Attempt to enrich given dependency with vulnerability details from OSS
Index component-report.
176016
private void enrich(final Dependency dependency) {
        log.debug("Enrich dependency: {}", dependency);

        for (Identifier id : dependency.getSoftwareIdentifiers()) {
            if (id instanceof PurlIdentifier) {
                log.debug("  Package: {} -> {}", id, id.getConfidence());

                PackageUrl purl = parsePackageUrl(id.getValue());
                if (purl != null) {
                    try {
                        ComponentReport report = reports.get(purl);
                        if (report == null) {
                            throw new IllegalStateException("Missing component-report for: " + purl);
                        }

                        // expose the URL to the package details for report generation
                        id.setUrl(report.getReference().toString());

                        for (ComponentReportVulnerability vuln : report.getVulnerabilities()) {
                            Vulnerability v = transform(report, vuln);
                            Vulnerability existing = dependency.getVulnerabilities().stream().filter(e->e.getName().equals(v.getName())).findFirst().orElse(null);
                            if (existing!=null) {
                                //TODO - can we enhance anything other than the references?
                                existing.getReferences().addAll(v.getReferences());
                            } else {
                                dependency.addVulnerability(v);
                            }
                        }
                    } catch (Exception e) {
                        log.warn("Failed to fetch component-report for: {}", purl, e);
                    }
                }
            }
        }
    }
273892
private final void fixReportDependencyAnalysis(final Element root) {
        for (final Element head : root.getElementsByTag("h2")) {
            head.tagName("h1");
        }

        for (final Element head : root.getElementsByTag("h3")) {
            head.tagName("h2");
        }
    }
795516
private boolean vulnerabilitiesMatch(Dependency dependency1, Dependency dependency2) {
        final Set<Vulnerability> one = dependency1.getVulnerabilities();
        final Set<Vulnerability> two = dependency2.getVulnerabilities();
        return one != null && two != null
                && one.size() == two.size()
                && one.containsAll(two);
    }
880421
private Map<String, DependencyInfo> parseDepsFiles() throws IOException {
    DepsFileParser depsParser = createDepsFileParser();
    Map<String, DependencyInfo> depsFiles = new LinkedHashMap<>();
    for (SourceFile file : deps) {
      if (!shouldSkipDepsFile(file)) {
        List<DependencyInfo>
            depInfos = depsParser.parseFileReader(
                file.getName(), file.getCodeReader());
        if (depInfos.isEmpty()) {
          reportNoDepsInDepsFile(file.getName());
        } else {
          for (DependencyInfo info : depInfos) {
            depsFiles.put(info.getPathRelativeToClosureBase(), removeRelativePathProvide(info));
          }
        }
      }
    }

    // If a deps file also appears in srcs, our build tools will move it
    // into srcs.  So we need to scan all the src files for addDependency
    // calls as well.
    for (SourceFile src : srcs) {
      if (!shouldSkipDepsFile(src)) {
        List<DependencyInfo> srcInfos =
            depsParser.parseFileReader(src.getName(), src.getCodeReader());
        for (DependencyInfo info : srcInfos) {
          depsFiles.put(info.getPathRelativeToClosureBase(), removeRelativePathProvide(info));
        }
      }
    }

    return depsFiles;
  }
1153873
private void versionDependencyError(String message, String actual, String minimum) {
        if (isSnapshot(actual) || isSnapshot(minimum)) {
            LOGGER.log(WARNING, "Suppressing dependency error in {0} v{1}: {2}", new Object[] {getLongName(), getVersion(), message});
        } else {
            dependencyErrors.put(message, false);
        }
    }
805543
function gatherDependencies (root, options, callback) {
  if (typeof options === 'function') {
    callback = options
    options = {}
  }

  options = extend(defaultOptions, options)

  /**
   * read-package-tree callback
   * @param  {error}  err  read-package-tree error
   * @param  {object} data read-package-tree blob (contains cyclical refrences)
   */
  var rpt_cb = function rpt_cb (err, data) {
    if (err) return logger.error(err)
    if (data.error) return logger.error(data.error)
    if (!data.package) {
      logger.warn('`data.package` not defined. Initializing placeholder.')
      data.package = {}
    }

    var dependencyReport = {}

    if (!data.package || !data.package.name) logger.warn('`data.package.name` missing')
    dependencyReport.name = data.package.name

    if (!data.package || !data.package.version) logger.warn('`data.package.version` missing')
    dependencyReport.version = data.package.version

    if (options.meta) {
      dependencyReport.meta = {
        nodeVersions: process.versions,
        date: Date.now()
      }
    }

    buildDependencyReport(dependencyReport, data, options, 0)

    // Finally, return gatherDependencies callback
    callback(null, dependencyReport)
  }

  fs.stat(path.resolve(root, 'node_modules'), function (err, stats) {
    if (err && err.code === 'ENOENT') {
      fs.stat(path.resolve(root, 'package.json'), function (er, sta) {
        if (er && er.code === 'ENOENT') {
          return callback(new Error('No module found'))
        }
        return callback(new Error('Need to run \`npm install\` first.'))
      })
    }
  })

  readPackageTree(root, options.filter, rpt_cb)
}
659272
def add_dependency(self, value):
        """"""
        if value.name in self.dependencies:
            self.dependencies[value.name.lower()].append(value)
        else:
            self.dependencies[value.name.lower()] = [ value ]
1191651
function extractDependencyIds(options) {
  const dependencies = [];

  function extract(items) {
    // Invalid if not Array
    if (Array.isArray(items)) {
      items.reduce((dependencies, item) => {
        // Items can be Array with depedency as first param
        const dep = Array.isArray(item) ? item[0] : item;

        // Only gather string references, not functions/modules
        if ('string' == typeof dep) dependencies.push(dep);
        return dependencies;
      }, dependencies);
    }
  }

  if (options.plugins) extract(options.plugins);
  if (options.presets) extract(options.presets);

  return dependencies;
}
1291215
def dependencies(dist, recursive=False, info=False):
    """"""

    def case_sorted(items):
        """Return unique list sorted in case-insensitive order."""
        return sorted(set(items), key=lambda i: i.lower())

    def requires(distribution):
        """Return the requirements for a distribution."""
        if recursive:
            req = set(pkg_resources.require(distribution.project_name))
            req.remove(distribution)
            return {r.as_requirement() for r in req}
        return distribution.requires()

    def modifier(distribution):
        """Return project's name or full requirement string."""
        return str(distribution) if info else distribution.project_name

    return case_sorted(modifier(r) for r in requires(dist))
655900
def set_dependencies(ctx, archive_name, dependency=None):
    '''
    
    '''

    _generate_api(ctx)
    kwargs = _parse_dependencies(dependency)

    var = ctx.obj.api.get_archive(archive_name)

    var.set_dependencies(dependencies=kwargs)
588879
def addDependencyInfo(self):
        
        logger.debug("Adding dependency info to the AboutDialog")
        self.progressLabel.setText("Retrieving package info...")
        self.editor.clear()

        self._addModuleInfo(mi.PythonModuleInfo())
        self._addModuleInfo(mi.QtModuleInfo())

        modules = ['numpy', 'scipy', 'pandas', 'pyqtgraph']
        for module in modules:
            self._addModuleInfo(module)

        self._addModuleInfo(mi.PillowInfo())
        self._addModuleInfo(mi.H5pyModuleInfo())
        self._addModuleInfo(mi.NetCDF4ModuleInfo())

        self.progressLabel.setText("")
        logger.debug("Finished adding dependency info to the AboutDialog")
556054
def find_vulns_by_cve(cve)
      uri  = '/api/2.0/vulnerability_definitions'
      resp = AJAX.get(self, uri, AJAX::CONTENT_TYPE::JSON, cve: cve)
      json = JSON.parse(resp, symbolize_names: true)
      json[:resources].map { |e| VulnerabilityDefinition.new.object_from_hash(self, e) }
    end
485358
function getDependencis(file, moduleId) {
    var res = [];

    if (!fs.existsSync(file)) {
        return res;
    }

    var codeAST = amd.getAst(fs.readFileSync(file));
    var info = amd.analyseModule(codeAST);

    var dependencies = info.actualDependencies || [];

    return dependencies.slice(info.factoryAst.params.length).map(function (id) {
        return amd.resolveModuleId(id, moduleId);
    });
}
1046560
function usage() {
        console.log("Audit installed packages and their dependencies to identify known");
        console.log("vulnerabilities.");
        console.log();
        console.log("If a package.json file is specified as an argument, only the dependencies in");
        console.log("the package file will be audited.");
        console.log();
        console.log(colors.bold.yellow("Limitations"));
        console.log();
        console.log("As this program depends on the OSS Index database, network access is");
        console.log("required. Connection problems with OSS Index will result in an exception.");
        console.log();
        console.log("The vulnerabilities do not always indicate all (or any) of the affected");
        console.log("versions it is best to read the vulnerability text itself to determine");
        console.log("whether any particular version is known to be vulnerable.");
}
59765
private void gatherEvidence(Dependency dependency, final String name,
            String contents) {
        final Matcher matcher = AC_INIT_PATTERN.matcher(contents);
        if (matcher.find()) {
            dependency.addEvidence(EvidenceType.PRODUCT, name, "Package", matcher.group(1), Confidence.HIGHEST);
            dependency.addEvidence(EvidenceType.VERSION, name, "Package Version", matcher.group(2), Confidence.HIGHEST);

            if (null != matcher.group(3)) {
                dependency.addEvidence(EvidenceType.VENDOR, name, "Bug report address", matcher.group(4), Confidence.HIGH);
            }
            if (null != matcher.group(5)) {
                dependency.addEvidence(EvidenceType.PRODUCT, name, "Tarname", matcher.group(6), Confidence.HIGH);
            }
            if (null != matcher.group(7)) {
                final String url = matcher.group(8);
                if (UrlStringUtils.isUrl(url)) {
                    dependency.addEvidence(EvidenceType.VENDOR, name, "URL", url, Confidence.HIGH);
                }
            }
        }
    }
163936
public void visitDependences(Archive source, Visitor v, Type level) {
        if (level == Type.SUMMARY) {
            final ArchiveDeps result = results.get(source);
            SortedMap<String, Archive> sorted = new TreeMap<>();
            for (Archive a : result.requires()) {
                sorted.put(a.getName(), a);
            }
            for (Archive archive : sorted.values()) {
                Profile profile = result.getTargetProfile(archive);
                v.visitDependence(source.getName(), source,
                                  profile != null ? profile.profileName() : archive.getName(), archive);
            }
        } else {
            ArchiveDeps result = results.get(source);
            if (level != type) {
                // requesting different level of analysis
                result = new ArchiveDeps(source, level);
                source.visitDependences(result);
            }
            SortedSet<Dep> sorted = new TreeSet<>(result.dependencies());
            for (Dep d : sorted) {
                v.visitDependence(d.origin(), d.originArchive(), d.target(), d.targetArchive());
            }
        }
    }
957898
@Override
    public void reportDependence(Symbol from, Symbol to) {
        // Capture dependencies between the packages.
        deps.collect(from.packge().fullname, to.packge().fullname);
    }