Back to Details

audit

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Vulnerability Scanning

漏洞扫描

Scan project dependencies for known vulnerabilities using the OSV database.
使用OSV数据库扫描项目依赖项中的已知漏洞。

Commands

命令

Scan for vulnerabilities:
bash
git-pkgs vulns scan
Show who introduced each vulnerable dependency:
bash
git-pkgs vulns blame
Options:
  • --ecosystem=ECO
    - filter by ecosystem
  • --severity=LEVEL
    - filter by severity (critical, high, medium, low)
  • --json
    - JSON output
扫描漏洞：
bash
git-pkgs vulns scan
查看引入每个易受攻击依赖项的人员：
bash
git-pkgs vulns blame
选项：
  • --ecosystem=ECO
    - 按生态系统筛选
  • --severity=LEVEL
    - 按严重程度筛选（critical、high、medium、low）
  • --json
    - JSON格式输出

Responding to vulnerabilities

漏洞响应流程

When vulnerabilities are found, check in order:
  1. Reachability - is the vulnerable code path actually called? Many CVEs affect features you don't use.
  2. Update - is a patched version available? Use 
    git-pkgs outdated <package>
    to check.
  3. Override transitive - force a newer version of the vulnerable transitive dependency.
  4. Fork and patch - apply the security fix to a fork.
  5. Remove - find an alternative or inline the functionality.
  6. Accept risk - document why it's not exploitable in your context.
发现漏洞时，请按以下顺序处理：
  1. 可达性 - 易受攻击的代码路径是否实际被调用？许多CVE影响的是您未使用的功能。
  2. 更新 - 是否有已修复的版本可用？使用
    git-pkgs outdated <package>
    进行检查。
  3. 覆盖传递依赖 - 强制使用易受攻击传递依赖项的较新版本。
  4. 分支并修补 - 将安全修复应用到分支版本。
  5. 移除 - 寻找替代方案或内联功能。
  6. 接受风险 - 记录在您的场景中为何该漏洞无法被利用。

When to use

使用场景

  • Before releases or deployments
  • During security reviews
  • When the user asks about vulnerabilities
  • In CI pipelines to catch new CVEs
  • 发布或部署前
  • 安全审查期间
  • 用户询问漏洞情况时
  • 在CI流水线中捕获新的CVE