dependency-vulnerability-audit

To audit dependencies for known vulnerabilities in Go modules, this skill automates scanning using govulncheck to detect supply-chain risks and enforce version pinning within CI workflows.

Yes, you can scan Maven JVM projects for supply-chain risk in a CI pipeline by integrating OWASP Dependency-Check to automatically verify dependency provenance and identify compromised builds.

Dependency provenance verification validates the origin and integrity of packages to prevent compromised builds. You need it during continuous delivery workflows to ensure dependencies are securely sourced and pinned.

Yes, this vulnerability audit works with both govulncheck for Go modules and OWASP Dependency-Check for Maven JVM projects, enforcing a checklist-driven workflow to scan, pin versions, and verify provenance.

The best way to prevent risky transitive dependencies in continuous delivery is enforcing a checklist-driven workflow that automatically scans dependencies, pins versions, and verifies provenance across your ecosystems.