Dependency Vulnerability Scanning

---




name: dependency-vulnerability-scanning
description: Implements dependency vulnerability scanning mechanisms to identify known security vulnerabilities in third-party libraries and dependencies.
license: MIT
compatibility: opencode
metadata:
  version: "1.0.0"
  domain: security
  triggers: dependency vulnerability scanning, library vulnerabilities, third-party security, vulnerability management, SCA
  role: implementation
  scope: implementation
  output-format: code
  archetypes: implementation, review
  anti_triggers: manual auditing, qualitative assessment
  response_profile:
    verbosity: medium
    directive_strength: high
    abstraction_level: operational




---





# Dependency Vulnerability Scanning

This tool implements scanning techniques to identify vulnerabilities in third-party libraries and dependencies, helping maintain secure applications by ensuring all libraries used are vetted for security risks. This ensures that the latest vulnerabilities are monitored and mitigated, allowing development teams to make informed decisions about using external libraries.

Dependency vulnerability scanning focuses on evaluating external libraries for known vulnerabilities in their versions, continuously tracking updates from security advisories and databases to prevent introducing issues into production environments.

## When to Use

- When incorporating third-party libraries into software projects to ensure risk management.
- For continuous dependency management in CI/CD pipelines to automate security controls.
- To ensure compliance with security standards and minimize the risk of vulnerabilities associated with outdated or insecure libraries.

## Core Workflow

1. **Identify Dependencies** — Catalog all external libraries used in the project along with their versions.
2. **Run Dependency Scanning Tool** — Execute the tool to discover known vulnerabilities by cross-referencing with a security database or advisory.
3. **Review Findings** — Prioritize vulnerabilities based on severity levels like critical, high, medium, or low.
4. **Update Dependencies** — Apply patches or updates to affected libraries, ensuring that compatibility is considered.
5. **Conduct Retests** — Re-scan to confirm that vulnerabilities have been addressed and ensure no new vulnerabilities are introduced.

## Implementation Patterns

### Pattern 1: Dependency Scan

This example shows how to scan for vulnerabilities in a requirements file:

```python
import subprocess
from typing import List

def scan_dependencies(requirements_file: str) -> List[dict]:
    """Scan the provided requirements file for vulnerabilities and return findings."""
    command = f'dependency-scanner --file {requirements_file}'
    result = subprocess.run(command, capture_output=True, text=True)
    findings = parse_results(result.stdout)  # Assume this function is defined elsewhere
    return findings
```

### Pattern 2: Advanced Configuration

A possible configuration file for the dependency scanner might look like this:

```yaml
scanner:
  database_url: http://vuln-db.local
  alert_level: critical
  include:
    - library1
    - library2
  exclude:
    - test-libraries
    - deprecated-libraries
```

### Pattern 3: Run and Report

Integration of the scanning tool with reporting:

```python
def run_and_report_scanner(requirements_file:str) -> None:
    findings = scan_dependencies(requirements_file)
    print(json.dumps(findings, indent=4))
```

## Constraints

### MUST DO
- Regularly update the dependency scanning tool's vulnerability database to ensure continuous monitoring of vulnerabilities.
- Automate scanning during build routines (CI/CD) to keep dependencies in check, preventing delays in builds.

### MUST NOT DO
- Allow the usage of vulnerable libraries without remediation efforts; all known vulnerabilities should be addressed promptly.
- Neglect scanning for libraries under active development, as even they can introduce vulnerabilities that need monitoring.