DEPENDENCY SCANNING

Dependency Scanning

CodeScan automatically detects dependency manifest files in your upload and checks every pinned package against the OSV (Open Source Vulnerabilities) database — the same database that powers GitHub Dependabot and Google's vulnerability tracking. It also queries each package registry to flag packages that are behind their latest release.

npm

package.json · package-lock.json · yarn.lock

PyPI

requirements.txt · Pipfile · pyproject.toml

Maven

pom.xml · build.gradle · build.gradle.kts

RubyGems

Gemfile.lock

crates.io

Cargo.toml · Cargo.lock

go.mod

Packagist

composer.json · composer.lock

NuGet

*.csproj · packages.config

Hex

mix.exs

How it works

When you upload files (or drag a ZIP), CodeScan automatically separates manifest files from source files. Manifests are sent to the dependency scanner in parallel with the AI pipeline — you get both results in the same scan session.

Parse

Each manifest is parsed to extract package name + pinned version. Package-lock and lock files are preferred over loose version ranges.

OSV query

Packages are batched and sent to the OSV API (up to 500 per request). OSV returns all known CVEs, GHSA advisories, and severity scores for each match.

Registry check

CodeScan queries the native registry for each ecosystem (npm, PyPI, RubyGems, crates.io, NuGet, Maven, Go proxy) to find the current latest release.

Report

Vulnerable packages are sorted by severity. Outdated-but-safe packages are listed separately. Fix versions from OSV advisories are shown inline.

Web — uploading manifests

Include a manifest alongside source files when uploading to the scanner. The easiest way is to upload a ZIP of your project root — CodeScan will find and scan all supported manifests automatically.

# Create a ZIP with your source and manifests
zip -r project.zip src/ package.json requirements.txt
# Then drag the ZIP onto the CodeScan upload area

Manifests detected in your upload appear in the Dependencies tab (next to Code Findings). If any vulnerable packages are found, the tab switches to it automatically.

CLI usage

The CLI detects manifests by filename and routes them to the dependency scanner automatically. No extra flags needed.

# Scan a directory — manifests are picked up automatically
codescan scan --dir ./

# Scan a specific manifest
codescan scan package.json

# Scan manifest + source files together
codescan scan --dir ./src package.json requirements.txt

# Show all vulnerable packages (not just top 3)
codescan scan --dir ./ --verbose

CLI output example

Scanning 2 manifest file(s) for dependency vulnerabilities...

✖ VULN  package.json — 3/142 packages vulnerable
       CRITICAL  lodash@4.17.19        → fix: 4.17.21
       HIGH      axios@0.21.0          → fix: 0.21.2
       MEDIUM    node-fetch@2.6.0      → fix: 2.6.7

✔ CLEAN requirements.txt — 18 packages checked

──────────────────────────────────────────────────────────
DEPENDENCY SCAN SUMMARY
──────────────────────────────────────────────────────────
  CRITICAL : 1
  HIGH     : 1
  Vulnerable packages : 3

Understanding results

Field	Description
Severity	CRITICAL / HIGH / MEDIUM / LOW — mapped from CVSS v3 score or database_specific field in the OSV advisory
CVSS score	Base score from the OSV advisory (v3.1 preferred, v3.0 fallback)
CVE IDs	Linked CVE identifiers extracted from OSV aliases
fix: X.Y.Z	The earliest version that resolves the vulnerability according to the OSV advisory
latest: X.Y.Z	The current latest version from the package registry — shown on vulnerable packages that are also behind the latest release
Outdated	Packages where the installed version differs from the registry latest, but no CVEs are known — listed in the collapsible section below vulnerable packages
dev	Package is in devDependencies / dev-only — lower deployment risk

Supported ecosystems & registries

Ecosystem	Manifest files	Latest-version source
npm	package.json, package-lock.json, yarn.lock	registry.npmjs.org
PyPI	requirements.txt, Pipfile, pyproject.toml	pypi.org/pypi
Maven	pom.xml, build.gradle, build.gradle.kts	search.maven.org
RubyGems	Gemfile.lock	rubygems.org/api
crates.io	Cargo.toml, Cargo.lock	crates.io/api
Go	go.mod	proxy.golang.org
Packagist	composer.json, composer.lock	OSV only
NuGet	*.csproj, packages.config	api.nuget.org
Hex	mix.exs	OSV only

API endpoint

The dependency scanner is available as a standalone REST endpoint — useful for CI pipelines or custom integrations.

POST https://codesscan.com/api/scan/deps
Content-Type: application/json

{
  "content": "<raw manifest file content>",
  "filename": "package.json"
}

# Response
{
  "manifest":          "package.json",
  "ecosystem":         "npm",
  "totalPackages":     142,
  "vulnerablePackages": 3,
  "criticalCount":     1,
  "highCount":         1,
  "mediumCount":       1,
  "lowCount":          0,
  "outdatedCount":     12,
  "packages": [
    {
      "name":          "lodash",
      "version":       "4.17.19",
      "ecosystem":     "npm",
      "isDev":         false,
      "latestVersion": "4.17.21",
      "isOutdated":    true,
      "vulns": [
        {
          "osvId":         "GHSA-35jh-r3h4-6jhm",
          "title":         "Prototype Pollution",
          "severity":      "CRITICAL",
          "cvssScore":     9.8,
          "cveIds":        ["CVE-2021-23337"],
          "fixedVersions": ["4.17.21"],
          "url":           "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
        }
      ]
    }
  ],
  "outdated": [
    { "name": "chalk", "version": "4.1.0", "latestVersion": "5.3.0", "ecosystem": "npm", "isDev": false }
  ],
  "scanDuration": 1240
}