dependency-vulnerability-scanning

To scan dependencies for CVE vulnerabilities, you must perform full transitive lockfile scanning to identify direct and indirect runtime risks, escalating any CRITICAL or HIGH CVEs unless runtime reachability is explicitly documented and justified.

Dependency supply-chain risk review is a structured evaluation of necessity, vulnerabilities, licenses, maintainer health, and lockfile integrity for package changes. You need it whenever adding, upgrading, downgrading, or vendoring dependencies across ecosystems like Node, Python, Java, and Go.

Yes, dependency vulnerability scanning includes SPDX license compatibility checks to verify alignment with your distribution obligations, specifically triggering legal reviews when GPL or AGPL-family licenses are detected in the proposed dependency tree.

To review install scripts and maintainer health, evaluate the package's security posture, maintainer activity levels, and scrutinize install or postinstall hooks for malicious behavior, ensuring unsafe supply-chain artifacts are blocked before entering your build.

The best way to enforce SBOM traceability during dependency upgrades is to require deterministic installs via frozen lockfiles and mandate SBOM regeneration, ensuring every transitive dependency change is tracked and documented before approval.

You need to justify necessity for every dependency addition to prevent unreviewed supply-chain changes from entering your runtime, requiring a written rationale detailing why the package is needed and which code paths will actually use it.