Skip to main content

Find and fix vulnerable npm dependencies

org.openrewrite.nodejs.DependencyVulnerabilityCheck

This software composition analysis (SCA) tool detects and upgrades dependencies with publicly disclosed vulnerabilities. This recipe both generates a report of vulnerable dependencies and upgrades to newer versions with fixes. This recipe only upgrades to the latest patch version. If a minor or major upgrade is required to reach the fixed version, this recipe will not make any changes. Vulnerability information comes from the GitHub Security Advisory Database, which aggregates vulnerability data from several public databases, including the National Vulnerability Database maintained by the United States government. Dependencies following Semantic Versioning will see their patch version updated where applicable.

Recipe source​

This recipe is only available to users of Moderne.

This recipe is available under the Moderne Proprietary License.

Options​

TypeNameDescriptionExample
BooleanaddMarkersOptional. Report each vulnerability as search result markers. When enabled you can see which dependencies are bringing in vulnerable transitives in the diff view. By default these markers are omitted, making it easier to see version upgrades within the diff.

Example​

Parameters​
ParameterValue
addMarkersnull
Before​
{
  "name": "example",
  "version": "1.0.0",
  "dependencies": {
    "dojo": "^1.10.0"
  }
}
After​
{
  "name": "example",
  "version": "1.0.0",
  "dependencies": {
    "dojo": "^1.10.10"
  }
}
Unchanged​
{
  "name": "example",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "example",
      "version": "1.0.0",
      "dependencies": {
        "dojo": "^1.10.0"
      }
    },
    "node_modules/dojo": {
      "version": "1.10.5",
      "resolved": "https://something",
      "integrity": "c29tZXRoaW5n",
      "engines": {
        "node": ">=18"
      }
    }
  }
}

Usage​

This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI:

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell
mod run . --recipe DependencyVulnerabilityCheck

If the recipe is not available locally, then you can install it using:

mod config recipes jar install org.openrewrite.recipe:rewrite-nodejs:0.23.0

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Vulnerability report​

org.openrewrite.nodejs.table.VulnerabilityReport

A vulnerability report that includes detailed information about the affected artifact and the corresponding CVEs.

Column NameDescription
CVEThe CVE number.
Package nameThe package name.
VersionThe resolved version.
Fixed in versionThe minimum version that is no longer vulnerable.
Last affected versionThe last version which is vulnerable.
Fixable with version update onlyWhether the vulnerability is likely to be fixed by increasing the dependency version only, with no code modifications required. This is a heuristic which assumes that the dependency is accurately versioned according to semver.
SummaryThe summary of the CVE.
Base scoreThe calculated base score.
DepthZero for direct dependencies.
CWEsCommon Weakness Enumeration (CWE) identifiers; semicolon separated.