dependency-security-scanning

Dependency security scanning identifies vulnerabilities in your project's dependencies by running tools like pnpm audit or Snyk in CI/CD pipelines. It detects known CVEs, evaluates severity via CVSS scores, and generates audit reports to guide remediation before deployment.

Direct dependencies are packages listed in your package.json; transitive dependencies are packages those packages depend on. Vulnerability scanning distinguishes both types to help you prioritize fixes—direct dependencies often need parent package upgrades, while transitive ones may require version overrides.

Yes. pnpm audit detects known vulnerabilities and integrates into CI/CD workflows for automated supply chain security. Dependency security scanning orchestrates these checks, parses audit outputs, evaluates CVE/CVSS data, and generates standardized reports for validation and compliance workflows.

Dependency security scanning evaluates fix feasibility for detected vulnerabilities and generates templated dependency-audit-report-template.md files. These reports distinguish critical from high-risk issues and recommend actionable steps like parent package upgrades or dependency version constraints.

Dependency security scanning applies to Node.js and multi-language repositories using pnpm, npm, or yarn. It supports Software Composition Analysis across your tech stack, analyzing dependencies for CVEs, CVSS scoring, and license compliance regardless of primary language.

Dependency security scanning assesses fix feasibility and guides remediation strategies when patches are unavailable. Options include accepting risk with documented justification, implementing compensating controls, or replacing the vulnerable dependency with a maintained alternative.