dependency_spy

Finds known vulnerabilities in your dependencies using yavdb as the source agregator of vulnerabilities.

Thanks to the amazing work done by libraries.io all the dependency manifest parsing is handled by bibliothecary and this means we have support for more than 20 package managers. Due to the limited sources of information we only have identified vulnerabilities for the ones listed in yavdb.

Disclaimer

This projects aims to provide an OSS alternative to identify known vulnerabilities for your dependencies. Although it makes a good effort in doing this, there is no assurance it is finding all the publicly available vulnerabilities. The maintainers take no responsibility for any harm caused by you relying on it. Use as a complement to other tools at your own risk.

Supported Package Managers

• NPM
• RubyGems
• Maven
• Nuget
• Packagist
• Pypi
• Go
• Cargo

Prerequisites

• Ruby 2.3 or newer

Installation

gem install dependency_spy

Usage

Examples

Check current directory project

depspy

TODO:

Tests

• Version Comparison

Features/Improvements

• Ignore vulnerabilities
• Improve output formatters
• Add more output options

Help

Commands:
  depspy check           # Check dependencies for known vulnerabilities
  depspy help [COMMAND]  # Describe available commands or one specific command
  depspy update          # Update known vulnerabilities database

Options:
  [--verbose], [--no-verbose]   
  d, [--vuln-db-path=VULN-DB-PATH]  # Default: <HOME>/.yavdb/yavdb

Development

After checking out the repo, run bin/setup to install dependencies. Then, run bundle exec rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

Contributing

Bug reports and pull requests are welcome on GitHub at https://github.com/rtfpessoa/dependency_spy. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.

Copyright

Copyright (c) 2017-present Rodrigo Fernandes. See LICENSE for details.