What Is Dependency Vulnerability Scanning?

Question

Accepted Answer

Dependency vulnerability scanning is the process of analyzing your project's third-party packages — both direct dependencies and their transitive sub-dependencies — against databases of known security vulnerabilities to identify components with published CVEs, security advisories, or other disclosed flaws. It is a core practice within Software Composition Analysis (SCA), focused specifically on the open-source and third-party code that makes up 70-90% of modern applications.

In practical terms, a scanner reads your project's manifest or lock file (package-lock.json, poetry.lock, go.sum, pom.xml, etc.), resolves the full dependency tree including transitive packages, and checks each package-version pair against vulnerability databases like OSV, NVD, and ecosystem-specific advisory feeds. The output is a list of known vulnerabilities affecting your dependency tree, ideally ranked by actual risk rather than theoretical severity.

The distinction between "theoretical severity" and "actual risk" is where most built-in ecosystem scanners fall short — and where the real value of modern scanning tools emerges.