CVE monitoring
A vulnerable package is installed. Does anything here call it?
Every scanner answers the first half. The second half is the one that decides whether somebody's afternoon is worth spending, and a list of installed packages cannot answer it. SourceAnt already holds a graph of what imports and calls what, so it can.
Two answers, and only one of them is urgent
Every advisory that matches something you install gets one of these, along with the reason.
reached Something you wrote imports or calls this package. The advisory is about code you actually run.
The files that name it come back with the verdict, so you can go and look rather than take our word for it.
installed It is declared, and nothing in this repository names it. Still worth patching one day. Not worth waking anyone up for.
Kept on the list rather than hidden, because a scanner that quietly drops things is a scanner nobody trusts twice.
Dependabot tells you the package is there. It does not tell you whether anything in your code reaches it, and that is the question the on-call engineer actually has.
How it knows
The code graph was already there
SourceAnt indexes what imports and calls what. Asking that index whether anything names a package turns a list of everything installed into the shorter list of what is wired in.
This is not a separate scanner bolted on. It is one more question put to a graph that was built for other reasons, which is why the answer arrives with the files behind it instead of a score.
Where it over-reports
A package whose name is also an ordinary word will match things that have nothing to do with it. That is why the verdict never travels alone. The files that produced it come with it, so a wrong answer takes you ten seconds to disprove rather than an afternoon to argue with.
The lockfile, not the manifest
A manifest says what was asked for. A lockfile says what is installed. An advisory is about the second one, so the lockfile wins wherever both exist.
| Ecosystem | Read first | Fallen back to |
|---|---|---|
| npm | package-lock.json | package.json |
| PyPI | poetry.lock | requirements.txt, then pyproject.toml |
A manifest that will not parse costs you one ecosystem from the answer, not the whole reading. Version ranges are compared conservatively on purpose, because a wrong yes is an alert somebody has to disprove.
What comes back per advisory
Enough to act without opening another tab, and enough to disagree without taking anyone's word for it.
- severity and summary
- As the advisory database states them, not as we restate them.
- installed version
- Read from your lockfile, so it is what is installed rather than what was asked for.
- affected range
- The range the advisory names, so you can check the match yourself.
- first patched version
- Where to go, when there is somewhere to go.
- declared in
- The file that pulled it in.
- direct or transitive
- Something you chose, or something your choices dragged along. Only one of them is yours to change.
Freshness
Aged on a clock, because your repository is not what moved
Most of what SourceAnt keeps stops being true when your code changes, so it is aged against the code. An advisory reading is not like that. It stops being true when the advisory database changes, which happens continuously while your repository sits perfectly still.
So a reading is kept for a set number of hours rather than until the next commit, and the clock is yours to set if you are under more pressure than most.
Two halves of the same question
One asks whether the code you install is safe. The other asks whether the code you install is yours.
This page
A package you installed has a published advisory against it, and your code reaches into it.
Supply chain naming
A package you thought was yours carries a name anyone could publish, and your build might take theirs.
Put your system on the record
Run the open core on your own infrastructure, or start on the hosted workspace. The graph is portable either way.