Skip to content

fix: reinstate the NodeAuditAnalyzer via use of npm audit via CLI #8725

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
chadlwilson wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

fix: reinstate the NodeAuditAnalyzer via use of npm audit via CLI #8725

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
66edf9b
feat: Migrate the NodeAuditAnalyzer to use the npm audit CLI.
chadlwilson Aug 6, 2026
e43f920
fix: treat 0.0 scores as valid
chadlwilson Aug 8, 2026
28b23b8
Merge branch 'main' into use-npm-audit-cli
chadlwilson Aug 10, 2026
0b74923
Merge branch 'main' into use-npm-audit-cli
chadlwilson Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ RUN apk upgrade --no-cache
apk add --no-cache --virtual .build-deps curl && \
apk add --no-cache git ruby npm && \
gem install --no-document bundler-audit && \
npm install --global --ignore-scripts corepack && \
npm install --global --ignore-scripts corepack && corepack enable npm && \
unzip dependency-check-${VERSION}-release.zip -d /usr/share/ && \
rm dependency-check-${VERSION}-release.zip && \
cd /usr/share/dependency-check/plugins && \
Expand All @@ -50,7 +50,7 @@ USER ${UID}

### Cache pieces needed for the specific run user
RUN bundle audit update && \
corepack prepare pnpm@latest yarn@latest --activate && \
corepack prepare npm@latest pnpm@latest yarn@latest --activate && \
printf "enableTelemetry: false\nenableScripts: false\n" >> ${HOME}/.yarnrc.yml && \
rm -rf /tmp/*

Expand Down
14 changes: 14 additions & 0 deletions ant/src/main/java/org/owasp/dependencycheck/taskdefs/Check.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,10 @@ public class Check extends Update {
* The path to `pnpm`.
*/
private String pathToPnpm;
/**
* The path to `npm`.
*/
private String pathToNpm;
/**
* Additional ZIP File extensions to add analyze. This should be a
* comma-separated list of file extensions to treat like ZIP files.
Expand Down Expand Up @@ -1136,6 +1140,15 @@ public void setPathToPnpm(String pathToPnpm) {
this.pathToPnpm = pathToPnpm;
}

/**
* Set the value of pathToNpm.
*
* @param pathToNpm new value of pathToNpm
*/
public void setPathToNpm(String pathToNpm) {
this.pathToNpm = pathToNpm;
}

/**
* Set the value of pathToGo.
*
Expand Down Expand Up @@ -1510,6 +1523,7 @@ protected void populateSettings() throws BuildException {
getSettings().setStringIfNotNull(Settings.KEYS.ANALYZER_GOLANG_PATH, pathToGo);
getSettings().setStringIfNotNull(Settings.KEYS.ANALYZER_YARN_PATH, pathToYarn);
getSettings().setStringIfNotNull(Settings.KEYS.ANALYZER_PNPM_PATH, pathToPnpm);
getSettings().setStringIfNotNull(Settings.KEYS.ANALYZER_NPM_PATH, pathToNpm);
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_MIX_AUDIT_ENABLED, mixAuditAnalyzerEnabled);
getSettings().setStringIfNotNull(Settings.KEYS.ANALYZER_MIX_AUDIT_PATH, mixAuditPath);
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
Expand Down
3 changes: 2 additions & 1 deletion ant/src/site/markdown/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,13 +117,14 @@ be needed.
| cpanfileAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Perl CPAN File Analyzer should be used. `enableExperimental` must be set to true. | true |
| nodeAnalyzerEnabled | Sets whether the Node Package Analyzer should be used. | true |
| nodePackageSkipDevDependencies | Sets whether the Node Package Analyzer will skip devDependencies. | false |
| nodeAuditAnalyzerEnabled | Sets whether the Node Audit Analyzer should be used. This analyzer requires an internet connection. | true |
| nodeAuditAnalyzerEnabled | Sets whether the Node Audit Analyzer should be used. This analyzer requires npm and an internet connection. | true |
| nodeAuditAnalyzerUseCache | Sets whether the Node Audit Analyzer will cache results. Cached results expire after 24 hours. | true |
| nodeAuditSkipDevDependencies | Sets whether the Node Audit Analyzer will skip devDependencies. | false |
| yarnAuditAnalyzerEnabled | Sets whether the Yarn Audit Analyzer should be used. This analyzer requires yarn and an internet connection. Use `nodeAuditSkipDevDependencies` to skip dev dependencies. | true |
| pnpmAuditAnalyzerEnabled | Sets whether the Pnpm Audit Analyzer should be used. This analyzer requires pnpm and an internet connection. Use `nodeAuditSkipDevDependencies` to skip dev dependencies. | true |
| pathToYarn | The path to `yarn`. |   |
| pathToPnpm | The path to `pnpm`. |   |
| pathToNpm | The path to `npm`. |   |
| retireJsAnalyzerEnabled | Sets whether the RetireJS Analyzer update and analyzer are enabled. | true |
| retireJsFilterNonVulnerable | Configures the RetireJS Analyzer to remove non-vulnerable JS dependencies from the report. | false |
| retireJsFilter | A nested configuration that can be specified multple times; The regex defined is used to filter JS files based on content. |   |
Expand Down
2 changes: 2 additions & 0 deletions cli/src/main/java/org/owasp/dependencycheck/App.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -527,6 +527,8 @@ protected void populateSettings(CliParser cli) throws InvalidSettingException {
cli.getStringArgument(CliParser.ARGUMENT.PATH_TO_YARN));
settings.setStringIfNotNull(Settings.KEYS.ANALYZER_PNPM_PATH,
cli.getStringArgument(CliParser.ARGUMENT.PATH_TO_PNPM));
settings.setStringIfNotNull(Settings.KEYS.ANALYZER_NPM_PATH,
cli.getStringArgument(CliParser.ARGUMENT.PATH_TO_NPM));
settings.setBooleanIfNotNull(Settings.KEYS.PRETTY_PRINT,
cli.hasOption(CliParser.ARGUMENT.PRETTY_PRINT));
settings.setStringIfNotNull(Settings.KEYS.ANALYZER_RETIREJS_REPO_JS_URL,
Expand Down
6 changes: 6 additions & 0 deletions cli/src/main/java/org/owasp/dependencycheck/CliParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -476,6 +476,8 @@ private void addAdvancedOptions(final Options options) {
"The path to the `yarn` executable."))
.addOption(newOptionWithArg(ARGUMENT.PATH_TO_PNPM, "path",
"The path to the `pnpm` executable."))
.addOption(newOptionWithArg(ARGUMENT.PATH_TO_NPM, "path",
"The path to the `npm` executable."))
.addOption(newOptionWithArg(ARGUMENT.RETIRE_JS_FILTERS, "pattern",
"Specify Retire JS content filter used to exclude files from analysis based on their content; "
+ "most commonly used to exclude based on your applications own copyright line. This "
Expand Down Expand Up @@ -1348,6 +1350,10 @@ public static class ARGUMENT {
* The CLI argument name for setting the path to `pnpm`.
*/
public static final String PATH_TO_PNPM = "pnpm";
/**
* The CLI argument name for setting the path to `npm`.
*/
public static final String PATH_TO_NPM = "npm";
/**
* Disables the Ruby Gemspec Analyzer.
*/
Expand Down
3 changes: 2 additions & 1 deletion cli/src/site/markdown/arguments.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,8 @@ Advanced Options
| | \-\-yarn | \<path\> | The path to `yarn`. | &nbsp; |
| | \-\-disablePnpmAudit | | Sets whether the pnpm Audit Analyzer will be used. This analyzer requires an internet connection and that pnpm is installed. Use `--nodeAuditSkipDevDependencies` to skip dev dependencies. | &nbsp; |
| | \-\-pnpm | \<path\> | The path to `pnpm`. | &nbsp; |
| | \-\-disableNodeAudit | | Sets whether the Node Audit Analyzer will be used. This analyzer requires an internet connection. | &nbsp; |
| | \-\-npm | \<path\> | The path to `npm`. | &nbsp; |
| | \-\-disableNodeAudit | | Sets whether the Node Audit Analyzer will be used. This analyzer requires an internet connection and that npm is installed. Use `--nodeAuditSkipDevDependencies` to skip dev dependencies. | &nbsp; |
| | \-\-disableNodeAuditCache | | When the argument is present the Node Audit Analyzer will not cache results. By default the results are cached for 24 hours. | &nbsp; |
| | \-\-nodeAuditSkipDevDependencies | | Configures the Node Audit Analyzer to skip devDependencies. | &nbsp; |
| | \-\-disableRetireJs | | Sets whether the RetireJS Analyzer will be used. | &nbsp; |
Expand Down
Loading
Loading