# Dependency Scanning (SCA) — DevSecOps

Source: https://www.skillbyai.com/en/devsecops/dso-sca

> Scan direct and transitive dependencies for known vulnerabilities and keep them updated automatically.

## Most of your code is someone else's

A typical application imports far more third-party code than it contains first-party code. **Software composition analysis (SCA)** reads your manifests and lockfiles (`package-lock.json`, `poetry.lock`, `go.sum`, `pom.xml`) and checks every resolved package version against vulnerability databases such as the GitHub Advisory Database, OSV and the NVD. Vulnerabilities are identified by **CVE** IDs and scored with **CVSS**. The important word is **transitive**: you may depend on library A, which depends on B, which has the vulnerability; the lockfile is what tells the scanner B is present. Tools include `npm audit`, `pip-audit`, OSV-Scanner, Trivy, Grype, Snyk and Dependabot alerts. Scanning is half of the job; the other half is **updating**. Bots like Dependabot and Renovate open pull requests that bump versions, and a good test suite is what makes merging them safe. SCA also helps with licence compliance.

## Auditing dependencies from the command line

Typical commands. Each exits non-zero when it finds vulnerabilities (at or above the severity threshold, where one is given), so they can gate a CI job.

```bash
# Node.js: fail on high or critical advisories
npm audit --audit-level=high

# Python: audit the packages listed in a requirements file
pip-audit -r requirements.txt

# Any ecosystem, using lockfiles found in the repository
osv-scanner scan source -r .
trivy fs --scanners vuln --severity HIGH,CRITICAL --exit-code 1 .
```

## Checking the ingredients

A restaurant can cook perfectly and still make people ill if a supplier's spice batch was contaminated. A food-safety recall list is the vulnerability database; checking every ingredient's batch number against it is SCA.

## Lockfiles are security files

Commit your lockfile. Without it, every build may resolve different transitive versions, scans become meaningless and a malicious new release can slip in unnoticed.

**Quiz:** Your app depends on library A, which depends on vulnerable library B. What is B called?

- [ ] A dev dependency
- [x] A transitive dependency
- [ ] A peer review
- [ ] A sink

*Answer:* A transitive dependency. Dependencies of your dependencies are transitive; lockfiles record them so SCA tools can check them.