sec-scan-dependencies

Run the ecosystem-appropriate scanner: npm audit for Node.js, pip-audit or safety for Python, and trivy or osv-scanner for containers and multi-language projects. Cross-reference results against NVD, GitHub Advisory, and OSV to confirm findings.

Parse the full dependency tree from your lock file rather than only direct dependencies. Tools like pip-audit and npm audit resolve transitive paths automatically, showing chains such as your-app to requests to urllib3 so you know which parent package to upgrade.

Use npm audit for Node.js projects and pip-audit or safety for Python. Use trivy or osv-scanner when scanning containers, multiple languages, or when you need broader OSV database coverage beyond a single package manager.

Create a workflow that runs on pushes to main and pull requests, scanning all supported package managers. Configure it to fail on CRITICAL and HIGH findings, allow MEDIUM with a linked issue, and schedule weekly scans with automated fix PRs.

A flagged CVE may not be reachable from your code, or the vulnerable function may never be invoked. Reduce noise by checking reachability, consulting EPSS exploit probability scores, and cross-referencing multiple vulnerability databases before acting.

Do not treat unfixable findings as urgent blockers. Evaluate actual exploitability and business impact, consider migrating to an alternative package, and document the accepted risk with a plan to revisit when a patched version ships.