dependency-scanning

# Dependency Scanning - Supply Chain Security Scans project dependencies for known vulnerabilities (CVEs) across multiple languages. **OWASP Coverage:** A03:2025 - Software Supply Chain Failures --- ## Supported Languages & Tools | Language | Primary Tool | Alternative | Manifest Files | |----------|-------------|-------------|----------------| | Python | uv | pip, poetry | pyproject.toml, uv.lock, requirements.txt, poetry.lock | | JavaScript | npm audit | yarn audit | package-lock.json, yarn.lock, pnpm-lock.yaml | | Go | govulncheck | go list | go.mod, go.sum | | Java | OWASP Dependency-Check | mvn versions | pom.xml, build.gradle | | Ruby | bundler-audit | - | Gemfile.lock | | PHP | composer audit | - | composer.lock | --- ## Prerequisites Check **ALWAYS run this check before scanning:** ```bash echo "=== Dependency Scanning Tools ===" # Python package managers command -v uv >/dev/null 2>&1 && echo "OK: uv $(uv --version 2>/dev/null | head -1)" || echo "NOT FOUND: uv" command -v poetry >/dev/null 2>&1 && echo "OK: poetry $(poetry --version 2>/dev/null)" || echo "NOT FOUND: poetry" command -v pip >/dev/null 2>&1 && echo "OK: pip $(pip --version 2>/dev/null | cut -d' ' -f2)" || echo "NOT FOUND: pip" # Python security scanners command -v pip-audit >/dev/null 2>&1 && echo "OK: pip-audit" || echo "MISSING: pip-audit" command -v safety >/dev/null 2>&1 && echo "OK: safety" || echo "OPTIONAL: safety" # JavaScript command -v npm >/dev/null 2>&1 && echo "OK: npm $(npm --v...