dependency-check / dependency-check/DependencyCheck

Use local node analysis insteed of npm audit

Open
#1,924 6 comments 4 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**
My problem is :
- In my CI, I can't finish a dependency check, because npm return http 503 error before the end of the check ...

**Describe the solution you'd like**
After some research, it seems the node audit results are directly available in json on GitHub .

So, I think it will be really better, to download this vulnerabilities in the local database, and search on it, instead of calling npm audit for each package .

Here you can get it : https://github.com/nodejs/security-advisories
In the ecosystem folder, separate by folder for each dependency, and by vulnerabilities, with semver version vulnerable, and bonus, A cvsscore !!!

Just some more information on this repository, it's a work in progress, because as I read they wants to create a GitHub pages website, to search a package ... But not important in our case .

Other things, this repository, is an extract of this repository : https://github.com/nodejs/security-wg , but better separated ( not all the json in same folder, but separated by package for example ), and As you can see in this issue : https://github.com/nodejs/security-wg/issues/494 they planned to migrate vulnerabilities to a separate repository.

So, if you plan to use this, this link can be helpful :
- github api to get last master commit : `https://api.github.com/repos/nodejs/security-advisories/commits/master`
- url to download the zip : `https://github.com/nodejs/security-advisories/archive/master.zip`

**Describe alternatives you've considered**
I've discuss about it ( a little ), with verdaccio-audit ( npm audit compatible api ), about using this local datas insteed of proxying audit request to npmjs, but this will not apply to users doesn't using verdaccio ( like users using nexus ) .

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.