# @sonarsource/analyzer-commons-configurations

> Shared analyzer configuration data (secret-exclusion regexes) generated from the sonar-analyzer-commons SecretClassifier, for use by non-JVM SonarSource analyzers. The payload is secret-patterns.json, with the sample values those patterns must reproduce i

Latest version **2.33.0-5369** (published 2026-09-21) · LGPL-3.0-only license · 0 weekly downloads

## Install

```sh
npm install @sonarsource/analyzer-commons-configurations
pnpm add @sonarsource/analyzer-commons-configurations
yarn add @sonarsource/analyzer-commons-configurations
bun add @sonarsource/analyzer-commons-configurations
```

## Health

**Score 60/100 (C)** — status: active.

Positive: no vulnerabilities; has provenance; recently updated; high maintenance score.

Warnings: low downloads; no types; no esm support.

## Facts

| | |
|---|---|
| Version | 2.33.0-5369 |
| Published | 2026-09-21 |
| First published | 2026-07-23 |
| Weekly downloads | 0 |
| License | LGPL-3.0-only |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 0 |
| Unpacked size | 10.6 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 28 |
| Maintainers | saberduck, gabssnake, andrea-guarino-sonarsource, gregaubert, sonar-jay, philippe-perrin-sonarsource, xay.tanovan, wouter-admiraal-sonarsource, mathieu-sonar, tomverin, jcarsique-sonar, yassin-kammoun-sonarsource, sonartech, lucio.merotta.sonarsource, lpaulger_sonarsource |

## Links

- npm: https://www.npmjs.com/package/@sonarsource/analyzer-commons-configurations
- Repository: https://github.com/SonarSource/sonar-analyzer-commons
- Homepage: https://github.com/SonarSource/sonar-analyzer-commons#readme
- Issues: https://github.com/SonarSource/sonar-analyzer-commons/issues
- npm.io page: https://npm.io/package/@sonarsource/analyzer-commons-configurations

## Recent versions

- 2.33.0-5369 (latest) — 2026-09-21
- 2.32.0-5319 — 2026-09-09
- 2.31.0-5284 — 2026-09-03
- 2.30.0-5193 — 2026-08-12
- 2.29.0-5138 — 2026-07-23

## README

# @sonarsource/analyzer-commons-configurations

Shared analyzer configuration data (secret-exclusion regexes) generated from the sonar-analyzer-commons
SecretClassifier, for use by non-JVM SonarSource analyzers.

The payload is `secret-patterns.json`.

`secret-exclusion-corpus.json` is the matching validation corpus. Every `knownNonSecrets` value must be suppressed by
`secret-patterns.json` in your regex engine - either matched by a `patternGroups` regex or equal to an
`exactMatchGroups` value, following the `match` semantics declared in that file - and no `secretCandidates` value may
be. Assert both in your own test suite, so a pattern that fails to compile or behaves differently outside the JVM is
caught here rather than becoming a missed or a noisy secret finding. A sample's `category` is informational and should
not be asserted on.

See [SonarSource/sonar-analyzer-commons](https://github.com/SonarSource/sonar-analyzer-commons) for details.

---
_Source: https://npm.io/package/@sonarsource/analyzer-commons-configurations · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._