What is dependency scanning?

A check that compares the packages your project installs, including the ones they pull in, against published vulnerability advisories, and flags any installed version with a known fix available.

How often should alerts be handled?

Read them weekly and patch high and critical ones within days. A scanner whose alerts nobody reads gives a green badge and no protection.

Why does my report list this step?

A website scan cannot see this from outside. The step appears when you answer No to the question a scan asks about dependency scanning, and it leaves your plan once you answer Yes on a later scan.

Security Small

Set up dependency vulnerability scanning

Find out whether your site has this problem, and every other check, in one free scan.

Check your site free

Why it matters

Most breaches exploit known vulnerabilities in outdated dependencies; without automated scanning these sit unnoticed until someone exploits them.

How to fix

1 Enable Dependabot (GitHub) or Snyk on the repository.
2 Triage alerts weekly and patch high-severity issues promptly.

Fix it in your stack

Dependabot

Commit .github/dependabot.yml and turn on Dependabot alerts in the repository security settings.

version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule: { interval: weekly }

npm

As a CI step, so a pull request that adds a known high-severity vulnerability fails.

npm audit --audit-level=high

Common mistakes

Turning scanning on and never reading the alerts, so a backlog of unpatched advisories builds up behind a green badge.
Scanning only direct dependencies, when most advisories land in the packages those dependencies pull in.
Patching the lockfile on one branch while the deployed build still installs the old version.

How to verify

1 Open the repository's security or dependency alerts and confirm the scanner has run against the current lockfile.
2 Confirm a new pull request that adds a known-vulnerable version gets flagged.
3 Check that open high-severity alerts each have an owner or a fix in progress.

Questions

What is dependency scanning?: A check that compares the packages your project installs, including the ones they pull in, against published vulnerability advisories, and flags any installed version with a known fix available.
How often should alerts be handled?: Read them weekly and patch high and critical ones within days. A scanner whose alerts nobody reads gives a green badge and no protection.
Why does my report list this step?: A website scan cannot see this from outside. The step appears when you answer No to the question a scan asks about dependency scanning, and it leaves your plan once you answer Yes on a later scan.

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site