fix: reinstate the NodeAuditAnalyzer via use of npm audit via CLI

[chadlwilson]

Description of Change

This reinstates the NodeAuditAnalyzer by implementing the approach suggested at #8422 (comment) to replace the manual package-lock parsing with use of npm ls --json (inventory) and npm audit --json (analysis).

This has been largely done with guided use of Claude, alongside some tweaks and edits made by me, but still needs testing & validation of approach - and more careful review of the code. Initially raising a PR for transparency & feedback, and anyone who wants to help smoke test it, since the automated testing within ODC is probably somewhat limited.

I evaluated other approaches to avoid manual package-lock parsing and could not find any decent Java libraries to do so.

Design guidelines/constraints

• largely based from the same approach as existing yarn and pnpm analyzers
  • with the addition of npm ls --json for full inventory
• Integration test should not need expectation changes to pass
• All configuration should work as before
• Should support use of locked npm versions via corepack, as with the yarn and pnpm analyzers
• for now, the NodePackageAnalyzer is untouched, and still does manual parsing (although Claude found many bugs with this)
• all unused code should be removed
• Pnpm and Yarn parsers should be reviewed for de-duplication and consistency
• unnecessary configuration flags from integrations can be removed and undocumented when specifying them unnecessarily is a no-op

TODO

• more detailed review of JSON parsing approach and complexity
• additional smoke testing with real projects
• review interactions with the NodePackageAnalyzer to ensure they still make sense.

Related issues

• fixes Remove legacy NodeAuditAnalyzer dependency on NPM audit legacy /quick API #8422

Have test cases been added to cover the new functionality?

yes

[Copilot]

Pull request overview

Reinstates Node Audit analysis using the local npm CLI, replacing the retired legacy audit API integration and addressing #8422.

Changes:

• Uses npm audit and npm ls for vulnerability and dependency data.
• Adds npm executable configuration across supported integrations.
• Removes legacy API code and adds npm audit v2 parser tests and documentation.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
utils/src/test/resources/dependencycheck.properties	Removes the retired API URL.
utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java	Deprecates the API URL and adds npm path configuration.
src/site/markdown/dependency-check-gradle/configuration.md	Updates Gradle Node Audit documentation.
src/site/markdown/dependency-check-gradle/configuration-aggregate.md	Updates aggregate Gradle documentation.
src/site/markdown/analyzers/node-audit-analyzer.md	Documents npm CLI requirements and supported files.
src/site/markdown/analyzers/index.md	Updates the Node Audit analysis method.
maven/src/site/markdown/configuration.md	Documents Maven npm path configuration.
maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java	Wires Maven npm path settings.
Dockerfile	Enables and prepares npm through Corepack.
core/src/test/resources/nodeaudit/npm-audit-report.json	Adds an npm audit v2 fixture.
core/src/test/resources/dependencycheck.properties	Removes the retired test API URL.
core/src/test/java/org/owasp/dependencycheck/data/nodeaudit/NpmPayloadBuilderTest.java	Removes obsolete payload-builder tests.
core/src/test/java/org/owasp/dependencycheck/data/nodeaudit/NpmCliAuditParserTest.java	Tests npm audit v2 parsing.
core/src/test/java/org/owasp/dependencycheck/data/nodeaudit/NodeAuditSearchTest.java	Removes obsolete API search tests.
core/src/main/resources/dependencycheck.properties	Removes the retired URL default.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/package-info.java	Updates package documentation.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmPayloadBuilder.java	Removes legacy API payload generation.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmCliAuditParser.java	Adds npm audit v2 report parsing.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NodeAuditSearch.java	Removes direct API communication.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/Advisory.java	Centralizes GHSA extraction.
core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java	Reuses centralized GHSA extraction.
core/src/main/java/org/owasp/dependencycheck/analyzer/NodeAuditAnalyzer.java	Runs npm audit and inventory commands.
core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractNpmAnalyzer.java	Removes legacy search initialization.
cli/src/site/markdown/arguments.md	Documents the --npm option.
cli/src/main/java/org/owasp/dependencycheck/CliParser.java	Adds the npm path CLI argument.
cli/src/main/java/org/owasp/dependencycheck/App.java	Applies the CLI npm path setting.
ant/src/site/markdown/configuration.md	Documents Ant npm path configuration.
ant/src/main/java/org/owasp/dependencycheck/taskdefs/Check.java	Wires Ant npm path settings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.