Find and fix vulnerable Nuget dependencies
org.openrewrite.csharp.dependencies.DependencyVulnerabilityCheckorg.openrewrite.recipe:rewrite-java-securityThis software composition analysis (SCA) tool detects and upgrades dependencies with publicly disclosed vulnerabilities. This recipe both generates a report of vulnerable dependencies and upgrades to newer versions with fixes. This recipe by default only upgrades to the latest **patch** version. If a minor or major upgrade is required to reach the fixed version, this can be controlled using the maximumUpgradeDelta option. Vulnerability information comes from the GitHub Security Advisory Database, which aggregates vulnerability data from several public databases, including the National Vulnerability Database maintained by the United States government. Dependencies following Semantic Versioning will see their _patch_ version updated where applicable. Last updated: 2026-07-27T1204.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.csharp.dependencies.DependencyVulnerabilityCheckIf the recipe isn’t available locally, install it with:
mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.36.0Options
| Name | Type | Description |
|---|---|---|
addMarkers | Boolean | Report each vulnerability as search result markers. When enabled you can see which dependencies are bringing in vulnerable transitives in the diff view. By default these markers are omitted, making it easier to see version upgrades within the diff. |
maximumUpgradeDelta | UpgradeDelta | The maximum difference to allow when suggesting a dependency version upgrade. Use none to only report vulnerabilities without making any changes. Patch version upgrades are the default and safest option, as patch releases assert full backwards compatibility with no breaking changes. Minor version upgrades can introduce new features but do not _typically_ include breaking changes. Major version upgrades will typically require code changes above and beyond this recipe. e.g. patch |
minimumSeverity | String | Only fix vulnerabilities with a severity level equal to or higher than the specified minimum. Vulnerabilities are classified as low, moderate, high, or critical based on their potential impact. Default is low, which includes all severity levels.e.g. moderate |
cvePattern | String | Only fix vulnerabilities matching this regular expression pattern. This allows filtering to specific CVEs or CVE ranges. For example, CVE-2023-.* will only check for CVEs from 2023, CVE-(2022|2023)-.* will check for CVEs from 2022 or 2023, CVE-2021-44228|CVE-2022-23305 will check for those specific CVEs. If not specified, all CVEs will be checked (subject to other filters).e.g. CVE-2023-.* |
Data tables
Structured output this recipe can produce.
- Vulnerability reportA vulnerability report that includes detailed information about the affected artifact and the corresponding CVEs.
org.openrewrite.csharp.dependencies.table.VulnerabilityReport - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats