Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Software Composition Analysis: Beyond Dependency CVE Lists

bugbunny.ai | blog | #supply-chain | #vulnerability-management | #devsecops | #sca | #sbom | #dependencies | #software-composition-analysis | #reachability

Summary

Software composition analysis beyond CVE lists: build an accurate SBOM, tie dependencies to services and owners, prioritize by reachability, and watch build-time tools and package scripts too.
Published
Collected

original ↗

Related coverage

blog · bugbunny.ai
Open Source Vulnerability Management: Fixing Dependency Risk Without Alert Fatigue
Open-source vulnerability management without alert fatigue: build a dependency inventory from manifests, lockfiles and images, then prioritize by reachability and exposure instead of chasing every CVE.
blog · aikido.dev
SCA Everywhere: Scan and Fix Open-Source Dependencies in Your IDE
Aikido's IDE extension now runs the full SCA workflow: scan manifests and lockfiles for CVEs with safe upgrade ranges, fix via AutoFix, and auto-refresh as lockfiles change.
blog · aikido.dev
Supply Chain Security: The Ultimate Guide to Software Composition Analysis (SCA) Tools
Guide to Software Composition Analysis: with 70–90% of app code from open source, SCA scans direct and transitive dependencies against CVE databases to prioritize real risks over noisy alerts.
blog · aikido.dev
Why Securing Bazel Builds is So Hard (And How to Make It Easier)
Bazel lacks standard lockfiles and manifests, making security scanning painful; Aikido now scans Bazel projects automatically and flags risky dependencies, replacing custom scripts and CI hacks.
blog · jfrog.com
JFrog4JFrog: DevSecOps Made Simple
Developers simply want to write code without interruption, while operations wish to build as fast as possible and deploy without restrictions. On the other hand, security professionals want to protect every step of the software supply chain from any potential security threats and vulnerabilities. In software development, every piece of code can potentially introduce vulnerabilities…
blog · netspi.com
Open Source Software – Is It the Death of Your Company?
Warns that companies often don't know which open source components their applications contain, covering license risks from permissive to copyleft and the security vulnerabilities buried in OSS.
back