dependency-triage

Scanning package manifests and lockfiles for CVEs and outdated dependencies involves reading the lockfile to identify package versions and checking them against vulnerability databases. This process provides risk classification and actionable recommendations for updates.

Classifying dependency update risks involves grouping package updates by risk level, such as patch, minor, or major. This groups updates by risk level, providing clear actions for each package like applying patches or escalating for human review.

Prioritizing outdated packages for software security requires finding known CVEs associated with the packages and grouping updates by risk level. This provides actionable recommendations, indicating which packages need immediate patches and which need human review.

Yes, performing dependency risk assessment requires access to package manifests and lockfiles. The process automates scanning these files to identify outdated packages and known CVEs, which is necessary to generate accurate risk classifications.

CVE scanning for software dependencies works by identifying known CVEs associated with the packages listed in the lockfile. It associates the identified package versions with known vulnerabilities to determine the software security risk level.

Escalating a package update for human review is recommended when the risk classification indicates a major or minor update rather than a simple patch. The risk classification process provides clear actions for each package, directing complex updates for human review.