Google Container Analysis: Node.js Client

release level npm version codecov

Container Analysis API client for Node.js

A comprehensive list of changes in each version may be found in the CHANGELOG.

Read more about the client libraries for Cloud APIs, including the older Google APIs Client Libraries, in Client Libraries Explained.

Table of contents:


Before you begin

  1. Select or create a Cloud Platform project.
  2. Enable billing for your project.
  3. Enable the Google Container Analysis API.
  4. Set up authentication with a service account so you can access the API from your local workstation.

Installing the client library

npm install @google-cloud/containeranalysis

Using the client library

 * TODO(developer): Uncomment these variables before running the sample
// const projectId = 'your-project-id', // Your GCP Project ID
// const noteId = 'my-note-id' // Id of the note

// Import the library and create a client
const {ContainerAnalysisClient} = require('@google-cloud/containeranalysis');
const client = new ContainerAnalysisClient();
// Fetch an instance of a Grafeas client:
// see:
const grafeasClient = client.getGrafeasClient();

// Construct request
// Associate the Note with a metadata type
// Here, we use the type "vulnerabiltity"
const formattedParent = grafeasClient.projectPath(projectId);

// Creates and returns a new Note
const [note] = await grafeasClient.createNote({
  parent: formattedParent,
  noteId: noteId,
  note: {
    vulnerability: {
      details: [
          affectedCpeUri: 'foo.uri',
          affectedPackage: 'foo',
          minAffectedVersion: {
            kind: 'MINIMUM',
          fixedVersion: {
            kind: 'MAXIMUM',

console.log(`Note ${} created.`);


Samples are in the samples/ directory. Each sample's has instructions for running its sample.

SampleSource CodeTry it
Create Notesource codeOpen in Cloud Shell
Create Occurrencesource codeOpen in Cloud Shell
Delete Notesource codeOpen in Cloud Shell
Delete Occurrencesource codeOpen in Cloud Shell
Get Discovery Infosource codeOpen in Cloud Shell
Get Notesource codeOpen in Cloud Shell
Get Occurrencesource codeOpen in Cloud Shell
Get High Vulnerabilities for Imagesource codeOpen in Cloud Shell
Occurrence PubSubsource codeOpen in Cloud Shell
Occurrences for Imagesource codeOpen in Cloud Shell
Occurrences for Notesource codeOpen in Cloud Shell
Poll Discovery Occurrence Finishedsource codeOpen in Cloud Shell
Quickstartsource codeOpen in Cloud Shell
Vulnerability Occurrences for Imagesource codeOpen in Cloud Shell

The Google Container Analysis Node.js Client API Reference documentation also contains samples.

Supported Node.js Versions

Our client libraries follow the Node.js release schedule. Libraries are compatible with all current active and maintenance versions of Node.js.

Client libraries targeting some end-of-life versions of Node.js are available, and can be installed via npm dist-tags. The dist-tags follow the naming convention legacy-(version).

Legacy Node.js versions are supported as a best effort:

  • Legacy versions will not be tested in continuous integration.
  • Some security patches may not be able to be backported.
  • Dependencies will not be kept up-to-date, and features will not be backported.

Legacy tags available

  • legacy-8: install client libraries from this dist-tag for versions compatible with Node.js 8.


This library follows Semantic Versioning.

This library is considered to be General Availability (GA). This means it is stable; the code surface will not change in backwards-incompatible ways unless absolutely necessary (e.g. because of critical security issues) or with an extensive deprecation period. Issues and requests against GA libraries are addressed with the highest priority.

More Information: Google Cloud Platform Launch Stages


Contributions welcome! See the Contributing Guide.

Please note that this, the samples/, and a variety of configuration files in this repository (including .nycrc and tsconfig.json) are generated from a central template. To edit one of these files, make an edit to its templates in directory.


Apache Version 2.0