
name = "java"
enabled = true

  [analyzers.meta]
  runtime_version = "11"

For coverage tool setup, see Code coverage > Java. For supported vulnerability target files, see Vulnerability scanning > Java.

Ruby

Analyzer shortcode: ruby

Configuration options

OptionTypeDefaultDescription
skip_doc_coverageArray[]Artifacts to skip: class, module, method, singleton_method
cyclomatic_complexity_thresholdString"medium"Risk threshold: low, medium, high, very-high, critical

Ruby 2.0 and above is supported.

Example

[[analyzers]]
name = "ruby"
enabled = true

For coverage tool setup, see Code coverage > Ruby. For supported vulnerability target files, see Vulnerability scanning > Ruby.

Rust

Analyzer shortcode: rust

Configuration options

OptionTypeDefaultDescription
msrvString"stable"Minimum supported Rust version (e.g. "1.58.1", "stable")
skip_doc_coverageArray[]Artifacts to skip: const, struct, union, enum, function, module, static, trait, type-alias
track_test_doc_coverageBooleanfalseReport doc coverage for test files
cyclomatic_complexity_thresholdString"high"Risk threshold: low, medium, high, very-high, critical

Rust 1.25.0 and above on the stable channel is supported. Nightly and beta channels are not supported.

Example

[[analyzers]]
name = "rust"
enabled = true

  [analyzers.meta]
  msrv = "1.58.1"

For coverage tool setup, see Code coverage > Rust. For supported vulnerability target files, see Vulnerability scanning > Rust.

Kotlin

Analyzer shortcode: kotlin

Configuration options

OptionTypeDefaultDescription
language_versionString"1.7"Kotlin version: 1.0–2.1
runtime_versionString"1.8"Java runtime version: 1.8, 9–21
cyclomatic_complexity_thresholdString"medium"Risk threshold: low, medium, high, very-high, critical

Example

[[analyzers]]
name = "kotlin"
enabled = true

  [analyzers.meta]
  language_version = "1.7"
  runtime_version = "1.8"

For coverage tool setup, see Code coverage > Kotlin. For supported vulnerability target files, see Vulnerability scanning > Kotlin.

Swift

Analyzer shortcode: swift

Configuration options

OptionTypeDefaultDescription
swift_versionString"5.8"Swift version used by your project
skip_doc_coverageArray[]Artifacts to skip: function, method, class, protocol, struct, enum
cyclomatic_complexity_thresholdString"high"Risk threshold: low, medium, high, very-high, critical

Example

[[analyzers]]
name = "swift"
enabled = true

  [analyzers.meta]
  swift_version = "5.8"

For coverage tool setup, see Code coverage > Swift.

C/C++

Analyzer shortcode: cxx

Configuration options

OptionTypeDefaultDescription
misra_complianceBooleanfalseEnable MISRA-C issues for linting
cyclomatic_complexity_thresholdString"very-high"Risk threshold: low, medium, high, very-high, critical

Example

[[analyzers]]
name = "cxx"
enabled = true

For coverage tool setup, see Code coverage > C/C++.

C#

Analyzer shortcode: csharp

Configuration options

OptionTypeDefaultDescription
cyclomatic_complexity_thresholdString"medium"Risk threshold: low, medium, high, very-high, critical

Example

[[analyzers]]
name = "csharp"
enabled = true

For coverage tool setup, see Code coverage > C#. For supported vulnerability target files, see Vulnerability scanning > C#.

Scala

Analyzer shortcode: scala

Configuration options

OptionTypeDefaultDescription
cyclomatic_complexity_thresholdString"medium"Risk threshold: low, medium, high, very-high, critical

Example

[[analyzers]]
name = "scala"
enabled = true

For coverage tool setup, see Code coverage > Scala.

PHP

Analyzer shortcode: php

Configuration options

OptionTypeDefaultDescription
bootstrap_filesArrayNoneFiles defining global constants, custom autoloaders, class aliases
skip_doc_coverageArray["magic"]Artifacts to skip: class, magic, nonpublic
cyclomatic_complexity_thresholdString"medium"Risk threshold: low, medium, high, very-high, critical

PHP 7 and 8 are supported.

Example

[[analyzers]]
name = "php"
enabled = true

For coverage tool setup, see Code coverage > PHP. For supported vulnerability target files, see Vulnerability scanning > PHP.

Docker

Analyzer shortcode: docker

The Docker analyzer analyzes Dockerfiles and raises issues for best practice violations.

Configuration options

OptionTypeDefaultDescription
dockerfile_pathsArray["Dockerfile"]Paths to Dockerfiles to analyze
trusted_registriesArrayNoneTrusted registries for image pulls (when set, other registries are flagged)

Example

[[analyzers]]
name = "docker"
enabled = true

  [analyzers.meta]
  dockerfile_paths = ["Dockerfile", "docker/Dockerfile.prod"]

Terraform

Analyzer shortcode: terraform

The Terraform analyzer analyzes your Terraform files and raises issues for security risks.

Configuration options

No analyzer-specific meta options.

Example

[[analyzers]]
name = "terraform"
enabled = true

Ansible

Analyzer shortcode: ansible

The Ansible analyzer analyzes playbooks, roles, and collections, and raises issues for bugs and syntax problems.

Configuration options

No analyzer-specific meta options.

Example

[[analyzers]]
name = "ansible"
enabled = true

Shell

Analyzer shortcode: shell

The Shell analyzer analyzes shell scripts and raises issues for bugs and syntax problems.

Configuration options

OptionTypeDefaultDescription
dialectStringAuto-detectedUNIX shell dialect: sh, bash, dash, ksh

Example

[[analyzers]]
name = "shell"
enabled = true

  [analyzers.meta]
  dialect = "bash"

SQL

Analyzer shortcode: sql

The SQL analyzer helps you write good SQL and catch errors before they hit your database.

Configuration options

OptionTypeDefaultDescription
max_line_lengthInteger80Maximum line length
tab_space_sizeInteger4Spaces per tab
indent_unitString"space"Indentation unit: tab, space
comma_styleString"trailing"Comma style: trailing, leading
capitalisation_policyString"consistent"Capitalization: consistent, upper, lower, capitalise
allow_scalarBooleantrueAllow single element in SELECT without flagging
single_table_referencesString"consistent"Reference style: qualified, unqualified, consistent

Example

[[analyzers]]
name = "sql"
enabled = true

  [analyzers.meta]
  max_line_length = 100
  indent_unit = "space"
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.