How are dependencies checked for vulnerabilities?
amaise automatically checks all third-party dependencies with every build:
Tool | Language | Behavior |
OWASP Dependency Check | Java | Build fails on CVSS ≥ 7 |
Snyk | Python | Continuous monitoring with alerting |
npm audit | TypeScript | With every build |
pip-audit | Python | With every build |
Additionally, license checks are performed: Copyleft licenses (AGPL, GPLv3, SSPL) are blocked in all languages to avoid supply chain risks.
All dependencies are version-locked (no floating versions). The current major versions are: Java 21, Spring Boot 3.5.7, Python 3.14, Vue 3. Dependencies are sourced exclusively from official registries (Maven Central, PyPI, npm).