dependency-check / dependency-check/DependencyCheck

Consider using `pip freeze` when available

Open
#1,320 0 comments 6 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

If pip is installed on the system executing dependency-check one will likely be able to get better dependency information by calling `pip freeze`.

See https://github.com/jeremylong/DependencyCheck/issues/963#issuecomment-341969087

Contributor guide

Open the contributing guide

Research direction

Start by tracing how dependency-check gathers dependency information on the system executing it, then determine how pip availability and pip freeze output can be evaluated. Compare the proposed output with the existing dependency information; done means pip freeze is used when available and dependency results remain correct when it is not.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, python
Domain
security, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.