Dependency Security

The Security sub-tab of the Health tab finds known vulnerabilities in the Composer, npm and NuGet packages of a project. It reads the exact versions from the lockfiles and checks them against public advisory databases. You can upgrade a package with one click, or send the upgrade to your AI tool.

The sub-tab is available for all projects. DevWorkspace Pro also checks your projects in the background and tells you about new vulnerabilities.

Supported lockfiles

The check needs a lockfile in the project folder. A manifest without a lockfile does not give exact versions.

Ecosystem	Lockfile	Package manager
Composer	composer.lock	Composer
npm	package-lock.json or npm-shrinkwrap.json	npm
npm	pnpm-lock.yaml	pnpm
npm	yarn.lock (Yarn classic and Yarn Berry)	Yarn
npm	bun.lock	Bun

The check includes direct and transitive dependencies, and production and dev dependencies.

For .NET projects, see NuGet packages.

If a project has more than one npm lockfile, DevWorkspace Pro uses the first one in the order of the table. The sub-tab shows a note for each lockfile that it did not check.

The sub-tab also shows a note when:

• composer.json has no composer.lock, or package.json has no lockfile. These packages are not checked.
• The project has only bun.lockb. This binary lockfile is not supported. Run bun install --save-text-lockfile to create bun.lock, then click Rescan.
• A lockfile cannot be read.

If the project has no supported lockfile and no .NET project or solution file, the sub-tab shows No lockfile to check.

NuGet packages

For a .NET project, DevWorkspace Pro runs this command in the project folder:

dotnet list <target> package --vulnerable --include-transitive --format json

• The target is the solution (*.sln, else *.slnx) in the project folder. Without a solution, it is each project file (*.csproj, *.fsproj, *.vbproj) in the project folder or its subfolders.
• The dotnet CLI gets the advisories from your NuGet sources (nuget.org by default). DevWorkspace Pro then gets the title and the fixed version from OSV.dev.
• The number of NuGet packages comes from obj/project.assets.json of each project.
• The command runs in the background. DevWorkspace Pro keeps the result and runs the command again when a project or solution file changes, or when the saved data is no longer recent. Rescan always runs the command again.

The check needs the .NET 8 SDK or later. If dotnet is not installed or is older, the sub-tab shows a note and does not check the NuGet packages. The other packages are checked as usual.

The command needs restored projects. If a project is not restored, the sub-tab shows a note. Run dotnet restore, then click Rescan.

Advisory sources

DevWorkspace Pro sends only package names and versions to these services:

Source	Used for
Packagist	Composer advisories. This is the data that composer audit uses.
npm registry	npm advisories. This is the data that npm audit uses.
OSV.dev	More details for each vulnerable package, for example fixed versions and the disclosure date. Optional: advisories that only OSV.dev reports. See OSV-only advisories.

When two sources report the same vulnerability (the same CVE, GHSA or PKSA ID), the sub-tab shows it one time.

DevWorkspace Pro keeps the advisory data on your computer and uses recent data again. Rescan always gets new data.

Composer audit settings

DevWorkspace Pro uses the audit settings in composer.json. Advisories in config.audit.ignore and severities in config.audit.ignore-severity do not show.

{
    "config": {
        "audit": {
            "ignore": ["CVE-2024-12345"],
            "ignore-severity": ["low"]
        }
    }
}

The Security sub-tab

When you open the sub-tab, DevWorkspace Pro checks the project. If the lockfiles and the settings did not change and the saved result is recent, the sub-tab shows the saved result. Click Rescan to check again now.

Below the title, the sub-tab shows when the check occurred and the number of packages, for example Checked 2 min ago · 84 Composer and 612 npm packages.

Severity tiles

Four tiles show the number of findings for each severity: Critical, High, Medium and Low. Advisories that use the name "moderate" show as Medium. When some findings have no known severity, a fifth tile, Unknown, shows their number.

Click a tile to show only that severity. Click more tiles to add more severities. Click a tile again to remove it.

If there are no findings, the sub-tab shows No known vulnerabilities.

The finding list

Each row is one vulnerability in one package version:

Column	Details
Severity	Critical, High, Medium, Low or Unknown.
Package	The package name and the advisory title. Badges: New, dev (dev dependency) and transitive (not in composer.json or package.json).
Installed	The version in the lockfile.
Fixed in	The first version without this vulnerability, and the type of upgrade: patch, minor or major. No fix yet means that no fixed version is published.
Disclosed	When the advisory was published. Move the pointer over it to see the date.

The list shows the most severe findings first. To sort by a different column, click Severity, Package, Fixed in or Disclosed. Click the column again to change the direction.

Use the toolbar to filter the list:

• Search: type a package name, title or advisory ID. Press / to go to the search box. Press Esc to clear it.
• Ecosystem: All, Composer, npm or NuGet. This shows only when the list has more than one ecosystem.
• Dependency type: All dependencies, Direct or Transitive.
• Environment: Production and dev, Production only or Dev only.

Finding details

Click a row, or press Enter, to open the details:

• Advisories: links to the GitHub advisory, the NVD page of the CVE, the source advisory and the OSV.dev page.
• Affected versions: the vulnerable version ranges.
• Installed: the version, and if it is a direct or transitive, production or dev dependency.
• Fixed in: the fixed version and the upgrade type. If a higher version also fixes all other known advisories of the package, the sub-tab shows it.
• Sources: the databases that report the advisory, and the CVSS score if it is known.
• The upgrade command. Click the copy icon to copy it.

For a transitive dependency, the fix can need an update of the package that requires it.

Upgrade packages

DevWorkspace Pro makes the upgrade command from the lockfile type:

Package	Command
Composer	composer update <package> --with-all-dependencies
Composer, direct, major upgrade	composer require <package>:^<version> --with-all-dependencies (with --dev for a dev dependency)
npm, direct	npm install, pnpm add, yarn add or bun add with <package>@<version>
npm, transitive	npm update, pnpm update --depth Infinity, yarn up -R or bun update with the package name
NuGet	dotnet add <project> package <package> --version <version> for each project that uses the package. For a transitive package, this adds a direct reference that sets the fixed version.

Run commands in DDEV

For a running DDEV project, the commands run inside DDEV: ddev composer ... and ddev exec npm .... dotnet commands always run on your computer. For a stopped DDEV project or a project without DDEV, they run on your computer in the project folder. The upgrade dialog tells you where the commands run.

To always run the commands on your computer, turn off Run Fix Commands via DDEV in Preferences.

Upgrade one package

1. Open the finding and click Upgrade.
2. The dialog shows the command, the packages and the target versions. Click Run command.

The command runs in a headless terminal. The status bar shows the progress. When the command finishes, DevWorkspace Pro checks the project again and shows the result:

• Upgrade complete. The vulnerability is fixed.
• Upgrade complete, but the packages are still vulnerable: the version constraints in your composer.json or package.json can stop the update. The row shows Still vulnerable. Click Send to AI to make the necessary changes.
• The upgrade stopped because a command failed: the message shows the command that failed. The next commands do not run.

Major upgrades

A major upgrade can have breaking changes. The dialog shows a warning. Read the upgrade guide of the package first, or click Send to AI instead.

Fix all safe updates

When some findings have a patch or minor fix, the sub-tab shows Fix N safe updates. Click it to upgrade all these packages together. DevWorkspace Pro groups the packages into as few commands as possible. The commands run one after the other.

Major upgrades are not included. The dialog shows them under Not included. Click Send to AI there to send them to your AI tool.

Select more than one finding

1. Select the check box of each finding. To select all shown findings, select the check box in the list header, or press ⌘+A (Ctrl+A) when a row has the focus. Space selects the row that has the focus.
2. In the toolbar, click Upgrade selected or Send selected to AI. Click Clear to clear the selection.

Upgrade selected includes major upgrades.

Send to AI

Send to AI opens the Send to AI dialog with a prompt for your AI tool. The prompt includes each package, its package manager, the installed and target versions, the advisories and their links. It tells the AI tool to:

1. Read the upgrade guide and changelog of each package.
2. Upgrade the packages (inside DDEV for a running DDEV project) and make the necessary code changes.
3. Run the test suite and fix what breaks.
4. Not commit the changes.

A finding shows Send to AI when the fix is a major upgrade, or when no fixed version is published.

Ignore a finding

1. Open the finding and click Ignore.
2. Optional: type a Reason.
3. Select when the ignore expires: 30 days, 90 days or Never.
4. Click Ignore.

An ignored finding does not count in the tiles, badges and notifications. To see ignored findings, click Ignored in the toolbar. To show the finding again, open it and click Stop ignoring. When an ignore expires, the finding shows again.

An ignore applies to the advisory in that package, for all versions of the package. Ignores are kept for each project on your computer.

OSV-only advisories

OSV.dev reports some advisories that composer audit and npm audit do not report. To see them, turn on Include OSV-Only Advisories in Preferences. DevWorkspace Pro then checks every locked package on OSV.dev.

These findings show in a separate section, Also reported by OSV, below the list. Check each one before you act on it.

Badges and project lists

The project lists show the result of the last check:

Place	What it shows
Health tab label	The number of findings. The color shows the highest severity: red for critical or high, orange for medium, blue for low.
Projects sidebar	A shield icon in the color of the highest severity.
Dashboard project card	A shield icon with the number of findings, in the color of the highest severity. Move the pointer over it to see the number of findings for each severity. Click it to open Health › Security.
Hover card of a project	The number of findings for each severity, and when the check occurred.
Overview tab	The Security card. See The Security card.

A badge shows when a project has findings that are not ignored. The badges count all severities, not only the severities at or above Minimum Severity to Notify. Hidden findings (for example dev dependencies when Include Dev Dependencies is off) do not count.

DevWorkspace Pro keeps the result of the last check on your computer. When the app starts, the badges show this saved result immediately. They do not wait for the background check. When a check finishes, the badges change.

A small orange dot shows that there are new findings. The dot goes away when you open Health › Security.

The Security card

The Overview tab of a project shows a Security card with the result of the last check:

Status	Details
N vulnerabilities found	The number of findings for each severity, including Unknown, and when the check occurred. A new badge shows the number of new findings.
No known vulnerabilities	When the check occurred and the number of packages.
Not checked yet	The project was not checked before. Click Check now.
No lockfile to check	See Supported lockfiles.
Checking dependencies…	A check is running.
The check did not complete	The error message. Click Try again.
Security checks are off	Check Composer Packages, Check npm Packages and Check NuGet Packages are all off. The card does not show saved findings.

The card has these buttons:

• Fix N safe updates: shows when some findings have a patch or minor fix. It opens the same dialog as in Health › Security. See Fix all safe updates.
• Rescan: checks the project again now.
• View details: opens Health › Security.

When Dependency Security Checks is Off, the card shows Background checks off after the check time.

When the advisory sources cannot be reached, the sub-tab shows the saved result and Offline. Click Retry to check again.

Background checks

DevWorkspace Pro checks your projects in the background:

• It checks the projects that show on the Projects page or the dashboard, and the projects that it checked before. It checks one project at a time.
• It checks a project again when its last check is older than the interval: Daily (default) or Weekly.
• It does not check when your computer is offline or on battery power.

Rescan when a lockfile changes

When a lockfile, composer.json or package.json changes, DevWorkspace Pro checks the project again shortly after. Only projects that were checked before are watched.

On Windows, when a WSL Distribution is set, DevWorkspace Pro cannot get change events from the WSL file system. It examines these files at regular intervals instead. When a file changes, it checks the project again.

Notifications

When a background check finds a new vulnerability, you get a system notification, for example New vulnerability in my-project. Click it to open Health › Security of the project.

You get a notification only for findings at or above Minimum Severity to Notify. The default is High. A finding with no known severity counts as Medium for this setting.

Settings

Open Preferences → Monitoring:

Setting	Default	Details
Dependency Security Checks	Daily	Daily, Weekly or Off. With Off, a check occurs only when you open Health › Security.
Notify About New Vulnerabilities	On	Shows a notification when a background check finds a new vulnerability.
Minimum Severity to Notify	High	Critical, High, Medium or Low. A finding with no known severity counts as Medium. The sub-tab always shows all findings.
Rescan When a Lockfile Changes	On	See Rescan when a lockfile changes.
Include Dev Dependencies	On	When off, DevWorkspace Pro still checks dev dependencies, but hides their findings in the sub-tab, badges and notifications. The sub-tab shows the number of hidden findings and why, for example 3 hidden: dev dependencies (2), npm off (1).
Include OSV-Only Advisories	Off	See OSV-only advisories.
Check Composer Packages	On	Checks composer.lock.
Check npm Packages	On	Checks package-lock.json, yarn.lock, pnpm-lock.yaml or bun.lock.
Check NuGet Packages	On	Checks .NET projects with dotnet list package --vulnerable. See NuGet packages.
Run Fix Commands via DDEV	On	See Run commands in DDEV.

Troubleshooting

Problem	What to do
No lockfile to check	Run composer install, npm install or the install command of your package manager to create the lockfile. Then click Rescan.
A note says that the .NET SDK is missing	Install the .NET 8 SDK or later. Make sure that dotnet --version works in your terminal. Then click Rescan.
A note says that some .NET projects were not checked	Run dotnet restore in the project folder. Then click Rescan.
The sub-tab shows Could not reach a source	Make sure that your computer is online. Then click Retry. The sub-tab shows the saved result.
A package is still vulnerable after Upgrade	The version constraint in composer.json or package.json does not allow the fixed version. For a transitive dependency, the package that requires it can block the update. Click Send to AI.
No notifications	Make sure that Notify About New Vulnerabilities is on, and that the finding is at or above Minimum Severity to Notify. Background checks do not run on battery power.