Dependency Scanning (SCA)

Most of your code is someone else's

A typical application imports far more third-party code than it contains first-party code. Software composition analysis (SCA) reads your manifests and lockfiles (package-lock.json, poetry.lock, go.sum, pom.xml) and checks every resolved package version against vulnerability databases such as the GitHub Advisory Database, OSV and the NVD. Vulnerabilities are identified by CVE IDs and scored with CVSS. The important word is transitive: you may depend on library A, which depends on B, which has the vulnerability; the lockfile is what tells the scanner B is present. Tools include npm audit, pip-audit, OSV-Scanner, Trivy, Grype, Snyk and Dependabot alerts. Scanning is half of the job; the other half is updating. Bots like Dependabot and Renovate open pull requests that bump versions, and a good test suite is what makes merging them safe. SCA also helps with licence compliance.

Auditing dependencies from the command line

Typical commands. Each exits non-zero when it finds vulnerabilities (at or above the severity threshold, where one is given), so they can gate a CI job.

# Node.js: fail on high or critical advisories
npm audit --audit-level=high

# Python: audit the packages listed in a requirements file
pip-audit -r requirements.txt

# Any ecosystem, using lockfiles found in the repository
osv-scanner scan source -r .
trivy fs --scanners vuln --severity HIGH,CRITICAL --exit-code 1 .

Checking the ingredients

A restaurant can cook perfectly and still make people ill if a supplier's spice batch was contaminated. A food-safety recall list is the vulnerability database; checking every ingredient's batch number against it is SCA.

Lockfiles are security files

Commit your lockfile. Without it, every build may resolve different transitive versions, scans become meaningless and a malicious new release can slip in unnoticed.

Quick check: Your app depends on library A, which depends on vulnerable library B. What is B called?

• A dev dependency
• A transitive dependency
• A peer review
• A sink