Dependency Auditor

module github.com/example/sample-go-service

go 1.20

require (
	github.com/gin-gonic/gin v1.9.1
	github.com/go-redis/redis/v8 v8.11.5
	github.com/golang-jwt/jwt/v4 v4.5.0
	github.com/gorilla/mux v1.8.0
	github.com/gorilla/websocket v1.5.0
	github.com/lib/pq v1.10.9
	github.com/stretchr/testify v1.8.2
	go.uber.org/zap v1.24.0
	golang.org/x/crypto v0.9.0
	gopkg.in/yaml.v3 v3.0.1
	gorm.io/driver/postgres v1.5.0
	gorm.io/gorm v1.25.1
)

require (
	github.com/bytedance/sonic v1.8.8 // indirect
	github.com/cespare/xxhash/v2 v2.2.0 // indirect
	github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
	github.com/davecgh/go-spew v1.1.1 // indirect
	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
	github.com/gin-contrib/sse v0.1.0 // indirect
	github.com/go-playground/locales v0.14.1 // indirect
	github.com/go-playground/universal-translator v0.18.1 // indirect
	github.com/go-playground/validator/v10 v10.13.0 // indirect
	github.com/goccy/go-json v0.10.2 // indirect
	github.com/jackc/pgpassfile v1.0.0 // indirect
	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
	github.com/jackc/pgx/v5 v5.3.1 // indirect
	github.com/jinzhu/inflection v1.0.0 // indirect
	github.com/jinzhu/now v1.1.5 // indirect
	github.com/json-iterator/go v1.1.12 // indirect
	github.com/klauspost/cpuid/v2 v2.2.4 // indirect
	github.com/leodido/go-urn v1.2.4 // indirect
	github.com/mattn/go-isatty v0.0.18 // indirect
	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
	github.com/modern-go/reflect2 v1.0.2 // indirect
	github.com/pelletier/go-toml/v2 v2.0.7 // indirect
	github.com/pmezard/go-difflib v1.0.0 // indirect
	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
	github.com/ugorji/go/codec v1.2.11 // indirect
	go.uber.org/atomic v1.11.0 // indirect
	go.uber.org/multierr v1.11.0 // indirect
	golang.org/x/arch v0.3.0 // indirect
	golang.org/x/net v0.10.0 // indirect
	golang.org/x/sys v0.8.0 // indirect
	golang.org/x/text v0.9.0 // indirect
)

{
  "name": "sample-web-app",
  "version": "1.2.3",
  "description": "A sample web application with various dependencies for testing dependency auditing",
  "main": "index.js",
  "scripts": {
    "start": "node index.js",
    "dev": "nodemon index.js",
    "build": "webpack --mode production",
    "test": "jest",
    "lint": "eslint src/",
    "audit": "npm audit"
  },
  "keywords": ["web", "app", "sample", "dependency", "audit"],
  "author": "Claude Skills Team",
  "license": "MIT",
  "dependencies": {
    "express": "4.18.1",
    "lodash": "4.17.20",
    "axios": "1.5.0",
    "jsonwebtoken": "8.5.1",
    "bcrypt": "5.1.0",
    "mongoose": "6.10.0",
    "cors": "2.8.5",
    "helmet": "6.1.5",
    "winston": "3.8.2",
    "dotenv": "16.0.3",
    "express-rate-limit": "6.7.0",
    "multer": "1.4.5-lts.1",
    "sharp": "0.32.1",
    "nodemailer": "6.9.1",
    "socket.io": "4.6.1",
    "redis": "4.6.5",
    "moment": "2.29.4",
    "chalk": "4.1.2",
    "commander": "9.4.1"
  },
  "devDependencies": {
    "nodemon": "2.0.22",
    "jest": "29.5.0",
    "supertest": "6.3.3",
    "eslint": "8.40.0",
    "eslint-config-airbnb-base": "15.0.0",
    "eslint-plugin-import": "2.27.5",
    "webpack": "5.82.1",
    "webpack-cli": "5.1.1",
    "babel-loader": "9.1.2",
    "@babel/core": "7.22.1",
    "@babel/preset-env": "7.22.2",
    "css-loader": "6.7.4",
    "style-loader": "3.3.3",
    "html-webpack-plugin": "5.5.1",
    "mini-css-extract-plugin": "2.7.6",
    "postcss": "8.4.23",
    "postcss-loader": "7.3.0",
    "autoprefixer": "10.4.14",
    "cross-env": "7.0.3",
    "rimraf": "5.0.1"
  },
  "engines": {
    "node": ">=16.0.0",
    "npm": ">=8.0.0"
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/example/sample-web-app.git"
  },
  "bugs": {
    "url": "https://github.com/example/sample-web-app/issues"
  },
  "homepage": "https://github.com/example/sample-web-app#readme"
}

# Core web framework
Django==4.1.7
djangorestframework==3.14.0
django-cors-headers==3.14.0
django-environ==0.10.0
django-extensions==3.2.1

# Database and ORM
psycopg2-binary==2.9.6
redis==4.5.4
celery==5.2.7

# Authentication and Security
django-allauth==0.54.0
djangorestframework-simplejwt==5.2.2
cryptography==40.0.1
bcrypt==4.0.1

# HTTP and API clients
requests==2.28.2
httpx==0.24.1
urllib3==1.26.15

# Data processing and analysis
pandas==2.0.1
numpy==1.24.3
Pillow==9.5.0
openpyxl==3.1.2

# Monitoring and logging
sentry-sdk==1.21.1
structlog==23.1.0

# Testing
pytest==7.3.1
pytest-django==4.5.2
pytest-cov==4.0.0
factory-boy==3.2.1
freezegun==1.2.2

# Development tools
black==23.3.0
flake8==6.0.0
isort==5.12.0
pre-commit==3.3.2
django-debug-toolbar==4.0.0

# Documentation
Sphinx==6.2.1
sphinx-rtd-theme==1.2.0

# Deployment and server
gunicorn==20.1.0
whitenoise==6.4.0

# Environment and configuration
python-decouple==3.8
pyyaml==6.0

# Utilities
click==8.1.3
python-dateutil==2.8.2
pytz==2023.3
six==1.16.0

# AWS integration
boto3==1.26.137
botocore==1.29.137

# Email
django-anymail==10.0

============================================================
LICENSE COMPLIANCE REPORT
============================================================
Analysis Date: 2024-02-16T15:30:00.000Z
Project: /example/sample-web-app
Project License: MIT

SUMMARY:
  Total Dependencies: 23
  Compliance Score: 92.5/100
  Overall Risk: LOW
  License Conflicts: 0

LICENSE DISTRIBUTION:
  Permissive: 21
  Copyleft_weak: 1
  Copyleft_strong: 0
  Proprietary: 0
  Unknown: 1

RISK BREAKDOWN:
  Low: 21
  Medium: 1
  High: 0
  Critical: 1

HIGH-RISK DEPENDENCIES:
------------------------------
  moment v2.29.4: Unknown (CRITICAL)

RECOMMENDATIONS:
--------------------
1. Investigate and clarify licenses for 1 dependencies with unknown licensing
2. Overall compliance score is high - maintain current practices
3. Consider updating moment.js which has been deprecated by maintainers

============================================================

============================================================
DEPENDENCY UPGRADE PLAN
============================================================
Generated: 2024-02-16T15:30:00.000Z
Timeline: 90 days

UPGRADE SUMMARY:
  Total Upgrades Available: 12
  Security Updates: 2
  Major Version Updates: 3
  High Risk Updates: 2

RISK ASSESSMENT:
  Overall Risk Level: MEDIUM
  Key Risk Factors:
    • 2 critical risk upgrades requiring careful planning
    • Core framework upgrades: ['express', 'webpack', 'eslint']
    • 1 major version upgrades with potential breaking changes

TOP PRIORITY UPGRADES:
------------------------------
🔒 lodash: 4.17.20 → 4.17.21 🔒
   Type: Patch | Risk: Low | Priority: 95.0
   Security: CVE-2021-23337: Prototype pollution vulnerability

🟡 express: 4.18.1 → 4.18.2
   Type: Patch | Risk: Low | Priority: 85.0

🟡 webpack: 5.82.1 → 5.88.0
   Type: Minor | Risk: Medium | Priority: 75.0

🔴 eslint: 8.40.0 → 9.0.0
   Type: Major | Risk: High | Priority: 65.0

🟢 cors: 2.8.5 → 2.8.7
   Type: Patch | Risk: Safe | Priority: 80.0

PHASED UPGRADE PLANS:
------------------------------
Phase 1: Security & Safe Updates (30 days)
  Dependencies: lodash, cors, helmet, dotenv, bcrypt
  Key Steps: Create feature branch; Update dependency versions in manifest files; Run dependency install/update commands

Phase 2: Regular Updates (36 days)
  Dependencies: express, axios, winston, multer
  Key Steps: Create feature branch; Update dependency versions in manifest files; Run dependency install/update commands

Phase 3: Major Updates (30 days)
  Dependencies: webpack, eslint, jest
  ... and 2 more
  Key Steps: Create feature branch; Update dependency versions in manifest files; Run dependency install/update commands

RECOMMENDATIONS:
--------------------
1. URGENT: 2 security updates available - prioritize immediately
2. Quick wins: 6 safe updates can be applied with minimal risk
3. Plan carefully: 2 high-risk upgrades need thorough testing

============================================================

{
  "timestamp": "2024-02-16T15:30:00.000Z",
  "project_path": "/example/sample-web-app",
  "dependencies": [
    {
      "name": "lodash",
      "version": "4.17.20",
      "ecosystem": "npm",
      "direct": true,
      "license": "MIT",
      "vulnerabilities": [
        {
          "id": "CVE-2021-23337",
          "summary": "Prototype pollution in lodash",
          "severity": "HIGH",
          "cvss_score": 7.2,
          "affected_versions": "<4.17.21",
          "fixed_version": "4.17.21",
          "published_date": "2021-02-15",
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"
          ]
        }
      ]
    },
    {
      "name": "axios",
      "version": "1.5.0",
      "ecosystem": "npm",
      "direct": true,
      "license": "MIT",
      "vulnerabilities": []
    },
    {
      "name": "express",
      "version": "4.18.1",
      "ecosystem": "npm",
      "direct": true,
      "license": "MIT",
      "vulnerabilities": []
    },
    {
      "name": "jsonwebtoken",
      "version": "8.5.1",
      "ecosystem": "npm",
      "direct": true,
      "license": "MIT",
      "vulnerabilities": []
    }
  ],
  "vulnerabilities_found": 1,
  "high_severity_count": 1,
  "medium_severity_count": 0,
  "low_severity_count": 0,
  "ecosystems": ["npm"],
  "scan_summary": {
    "total_dependencies": 4,
    "unique_dependencies": 4,
    "ecosystems_found": 1,
    "vulnerable_dependencies": 1,
    "vulnerability_breakdown": {
      "high": 1,
      "medium": 0,
      "low": 0
    }
  },
  "recommendations": [
    "URGENT: Address 1 high-severity vulnerabilities immediately",
    "Update lodash from 4.17.20 to 4.17.21 to fix CVE-2021-23337"
  ]
}

#!/usr/bin/env python3
"""
Dependency Scanner - Multi-language dependency vulnerability and analysis tool.

This script parses dependency files from various package managers, extracts direct
and transitive dependencies, checks against built-in vulnerability databases,
and provides comprehensive security analysis with actionable recommendations.

Author: Claude Skills Engineering Team
License: MIT
"""

import json
import os
import re
import sys
import argparse
from typing import Dict, List, Set, Any, Optional, Tuple
from pathlib import Path
from dataclasses import dataclass, asdict
from datetime import datetime
import hashlib
import subprocess

@dataclass
class Vulnerability:
    """Represents a security vulnerability."""
    id: str
    summary: str
    severity: str
    cvss_score: float
    affected_versions: str
    fixed_version: Optional[str]
    published_date: str
    references: List[str]

@dataclass
class Dependency:
    """Represents a project dependency."""
    name: str
    version: str
    ecosystem: str
    direct: bool
    license: Optional[str] = None
    description: Optional[str] = None
    homepage: Optional[str] = None
    vulnerabilities: List[Vulnerability] = None
    
    def __post_init__(self):
        if self.vulnerabilities is None:
            self.vulnerabilities = []

class DependencyScanner:
    """Main dependency scanner class."""
    
    def __init__(self):
        self.known_vulnerabilities = self._load_vulnerability_database()
        self.supported_files = {
            'package.json': self._parse_package_json,
            'package-lock.json': self._parse_package_lock,
            'yarn.lock': self._parse_yarn_lock,
            'requirements.txt': self._parse_requirements_txt,
            'pyproject.toml': self._parse_pyproject_toml,
            'Pipfile.lock': self._parse_pipfile_lock,
            'poetry.lock': self._parse_poetry_lock,
            'go.mod': self._parse_go_mod,
            'go.sum': self._parse_go_sum,
            'Cargo.toml': self._parse_cargo_toml,
            'Cargo.lock': self._parse_cargo_lock,
            'Gemfile': self._parse_gemfile,
            'Gemfile.lock': self._parse_gemfile_lock,
        }
    
    def _load_vulnerability_database(self) -> Dict[str, List[Vulnerability]]:
        """Load built-in vulnerability database with common CVE patterns."""
        return {
            # JavaScript/Node.js vulnerabilities
            'lodash': [
                Vulnerability(
                    id='CVE-2021-23337',
                    summary='Prototype pollution in lodash',
                    severity='HIGH',
                    cvss_score=7.2,
                    affected_versions='<4.17.21',
                    fixed_version='4.17.21',
                    published_date='2021-02-15',
                    references=['https://nvd.nist.gov/vuln/detail/CVE-2021-23337']
                )
            ],
            'axios': [
                Vulnerability(
                    id='CVE-2023-45857',
                    summary='Cross-site request forgery in axios',
                    severity='MEDIUM',
                    cvss_score=6.1,
                    affected_versions='>=1.0.0 <1.6.0',
                    fixed_version='1.6.0',
                    published_date='2023-10-11',
                    references=['https://nvd.nist.gov/vuln/detail/CVE-2023-45857']
                )
            ],
            'express': [
                Vulnerability(
                    id='CVE-2022-24999',
                    summary='Open redirect in express',
                    severity='MEDIUM',
                    cvss_score=6.1,
                    affected_versions='<4.18.2',
                    fixed_version='4.18.2',
                    published_date='2022-11-26',
                    references=['https://nvd.nist.gov/vuln/detail/CVE-2022-24999']
                )
            ],
            
            # Python vulnerabilities
            'django': [
                Vulnerability(
                    id='CVE-2024-27351',
                    summary='SQL injection in Django',
                    severity='HIGH',
                    cvss_score=9.8,
                    affected_versions='>=3.2 <4.2.11',
                    fixed_version='4.2.11',
                    published_date='2024-02-06',
                    references=['https://nvd.nist.gov/vuln/detail/CVE-2024-27351']
                )
            ],
            'requests': [
                Vulnerability(
                    id='CVE-2023-32681',
                    summary='Proxy-authorization header leak in requests',
                    severity='MEDIUM',
                    cvss_score=6.1,
                    affected_versions='>=2.3.0 <2.31.0',
                    fixed_version='2.31.0',
                    published_date='2023-05-26',
                    references=['https://nvd.nist.gov/vuln/detail/CVE-2023-32681']
                )
            ],
            'pillow': [
                Vulnerability(
                    id='CVE-2023-50447',
                    summary='Arbitrary code execution in Pillow',
                    severity='HIGH',
                    cvss_score=8.8,
                    affected_versions='<10.2.0',
                    fixed_version='10.2.0',
                    published_date='2024-01-02',
                    references=['https://nvd.nist.gov/vuln/detail/CVE-2023-50447']
                )
            ],
            
            # Go vulnerabilities
            'github.com/gin-gonic/gin': [
                Vulnerability(
                    id='CVE-2023-26125',
                    summary='Path traversal in gin',
                    severity='HIGH',
                    cvss_score=7.5,
                    affected_versions='<1.9.1',
                    fixed_version='1.9.1',
                    published_date='2023-02-28',
                    references=['https://nvd.nist.gov/vuln/detail/CVE-2023-26125']
                )
            ],
            
            # Rust vulnerabilities
            'serde': [
                Vulnerability(
                    id='RUSTSEC-2022-0061',
                    summary='Deserialization vulnerability in serde',
                    severity='HIGH',
                    cvss_score=8.2,
                    affected_versions='<1.0.152',
                    fixed_version='1.0.152',
                    published_date='2022-12-07',
                    references=['https://rustsec.org/advisories/RUSTSEC-2022-0061']
                )
            ],
            
            # Ruby vulnerabilities
            'rails': [
                Vulnerability(
                    id='CVE-2023-28362',
                    summary='ReDoS vulnerability in Rails',
                    severity='HIGH',
                    cvss_score=7.5,
                    affected_versions='>=7.0.0 <7.0.4.3',
                    fixed_version='7.0.4.3',
                    published_date='2023-03-13',
                    references=['https://nvd.nist.gov/vuln/detail/CVE-2023-28362']
                )
            ]
        }
    
    def scan_project(self, project_path: str) -> Dict[str, Any]:
        """Scan a project directory for dependencies and vulnerabilities."""
        project_path = Path(project_path)
        
        if not project_path.exists():
            raise FileNotFoundError(f"Project path does not exist: {project_path}")
        
        scan_results = {
            'timestamp': datetime.now().isoformat(),
            'project_path': str(project_path),
            'dependencies': [],
            'vulnerabilities_found': 0,
            'high_severity_count': 0,
            'medium_severity_count': 0,
            'low_severity_count': 0,
            'ecosystems': set(),
            'scan_summary': {},
            'recommendations': []
        }
        
        # Find and parse dependency files
        for file_pattern, parser in self.supported_files.items():
            matching_files = list(project_path.rglob(file_pattern))
            
            for dep_file in matching_files:
                try:
                    dependencies = parser(dep_file)
                    scan_results['dependencies'].extend(dependencies)
                    
                    for dep in dependencies:
                        scan_results['ecosystems'].add(dep.ecosystem)
                        
                        # Check for vulnerabilities
                        vulnerabilities = self._check_vulnerabilities(dep)
                        dep.vulnerabilities = vulnerabilities
                        
                        scan_results['vulnerabilities_found'] += len(vulnerabilities)
                        
                        for vuln in vulnerabilities:
                            if vuln.severity == 'HIGH':
                                scan_results['high_severity_count'] += 1
                            elif vuln.severity == 'MEDIUM':
                                scan_results['medium_severity_count'] += 1
                            else:
                                scan_results['low_severity_count'] += 1
                
                except Exception as e:
                    print(f"Error parsing {dep_file}: {e}")
                    continue
        
        scan_results['ecosystems'] = list(scan_results['ecosystems'])
        scan_results['scan_summary'] = self._generate_scan_summary(scan_results)
        scan_results['recommendations'] = self._generate_recommendations(scan_results)
        
        return scan_results
    
    def _check_vulnerabilities(self, dependency: Dependency) -> List[Vulnerability]:
        """Check if a dependency has known vulnerabilities."""
        vulnerabilities = []
        
        # Check package name (exact match and common variations)
        package_names = [dependency.name, dependency.name.lower()]
        
        for pkg_name in package_names:
            if pkg_name in self.known_vulnerabilities:
                for vuln in self.known_vulnerabilities[pkg_name]:
                    if self._version_matches_vulnerability(dependency.version, vuln.affected_versions):
                        vulnerabilities.append(vuln)
        
        return vulnerabilities
    
    def _version_matches_vulnerability(self, version: str, affected_pattern: str) -> bool:
        """Check if a version matches a vulnerability pattern."""
        # Simple version matching - in production, use proper semver library
        try:
            # Handle common patterns like "<4.17.21", ">=1.0.0 <1.6.0"
            if '<' in affected_pattern and '>' not in affected_pattern:
                # Pattern like "<4.17.21"
                max_version = affected_pattern.replace('<', '').strip()
                return self._compare_versions(version, max_version) < 0
            elif '>=' in affected_pattern and '<' in affected_pattern:
                # Pattern like ">=1.0.0 <1.6.0"
                parts = affected_pattern.split('<')
                min_part = parts[0].replace('>=', '').strip()
                max_part = parts[1].strip()
                return (self._compare_versions(version, min_part) >= 0 and 
                       self._compare_versions(version, max_part) < 0)
        except:
            pass
        
        return False
    
    def _compare_versions(self, v1: str, v2: str) -> int:
        """Simple version comparison. Returns -1, 0, or 1."""
        try:
            def normalize(v):
                return [int(x) for x in re.sub(r'(\.0+)*$','', v).split('.')]
            
            v1_parts = normalize(v1)
            v2_parts = normalize(v2)
            
            if v1_parts < v2_parts:
                return -1
            elif v1_parts > v2_parts:
                return 1
            else:
                return 0
        except:
            return 0
    
    # Package file parsers
    
    def _parse_package_json(self, file_path: Path) -> List[Dependency]:
        """Parse package.json for Node.js dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                data = json.load(f)
            
            # Parse dependencies
            for dep_type in ['dependencies', 'devDependencies']:
                if dep_type in data:
                    for name, version in data[dep_type].items():
                        dep = Dependency(
                            name=name,
                            version=version.replace('^', '').replace('~', '').replace('>=', '').replace('<=', ''),
                            ecosystem='npm',
                            direct=True
                        )
                        dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing package.json: {e}")
        
        return dependencies
    
    def _parse_package_lock(self, file_path: Path) -> List[Dependency]:
        """Parse package-lock.json for Node.js transitive dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                data = json.load(f)
            
            if 'packages' in data:
                for path, pkg_info in data['packages'].items():
                    if path == '':  # Skip root package
                        continue
                    
                    name = path.split('/')[-1] if '/' in path else path
                    version = pkg_info.get('version', '')
                    
                    dep = Dependency(
                        name=name,
                        version=version,
                        ecosystem='npm',
                        direct=False,
                        description=pkg_info.get('description', '')
                    )
                    dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing package-lock.json: {e}")
        
        return dependencies
    
    def _parse_yarn_lock(self, file_path: Path) -> List[Dependency]:
        """Parse yarn.lock for Node.js dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                content = f.read()
            
            # Simple yarn.lock parsing
            packages = re.findall(r'^([^#\s][^:]+):\s*\n(?:\s+.*\n)*?\s+version\s+"([^"]+)"', content, re.MULTILINE)
            
            for package_spec, version in packages:
                name = package_spec.split('@')[0] if '@' in package_spec else package_spec
                name = name.strip('"')
                
                dep = Dependency(
                    name=name,
                    version=version,
                    ecosystem='npm',
                    direct=False
                )
                dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing yarn.lock: {e}")
        
        return dependencies
    
    def _parse_requirements_txt(self, file_path: Path) -> List[Dependency]:
        """Parse requirements.txt for Python dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                lines = f.readlines()
            
            for line in lines:
                line = line.strip()
                if line and not line.startswith('#') and not line.startswith('-'):
                    # Parse package==version or package>=version patterns
                    match = re.match(r'^([a-zA-Z0-9_-]+)([><=!]+)(.+)$', line)
                    if match:
                        name, operator, version = match.groups()
                        dep = Dependency(
                            name=name,
                            version=version,
                            ecosystem='pypi',
                            direct=True
                        )
                        dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing requirements.txt: {e}")
        
        return dependencies
    
    def _parse_pyproject_toml(self, file_path: Path) -> List[Dependency]:
        """Parse pyproject.toml for Python dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                content = f.read()
            
            # Simple TOML parsing for dependencies
            dep_section = re.search(r'\[tool\.poetry\.dependencies\](.*?)(?=\[|\Z)', content, re.DOTALL)
            if dep_section:
                for line in dep_section.group(1).split('\n'):
                    match = re.match(r'^([a-zA-Z0-9_-]+)\s*=\s*["\']([^"\']+)["\']', line.strip())
                    if match:
                        name, version = match.groups()
                        if name != 'python':
                            dep = Dependency(
                                name=name,
                                version=version.replace('^', '').replace('~', ''),
                                ecosystem='pypi',
                                direct=True
                            )
                            dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing pyproject.toml: {e}")
        
        return dependencies
    
    def _parse_pipfile_lock(self, file_path: Path) -> List[Dependency]:
        """Parse Pipfile.lock for Python dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                data = json.load(f)
            
            for section in ['default', 'develop']:
                if section in data:
                    for name, info in data[section].items():
                        version = info.get('version', '').replace('==', '')
                        dep = Dependency(
                            name=name,
                            version=version,
                            ecosystem='pypi',
                            direct=(section == 'default')
                        )
                        dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing Pipfile.lock: {e}")
        
        return dependencies
    
    def _parse_poetry_lock(self, file_path: Path) -> List[Dependency]:
        """Parse poetry.lock for Python dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                content = f.read()
            
            # Extract package entries from TOML
            packages = re.findall(r'\[\[package\]\]\nname\s*=\s*"([^"]+)"\nversion\s*=\s*"([^"]+)"', content)
            
            for name, version in packages:
                dep = Dependency(
                    name=name,
                    version=version,
                    ecosystem='pypi',
                    direct=False
                )
                dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing poetry.lock: {e}")
        
        return dependencies
    
    def _parse_go_mod(self, file_path: Path) -> List[Dependency]:
        """Parse go.mod for Go dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                content = f.read()
            
            # Parse require block
            require_match = re.search(r'require\s*\((.*?)\)', content, re.DOTALL)
            if require_match:
                requires = require_match.group(1)
                for line in requires.split('\n'):
                    match = re.match(r'\s*([^\s]+)\s+v?([^\s]+)', line.strip())
                    if match:
                        name, version = match.groups()
                        dep = Dependency(
                            name=name,
                            version=version,
                            ecosystem='go',
                            direct=True
                        )
                        dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing go.mod: {e}")
        
        return dependencies
    
    def _parse_go_sum(self, file_path: Path) -> List[Dependency]:
        """Parse go.sum for Go dependency checksums."""
        return []  # go.sum mainly contains checksums, dependencies are in go.mod
    
    def _parse_cargo_toml(self, file_path: Path) -> List[Dependency]:
        """Parse Cargo.toml for Rust dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                content = f.read()
            
            # Parse [dependencies] section
            dep_section = re.search(r'\[dependencies\](.*?)(?=\[|\Z)', content, re.DOTALL)
            if dep_section:
                for line in dep_section.group(1).split('\n'):
                    match = re.match(r'^([a-zA-Z0-9_-]+)\s*=\s*["\']([^"\']+)["\']', line.strip())
                    if match:
                        name, version = match.groups()
                        dep = Dependency(
                            name=name,
                            version=version,
                            ecosystem='cargo',
                            direct=True
                        )
                        dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing Cargo.toml: {e}")
        
        return dependencies
    
    def _parse_cargo_lock(self, file_path: Path) -> List[Dependency]:
        """Parse Cargo.lock for Rust dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                content = f.read()
            
            # Parse [[package]] entries
            packages = re.findall(r'\[\[package\]\]\nname\s*=\s*"([^"]+)"\nversion\s*=\s*"([^"]+)"', content)
            
            for name, version in packages:
                dep = Dependency(
                    name=name,
                    version=version,
                    ecosystem='cargo',
                    direct=False
                )
                dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing Cargo.lock: {e}")
        
        return dependencies
    
    def _parse_gemfile(self, file_path: Path) -> List[Dependency]:
        """Parse Gemfile for Ruby dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                content = f.read()
            
            # Parse gem declarations
            gems = re.findall(r'gem\s+["\']([^"\']+)["\'](?:\s*,\s*["\']([^"\']+)["\'])?', content)
            
            for gem_info in gems:
                name = gem_info[0]
                version = gem_info[1] if len(gem_info) > 1 and gem_info[1] else ''
                
                dep = Dependency(
                    name=name,
                    version=version,
                    ecosystem='rubygems',
                    direct=True
                )
                dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing Gemfile: {e}")
        
        return dependencies
    
    def _parse_gemfile_lock(self, file_path: Path) -> List[Dependency]:
        """Parse Gemfile.lock for Ruby dependencies."""
        dependencies = []
        
        try:
            with open(file_path, 'r') as f:
                content = f.read()
            
            # Extract GEM section
            gem_section = re.search(r'GEM\s*\n(.*?)(?=\n\S|\Z)', content, re.DOTALL)
            if gem_section:
                specs = gem_section.group(1)
                gems = re.findall(r'\s+([a-zA-Z0-9_-]+)\s+\(([^)]+)\)', specs)
                
                for name, version in gems:
                    dep = Dependency(
                        name=name,
                        version=version,
                        ecosystem='rubygems',
                        direct=False
                    )
                    dependencies.append(dep)
        
        except Exception as e:
            print(f"Error parsing Gemfile.lock: {e}")
        
        return dependencies
    
    def _generate_scan_summary(self, scan_results: Dict[str, Any]) -> Dict[str, Any]:
        """Generate a summary of the scan results."""
        total_deps = len(scan_results['dependencies'])
        unique_deps = len(set(dep.name for dep in scan_results['dependencies']))
        
        return {
            'total_dependencies': total_deps,
            'unique_dependencies': unique_deps,
            'ecosystems_found': len(scan_results['ecosystems']),
            'vulnerable_dependencies': len([dep for dep in scan_results['dependencies'] if dep.vulnerabilities]),
            'vulnerability_breakdown': {
                'high': scan_results['high_severity_count'],
                'medium': scan_results['medium_severity_count'],
                'low': scan_results['low_severity_count']
            }
        }
    
    def _generate_recommendations(self, scan_results: Dict[str, Any]) -> List[str]:
        """Generate actionable recommendations based on scan results."""
        recommendations = []
        
        high_count = scan_results['high_severity_count']
        medium_count = scan_results['medium_severity_count']
        
        if high_count > 0:
            recommendations.append(f"URGENT: Address {high_count} high-severity vulnerabilities immediately")
        
        if medium_count > 0:
            recommendations.append(f"Schedule fixes for {medium_count} medium-severity vulnerabilities within 30 days")
        
        vulnerable_deps = [dep for dep in scan_results['dependencies'] if dep.vulnerabilities]
        if vulnerable_deps:
            for dep in vulnerable_deps[:3]:  # Top 3 most critical
                for vuln in dep.vulnerabilities:
                    if vuln.fixed_version:
                        recommendations.append(f"Update {dep.name} from {dep.version} to {vuln.fixed_version} to fix {vuln.id}")
        
        if len(scan_results['ecosystems']) > 3:
            recommendations.append("Consider consolidating package managers to reduce complexity")
        
        return recommendations
    
    def generate_report(self, scan_results: Dict[str, Any], format: str = 'text') -> str:
        """Generate a human-readable or JSON report."""
        if format == 'json':
            # Convert Dependency objects to dicts for JSON serialization
            serializable_results = scan_results.copy()
            serializable_results['dependencies'] = [
                {
                    'name': dep.name,
                    'version': dep.version,
                    'ecosystem': dep.ecosystem,
                    'direct': dep.direct,
                    'license': dep.license,
                    'vulnerabilities': [asdict(vuln) for vuln in dep.vulnerabilities]
                }
                for dep in scan_results['dependencies']
            ]
            return json.dumps(serializable_results, indent=2, default=str)
        
        # Text format report
        report = []
        report.append("=" * 60)
        report.append("DEPENDENCY SECURITY SCAN REPORT")
        report.append("=" * 60)
        report.append(f"Scan Date: {scan_results['timestamp']}")
        report.append(f"Project: {scan_results['project_path']}")
        report.append("")
        
        # Summary
        summary = scan_results['scan_summary']
        report.append("SUMMARY:")
        report.append(f"  Total Dependencies: {summary['total_dependencies']}")
        report.append(f"  Unique Dependencies: {summary['unique_dependencies']}")
        report.append(f"  Ecosystems: {', '.join(scan_results['ecosystems'])}")
        report.append(f"  Vulnerabilities Found: {scan_results['vulnerabilities_found']}")
        report.append(f"    High Severity: {summary['vulnerability_breakdown']['high']}")
        report.append(f"    Medium Severity: {summary['vulnerability_breakdown']['medium']}")
        report.append(f"    Low Severity: {summary['vulnerability_breakdown']['low']}")
        report.append("")
        
        # Vulnerable dependencies
        vulnerable_deps = [dep for dep in scan_results['dependencies'] if dep.vulnerabilities]
        if vulnerable_deps:
            report.append("VULNERABLE DEPENDENCIES:")
            report.append("-" * 30)
            
            for dep in vulnerable_deps:
                report.append(f"Package: {dep.name} v{dep.version} ({dep.ecosystem})")
                for vuln in dep.vulnerabilities:
                    report.append(f"  • {vuln.id}: {vuln.summary}")
                    report.append(f"    Severity: {vuln.severity} (CVSS: {vuln.cvss_score})")
                    if vuln.fixed_version:
                        report.append(f"    Fixed in: {vuln.fixed_version}")
                    report.append("")
        
        # Recommendations
        if scan_results['recommendations']:
            report.append("RECOMMENDATIONS:")
            report.append("-" * 20)
            for i, rec in enumerate(scan_results['recommendations'], 1):
                report.append(f"{i}. {rec}")
            report.append("")
        
        report.append("=" * 60)
        return '\n'.join(report)

def main():
    """Main entry point for the dependency scanner."""
    parser = argparse.ArgumentParser(
        description='Scan project dependencies for vulnerabilities and security issues',
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
  python dep_scanner.py /path/to/project
  python dep_scanner.py . --format json --output results.json
  python dep_scanner.py /app --fail-on-high
        """
    )
    
    parser.add_argument('project_path', 
                       help='Path to the project directory to scan')
    parser.add_argument('--format', choices=['text', 'json'], default='text',
                       help='Output format (default: text)')
    parser.add_argument('--output', '-o',
                       help='Output file path (default: stdout)')
    parser.add_argument('--fail-on-high', action='store_true',
                       help='Exit with error code if high-severity vulnerabilities found')
    parser.add_argument('--quick-scan', action='store_true',
                       help='Perform quick scan (skip transitive dependencies)')
    
    args = parser.parse_args()
    
    try:
        scanner = DependencyScanner()
        results = scanner.scan_project(args.project_path)
        report = scanner.generate_report(results, args.format)
        
        if args.output:
            with open(args.output, 'w') as f:
                f.write(report)
            print(f"Report saved to {args.output}")
        else:
            print(report)
        
        # Exit with error if high-severity vulnerabilities found and --fail-on-high is set
        if args.fail_on_high and results['high_severity_count'] > 0:
            sys.exit(1)
    
    except Exception as e:
        print(f"Error: {e}", file=sys.stderr)
        sys.exit(1)

if __name__ == '__main__':
    main()

{
  "timestamp": "2026-02-16T15:42:09.730696",
  "project_path": "test-project",
  "dependencies": [
    {
      "name": "express",
      "version": "4.18.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": [
        {
          "id": "CVE-2022-24999",
          "summary": "Open redirect in express",
          "severity": "MEDIUM",
          "cvss_score": 6.1,
          "affected_versions": "<4.18.2",
          "fixed_version": "4.18.2",
          "published_date": "2022-11-26",
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"
          ]
        },
        {
          "id": "CVE-2022-24999",
          "summary": "Open redirect in express",
          "severity": "MEDIUM",
          "cvss_score": 6.1,
          "affected_versions": "<4.18.2",
          "fixed_version": "4.18.2",
          "published_date": "2022-11-26",
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"
          ]
        }
      ]
    },
    {
      "name": "lodash",
      "version": "4.17.20",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": [
        {
          "id": "CVE-2021-23337",
          "summary": "Prototype pollution in lodash",
          "severity": "HIGH",
          "cvss_score": 7.2,
          "affected_versions": "<4.17.21",
          "fixed_version": "4.17.21",
          "published_date": "2021-02-15",
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"
          ]
        },
        {
          "id": "CVE-2021-23337",
          "summary": "Prototype pollution in lodash",
          "severity": "HIGH",
          "cvss_score": 7.2,
          "affected_versions": "<4.17.21",
          "fixed_version": "4.17.21",
          "published_date": "2021-02-15",
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"
          ]
        }
      ]
    },
    {
      "name": "axios",
      "version": "1.5.0",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": [
        {
          "id": "CVE-2023-45857",
          "summary": "Cross-site request forgery in axios",
          "severity": "MEDIUM",
          "cvss_score": 6.1,
          "affected_versions": ">=1.0.0 <1.6.0",
          "fixed_version": "1.6.0",
          "published_date": "2023-10-11",
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-45857"
          ]
        },
        {
          "id": "CVE-2023-45857",
          "summary": "Cross-site request forgery in axios",
          "severity": "MEDIUM",
          "cvss_score": 6.1,
          "affected_versions": ">=1.0.0 <1.6.0",
          "fixed_version": "1.6.0",
          "published_date": "2023-10-11",
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-45857"
          ]
        }
      ]
    },
    {
      "name": "jsonwebtoken",
      "version": "8.5.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "bcrypt",
      "version": "5.1.0",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "mongoose",
      "version": "6.10.0",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "cors",
      "version": "2.8.5",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "helmet",
      "version": "6.1.5",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "winston",
      "version": "3.8.2",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "dotenv",
      "version": "16.0.3",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "express-rate-limit",
      "version": "6.7.0",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "multer",
      "version": "1.4.5-lts.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "sharp",
      "version": "0.32.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "nodemailer",
      "version": "6.9.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "socket.io",
      "version": "4.6.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "redis",
      "version": "4.6.5",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "moment",
      "version": "2.29.4",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "chalk",
      "version": "4.1.2",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "commander",
      "version": "9.4.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "nodemon",
      "version": "2.0.22",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "jest",
      "version": "29.5.0",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "supertest",
      "version": "6.3.3",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "eslint",
      "version": "8.40.0",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "eslint-config-airbnb-base",
      "version": "15.0.0",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "eslint-plugin-import",
      "version": "2.27.5",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "webpack",
      "version": "5.82.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "webpack-cli",
      "version": "5.1.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "babel-loader",
      "version": "9.1.2",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "@babel/core",
      "version": "7.22.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "@babel/preset-env",
      "version": "7.22.2",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "css-loader",
      "version": "6.7.4",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "style-loader",
      "version": "3.3.3",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "html-webpack-plugin",
      "version": "5.5.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "mini-css-extract-plugin",
      "version": "2.7.6",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "postcss",
      "version": "8.4.23",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "postcss-loader",
      "version": "7.3.0",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "autoprefixer",
      "version": "10.4.14",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "cross-env",
      "version": "7.0.3",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    },
    {
      "name": "rimraf",
      "version": "5.0.1",
      "ecosystem": "npm",
      "direct": true,
      "license": null,
      "vulnerabilities": []
    }
  ],
  "vulnerabilities_found": 6,
  "high_severity_count": 2,
  "medium_severity_count": 4,
  "low_severity_count": 0,
  "ecosystems": [
    "npm"
  ],
  "scan_summary": {
    "total_dependencies": 39,
    "unique_dependencies": 39,
    "ecosystems_found": 1,
    "vulnerable_dependencies": 3,
    "vulnerability_breakdown": {
      "high": 2,
      "medium": 4,
      "low": 0
    }
  },
  "recommendations": [
    "URGENT: Address 2 high-severity vulnerabilities immediately",
    "Schedule fixes for 4 medium-severity vulnerabilities within 30 days",
    "Update express from 4.18.1 to 4.18.2 to fix CVE-2022-24999",
    "Update express from 4.18.1 to 4.18.2 to fix CVE-2022-24999",
    "Update lodash from 4.17.20 to 4.17.21 to fix CVE-2021-23337",
    "Update lodash from 4.17.20 to 4.17.21 to fix CVE-2021-23337",
    "Update axios from 1.5.0 to 1.6.0 to fix CVE-2023-45857",
    "Update axios from 1.5.0 to 1.6.0 to fix CVE-2023-45857"
  ]
}

{
  "name": "sample-web-app",
  "version": "1.2.3",
  "description": "A sample web application with various dependencies for testing dependency auditing",
  "main": "index.js",
  "scripts": {
    "start": "node index.js",
    "dev": "nodemon index.js",
    "build": "webpack --mode production",
    "test": "jest",
    "lint": "eslint src/",
    "audit": "npm audit"
  },
  "keywords": ["web", "app", "sample", "dependency", "audit"],
  "author": "Claude Skills Team",
  "license": "MIT",
  "dependencies": {
    "express": "4.18.1",
    "lodash": "4.17.20",
    "axios": "1.5.0",
    "jsonwebtoken": "8.5.1",
    "bcrypt": "5.1.0",
    "mongoose": "6.10.0",
    "cors": "2.8.5",
    "helmet": "6.1.5",
    "winston": "3.8.2",
    "dotenv": "16.0.3",
    "express-rate-limit": "6.7.0",
    "multer": "1.4.5-lts.1",
    "sharp": "0.32.1",
    "nodemailer": "6.9.1",
    "socket.io": "4.6.1",
    "redis": "4.6.5",
    "moment": "2.29.4",
    "chalk": "4.1.2",
    "commander": "9.4.1"
  },
  "devDependencies": {
    "nodemon": "2.0.22",
    "jest": "29.5.0",
    "supertest": "6.3.3",
    "eslint": "8.40.0",
    "eslint-config-airbnb-base": "15.0.0",
    "eslint-plugin-import": "2.27.5",
    "webpack": "5.82.1",
    "webpack-cli": "5.1.1",
    "babel-loader": "9.1.2",
    "@babel/core": "7.22.1",
    "@babel/preset-env": "7.22.2",
    "css-loader": "6.7.4",
    "style-loader": "3.3.3",
    "html-webpack-plugin": "5.5.1",
    "mini-css-extract-plugin": "2.7.6",
    "postcss": "8.4.23",
    "postcss-loader": "7.3.0",
    "autoprefixer": "10.4.14",
    "cross-env": "7.0.3",
    "rimraf": "5.0.1"
  },
  "engines": {
    "node": ">=16.0.0",
    "npm": ">=8.0.0"
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/example/sample-web-app.git"
  },
  "bugs": {
    "url": "https://github.com/example/sample-web-app/issues"
  },
  "homepage": "https://github.com/example/sample-web-app#readme"
}