Dependency Scanner

CVE scanning across npm, pip, cargo, and go module dependency trees. Shows fix versions and generates the exact upgrade command per ecosystem.

Overview

Dependency Scanner scans your project's manifest and lock files for known vulnerabilities across npm, pip, cargo, and go modules. Results are shown as a dependency tree — vulnerable packages are flagged with their CVE ID, severity, and CVSS score, and each row can be expanded to show the transitive dependencies that pulled in the vulnerable package.

Try it with sample data first

Click Sample Results on the idle screen to explore the full UI — filters, dependency tree, fix commands — with mock vulnerability data before connecting a real Git repository.

Quick Start

Open Dependency Scanner from the Security sidebar.
Connect a Git provider (GitHub, GitLab, or Bitbucket) from Settings → Integrations, or click Sample Results to try it with mock data.
Enter the repository path and click Scan Now.
Review the dependency tree — filter by severity (Critical/High/Medium/Low) or ecosystem (npm/pip/cargo/go), and search by package name or CVE ID.
Click a row to see the exact fix command for your package manager (npm install pkg@fix, pip install "pkg>=fix", cargo update -p pkg --precise fix, go get pkg@vfix) in the terminal panel at the bottom, and copy it with one click.

Supported Ecosystems

Ecosystem	Manifest / lock file	Fix command generated
npm	`package-lock.json`	`npm install pkg@fixVersion --save`
pip	`requirements.txt`	`pip install "pkg>=fixVersion"`
cargo	`Cargo.lock`	`cargo update -p pkg --precise fixVersion`
go mod	`go.sum`	`go get pkg@vfixVersion`

Features

Transitive Dependency Tree

Expand any top-level package to see the nested dependencies that introduced a vulnerability, with per-row severity and CVE links to the NVD advisory.

Fix Command Terminal

Selecting a vulnerable package shows the exact upgrade command for its ecosystem in the terminal panel — copy it directly, no need to look up syntax.

Severity & Ecosystem Filters

Filter the results by CVSS severity band or package ecosystem, and search by package name or CVE ID.

Export Scan Results

Export the full scan (summary counts + every dependency and its vulnerability data) as JSON for sharing with your team or attaching to a ticket.

AI Assistant

Every screen in Security Hub now ships with an embedded AI Assistant, opened from the vertical AI Assistant tab on the right edge of the screen. The assistant reads the data currently on screen — the dependency scan results, or the single package you have selected — and answers questions, triages findings, or drafts a remediation plan directly in the chat panel.

Remediation Plan

Ask for the exact upgrade commands for the current findings, ordered by severity, ready to paste into your terminal.

No-Fix Packages

Identify packages with no fixed version available yet, so you know which ones need a workaround or version pin instead of an upgrade.

Sprint Checklist

Generate a remediation checklist for the current sprint, grouped by priority.

Save as Report & Add Knowledge

Any assistant reply can be saved as a report (available later from My Reports) via the Save as Report button under the last message. Click Add Knowledge in the input dock to attach files or notes from your Knowledge library so the assistant's answers can reference them.

FAQ

Does Dependency Scanner upload my source code?

No — only the repository's manifest/lock file contents are read to resolve package names and versions for the CVE lookup.

What if a package has no fixed version yet?

The row shows a dash instead of a fix version and no fix command is generated. Ask the AI Assistant for a workaround suggestion, or track the upstream issue until a patched release ships.