Hands-On Security in DevOps

Dependency check

Known vulnerabilities in third-party components or dependencies are considered to be parts of the OWASP Top 10 List of Using Components with Known Vulnerabilities. These known vulnerable components should be identified at an early development stage. It is also suggested that you perform the vulnerability scanning of the dependency components not only in the development stage but also in the production stage on a regular basis.

The following tools will help you scan for vulnerable components:

Tool	Supported languages
OWASP Dependency Check	The OWASP Dependency Check scans for dependency vulnerabilities in Java, Ruby, PHP, JavaScript, Python, and .NET.
Retire.JS	Retire.JS scans for vulnerable JavaScript ...