--- # === IDENTITY === id: software/security/dependency-vulnerability-scanning/2026 canonical_question: "How do I scan and manage dependency vulnerabilities?" aliases: - "dependency vulnerability scanning tools" - "SCA software composition analysis" - "npm audit pip-audit Snyk Trivy" - "find vulnerable dependencies in project" - "SBOM vulnerability detection" - "open source dependency security" - "CVE scanning for packages" - "supply chain security scanning" entity_type: software_reference domain: software > security > Dependency Vulnerability Scanning region: global jurisdiction: global temporal_scope: 2024-2026 # === VERIFICATION === last_verified: 2026-02-27 confidence: 0.93 version: 1.0 first_published: 2026-02-27 # === TEMPORAL VALIDITY === temporal_validity: status: stable last_breaking_change: "OWASP Dependency-Check 10.x requires NVD API key (2024); npm audit signatures validation added in npm 9 (2023); OSV-Scanner v2 guided remediation (2025)" next_review: 2026-08-26 change_sensitivity: medium # === CONSTRAINTS === constraints: - "NEVER ship to production without scanning dependencies for known CVEs -- at minimum run native audit commands (npm audit, pip-audit) in CI" - "Vulnerability databases lag behind disclosure -- zero-day dependencies require additional controls (lockfile pinning, SBOM monitoring)" - "CVSS score alone is insufficient for prioritization -- factor in reachability, exploit maturity, and whether the vulnerable code path is actually called" - "Transitive (indirect) dependencies are the primary attack surface -- tools MUST resolve the full dependency tree, not just direct dependencies" - "Automated fix PRs can introduce breaking changes -- always run full test suites before merging dependency upgrades" # === SKIP CONDITIONS === skip_this_unit_if: - condition: "Need to scan container images for OS-level vulnerabilities (not application dependencies)" use_instead: "software/devops/container-security-scanning/2026" - condition: "Need static application security testing (SAST) for your own code, not third-party libraries" use_instead: "software/security/static-analysis-sast/2026" - condition: "Need to manage software licenses in dependencies, not security vulnerabilities" use_instead: "software/legal/open-source-license-compliance/2026" # === AGENT HINTS === inputs_needed: - key: "ecosystem" question: "What language ecosystem are you using?" type: choice options: ["Node.js/npm", "Python/pip", "Java/Maven/Gradle", "Go", ".NET/NuGet", "Rust/Cargo", "Ruby/Bundler", "Multi-language"] - key: "environment" question: "Where do you want to run the scanning?" type: choice options: ["CI/CD pipeline", "Local development", "IDE", "Container images", "Production monitoring"] # === DISTRIBUTION === canonical_source: "https://knowledgelib.io/software/security/dependency-vulnerability-scanning/2026" suggested_citation: "Source: knowledgelib.io -- AI Knowledge Library (verified 2026-02-27)" # === RELATED UNITS === related_kos: depends_on: [] related_to: - id: "software/security/xss-prevention/2026" label: "XSS Prevention" - id: "software/security/secrets-management/2026" label: "Secrets Management" solves: [] alternative_to: [] often_confused_with: - id: "software/security/static-analysis-sast/2026" label: "Static Analysis (SAST)" - id: "software/devops/container-security-scanning/2026" label: "Container Security Scanning" # === SOURCES (7 authoritative sources) === # Types: official_docs, technical_blog, rfc_spec, academic_paper, community_resource, industry_report # Reliability: high, moderate_high, moderate, moderate_low, low, authoritative sources: - id: src1 title: "Auditing package dependencies for security vulnerabilities" author: npm url: https://docs.npmjs.com/auditing-package-dependencies-for-security-vulnerabilities/ type: official_docs published: 2025-01-15 reliability: authoritative - id: src2 title: "pip-audit: Audits Python environments and dependency trees for known vulnerabilities" author: PyPA url: https://github.com/pypa/pip-audit type: official_docs published: 2025-06-01 reliability: high - id: src3 title: "Open Source Security Management" author: Snyk url: https://snyk.io/product/open-source-security-management/ type: official_docs published: 2025-09-01 reliability: high - id: src4 title: "About Dependabot alerts" author: GitHub url: https://docs.github.com/code-security/dependabot/dependabot-alerts/about-dependabot-alerts type: official_docs published: 2025-10-01 reliability: authoritative - id: src5 title: "Trivy: Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories" author: Aqua Security url: https://github.com/aquasecurity/trivy type: official_docs published: 2025-12-01 reliability: high - id: src6 title: "OWASP Dependency-Check" author: OWASP Foundation url: https://owasp.org/www-project-dependency-check/ type: community_resource published: 2025-09-01 reliability: authoritative - id: src7 title: "OSV-Scanner: Vulnerability Scanner for Open Source" author: Google url: https://github.com/google/osv-scanner type: official_docs published: 2025-11-01 reliability: high --- # Dependency Vulnerability Scanning: Tools, CI Integration, and Best Practices ## TL;DR - **Bottom line**: Run ecosystem-native audit commands (`npm audit`, `pip-audit`) in every CI build, layer Dependabot or Snyk for automated fix PRs, and use Trivy or OSV-Scanner for multi-ecosystem or container scanning. - **Key tool/command**: `npm audit --audit-level=high` (Node.js), `pip-audit` (Python), `trivy fs .` (multi-language), `osv-scanner --lockfile=package-lock.json` (OSV database) - **Watch out for**: Ignoring transitive dependency vulnerabilities -- over 80% of exploitable CVEs come from indirect dependencies that you did not explicitly install. - **Works with**: All major ecosystems (npm, pip, Maven, Gradle, Go, Cargo, NuGet, Bundler). GitHub Dependabot, GitLab Dependency Scanning, and all major CI/CD platforms. ## Constraints - NEVER ship to production without scanning dependencies for known CVEs -- at minimum run native audit commands (npm audit, pip-audit) in CI - Vulnerability databases lag behind disclosure -- zero-day dependencies require additional controls (lockfile pinning, SBOM monitoring) - CVSS score alone is insufficient for prioritization -- factor in reachability, exploit maturity, and whether the vulnerable code path is actually called - Transitive (indirect) dependencies are the primary attack surface -- tools MUST resolve the full dependency tree, not just direct dependencies - Automated fix PRs can introduce breaking changes -- always run full test suites before merging dependency upgrades ## Quick Reference | # | Tool | Ecosystem | Free Tier | CI Integration | Auto-Fix PRs | Vuln Database | Key Differentiator | |---|---|---|---|---|---|---|---| | 1 | `npm audit` | Node.js | Built-in | `npm audit --audit-level=high` | `npm audit fix` | npm Advisory DB (GitHub) | Zero setup, ships with npm 6+ | | 2 | `pip-audit` | Python | Free/OSS | `pip-audit --strict --fix` | `--fix` flag | OSV (PyPA Advisory DB) | Official PyPA tool, resolves full tree | | 3 | Snyk Open Source | 13+ languages | Free (100 tests/mo) | CLI, GitHub App, IDE | Auto PR + Snyk patches | Snyk Intel DB (3x NVD) | Reachability analysis, priority score 0-1000 | | 4 | GitHub Dependabot | All GitHub ecosystems | Free on GitHub | Built-in to GitHub | Auto security PRs | GitHub Advisory DB (GHSA) | Zero config on GitHub repos, auto-triage rules | | 5 | Trivy | OS + 10+ app ecosystems | Free/OSS | `trivy fs .` or `trivy image` | No (detection only) | NVD, GHSA, OSV, vendor DBs | Scans containers, filesystems, IaC, SBOM, secrets | | 6 | OWASP Dependency-Check | Java, .NET, Ruby, Python | Free/OSS | Maven/Gradle plugin, CLI | No (detection only) | NVD (requires API key) | CPE-based matching, HTML/JSON reports, CRA compliance | | 7 | OSV-Scanner | All OSV ecosystems | Free/OSS | `osv-scanner --lockfile=` | Guided remediation (v2) | OSV.dev (38k+ advisories) | Google-backed, aggregates 16 ecosystem DBs | | 8 | `cargo audit` | Rust | Free/OSS | `cargo audit` in CI | `cargo audit fix` (nightly) | RustSec Advisory DB | Native Rust tooling, checks for unmaintained crates | | 9 | `govulncheck` | Go | Free/OSS | `govulncheck ./...` | No | Go Vulnerability DB | Official Go team tool, call-graph reachability analysis | | 10 | Grype | Multi-language | Free/OSS | `grype dir:.` or `grype image` | No (detection only) | NVD, GHSA, vendor feeds | Pairs with Syft SBOM generator, fast image scanning | ## Decision Tree > Full script: [decision-tree.txt](scripts/decision-tree.txt) (27 lines) ``` START: What is your primary ecosystem? |-- Node.js/npm? | |-- YES --> Use `npm audit` in CI + Dependabot for auto-fix PRs | +-- NO | |-- Python/pip? # ... (see full script) ``` ## Step-by-Step Guide ### 1. Run native ecosystem audit in CI Start with the built-in audit command for your ecosystem. These require zero additional setup and catch the majority of known vulnerabilities. [src1] **Node.js:** ```bash # Fail CI on high/critical vulnerabilities npm audit --audit-level=high # Production dependencies only (skip devDependencies) npm audit --omit=dev --audit-level=high ``` **Python:** ```bash # Install pip-audit pip install pip-audit # Audit current environment, fail on any finding pip-audit --strict # Audit from requirements file pip-audit -r requirements.txt --strict ``` **Verify**: `npm audit` exits with code 0 (clean) or non-zero (vulnerabilities found). `pip-audit --strict` exits non-zero on any vulnerability. ### 2. Enable GitHub Dependabot for automated fix PRs Dependabot monitors your dependency graph and creates pull requests to upgrade vulnerable packages. [src4] ```yaml # .github/dependabot.yml version: 2 updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" open-pull-requests-limit: 10 labels: - "dependencies" - "security" - package-ecosystem: "pip" directory: "/" schedule: interval: "weekly" open-pull-requests-limit: 10 ``` Enable security updates in repository Settings > Security > Dependabot > Enable Dependabot security updates. **Verify**: After enabling, check the Security tab > Dependabot alerts. Existing vulnerabilities should appear within minutes. ### 3. Add Trivy for multi-ecosystem and container scanning Trivy scans filesystems, container images, and IaC configs in a single tool. [src5] ```bash # Install Trivy # macOS brew install trivy # Linux curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin # Scan project filesystem for dependency vulnerabilities trivy fs --severity HIGH,CRITICAL . # Scan a container image trivy image --severity HIGH,CRITICAL myapp:latest # Generate SBOM in CycloneDX format trivy fs --format cyclonedx --output sbom.json . ``` **Verify**: `trivy fs .` outputs a table of vulnerabilities grouped by severity. Exit code 0 means no findings at the configured severity level. ### 4. Integrate scanning into GitHub Actions CI Create a workflow that runs vulnerability scanning on every push and pull request. [src1] [src5] ```yaml # .github/workflows/security-scan.yml name: Dependency Security Scan on: push: branches: [main] pull_request: branches: [main] schedule: - cron: '0 6 * * 1' # Weekly Monday 6am UTC jobs: npm-audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: '20' - run: npm ci - run: npm audit --audit-level=high trivy-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@0.28.0 with: scan-type: 'fs' scan-ref: '.' severity: 'HIGH,CRITICAL' exit-code: '1' format: 'table' osv-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run OSV-Scanner uses: google/osv-scanner-action/osv-scanner-action@v2 with: scan-args: |- --lockfile=package-lock.json --lockfile=requirements.txt ``` **Verify**: Push a commit -- the Actions tab should show three scanning jobs. A finding at HIGH or CRITICAL severity will fail the build. ### 5. Configure Snyk for reachability-aware scanning (optional) Snyk provides the deepest vulnerability intelligence with reachability analysis that tells you if your code actually calls the vulnerable function. [src3] ```bash # Install Snyk CLI npm install -g snyk # Authenticate snyk auth # Test project for vulnerabilities (Node.js) snyk test --severity-threshold=high # Monitor project continuously (creates dashboard entry) snyk monitor # Python project snyk test --file=requirements.txt --severity-threshold=high ``` **Verify**: `snyk test` outputs a vulnerability report with priority scores. Check the Snyk dashboard at app.snyk.io for monitored projects. ### 6. Generate and track SBOM for compliance Produce a Software Bill of Materials alongside vulnerability scanning for supply chain transparency. [src5] [src7] ```bash # Generate SBOM with Trivy (CycloneDX format) trivy fs --format cyclonedx --output sbom.cdx.json . # Generate SBOM with Syft (alternative) syft . -o cyclonedx-json > sbom.cdx.json # Scan SBOM for vulnerabilities with Grype grype sbom:sbom.cdx.json --fail-on high # Scan SBOM with OSV-Scanner osv-scanner --sbom=sbom.cdx.json ``` **Verify**: `sbom.cdx.json` contains a `components` array listing all dependencies with versions. `grype sbom:sbom.cdx.json` reports vulnerabilities found in SBOM components. ## Code Examples ### GitHub Actions: Complete Multi-Tool CI Pipeline > Full script: [github-actions-complete-multi-tool-ci-pipeline.yml](scripts/github-actions-complete-multi-tool-ci-pipeline.yml) (29 lines) ```yaml # .github/workflows/dependency-scan.yml # Input: Push/PR to main branch, or weekly schedule # Output: Build fails on HIGH/CRITICAL vulnerabilities name: Dependency Vulnerability Scan on: # ... (see full script) ``` ### Node.js: Programmatic npm audit with JSON parsing ```javascript // Input: Project with package-lock.json // Output: Parsed vulnerability report object const { execSync } = require('child_process'); function auditDependencies() { try { const output = execSync('npm audit --json --omit=dev', { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 // 10MB for large trees }); const report = JSON.parse(output); const { vulnerabilities } = report; const critical = Object.values(vulnerabilities) .filter(v => v.severity === 'critical'); const high = Object.values(vulnerabilities) .filter(v => v.severity === 'high'); console.log(`Critical: ${critical.length}, High: ${high.length}`); return { critical, high, total: report.metadata.vulnerabilities }; } catch (err) { // npm audit exits non-zero when vulnerabilities found const report = JSON.parse(err.stdout); return report.metadata.vulnerabilities; } } ``` ### Python: pip-audit in CI with custom output > Full script: [python-pip-audit-in-ci-with-custom-output.py](scripts/python-pip-audit-in-ci-with-custom-output.py) (25 lines) ```python # Input: Python environment with installed packages # Output: JSON vulnerability report import subprocess import json import sys # ... (see full script) ``` ### Bash: Trivy multi-target scan script ```bash #!/usr/bin/env bash # Input: Project root directory # Output: Vulnerability reports for filesystem + container images set -euo pipefail SEVERITY="HIGH,CRITICAL" EXIT_CODE=1 # Fail on findings echo "=== Scanning filesystem dependencies ===" trivy fs --severity "$SEVERITY" --exit-code "$EXIT_CODE" . echo "=== Generating SBOM ===" trivy fs --format cyclonedx --output sbom.cdx.json . echo "=== Scanning container image (if Dockerfile exists) ===" if [ -f Dockerfile ]; then IMAGE_TAG="$(basename "$(pwd)"):scan" docker build -t "$IMAGE_TAG" . trivy image --severity "$SEVERITY" --exit-code "$EXIT_CODE" "$IMAGE_TAG" fi echo "=== Scan complete ===" ``` ## Anti-Patterns ### Wrong: Only scanning direct dependencies ```json // BAD -- checking only top-level package.json, missing transitive vulnerabilities { "scripts": { "security": "npm ls --depth=0 | grep -i vulnerable" } } // This misses 80%+ of vulnerability surface area in transitive deps ``` ### Correct: Full dependency tree scanning ```json // GOOD -- npm audit resolves the full transitive tree automatically { "scripts": { "security": "npm audit --audit-level=high --omit=dev" } } ``` ### Wrong: Blanket ignoring all vulnerabilities to pass CI ```bash # BAD -- suppressing all audit output to avoid CI failures npm audit || true # or npm audit --audit-level=none ``` ### Correct: Targeted exceptions with documented reasoning ```bash # GOOD -- ignore specific CVEs with justification # pip-audit: skip CVE-2024-XXXXX (not reachable in our usage) pip-audit --ignore-vuln PYSEC-2024-XXXXX # npm: use .npmrc or overrides in package.json for false positives # Always document WHY the exception is safe ``` ### Wrong: Running scans only on main branch ```yaml # BAD -- vulnerabilities enter through PRs that were never scanned on: push: branches: [main] ``` ### Correct: Scanning on every PR and on schedule ```yaml # GOOD -- catch vulnerabilities before merge + detect new disclosures on: push: branches: [main] pull_request: schedule: - cron: '0 6 * * 1' # Weekly scan for new disclosures ``` ### Wrong: Using only CVSS score for prioritization ```bash # BAD -- a CVSS 9.8 in an unreachable transitive dep wastes time # while a CVSS 7.0 in a directly-called function is critical npm audit --audit-level=critical # Only critical CVSS ``` ### Correct: Factor in reachability and exploit maturity ```bash # GOOD -- Snyk provides priority scoring with reachability snyk test --severity-threshold=high # Output includes: "Reachable: Yes/No" and priority score 0-1000 # GOOD -- govulncheck only reports Go vulns in called functions govulncheck ./... ``` ## Common Pitfalls - **Stale lockfiles**: Running `npm audit` without `npm ci` first may scan an outdated dependency tree. Fix: Always run `npm ci` (or equivalent) before auditing in CI. [src1] - **NVD API key required for OWASP Dependency-Check**: Since 2024, NVD rate-limits anonymous requests. Scans will fail or be incomplete without a free API key. Fix: Register at nvd.nist.gov, set `NVD_API_KEY` environment variable. [src6] - **npm audit fix --force breaks applications**: The `--force` flag upgrades to major versions, potentially introducing breaking changes. Fix: Use `npm audit fix` (without force) first, manually review remaining issues. [src1] - **False positives in OWASP Dependency-Check**: CPE-based matching produces false positives, especially for common library names. Fix: Use `suppressions.xml` to document and suppress confirmed false positives. [src6] - **pip-audit misses packages installed outside pip**: System packages, conda packages, or manually compiled libraries are not scanned. Fix: Use `pip-audit -r requirements.txt` to audit the manifest, and `trivy fs .` for broader coverage. [src2] - **Dependabot PR fatigue**: High-traffic repos receive dozens of Dependabot PRs weekly, causing developers to ignore them. Fix: Configure auto-triage rules, group updates, and set `open-pull-requests-limit` in dependabot.yml. [src4] - **Container base image vulnerabilities conflated with app vulnerabilities**: Trivy reports OS package CVEs from the base image alongside application dependency CVEs. Fix: Use `trivy fs .` for app dependencies only, `trivy image` for full container analysis. [src5] - **Scanning without SBOM makes incident response slow**: When a new zero-day is announced, you need to know instantly which services use the affected package. Fix: Generate SBOM in CI and store as build artifact (`trivy fs --format cyclonedx`). [src7] ## Diagnostic Commands ```bash # Check npm for known vulnerabilities (Node.js) npm audit --json | jq '.metadata.vulnerabilities' # List all vulnerable Python packages pip-audit --format=json | jq '.[] | "\(.name)==\(.version): \(.id)"' # Scan filesystem with Trivy (all severities) trivy fs --severity HIGH,CRITICAL . # Scan container image for OS + app vulnerabilities trivy image --severity HIGH,CRITICAL myapp:latest # Scan with OSV-Scanner using lockfile osv-scanner --lockfile=package-lock.json # Check Go project for reachable vulnerabilities govulncheck ./... # Scan Rust project cargo audit # Generate SBOM in CycloneDX format trivy fs --format cyclonedx --output sbom.cdx.json . # Verify Dependabot is active on a GitHub repo gh api repos/{owner}/{repo}/vulnerability-alerts --jq '.state' # OWASP Dependency-Check CLI scan (Java) dependency-check --project myapp --scan ./lib --format HTML --nvdApiKey $NVD_API_KEY ``` ## Version History & Compatibility | Tool | Current Version | Status | Key Changes | |---|---|---|---| | npm audit | npm 10.x | Current | Signature verification, `--omit=dev` flag | | npm audit | npm 9.x | Supported | Added `npm audit signatures` validation | | npm audit | npm 6.x | Legacy | First built-in audit command | | pip-audit | 2.x | Current | OSV backend, `--fix` flag, multiple output formats | | Snyk CLI | 1.x | Current | Reachability analysis, priority scoring, Snyk Code integration | | Dependabot | v2 | Current | Auto-triage rules, grouped updates, multi-ecosystem | | Trivy | 0.58.x | Current | SBOM scanning, guided remediation, VEX support | | OWASP Dep-Check | 11.x | Current | Requires NVD API key, RetireJS analyzer, CRA alignment | | OWASP Dep-Check | 10.x | Maintained | NVD API key requirement introduced | | OSV-Scanner | 2.x | Current | Guided remediation, SBOM scanning, call-graph analysis | | OSV-Scanner | 1.x | Legacy | Basic lockfile scanning | | govulncheck | 1.x | Current | Call-graph reachability, Go standard library coverage | | cargo audit | 0.21.x | Current | Binary scanning, `cargo audit fix` (nightly) | ## When to Use / When Not to Use | Use When | Don't Use When | Use Instead | |---|---|---| | Any project with third-party dependencies | Project has zero external dependencies | No scanning needed | | CI/CD pipeline should block vulnerable builds | You only want informational alerts, not CI gating | Enable Dependabot alerts only (no CI integration) | | Need multi-ecosystem scanning in one tool | Only using one language ecosystem | Native audit tool (npm audit, pip-audit) is simpler | | Need reachability analysis to reduce noise | Budget is zero and noise tolerance is high | Free tools (npm audit, OSV-Scanner, Trivy) | | Compliance requires SBOM generation | Project is internal-only prototype with no compliance needs | Basic audit commands suffice | | Container images need full OS + app scanning | Only scanning application code (no containers) | Trivy fs or native audit tools | ## Important Caveats - No single vulnerability database is complete -- NVD, GHSA, and OSV each contain advisories the others miss. Using multiple tools or an aggregator (OSV-Scanner, Trivy) provides the best coverage. - Vulnerability scanners only find *known* CVEs -- they cannot detect malicious packages (typosquatting, dependency confusion) or zero-day exploits. Complement with lockfile integrity checks and supply chain security practices. - OWASP Dependency-Check relies on CPE matching against NVD, which produces higher false positive rates than tools with native package manager integration (npm audit, pip-audit, Snyk). - Snyk's proprietary vulnerability database is larger than NVD but the advanced features (reachability, priority scoring) require a paid plan for larger teams. - `npm audit fix --force` and Dependabot major version PRs can introduce breaking changes -- never auto-merge without a passing test suite. - Go's `govulncheck` and Snyk's reachability analysis are the only tools that verify whether your code actually calls the vulnerable function -- other tools report any presence of the vulnerable package version. ## Related Units - [XSS Prevention](/software/security/xss-prevention/2026) - [Secrets Management](/software/security/secrets-management/2026) - [Static Analysis (SAST)](/software/security/static-analysis-sast/2026) - [Container Security Scanning](/software/devops/container-security-scanning/2026)