Package: h2-depscan
Introduction██╗░░██╗██████╗░░██████╗███████╗░█████╗░██╗░░░██╗██████╗░██╗████████╗██╗░░░██╗
██║░░██║╚════██╗██╔════╝██╔════╝██╔══██╗██║░░░██║██╔══██╗██║╚══██╔══╝╚██╗░██╔╝
███████║░░███╔═╝╚█████╗░█████╗░░██║░░╚═╝██║░░░██║██████╔╝██║░░░██║░░░░╚████╔╝░
██╔══██║██╔══╝░░░╚═══██╗██╔══╝░░██║░░██╗██║░░░██║██╔══██╗██║░░░██║░░░░░╚██╔╝░░
██║░░██║███████╗██████╔╝███████╗╚█████╔╝╚██████╔╝██║░░██║██║░░░██║░░░░░░██║░░░
╚═╝░░╚═╝╚══════╝╚═════╝░╚══════╝░╚════╝░░╚═════╝░╚═╝░░╚═╝╚═╝░░░╚═╝░░░░░░╚═╝░░░H2-depscan is a completely open-source tool for auditing project dependencies against known vulnerabilities, advisories, and licensing restrictions. As an input, both local repositories and container images are supported. The tool is suited for continuous integration setups, as it has built-in build breaker logic.Vulnerability Data sourcesOSVNVDGitHubNPMUsageh2-depscan is an excellent tool for continuous integration (CI) and local development.Full list of options:usage:H2-depscan[-h][--no-banner][--cache][--sync][--suggest][--risk-audit][--private-nsPRIVATE_NS][-tPROJECT_TYPE][--bomBOM]-iSRC_DIR[-oREPORT_FILE][--no-error]-h,--helpshowthishelpmessageandexit--no-bannerDonotdisplaybanner--cacheCachevulnerabilityinformationinplatformspecificuser_data_dir--syncSynctoreceivethelatestvulnerabilitydata.Shouldhaveinvokedcachefirst.--suggestSuggestappropriatefixversionforeachidentifiedvulnerability.--risk-auditPerformpackageriskaudit(slowoperation).Npmonly.--private-nsPRIVATE_NSPrivatenamespacetousewhileperformingossriskaudit.Privatepackagesshouldnotbeavailableinpublicregistriesbydefault.Commaseparatedvaluesaccepted.-tPROJECT_TYPE,--typePROJECT_TYPEOverrideprojecttypeifauto-detectionisincorrect--bomBOMExamineusingthegivenSoftwareBill-of-Materials(SBoM)fileinCycloneDXformat.Usecdxgencommandtoproduceone.-iSRC_DIR,--srcSRC_DIRSourcedirectory-oREPORT_FILE,--report_fileREPORT_FILEReportfilenamewithdirectory--no-errorContinueonerrortopreventbuildfrombreakingScanning containers locally (Python version)Scanlatesttag of the containerh2security/h2-sastscan-slimh2-depscan--no-error--cache--srch2security/h2-sastscan-slim-ocontainertests/depscan-scan.json-tdockerIncludelicenseto the type to perform license audit.h2-depscan--no-error--cache--srch2security/h2-sastscan-slim-ocontainertests/depscan-scan.json-tdocker,licenseYou can also specify the image using the sha256 digesth2-depscan--no-error--srcdebian@sha256:1cfbc587ea5598545ac045ee776965a005b1f0c26d5daf5479b859b092697439-ocontainertests/depscan-redmine.json-tdockerYou can also save container images using docker or podman save command and pass the archive to depscan for scanning.dockersave-o/tmp/scanslim.tarh2security/h2-sastscan-slim:latest# podman save --format oci-archive -o /tmp/scanslim.tar h2security/h2-sastscan-slim:latestdepscan--no-error--src/tmp/scanslim.tar-oreports/depscan-scan.json-tdockerTo scan with default settingsdockerrun--rm-v$PWD:/apph2security/h2-depscanscan--src/app--report_file/app/reports/depscan.jsonTo scan with custom environment variables based configurationdockerrun--rm\-eVDB_HOME=/db\-eNVD_START_YEAR=2010\-eGITHUB_PAGE_COUNT=5\-eGITHUB_TOKEN=<token>\-v/tmp:/db\-v$PWD:/apph2security/h2-depscanscan--src/app--report_file/app/reports/depscan.jsonIn the above example,/tmpis mounted as/dbinto the container. This directory is then specified asVDB_HOMEfor caching the vulnerability information. This way the database can be cached and reused to improve performance.Supported languages and package formatdep-scan uses cdxgen command internally to create Software Bill-of-Materials (SBoM) file for the project. This is then used for performing the scans.The following projects and package-dependency format is supported by cdxgen.LanguagePackage formatnode.jspackage-lock.json, pnpm-lock.yaml, yarn.lock, rush.jsjavamaven (pom.xml [1]), gradle (build.gradle, .kts), scala (sbt)phpcomposer.lockpythonsetup.py, requirements.txt [2], Pipfile.lock, poetry.lock, bdist_wheel, .whlgobinary, go.mod, go.sum, Gopkg.lockrubyGemfile.lock, gemspecrustCargo.toml, Cargo.lock.Net.csproj, packages.config, project.assets.json, packages.lock.jsondocker / oci imageAll supported languages excluding OS packages