Dependency Scanning

依赖项扫描

Identify vulnerabilities in third-party dependencies and libraries.

识别第三方依赖项和库中的漏洞。

When to Use This Skill

何时使用该技能

Use this skill when:

Managing third-party dependencies
Implementing software composition analysis
Meeting compliance requirements
Securing the software supply chain
Automating vulnerability detection

在以下场景使用该技能：

管理第三方依赖项
实施软件成分分析
满足合规要求
保障软件供应链安全
自动化漏洞检测

Prerequisites

前置条件

Package manifest files (package.json, requirements.txt, etc.)
CI/CD pipeline access
Dependency scanning tool

包清单文件（package.json、requirements.txt等）
CI/CD流水线访问权限
依赖项扫描工具

Tool Comparison

工具对比

Tool	Type	Languages	Best For
Snyk	Commercial/Free	Many	Comprehensive SCA
Dependabot	Free (GitHub)	Many	Automated PRs
OWASP Dep-Check	OSS	Many	Free scanning
npm audit	Built-in	Node.js	Quick checks
pip-audit	OSS	Python	Python projects
Trivy	OSS	Many	Container deps

工具	类型	支持语言	最佳适用场景
Snyk	商业版/免费版	多种	全面的软件成分分析（SCA）
Dependabot	免费（GitHub）	多种	自动创建PR
OWASP Dep-Check	开源软件（OSS）	多种	免费扫描
npm audit	内置工具	Node.js	快速检查
pip-audit	开源软件（OSS）	Python	Python项目
Trivy	开源软件（OSS）	多种	容器依赖项扫描

Snyk

CLI Usage

CLI使用方法

bash

undefined

bash

undefined

Install

npm install -g snyk

Authenticate

snyk auth

Test project

snyk test

Monitor project (track over time)

snyk monitor

Test specific manifest

snyk test --file=package.json snyk test --file=requirements.txt

Output formats

snyk test --json > snyk-results.json snyk test --sarif > snyk-results.sarif

Fix vulnerabilities

snyk fix

Ignore vulnerability

snyk ignore --id=SNYK-JS-LODASH-567746 --expiry=2024-12-31 --reason="No exploit path"

undefined

snyk ignore --id=SNYK-JS-LODASH-567746 --expiry=2024-12-31 --reason="No exploit path"

undefined

CI Integration

CI集成

yaml

undefined

yaml

undefined

.github/workflows/snyk.yml

on: push: branches: [main] pull_request:

jobs: snyk: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

  - name: Run Snyk to check for vulnerabilities
    uses: snyk/actions/node@master
    env:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
    with:
      args: --severity-threshold=high

  - name: Upload results to GitHub
    uses: github/codeql-action/upload-sarif@v3
    with:
      sarif_file: snyk.sarif

undefined

on: push: branches: [main] pull_request:

jobs: snyk: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

  - name: Run Snyk to check for vulnerabilities
    uses: snyk/actions/node@master
    env:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
    with:
      args: --severity-threshold=high

  - name: Upload results to GitHub
    uses: github/codeql-action/upload-sarif@v3
    with:
      sarif_file: snyk.sarif

undefined

Policy File

策略文件

yaml

undefined

yaml

undefined

.snyk

version: v1.25.0 ignore: SNYK-JS-LODASH-567746: - '*': reason: No user input reaches this function expires: 2024-12-31 created: 2024-01-15

'snyk:lic:npm:gpl-3.0': - '*': reason: Internal use only

patch: {}

undefined

version: v1.25.0 ignore: SNYK-JS-LODASH-567746: - '*': reason: No user input reaches this function expires: 2024-12-31 created: 2024-01-15

'snyk:lic:npm:gpl-3.0': - '*': reason: Internal use only

patch: {}

undefined

GitHub Dependabot

Configuration

配置

yaml

undefined

yaml

undefined

.github/dependabot.yml

version: 2 updates:

JavaScript/Node.js

package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" day: "monday" open-pull-requests-limit: 10 reviewers:
- "security-team" labels:
- "dependencies"
- "security" ignore:
- dependency-name: "aws-sdk" update-types: ["version-update:semver-major"] groups: development-dependencies: dependency-type: "development" update-types:
  - "minor"
  - "patch"

Python

package-ecosystem: "pip" directory: "/" schedule: interval: "daily"

Docker

package-ecosystem: "docker" directory: "/" schedule: interval: "weekly"

GitHub Actions

package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly"

undefined

version: 2 updates:

JavaScript/Node.js

package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" day: "monday" open-pull-requests-limit: 10 reviewers:
- "security-team" labels:
- "dependencies"
- "security" ignore:
- dependency-name: "aws-sdk" update-types: ["version-update:semver-major"] groups: development-dependencies: dependency-type: "development" update-types:
  - "minor"
  - "patch"

Python

package-ecosystem: "pip" directory: "/" schedule: interval: "daily"

Docker

package-ecosystem: "docker" directory: "/" schedule: interval: "weekly"

GitHub Actions

package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly"

undefined

Security Alerts

安全警报

yaml

undefined

yaml

undefined

Automated security updates

Enable in repository Settings > Security > Dependabot

Dependabot will automatically:

- Create PRs for vulnerable dependencies

- Update to patched versions

- Provide CVE details in PR description

undefined

undefined

OWASP Dependency-Check

Installation

安装

bash

undefined

bash

undefined

Download

wget https://github.com/jeremylong/DependencyCheck/releases/download/v9.0.0/dependency-check-9.0.0-release.zip unzip dependency-check-9.0.0-release.zip

Or via Homebrew

brew install dependency-check

undefined

brew install dependency-check

undefined

Usage

使用方法

bash

undefined

bash

undefined

Scan project

dependency-check --project "MyProject"
--scan /path/to/project
--out /path/to/reports
--format HTML
--format JSON

With specific analyzers

dependency-check --project "MyProject"
--scan .
--enableExperimental
--disableRetireJS

CI configuration

dependency-check --project "MyProject"
--scan .
--format JSON
--failOnCVSS 7
--suppression suppression.xml

undefined

dependency-check --project "MyProject"
--scan .
--format JSON
--failOnCVSS 7
--suppression suppression.xml

undefined

Suppression File

抑制文件

xml

<!-- suppression.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
  <suppress>
    <notes>False positive - not using vulnerable function</notes>
    <packageUrl regex="true">^pkg:npm/lodash@.*$</packageUrl>
    <cve>CVE-2021-23337</cve>
  </suppress>
  
  <suppress until="2024-12-31">
    <notes>Risk accepted - mitigated by WAF</notes>
    <cpe>cpe:/a:apache:struts:2.5.0</cpe>
    <vulnerabilityName>CVE-2023-12345</vulnerabilityName>
  </suppress>
</suppressions>

xml

<!-- suppression.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
  <suppress>
    <notes>False positive - not using vulnerable function</notes>
    <packageUrl regex="true">^pkg:npm/lodash@.*$</packageUrl>
    <cve>CVE-2021-23337</cve>
  </suppress>
  
  <suppress until="2024-12-31">
    <notes>Risk accepted - mitigated by WAF</notes>
    <cpe>cpe:/a:apache:struts:2.5.0</cpe>
    <vulnerabilityName>CVE-2023-12345</vulnerabilityName>
  </suppress>
</suppressions>

Maven Integration

Maven集成

xml

<!-- pom.xml -->
<plugin>
  <groupId>org.owasp</groupId>
  <artifactId>dependency-check-maven</artifactId>
  <version>9.0.0</version>
  <configuration>
    <failBuildOnCVSS>7</failBuildOnCVSS>
    <suppressionFiles>
      <suppressionFile>suppression.xml</suppressionFile>
    </suppressionFiles>
  </configuration>
  <executions>
    <execution>
      <goals>
        <goal>check</goal>
      </goals>
    </execution>
  </executions>
</plugin>

xml

<!-- pom.xml -->
<plugin>
  <groupId>org.owasp</groupId>
  <artifactId>dependency-check-maven</artifactId>
  <version>9.0.0</version>
  <configuration>
    <failBuildOnCVSS>7</failBuildOnCVSS>
    <suppressionFiles>
      <suppressionFile>suppression.xml</suppressionFile>
    </suppressionFiles>
  </configuration>
  <executions>
    <execution>
      <goals>
        <goal>check</goal>
      </goals>
    </execution>
  </executions>
</plugin>

Language-Specific Tools

特定语言工具

Node.js (npm audit)

bash

undefined

bash

undefined

Run audit

npm audit

JSON output

npm audit --json

Fix automatically

npm audit fix

Fix with breaking changes

npm audit fix --force

Production only

npm audit --production

undefined

npm audit --production

undefined

Python (pip-audit)

bash

undefined

bash

undefined

Install

pip install pip-audit

Scan installed packages

pip-audit

Scan requirements file

pip-audit -r requirements.txt

Output formats

pip-audit --format json pip-audit --format cyclonedx-json

Fix vulnerabilities

pip-audit --fix

undefined

pip-audit --fix

undefined

Go (govulncheck)

bash

undefined

bash

undefined

Install

go install golang.org/x/vuln/cmd/govulncheck@latest

Scan project

govulncheck ./...

JSON output

govulncheck -json ./...

undefined

govulncheck -json ./...

undefined

Ruby (bundler-audit)

bash

undefined

bash

undefined

Install

gem install bundler-audit

Update database

bundle-audit update

Run audit

bundle-audit check

Output format

bundle-audit check --format json

undefined

bundle-audit check --format json

undefined

SBOM Generation

SBOM生成

CycloneDX

bash

undefined

bash

undefined

Node.js

npx @cyclonedx/cyclonedx-npm --output-file sbom.json

Python

pip install cyclonedx-bom cyclonedx-py -o sbom.json

Go

go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest cyclonedx-gomod mod -json > sbom.json

undefined

go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest cyclonedx-gomod mod -json > sbom.json

undefined

Syft

bash

undefined

bash

undefined

Install

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s

Generate SBOM

syft dir:/path/to/project -o cyclonedx-json > sbom.json syft dir:/path/to/project -o spdx-json > sbom-spdx.json

From container

syft myimage:latest -o cyclonedx-json > sbom.json

undefined

syft myimage:latest -o cyclonedx-json > sbom.json

undefined

CI/CD Pipeline

CI/CD流水线

yaml

undefined

yaml

undefined

Comprehensive dependency scanning

on: push: branches: [main] pull_request: schedule: - cron: '0 8 * * *'

jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

  - name: npm audit
    run: npm audit --audit-level=high

  - name: Snyk scan
    uses: snyk/actions/node@master
    env:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
    with:
      args: --severity-threshold=high
      
  - name: Generate SBOM
    run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json

  - name: Upload SBOM
    uses: actions/upload-artifact@v4
    with:
      name: sbom
      path: sbom.json

undefined

on: push: branches: [main] pull_request: schedule: - cron: '0 8 * * *'

jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

  - name: npm audit
    run: npm audit --audit-level=high

  - name: Snyk scan
    uses: snyk/actions/node@master
    env:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
    with:
      args: --severity-threshold=high
      
  - name: Generate SBOM
    run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json

  - name: Upload SBOM
    uses: actions/upload-artifact@v4
    with:
      name: sbom
      path: sbom.json

undefined

Common Issues

常见问题

Issue: Too Many Alerts

问题：警报数量过多

Problem: Overwhelmed by vulnerability count Solution: Prioritize by exploitability, filter by severity

问题描述：被大量漏洞警报淹没 解决方案：根据可利用性优先处理，按严重程度过滤

Issue: No Fix Available

问题：无可用修复方案

Problem: Vulnerable dependency has no patch Solution: Consider alternatives, implement compensating controls

问题描述：存在漏洞的依赖项暂无补丁 解决方案：考虑替代方案，实施补偿控制措施

Issue: Breaking Updates

问题：更新导致功能中断

Problem: Security fix breaks functionality Solution: Review changelogs, test thoroughly, use lockfiles

问题描述：安全修复破坏了现有功能 解决方案：查看变更日志，全面测试，使用锁定文件

Best Practices

最佳实践

Scan on every build
Use lockfiles for reproducibility
Set severity thresholds
Generate and track SBOMs
Document exceptions properly
Update dependencies regularly
Monitor for new vulnerabilities
Automate PR creation for updates

每次构建时都进行扫描
使用锁定文件确保可复现性
设置严重程度阈值
生成并跟踪SBOM
妥善记录例外情况
定期更新依赖项
监控新出现的漏洞
自动创建更新PR

dependency-scanning

Original

Translation

Dependency Scanning

依赖项扫描

When to Use This Skill

何时使用该技能

Prerequisites

前置条件

Tool Comparison

工具对比

Snyk

Snyk

CLI Usage

CLI使用方法

Install

Install

Authenticate

Authenticate

Test project

Test project

Monitor project (track over time)

Monitor project (track over time)

Test specific manifest

Test specific manifest

Output formats

Output formats

Fix vulnerabilities

Fix vulnerabilities

Ignore vulnerability

Ignore vulnerability

CI Integration

CI集成

.github/workflows/snyk.yml

.github/workflows/snyk.yml

Policy File

策略文件

.snyk

.snyk

GitHub Dependabot

GitHub Dependabot

Configuration

配置

.github/dependabot.yml

.github/dependabot.yml

JavaScript/Node.js

Python

Docker

GitHub Actions

JavaScript/Node.js

Python

Docker

GitHub Actions

Security Alerts

安全警报

Automated security updates

Automated security updates

Enable in repository Settings > Security > Dependabot

Enable in repository Settings > Security > Dependabot

Dependabot will automatically:

Dependabot will automatically:

- Create PRs for vulnerable dependencies

- Create PRs for vulnerable dependencies

- Update to patched versions

- Update to patched versions

- Provide CVE details in PR description

- Provide CVE details in PR description

OWASP Dependency-Check

OWASP Dependency-Check

Installation

安装

Download

Download

Or via Homebrew

Or via Homebrew

Usage

使用方法

Scan project

Scan project

With specific analyzers