dependency-check / dependency-check/DependencyCheck
Use local node analysis insteed of npm audit
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
My problem is :
- In my CI, I can't finish a dependency check, because npm return http 503 error before the end of the check ...
**Describe the solution you'd like**
After some research, it seems the node audit results are directly available in json on GitHub .
So, I think it will be really better, to download this vulnerabilities in the local database, and search on it, instead of calling npm audit for each package .
Here you can get it : https://github.com/nodejs/security-advisories
In the ecosystem folder, separate by folder for each dependency, and by vulnerabilities, with semver version vulnerable, and bonus, A cvsscore !!!
Just some more information on this repository, it's a work in progress, because as I read they wants to create a GitHub pages website, to search a package ... But not important in our case .
Other things, this repository, is an extract of this repository : https://github.com/nodejs/security-wg , but better separated ( not all the json in same folder, but separated by package for example ), and As you can see in this issue : https://github.com/nodejs/security-wg/issues/494 they planned to migrate vulnerabilities to a separate repository.
So, if you plan to use this, this link can be helpful :
- github api to get last master commit : `https://api.github.com/repos/nodejs/security-advisories/commits/master`
- url to download the zip : `https://github.com/nodejs/security-advisories/archive/master.zip`
**Describe alternatives you've considered**
I've discuss about it ( a little ), with verdaccio-audit ( npm audit compatible api ), about using this local datas insteed of proxying audit request to npmjs, but this will not apply to users doesn't using verdaccio ( like users using nexus ) .
Contributor guide
Assessment
This issue has not been assessed yet.