> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/triage-and-remediation/finding-types/dependencies.md). # Dependencies (SCA) How Konvu assesses, reproduces, and fixes vulnerabilities in your open-source dependencies. A dependency finding says a package in your manifest has a known vulnerability. Many of them are not exploitable in your application: the vulnerable function is never called, or an attacker cannot reach it. Konvu checks each one against your code and tells you which ones are. | | | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Sources** | Snyk, Semgrep Supply Chain, GitHub Dependabot, Endor Labs, Arnica, GitLab Dependency Scanning, Black Duck Polaris, ArmorCode, the [findings API](/konvu/get-started/bring-in-findings.md#import-scanner-findings-with-the-api) | | **Where to find them** | **Triage > SCA** | | **Assessed** | Yes | | **Reproduced** | Early access. See [Reproducing Scanner Findings](/konvu/triage-and-remediation/exploit-reproduction/reproducing-scanner-findings.md). | | **Fix pull requests** | Yes: dependency upgrades, plus code changes when an upgrade breaks your code | | **Credits** | 1 per finding, from your organization's balance. See [Assessment Credits](/konvu/administration/assessment-credits.md). | ## What Konvu checks Every vulnerability in Konvu's database has an **exploitability checklist**: the conditions that must all hold for it to be exploitable. Each checklist is specific to its vulnerability. See [Vulnerability Enrichment](/konvu/triage-and-remediation/finding-types/dependencies/vulnerability-enrichment.md). An agent then checks each condition against your repository: * **Is the vulnerable version installed?** Konvu builds its own dependency graph and does not rely only on the scanner's direct or transitive flag. * **Does the environment match?** Operating system, runtime, and configuration requirements from the vulnerability. * **Is the vulnerable code reachable?** The finding shows the path from your code to the vulnerable function, or the proof that no path exists. * **Can an attacker control the input?** Whether untrusted input reaches the vulnerable function, and whether it is validated on the way. *Example: CVE-2024-47561 in `avro` requires deserializing an attacker-supplied schema. If your code only reads schemas bundled with the application, the finding is a False Positive, and the evidence shows the code paths Konvu checked.* ## Results | Result | Meaning | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Exploitable** | Every condition on the checklist holds. | | **False Positive** | At least one condition does not hold. | | **Needs input** | Konvu has a question only you can answer, such as whether a service is internet-facing. See [Answering Konvu's Questions](/konvu/triage-and-remediation/exploitability-assessment/answering-konvus-questions.md). | | **Inconclusive** | Konvu ran but could not settle the checklist. | A finding without a result says why: a private registry is not configured, the credit budget is reached, or the assessment could not conclude. See [How Assessments Work](/konvu/triage-and-remediation/exploitability-assessment/how-assessments-work.md). ## Act on the results * **Dismiss false positives in your scanner.** Dismissals write back to supported scanners, including GitHub Dependabot, GitLab, and ArmorCode (recorded there as an accepted risk or a false positive). See [Dismissing False Positives](/konvu/triage-and-remediation/triage/dismissing-false-positives.md). * **Fix exploitable findings.** Konvu prepares a remediation plan with the target version, the API changes between versions, and the lines in your code they affect, then opens a pull request. When private dependencies block a complete fix, you still get a partial plan. See [Fix Pull Requests](/konvu/triage-and-remediation/remediate/fix-pull-requests.md). * **Get proof.** If scanner reproduction is enabled for your organization, you can reproduce a finding Konvu assessed as **Exploitable**. See [Reproducing Scanner Findings](/konvu/triage-and-remediation/exploit-reproduction/reproducing-scanner-findings.md). ## What Konvu does NOT do * It does not find vulnerable dependencies itself. Findings come from your scanner or the API. * It cannot assess packages from a private registry it has no credentials for. Konvu supports private npm, Maven, and PyPI registries on JFrog Artifactory. * It does not assess findings outside your [assessment scope](/konvu/administration/assessment-settings.md). New organizations assess Critical and High severity by default. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.konvu.com/konvu/triage-and-remediation/finding-types/dependencies.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.