Home Search Pricing Get inErrata About

Sign in Sign up

Graph/dependency-scan-drift

Pattern

Dependency Security Scan Drift

dependency-scan-drift

Vulnerability findings get out of sync with what you actually ship because scanners evaluate resolved/transitive dependency graphs, legacy vulnerability DB matches persist, and exclusion/config interfaces differ. False positives and missed supply-chain backdoors increase review workload and risk.

Node Details

Public graph metadata

Updated8/1/2026

Connections

30 linked nodes

vector-dedup and semantic-search integration tests. Tension: the dimension gap looked like it forced either paid API keys in CI or invasive schema parameterization. Outcome: every embedding-dependent test skipped or failed.

GitHub Advanced Security (via MicrosoftSecurityDevOps/ESLint scanning in Azure DevOps pipelines) flags @microsoft/sdl/no-html-method and @microsoft/sdl/no-inner-html violations inside standard jQuery/bootstrap/validation libraries, even though the project dependencies are up to date.

It still shows vulnerabilities. — when I pull the latest python:3.11-slim image. Tension: There are three vulnerabilities: CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492).

We run `dotnet list .sln package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json` nightly on our CI server. Tension: update the runtime on our CI server and instruct our customer to do the same on their machines.

this dependency has 2 critical vulnurabilities — org.eclipse.jetty jetty-websocket 8.1.1.v20120215. Tension: there are no correspondng version of `jetty-websocket` so I have no idea how can I fix this issue. Outcome: Those vulnerabilities are fixed in jetty-server » 9.3.24.v20180605.

Nightly GHAS dependency scanning in Azure DevOps detects vulnerabilities, but there is no automatic way to notify users when new vulnerabilities are found. Users must manually check alerts across multiple repositories each morning.

Dependabot flagged this issue but cannot update webpack-dev-middleware to a non-vulnerable version. Tension: updating to a secure version seems non-trivial.

Web applications running on Wildfly but built using outdated NodeJS versions may have security vulnerabilities. The user is unsure whether the NodeJS version used to build/run the app matters when NodeJS is not the runtime on production.

SonarCloud raises javasecurity:S2083 because the code constructs a File/FileInputStream path using user-influenced data, which could enable path traversal/path injection (e.g., using ../).

Adding nondeterministic compilation breaks reproducible builds — users will no longer be able to verify the packages they install. Tension: this security measure is a good example of so-called security theater. Outcome: it will not provide additional security for most of the cases, but will greatly complicate a lot of things.

it will likely result in a number of nondeterministic bugs — users of source-based distributions could take advantage of this security measure. Tension: which will be impossible to locate automatically. Outcome: will greatly complicate a lot of things.

you are going to get a change request — if you don't keep your front-end dependencies up-to-date after a year or two. Tension: that will require you to upgrade an existing dependency for compatibility, that will break 5 other things. Outcome: you won't be able to modify them without declaring package.json bankruptcy and starting over.

An attacker finds a vulnerability in one of your frontend-dependencies which he is able to exploit somehow — the backend stack is highly secure. Tension: malicious behavior which effects your highly secure backend-application. Outcome: keep your front end packages up-to-date.

ECR scan reports CVEs in the final Docker image

Azure defender or qualys flags it as present — after excluding the dependency and adding it exclusively. Tension: that confirms that the dependency is coming from some fat jar that is not visible via mvn dependency:tree neither by any IDE. Outcome: I want to know if there is any way we can view all the dependencies inside fat jars included in the project.

A vulnerability scanner reports a vulnerable npm package (monorepo-symlink-test) in the Docker image even though it is not explicitly wanted, and it still appears under node_modules.

Tension: it can contain false positives (very common with the OWASP tool) and "disputed" vulnerabilities. Outcome: Let's examine only t.

OWASP dependency scanning reports critical vulnerabilities in Maven dependencies used by a Java Jersey application, even after upgrading to latest versions. The scan output also includes artifacts whose provenance in the project is unclear (e.g., kerb-server).

The project’s dependency tree includes the vulnerable `inflight@1.0.6` library (deduped) via transitive dependencies of Angular build/CLI tooling, and the user needs to mitigate the vulnerability without migrating to Angular 16.

I have 7 moderate vulnerabilities with `Semver` — I have a problem with a `ViteJS` project. Tension: Depends on vulnerable versions of semver. Outcome: delete the `node_modules` and the `package-lock.json` but nothing to do it does not work.

The user wants an automated security vulnerability report for all Bower-managed dependencies similar to `npm audit`. They cannot find a Bower equivalent command/tool.

The code generator in pipeline builds the package into the deployment JAR. — building a code generation tool using JHipster. Tension: Beside approved code scanning tools, what else can be done here on security front ?

Snyk project scans do not consistently ignore/exclude folders depending on whether the project is imported via SCM versus run via the CLI, and behavior differs between Snyk Code (SAST) and Snyk Open Source scans.

Finding NuGet packages that intentionally contain known vulnerabilities for testing security tools is difficult.

I want to start measure the software security — I use sonar for detecting the vulnerabilities but it is not enough. Tension: I am not able to see the progress and effort spend on it. Outcome: what can I measure instead of number of vulnerabilities.

Disabling Visual Studio background updates may leave security vulnerabilities unpatched until manual update checks

if this indicate some security issue ?

netty-all.4.1.58.Final, which give high security risk in nexus scan — Cassandra has been using netty-all.4.1.58.Final. Tension: sonatype-2021-0789, CVSS score 8.4.

Features built on optional capabilities silently degrade across the client matrix. Outcome: Community 4's transport bugs and Community 103's capability detection failures are two symptoms of the same architectural constraint.

A CI source-grep gate blocking merges on forbidden DOM patterns. Outcome: all false positives.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Dependency Security Scan Drift - inErrata Knowledge Graph | Inerrata