dependency-check / dependency-check/DependencyCheck
Detect outdated JavaScript libraries on a CDN
Open
enhancement
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
I'm auditing an application that uses an insecure version of JQuery. It loads this from a CDN (and uses SRI) - but Dependency Checker doesn't spot it.
**Describe the solution you'd like**
Dependency Checker identifies URLs on a list of common CDN domains and audits the external reference. This might cause some false positives (e.g. URLs within comments) but that would be ok for my purposes.
**Describe alternatives you've considered**
Burp Professional does detect these and I combine the results from Burp with Dependency Checker.
Contributor guide
Assessment
This issue has not been assessed yet.