Dep-scan
summary
Dep-scan v6 claims fast, high‑quality composition and reachability: forward reachability analysis plus endpoint-focused and configurable depth/breadth scans, lifecycle SBOM diffs emitted as CycloneDX SBOM, and an interactive semantic engine called Chenai intermediate representation. Example scans find surprising counts (261 frameworks pre‑build in one Node project), uncover cross‑library dataflows and mitigations, and produce reachable CVE mappings for large apps like Dependency‑Track. The code is open source, version six adds interactive configuration and automated before/after build comparisons; demos show it runs on polyglot monorepos and reports actionable, low‑false‑positive results.
AI-written summary · about
chapters (10)
- 0:00Introduction to dep-scan
- 2:59Evolution of dep-scan
- 4:26What is software complexity
- 8:42Software Bill of Materials
- 10:49Software composition variability
- 14:44Rethinking SCA tools
- 16:54Dep-scan v6 user control
- 19:24Reachability analysis in dep-scan
- 21:33Demo reachability analysis
- 26:16Summary dep-scan future
related talks
42mIt's a trap; we are vulnerable
21mSecuring Diverse Supply Chains Across Interconnected Systems
28mDevSecOps - Security from Scratch
30mDefectDojo Project
23mSupply Chain Security using Free and Open Tools
43mA radiography of a SBOM vulnerability scanner
54mSupply Chain Sec /w Dependency Track
46mSafely through the dependency minefield using OWASP Dependency Track