> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/code-reviews/dependency-analysis.md).

# Dependency Analysis

## Overview

Nullify continuously monitors every package dependency for known CVEs and determines how risky they are within the context of your application and where it runs. It reviews all packages on your default branch periodically to catch new CVEs as they emerge, and analyzes every pull request to prevent new CVEs from being introduced. This combines vulnerability detection with application context to separate noise from genuine risk.

## What It Delivers

* **Manifest discovery** across `go.mod`, `package.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`, `pom.xml`, `build.gradle`, `libs.versions.toml`, `requirements.txt`, `pyproject.toml`, `conda-lock.yml`, `Gemfile`, `.csproj`, `composer.json`, `Cargo.toml`, and more.
* **Enriched advisories** that blend NVD, OSV, CISA Known Exploited Vulnerabilities (KEV), FIRST EPSS exploit-probability scores, vendor feeds, and Nullify intelligence to calculate severity, exploitability, and affected services.
* **Reachability reasoning** analyzes how your programs use the vulnerable code in the dependency, not just whether it is called, and how exposed it is in the infrastructure.
* **Comprehensive triage** compute a risk score comprised of technical and business context
* **Automated remediation** for Go modules, npm/pnpm, Maven, Gradle, PyPI, Poetry, Composer, RubyGems/Bundler, and NuGet with changelog summaries and optional PR creation.

See [Supported Ecosystems](/capabilities/code-reviews/dependency-analysis/supported-ecosystems.md) for per-package manifest details and for the agent-drafted autofix tiers that cover every other ecosystem (Bun, Cargo, uv, uv-managed PyPI, Conda, Yarn, Pipenv, Swift PM, Dart/Flutter, and Elixir Mix).

## Scanners and package intelligence

The local dependency scan combines Trivy filesystem vulnerability results with OSV Scanner results and deduplicates them. GitHub Actions workflow references are also dependency inputs and are checked in the GitHub Actions ecosystem. Workflow dependency detection does not imply an SCA autofix exists for those references.

Malicious-package intelligence is distinct from a CVE: a match against the OpenSSF malicious-package feed can produce a malicious verdict without a vulnerability advisory. Missing advisory, KEV, or EPSS data is not proof a package is safe.

For dependencies hosted outside public registries, configure a [private package registry](/connectors/package-registries.md) with the credentials and scope required to resolve its metadata.

## Container images

Container scanning inventories image packages with Syft and checks vulnerabilities with Grype. Findings are exposed separately from source dependency findings, with image/package context, triage, tickets, and scan activity. A base-image upgrade can be proposed through container autofix when the affected image maps to a supported repository change; review the resulting build and application tests before merging.

See the [Dependency Analysis API](/api-reference/api-reference/dependency-analysis.md) for container findings, triage, and autofix polling. Container package presence and source-code reachability are different signals.

## Related

* [Threat Intelligence](/capabilities/threat-intelligence.md): newly disclosed vulnerabilities and supply-chain compromises assessed against your whole environment, not only the next scan.