dependency-check / dependency-check/DependencyCheck
Implement Rust dependency check via Cargo.lock file
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
This feature request is not related to a problem.
**Describe the solution you'd like**
Rusts package manager cargo includes a audit binary that fetches known vulnerabilities of used packages/crates from the crates.io vulnerability repo: [https://github.com/rustsec/rustsec](url).
An example output from `cargo audit` looks like this:
```
Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
Loaded 748 security advisories (from /home/user/.cargo/advisory-db)
Updating crates.io index
Scanning Cargo.lock for vulnerabilities (176 crate dependencies)
Crate: paste
Version: 1.0.15
Warning: unmaintained
Title: paste - no longer maintained
Date: 2024-10-07
ID: RUSTSEC-2024-0436
URL: https://rustsec.org/advisories/RUSTSEC-2024-0436
Dependency tree:
paste 1.0.15
├── tokenizers 0.21.1
│ └── solution 0.1.0
└── macro_rules_attribute 0.2.0
└── tokenizers 0.21.1
warning: 1 allowed warning found
```
Since all used dependencies (and sub dependencies) are listed in Cargo.lock, if would be useful to have DependencyCheck also report the results for known vulnerabilities in rust projects.
**Describe alternatives you've considered**
DependencyCheck is our goto solution for tracking our used dependencies. I have not checked any alternatives, since we would like to use DependencyCheck for rust based projects.
**Additional context**
I'd be very open and inclined to develop this feature myself if I am given some pointers on how you'd like to have this feature integrated.
The easiest way of course would be to have cargo (audit) as an optional runtime dependency which would be enabled as an opt in feature. I'm not sure if you are open to this solution.
Contributor guide
Assessment
This issue has not been assessed yet.