Dependency vulnerability reports

Identifies dependency / software composition analysis (SCA) vulnerability reports - npm/pip audit, Snyk, Dependabot, OWASP Dependency-Check, Trivy/Grype - with package coordinates, advisory IDs and installed/fixed versions. General vulnerability assessment reports are covered by global-vulnerability-assessment-report.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: tool/report wording is discovery-only; enforcement requires package, advisory or version structure, and 85 adds a second structure and dependency context.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:dependency\s+(?:vulnerabilit(?:y|ies)|scan|check|audit)(?:\s+report)?|software\s+composition\s+analysis|SCA\s+(?:scan|report|findings|results)|(?:npm|yarn|pnpm|pip)\s+audit|OWASP\s+Dependency[\s-]Check|Dependabot\s+(?:alerts?|security\s+updates?)|Snyk\s+(?:test|scan|report|monitor)|vulnerable\s+(?:dependency|dependencies|packages?)|(?:Trivy|Grype)\s+(?:scan|report)|SBOM\s+vulnerability\s+report)\b

Corroborative evidence keywords

transitive dependency, direct dependency, reachable, package-lock.json, critical severity

Proximity: 300 characters

Should match

Snyk test report - billing-api (branch main) Package: org.apache.logging.log4j:log4j-core:2.14.1 (transitive dependency via spring-boot-starter-log4j2) Advisory: CVE-2021-44228 Severity: critical Installed: 2.14.1 Fixed in: 2.17.1 Package: lodash@4.17.20 Advisory: CVE-2021-23337 Fixed in: 4.17.21 — High tier (85) - package coordinates, advisory IDs and fixed versions with transitive dependency context
npm audit output for the intranet front end: minimist@1.2.5 flagged, see the ticket for details. — Medium tier (75) - package coordinate only
Dependabot alerts for the rates portal - GHSA-29mw-wpgm-hmr9 raised this morning. — Medium tier (75) - advisory ID only
The dependency scan report for the portal is attached to the change request. — Discovery tier (65) - report wording only

Should not match

nessus vulnerability — Generic vulnerability wording outside the SCA scope
The quarterly vulnerability report is attached. — General vulnerability report wording is no longer a primary
OWASP guidance note: organisations should run a dependency check on every build and upgrade to the fixed version. — Guidance text
Dependency scan report template Package: ______ Advisory: ______ Fixed in: ______ — Blank template
Media release: researchers say vulnerable dependencies such as log4j-core@2.14.1 remain common in open-source projects. — News framing with a package coordinate must not enforce

Known false positives

Public advisories (GitHub Advisory Database, NVD) and changelogs list package versions and advisory IDs. Mitigation: Primary requires SCA report/tool wording; guidance, news, training and template framing are excluded. Public advisory pages titled as dependency reports can still reach enforce tiers.