Dependency Checker

Dependency Checker Skill

Overview

Software Composition Analysis (SCA) skill for identifying vulnerable dependencies, outdated packages, and license compliance issues across multiple package managers and languages.

Capabilities

1. Vulnerability Detection

• Known CVE detection in dependencies
• Transitive dependency analysis
• Severity assessment (Critical, High, Medium, Low)
• Exploit availability checking
• Patch availability verification

2. Dependency Management

• Outdated package identification
• Version conflict detection
• Breaking change alerts
• Update recommendations
• Lock file validation

3. License Compliance

• License compatibility checking
• GPL/LGPL contamination detection
• Commercial use restrictions
• Attribution requirements

4. Multi-Language Support

• JavaScript/TypeScript: npm, yarn, pnpm
• Python: pip, pipenv, poetry
• Java: Maven, Gradle
• Ruby: Bundler
• Go: go.mod
• .NET: NuGet
• PHP: Composer

Tools Integration

Snyk (Primary Tool)

Industry-leading SCA with AI-powered fix recommendations:

# Install Snyk
npm install -g snyk

# Authenticate
snyk auth

# Test for vulnerabilities
snyk test

# Monitor for new vulnerabilities
snyk monitor

# Fix vulnerabilities automatically
snyk fix

GitHub Dependabot

Automated dependency updates:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10

  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"

npm audit (Built-in)

# Check vulnerabilities
npm audit

# Show detailed report
npm audit --json > audit-report.json

# Fix automatically
npm audit fix

# Force fix (may introduce breaking changes)
npm audit fix --force

pip-audit (Python)

# Install
pip install pip-audit

# Scan dependencies
pip-audit

# Check specific requirements file
pip-audit -r requirements.txt

# Output JSON
pip-audit --format json > pip-audit.json

OWASP Dependency-Check

Multi-language dependency scanner:

# Download
wget https://github.com/jeremylong/DependencyCheck/releases/download/v8.0.0/dependency-check-8.0.0-release.zip

# Run scan
./dependency-check/bin/dependency-check.sh \
  --project "MyProject" \
  --scan ./src \
  --format ALL \
  --out ./reports

Integration Scripts

dependency_scan.sh

Automated multi-language dependency scanning:

#!/bin/bash
# Comprehensive dependency vulnerability scan

REPORT_DIR="security-reports/dependencies"
mkdir -p $REPORT_DIR

echo "=== Dependency Vulnerability Scan ==="

# 1. JavaScript/Node.js
if [ -f "package.json" ]; then
    echo "Scanning npm dependencies..."
    npm audit --json > $REPORT_DIR/npm-audit.json || true

    if command -v snyk &> /dev/null; then
        echo "Running Snyk scan..."
        snyk test --json > $REPORT_DIR/snyk-npm.json || true
    fi
fi

# 2. Python
if [ -f "requirements.txt" ] || [ -f "Pipfile" ]; then
    echo "Scanning Python dependencies..."
    pip-audit --format json > $REPORT_DIR/pip-audit.json || true

    if command -v snyk &> /dev/null; then
        echo "Running Snyk scan (Python)..."
        snyk test --file=requirements.txt --json > $REPORT_DIR/snyk-python.json || true
    fi
fi

# 3. Java
if [ -f "pom.xml" ]; then
    echo "Scanning Maven dependencies..."
    mvn dependency:tree > $REPORT_DIR/maven-tree.txt

    if command -v snyk &> /dev/null; then
        echo "Running Snyk scan (Java)..."
        snyk test --file=pom.xml --json > $REPORT_DIR/snyk-java.json || true
    fi
fi

# 4. OWASP Dependency Check
if command -v dependency-check &> /dev/null; then
    echo "Running OWASP Dependency Check..."
    dependency-check --project "MyProject" --scan . --format JSON \
      --out $REPORT_DIR/owasp-dependency-check.json
fi

echo "=== Scan Complete ==="
echo "Reports saved to: $REPORT_DIR/"

analyze_dependencies.py

Parse and prioritize vulnerabilities:

#!/usr/bin/env python3
import json
import sys
from collections import defaultdict

def analyze_npm_audit(json_file):
    """Analyze npm audit results"""
    try:
        with open(json_file) as f:
            data = json.load(f)
    except FileNotFoundError:
        print(f"⚠️  {json_file} not found")
        return {}

    vulnerabilities = data.get('vulnerabilities', {})

    findings = defaultdict(list)
    for pkg, vuln in vulnerabilities.items():
        severity = vuln.get('severity', 'unknown')
        findings[severity].append({
            'package': pkg,
            'severity': severity,
            'via': vuln.get('via', []),
            'range': vuln.get('range', ''),
            'fix_available': vuln.get('fixAvailable', False)
        })

    return findings

def analyze_snyk_results(json_file):
    """Analyze Snyk results"""
    try:
        with open(json_file) as f:
            data = json.load(f)
    except FileNotFoundError:
        print(f"⚠️  {json_file} not found")
        return {}

    vulnerabilities = data.get('vulnerabilities', [])

    findings = defaultdict(list)
    for vuln in vulnerabilities:
        severity = vuln.get('severity', 'unknown')
        findings[severity].append({
            'package': vuln.get('packageName'),
            'version': vuln.get('version'),
            'title': vuln.get('title'),
            'cve': vuln.get('identifiers', {}).get('CVE', []),
            'upgrade': vuln.get('upgradePath', []),
            'exploitMaturity': vuln.get('exploitMaturity', 'unknown')
        })

    return findings

def print_summary(npm_findings, snyk_findings):
    """Print combined summary"""
    print("=== Dependency Vulnerability Summary ===\n")

    all_findings = defaultdict(list)
    for severity in ['critical', 'high', 'medium', 'low']:
        all_findings[severity].extend(npm_findings.get(severity, []))
        all_findings[severity].extend(snyk_findings.get(severity, []))

    for severity in ['critical', 'high', 'medium', 'low']:
        findings = all_findings.get(severity, [])
        if findings:
            print(f"\n{severity.upper()}: {len(findings)} vulnerabilities")
            for finding in findings[:5]:  # Show first 5
                pkg = finding.get('package', 'Unknown')
                title = finding.get('title', 'No description')
                print(f"  • {pkg}: {title[:60]}...")

                if finding.get('fix_available'):
                    print(f"    ✓ Fix available")
                elif finding.get('upgrade'):
                    print(f"    ✓ Upgrade to: {finding['upgrade']}")

                if finding.get('cve'):
                    print(f"    🔗 CVE: {', '.join(finding['cve'][:2])}")

    # Calculate risk score
    score = (
        len(all_findings['critical']) * 10 +
        len(all_findings['high']) * 5 +
        len(all_findings['medium']) * 2 +
        len(all_findings['low']) * 1
    )
    print(f"\n=== Risk Score: {score} (Lower is better) ===")

    if score > 50:
        print("⚠️  HIGH RISK: Immediate action required")
    elif score > 20:
        print("⚠️  MEDIUM RISK: Address soon")
    else:
        print("✓ LOW RISK: Monitor and update regularly")

if __name__ == '__main__':
    npm_findings = analyze_npm_audit('security-reports/dependencies/npm-audit.json')
    snyk_findings = analyze_snyk_results('security-reports/dependencies/snyk-npm.json')
    print_summary(npm_findings, snyk_findings)

update_dependencies.sh

Automated dependency updates:

#!/bin/bash
# Update dependencies with testing

echo "=== Dependency Update Process ==="

# 1. Create backup branch
git checkout -b dependency-update-$(date +%Y%m%d)

# 2. Update npm dependencies
if [ -f "package.json" ]; then
    echo "Updating npm dependencies..."
    npm update
    npm audit fix

    # Run tests
    echo "Running tests..."
    npm test
    if [ $? -ne 0 ]; then
        echo "❌ Tests failed after npm update"
        git checkout main
        exit 1
    fi
fi

# 3. Update Python dependencies
if [ -f "requirements.txt" ]; then
    echo "Updating Python dependencies..."
    pip list --outdated --format=json | \
      jq -r '.[] | "\(.name)==\(.latest_version)"' > requirements.new.txt

    # Test with new versions
    pip install -r requirements.new.txt
    pytest
    if [ $? -eq 0 ]; then
        mv requirements.new.txt requirements.txt
    else
        echo "❌ Tests failed after pip update"
        rm requirements.new.txt
        git checkout main
        exit 1
    fi
fi

# 4. Commit changes
git add package.json package-lock.json requirements.txt
git commit -m "chore: update dependencies

- Updated npm packages
- Updated Python packages
- All tests passing"

echo "✓ Dependencies updated successfully"
echo "Review changes and merge: git checkout main && git merge dependency-update-$(date +%Y%m%d)"

Common Vulnerability Scenarios

1. Outdated Dependencies

{
  "name": "lodash",
  "version": "4.17.15",  // Vulnerable
  "fix": "4.17.21"       // Patched
}

Solution:

npm update lodash
# Or specify version
npm install lodash@4.17.21

2. Transitive Dependencies

app (your code)
  └─ express@4.16.0
      └─ qs@6.5.2 (VULNERABLE!)

Solution:

# Force resolution (npm)
npm install qs@6.11.0

# Or use overrides in package.json
{
  "overrides": {
    "qs": "6.11.0"
  }
}

3. No Fix Available

⚠️  Prototype Pollution in lodash < 4.17.21
    No patch available for dependency tree

Solution:

• Find alternative package
• Vendor and patch manually
• Accept risk (with documentation)
• Refactor to remove dependency

CI/CD Integration

GitHub Actions with Dependabot

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    labels:
      - "dependencies"
      - "security"
    reviewers:
      - "security-team"

  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"

Snyk Monitoring

name: Snyk Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

License Compliance

Check Licenses

# npm
npm install -g license-checker
license-checker --summary

# Python
pip install pip-licenses
pip-licenses --format=markdown > licenses.md

# Output incompatible licenses
license-checker --onlyAllow "MIT;Apache-2.0;BSD-3-Clause;ISC"

Common License Issues

• GPL: Requires source code disclosure
• AGPL: Triggers on network use
• LGPL: Linking requirements
• Commercial: May require purchase

Best Practices

1. Automated Scanning: Run on every commit
2. Dependabot/Renovate: Enable automatic PRs
3. Version Pinning: Use lock files (package-lock.json, Pipfile.lock)
4. Regular Updates: Weekly dependency updates
5. Test Thoroughly: Run full test suite after updates
6. Security Alerts: Configure notifications
7. License Review: Check before adding dependencies
8. Minimal Dependencies: Fewer deps = fewer vulnerabilities
9. Audit New Packages: Check reputation, maintenance
10. Document Exceptions: If can't upgrade, document why

Vulnerability Remediation Priority

Requirements

# Snyk
npm install -g snyk

# npm audit (built-in with npm)

# Python
pip install pip-audit safety

# OWASP Dependency Check
wget https://github.com/jeremylong/DependencyCheck/releases/latest

# License checker
npm install -g license-checker
pip install pip-licenses

Metrics to Track

• Known vulnerabilities: 0 critical, 0 high
• Average age of dependencies: < 6 months
• Update frequency: Weekly
• Time to patch: < 24h for critical
• Dependency count: Minimize
• License compliance: 100%
• False positive rate: < 5%