Find and fix vulnerable npm dependencies
org.openrewrite.nodejs.security.DependencyVulnerabilityCheckorg.openrewrite.recipe:rewrite-nodejsThis software composition analysis (SCA) tool detects and upgrades dependencies with publicly disclosed vulnerabilities. This recipe both generates a report of vulnerable dependencies and upgrades to newer versions with fixes. This recipe by default only upgrades to the latest patch version. If a minor or major upgrade is required to reach the fixed version, this can be controlled using the maximumUpgradeDelta option. Vulnerability information comes from the GitHub Security Advisory Database, which aggregates vulnerability data from several public databases.
## Customizing Vulnerability Data
Extend this recipe and override baselineVulnerabilities(ctx) to replace the bundled advisory database, or override supplementalVulnerabilities(ctx) to add organisation-specific advisories alongside the bundled data.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.nodejs.security.DependencyVulnerabilityCheckIf the recipe isn’t available locally, install it with:
mod config recipes jar install org.openrewrite.recipe:rewrite-nodejs:0.47.3Options
| Name | Type | Description |
|---|---|---|
scope | String | Match dependencies with the specified scope. Default includes all scopes. e.g. dependencies |
transitiveFixStrategy | String | Strategy for handling transitive dependency vulnerabilities. report only reports them without fixing. override adds overrides/resolutions for transitive vulnerabilities. lock-file updates the lock file to resolve safe versions without modifying package.json. Default is report.e.g. override |
preferDirectUpgrade | Boolean | When fixing transitive vulnerabilities, first try to find higher versions of direct dependencies that include safe transitive versions. Default is true.e.g. false |
maximumUpgradeDelta | String | The maximum difference to allow when upgrading a dependency version. Use none to only report vulnerabilities without making any changes.e.g. patch |
minimumSeverity | String | Only fix vulnerabilities with a severity level equal to or higher than the specified minimum. Default is low.e.g. moderate |
cvePattern | String | Only fix vulnerabilities matching this regular expression pattern. e.g. CVE-2023-.* |
fixDeclaredVersions | Boolean | When enabled, also upgrades version specifiers declared in package.json that specify vulnerable versions, even if the lock file already resolves to a safe version. Default is false.e.g. true |
addOverrideComments | Boolean | When enabled, adds a comment field (e.g. //overrides) alongside overrides to document which CVEs each override is fixing. Default is true.e.g. true |
Data tables
Structured output this recipe can produce.
- Vulnerability reportLists all vulnerabilities found in project dependencies.
org.openrewrite.nodejs.table.VulnerabilityReport - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats