dependency-check / dependency-check/DependencyCheck
Consider conda dependencies in Python analyzer
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
I work with projects based on Python dependencies in conda channels. In addition to that, I use conda-lock to manage transient dependencies. This provides me a framework that enables full reproducibility with conda-lock .lock files that provide a full reference of dependencies and their source urls. I am frustrated because DependencyCheck at the moment does not consider the conda ecosystem when looking dependencies up, and does not utilize conda-lock .lock files either.
As a consequence, when I use DependencyCheck in my Python projects, I get reports based on an approximate set of python dependencies. DependencyCheck only considers the pypi ecosystem for Python dependencies, but not all the python libraries that my projects depend on are found on pypi channels, some are only found in conda channels.
Also, the conda-lock .lock files are not considered by DependencyCheck, while they provide a precise set of python libraries dependencies and pointers to their sources.
**Describe the solution you'd like**
I would like the Python analyzers to scan conda-lock .lockfiles and extract evidence from them. The resulting CPE entries should have conda [Entry Type] when the evidence is extracted from conda-lock .lockfiles, so that vulnerabilities are better identified in the vulnerabilities databases that account for the conda ecosystem.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
Add any other context or screenshots about the feature request here.
Contributor guide
Assessment
This issue has not been assessed yet.