Package: dependency-check
Code:https://github.com/jhermann/dependency-check-py#readmeDocs:https://github.com/jeremylong/dependencycheck#readmeCI:https://travis-ci.org/jhermann/dependency-check-pyIssues:https://github.com/jhermann/dependency-check-py/issuesOverviewdependency-checkscans application dependencies and checks whether they contain any published vulnerabilities
(based on the NISTNVD).
It runs in the JVM, so you need some form ofjavaavailable in yourPATH.
The script should work on Linux, Mac OSX and Windows, but right now is only tested on Linux.UsageAfter installation, you’ll have thedependency-checkcommand available that, on first use,
will automatically download and install the OWASP release archive once for all projects.
It’ll then redirect any calls to that installation, meaning the downloaded NVD data is shared
amongst projects.dependency-check --disableAssembly -s . -o build --project "$(python ./setup.py --name)" \
    --exclude ".git/**" --exclude ".venv/**" --exclude "**/__pycache__/**" --exclude ".tox/**" \
    && xdg-open build/dependency-check-report.htmlPlease see theDependencyCheck sitefor more configuration and usage details.To install from PyPI, adddependency-checkto yourdev-requirements.txtor a similar file. For more installation options, see the “Installation” section below.CustomizationUsing environment variables, you can change the version and download location of the release archive,
and the directory for the local installation.VariableDefaultDEPENDENCY_CHECK_VERSION6.2.2DEPENDENCY_CHECK_URLhttps://github.com/jeremylong/DependencyCheck/releases/download/v{version}/dependency-check-{version}-release.zipDEPENDENCY_CHECK_HOME~/.local/dependency-checkDEPENDENCY_CHECK_NVD_URLUse NIST NVD URLsTo update to a new version of the OWASP software,
delete~/.local/dependency-check/bin/,
setDEPENDENCY_CHECK_VERSIONto the new version number,
and calldependency-check.The variableDEPENDENCY_CHECK_NVD_URLcan be used to point to a local copy of the various NVD feeds,
in a flat hierarchy with compressed JSON files.exportDEPENDENCY_CHECK_NVD_URL='https://repo.local/nvd/nvdcve-1.1-%d.json.gz'If you set this, the options--cveUrlBaseand--cveUrlModifiedwill be added to each call.
Note that the%drepresenting the year is replaced bymodifiedfor the latter.Remove the~/.local/dependency-check/data/directory to force a full data reload.InstallationTo just get thedependency-checkCLI tool installed into your home,
independent of any project, callpython3-mpip install--userdependency-checkas usual,
seereleasesfor an overview of available versions.If you prefer anisolated and easily removable venv installation,
consider usingdephell jail install dependency-checkinstead.To get a bleeding-edge version from source, use these commands:repo="jhermann/dependency-check-py"
python3 -m pip install -r "https://raw.githubusercontent.com/$repo/master/requirements.txt"
python3 -m pip install "https://github.com/$repo/archive/master.zip#egg=dependency-check"As a developer, to create a working directory for this project, call these commands:git clone "https://github.com/jhermann/dependency-check-py.git"
cd "dependency-check-py"
command . .env --yes --develop
invoke build --docs test checkYou might also need to follow somesetup proceduresto make the necessary basic commands available onLinux,Mac OS X, andWindows.Other Python Security Toolsopenstack/bandit– Security linter designed to find common security issues in Python code, by static AST analysis.pyupio/safety– Safety checks your installed dependencies for known security vulnerabilities.pyupio/safety-db– A curated database of security vulnerabilities in Python packages.eliasgranderubio/dagda– Static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in Docker images, and runtime monitoring of containers for anomalous activities.anchore/anchore-engine– A service for inspection, analysis and certification of container images, provided as a ready-to-deploy Docker container image.vintasoftware/python-linters-and-code-analysis– Curated list of Python linters and code analysis tools.