Dependency Scanning (SCA)

​

Overview

• What it Does: Dependency Scanning, also known as Software Composition Analysis (SCA), automatically identifies known security vulnerabilities in your project’s third-party dependencies and libraries. It scans dependency manifest files (like package.json, requirements.txt, pom.xml) and provides detailed vulnerability information including CVE identifiers, CVSS scores, and remediation guidance.
• Who it’s For: This feature is designed for security teams, developers, DevOps engineers, and anyone responsible for maintaining secure software applications. It’s particularly valuable for teams managing projects with numerous third-party dependencies who need to stay informed about security vulnerabilities that could impact their applications.

​

Key Features and Benefits

• Comprehensive Ecosystem Coverage: Scans dependencies across 25+ programming languages and ecosystems including Python, JavaScript/Node.js, Java, Go, Ruby, PHP, C#, Swift, and many more
• Authoritative Data Sources: Leverages multiple trusted vulnerability databases including:
  • GitHub Advisory Database (CC-BY 4.0)
  • PyPI Advisory Database (CC-BY 4.0)
  • Go Vulnerability Database (CC-BY 4.0)
  • Rust Advisory Database (CC0 1.0)
  • Global Security Database (CC0 1.0)
  • OSS-Fuzz (CC-BY 4.0)
  • Rocky Linux (BSD)
  • AlmaLinux (MIT)
  • Haskell Security Advisories (CC0 1.0)
  • RConsortium Advisory Database (Apache 2.0)
  • OpenSSF Malicious Packages (Apache 2.0)
  • Python Software Foundation Database (CC-BY 4.0)
  • Bitnami Vulnerability Database (Apache 2.0)
  • Ubuntu (GPL v3)
  • And many more authoritative sources
• Rich Vulnerability Intelligence: Provides detailed vulnerability information including:
  • CVE identifiers and alternative vulnerability IDs
  • CVSS scores and severity ratings (Critical, High, Medium, Low)
  • Affected package versions and available fixes
  • Detailed vulnerability descriptions and references
  • Publication dates and external links
• Smart Scanning Logic: Automatically detects when dependency files are present and optimizes scanning performance

​

Setup Instructions

​

Prerequisites

• Project must contain at least one supported dependency file
• Appropriate permissions to run security scans
• Access to the scanning service

​

Configuration Steps

1. Access Scanning Configuration: Navigate to your project’s security scanning settings
2. Enable SCA Scanning: Toggle the dependency scanning option to “enabled”
3. Verify Dependency Files: Ensure your project contains supported dependency files:
   Copy

   # Python
   requirements.txt, Pipfile, Pipfile.lock, pyproject.toml, poetry.lock
   
   # JavaScript/Node.js
   package.json, package-lock.json, yarn.lock, pnpm-lock.yaml
   
   # Java
   pom.xml, build.gradle, build.gradle.kts, gradle.lockfile
   
   # Go
   go.mod, go.sum
   
   # Ruby
   Gemfile, Gemfile.lock
   
   # PHP
   composer.json, composer.lock
   
   # C#
   *.csproj, packages.config
   
   # Swift
   Package.swift, Package.resolved
   

4. Configure Scan Scope: Choose whether to include dependency scanning in full or partial scans
5. Set Up Notifications: Configure how you want to be notified of new vulnerabilities

​

Usage Guide

​

Key Workflows

1. Automatic Detection: The system automatically identifies dependency files in your project directory
2. Comprehensive Scanning: Analyzes all supported dependency files and cross-references against vulnerability databases
3. Vulnerability Processing: Processes scan results and enriches with additional security intelligence
4. Issue Creation: Creates trackable security issues for each vulnerability found
5. Reporting: Generates comprehensive vulnerability reports with actionable remediation guidance

​

Supported Ecosystems

• AlmaLinux - Enterprise Linux packages
• Alpine - Alpine Linux packages
• Android - Android app dependencies
• Bitnami - Bitnami application packages
• crates.io - Rust packages
• Curl - cURL library vulnerabilities
• Debian GNU/Linux - Debian packages
• Git - Git repositories (including C/C++)
• GitHub Actions - GitHub Action workflows
• Go - Go modules and packages
• Haskell - Haskell packages
• Hex - Elixir packages
• Linux kernel - Linux kernel vulnerabilities
• Maven - Java Maven dependencies
• npm - Node.js packages
• NuGet - .NET packages
• OSS-Fuzz - Google’s continuous fuzzing service
• Packagist - PHP packages
• Pub - Dart packages
• PyPI - Python packages
• Python - Python language vulnerabilities
• R - R packages (CRAN and Bioconductor)
• Rocky Linux - Rocky Linux packages
• RubyGems - Ruby packages
• SwiftURL - Swift packages
• Ubuntu OS - Ubuntu packages

​

Multi-Ecosystem Project Example

Enterprise Application:
├── backend/
│   ├── requirements.txt        ✓ Python dependencies
│   ├── pom.xml                 ✓ Java dependencies
│   └── go.mod                  ✓ Go dependencies
├── frontend/
│   ├── package.json            ✓ Node.js dependencies
│   └── package-lock.json       ✓ Lock file
├── mobile/
│   └── Gemfile                 ✓ Ruby dependencies
└── infrastructure/
    └── docker-compose.yml      ✓ Container dependencies

​

Vulnerability Severity Breakdown

• Critical: Immediate action required, potential for complete system compromise
• High: Should be addressed promptly, significant security impact
• Medium: Should be addressed in regular maintenance cycles
• Low: Minor issues that can be addressed when convenient

​

Best Practices

• Regular Scanning: Enable automatic scanning to catch new vulnerabilities as they are disclosed
• Dependency Updates: Promptly update dependencies when fixes are available for identified vulnerabilities
• Severity Prioritization: Focus on addressing Critical and High severity vulnerabilities first
• Risk Assessment: Evaluate whether vulnerabilities actually affect your application’s attack surface
• Dependency Hygiene: Regularly review and remove unused dependencies to reduce attack surface
• Version Pinning: Use specific version numbers in dependency files for consistent scanning results
• Monitoring: Set up alerts for new vulnerabilities discovered in your dependencies
• Documentation: Maintain records of accepted risks and remediation decisions

​

Troubleshooting

​

Common Issues

• Solution: Verify that dependency files are in supported formats and contain valid package information
• Check: Ensure dependency files are not corrupted or contain syntax errors

• Solution: Check that all dependency files are included in the scan scope
• Check: Verify that dependency files are properly formatted and accessible

• Solution: Review vulnerability details to determine if they actually affect your application
• Check: Consider the specific usage patterns and attack vectors in your application

• Solution: This is normal for large projects with many dependencies
• Check: Consider using incremental scanning for changed files only