Dependency security (SCA): pip-audit, npm audit, OSV-Scanner
You find known vulnerabilities in the open-source packages your projects use, work out whether you are really affected and automate updates in a controlled way.
Level 201 · 17 lessons · 15 practice labs
Lessons
Knowing your dependencies
- Direct and transitive dependencies
- Lock files: why pinning versions is a must
- Vulnerability databases: CVE, GHSA and OSV
- Short task: map a project’s dependency tree
Scanning
- pip-audit for Python
- npm audit for Node.js
- OSV-Scanner for several languages
- Reachability: is the vulnerable code really called
- Short task: scan three projects and compare the results
Fixing
- Upgrade strategy: patch, minor and major versions
- When no fix exists: interim measures
- Automated update pull requests with Renovate
- Licence checks: which licences cause trouble
- Short task: write a Renovate config that groups security updates
A lasting process
- Dependency policy: rules for adding new packages
- SCA in CI and a failure threshold
- Capstone: secure the dependencies of an outdated Node.js app
Practice labs
- Map a project’s dependency tree: Count direct and transitive dependencies and write out the deepest chain.
- Pin versions with a lock file: Generate the lock file for a project without one and verify with hashes that two installs bring the same versions.
- Compare one vulnerability across CVE, GHSA and OSV records: Compare the affected version range of one flaw in three sources, explain the difference and decide whether the project is affected.
- Scan a Python project with pip-audit: Run the scan and list the vulnerable packages with their fixed versions.
- Scan three projects and compare the results: Merge pip-audit, npm audit and OSV-Scanner output into one table and explain the finding where the tools disagree.
- Prove whether the vulnerable code is really called: Find the function the reported flaw affects, search the project for a call path and reprioritise by reachability.
- Upgrade to a patch version and run the tests: Move one package to the fixed patch version and show the tests pass.
- Apply an interim measure for a flaw with no fix: Disable the feature that triggers the flaw or constrain its input, and record the measure with an end date.
- Complete a major version upgrade including the breaking calls: Extract breaking APIs from the changelog, adapt the code, get tests passing and close a transitive flaw with a version override.
- Find the troublesome licences in the dependency list: Produce a licence report and flag the two packages that conflict with policy.
- Write a Renovate config that groups security updates: Write rules that gather security updates into one request and keep major versions separate, and verify with a dry run.
- Write a dependency policy and enforce it in CI with a threshold: Set the rules for adding new packages, add an SCA step that stops the pipeline on a high flaw and show a documented exception passes.
- Summarise the dependency state of an outdated Node.js app: Extract the number of outdated packages, the number of vulnerabilities and the age of the oldest package.
- Plan the upgrade order for the old app: Rank the flaws by severity and reachability and write the first five upgrades with their risk.
- Secure the dependencies of an outdated Node.js app: Close critical and high flaws, refresh the lock file, write justified exceptions for the rest and present before and after scan results.
About this course
You find known vulnerabilities in the open-source packages your projects use, work out whether you are really affected and automate updates in a controlled way.
What you will learn
- Knowing your dependencies
- Scanning
- Fixing
- A lasting process
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.