Dependency Auditing

Dependency Auditing

The Principle

EVERY DEPENDENCY IS AN ATTACK SURFACE.
Audit proactively, not after the breach.

Your app's security is only as strong as its weakest transitive dependency.

Tool Selection by Ecosystem

# Quick audit commands
npm audit --production          # Skip devDependencies
pip-audit -r requirements.txt   # Python
cargo audit                     # Rust
govulncheck ./...               # Go (analyzes actual call graph)
bundler-audit check --update    # Ruby (update advisory DB first)

CVE Triage Workflow

Step 1: Severity Assessment

Step 2: Exploitability Analysis

Not all CVEs are exploitable in your context. Ask:

1. Is the vulnerable code path reachable? (govulncheck does this automatically for Go)
2. Is the vulnerable feature used? (e.g., XML parsing CVE irrelevant if you only parse JSON)
3. Is it exposed to untrusted input? (internal-only service vs public API)
4. Are there existing mitigations? (WAF, input validation, sandboxing)

Step 3: Decision Matrix

Step 4: Response Options

SBOM Generation

Software Bill of Materials -- inventory of all components in your software.

Why SBOM Matters

• Required by US Executive Order 14028 for government contracts
• Enables rapid response when new CVEs drop (search your SBOM)
• License compliance auditing at scale

Tools and Formats

# Generate SBOM with syft
syft . -o cyclonedx-json > sbom.json
syft . -o spdx-json > sbom.spdx.json

# Scan container image
syft myimage:latest -o cyclonedx-json > sbom.json

# Scan SBOM for vulnerabilities
grype sbom:./sbom.json

License Compliance

License Categories

Scanning Tools

# npm
npx license-checker --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC"

# Python
pip install pip-licenses
pip-licenses --fail-on "GPL-2.0;GPL-3.0;AGPL-3.0"

# Multi-ecosystem
licensee detect .

Dependabot Configuration

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    open-pull-requests-limit: 10
    groups:
      dev-dependencies:
        dependency-type: "development"
        update-types: ["minor", "patch"]
      production-minor-patch:
        dependency-type: "production"
        update-types: ["minor", "patch"]
    # Major production upgrades get individual PRs
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]
    # Except security updates -- always allow
    security-updates:
      open-pull-requests-limit: 20

  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      all-minor-patch:
        update-types: ["minor", "patch"]

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Renovate Configuration

// renovate.json
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "schedule": ["before 7am on Monday"],
  "timezone": "America/New_York",
  "packageRules": [
    {
      "description": "Automerge non-major dev dependencies",
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true,
      "automergeType": "pr"
    },
    {
      "description": "Group non-major production patches",
      "matchDepTypes": ["dependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "production dependencies (non-major)"
    },
    {
      "description": "Pin GitHub Actions digests",
      "matchManagers": ["github-actions"],
      "pinDigests": true
    }
  ],
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"]
  }
}

CI Integration

Pipeline Placement

PR opened → lint → test → dependency audit → SBOM → build → deploy

GitHub Actions Example

- name: Audit dependencies
  run: npm audit --audit-level=critical
  # Fails on critical only; high/medium are warnings

- name: Check licenses
  run: npx license-checker --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC"

- name: Generate SBOM
  run: syft . -o cyclonedx-json > sbom.json

- name: Scan SBOM
  run: grype sbom:./sbom.json --fail-on critical

Severity Gating Strategy

Supply Chain Attack Patterns

Defensive Measures

# npm: disable install scripts by default
npm config set ignore-scripts true
# Explicitly allow for known packages
npx --allow-scripts=node-gyp npm install

# Use lock files (always commit them)
npm ci          # Install from lock file exactly (not npm install)
yarn install --frozen-lockfile
pip install --require-hashes -r requirements.txt

Pinning vs Floating Versions

Recommendation:

• Libraries: Use caret (^) for flexibility; consumers resolve versions
• Applications: Use exact pins or lock files for determinism
• CI/CD (GitHub Actions): Pin to SHA digests, not tags (tags can be moved)

# Bad: tag can be force-pushed
- uses: actions/checkout@v4

# Good: SHA is immutable
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

Gotchas

• npm audit reports vulnerabilities in devDependencies that never ship to production; use --production or --omit=dev to filter
• govulncheck is call-graph aware (only reports reachable vulns); other tools report all vulns in dependency tree regardless of reachability
• CVSS scores don't account for YOUR context; a CVSS 9.8 in a function you never call is lower risk than a CVSS 6.0 in code you expose to the internet
• Transitive dependencies are where most vulnerabilities hide; direct deps are usually well-maintained
• Lock files must be committed to git; without them, npm install on CI may resolve different versions than local
• pip-audit requires a lock file or --strict for reproducible results; bare requirements.txt with ranges is insufficient
• License scanning misses dual-licensed packages and license changes between versions; verify manually for critical dependencies
• Dependabot/Renovate automerge should only be enabled for dev dependencies with good test coverage

Cross-References

• security:security-analysis -- SAST scanning, vulnerability detection, threat modeling
• security:secrets-management -- preventing secrets from leaking into dependencies
• migration:dependency-upgrade -- strategies for upgrading major dependency versions