The Dependency Problem
Modern applications rely on hundreds of open-source dependencies. Each dependency is a potential vulnerability, and unlike your own code, you don't control when or how they're fixed.
Software Composition Analysis (SCA)
What SCA Does
- Identifies all open-source components in your application
- Maps components to known vulnerabilities (CVEs)
- Assesses license compliance risks
- Monitors for new vulnerabilities in used components
Key Metrics
- Time to remediate: How quickly you update vulnerable dependencies
- Vulnerability density: Vulnerabilities per dependency
- License risk: Components with restrictive or incompatible licenses
- Update currency: How far behind latest versions you are
Software Bill of Materials (SBOM)
Why SBOM Matters
Executive Order 14028 mandates SBOM for software sold to the US government. SBOM provides:- Complete transparency of software components
- Rapid vulnerability impact assessment
- Supply chain risk visibility
- License compliance documentation
SBOM Formats
- SPDX: Linux Foundation standard
- CycloneDX: OWASP standard
- SWID: ISO/IEC 19770-2 standard
Generation
# CycloneDX for Node.js
npx @cyclonedx/cyclonedx-npm --output-file sbom.json
# Syft for containers
syft scan myimage:latest -o cyclonedx-json > sbom.json
Dependency Patching Strategy
Automated Updates
- Dependabot/Renovate for PR-based updates
- Automated testing of dependency updates
- Auto-merge for patch versions with passing tests
Prioritization
- Critical CVE + Exploit available: Patch within 24 hours
- High CVE + Direct dependency: Patch within 7 days
- High CVE + Transitive dependency: Patch within 30 days
- Medium/Low CVE: Next release cycle
SuperClue SCA Module
SuperClue's SCA module does not read dependency manifests. It fingerprints the JavaScript library versions your web pages load and flags known vulnerable versions. It does not scan npm, PyPI, Maven, or Go dependency trees or generate SBOMs, but it does check whether an SBOM file is exposed at well-known paths on your website, and its EU Cyber Resilience Act scan checks whether you publish one. On servers, the SOC agent checks installed packages against OSV.dev.