feat: support and prefer githubID vuln identifiers from RetireJS#8419
Merged
jeremylong merged 2 commits intodependency-check:mainfrom Apr 19, 2026
Merged
Conversation
Signed-off-by: Chad Wilson <[email protected]>
boring-cyborg
Bot
added
core
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Dependency-Check’s RetireJS integration to align with the current RetireJS repository schema, preferring githubID identifiers (GHSA) and preventing overly-long/multiline summary values from becoming vulnerability names (improving report readability and suppressions).
Changes:
- Refactors RetireJS analysis to centralize identifier parsing and vulnerability-name selection (CVE > GHSA > secondary IDs > “sensible” summary > fallback).
- Updates/extends tests to cover the new identifier preference behavior and adds minimal “safe” JS fixtures for version detection.
- Removes OSVDB references from documentation.
Reviewed changes
Copilot reviewed 8 out of 11 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
core/src/main/java/org/owasp/dependencycheck/analyzer/RetireJsAnalyzer.java |
Refactors RetireJS scanning + introduces RetireJsLibrary to implement new identifier preference logic (GHSA support, summary constraints, osvdb removal). |
core/src/test/java/org/owasp/dependencycheck/analyzer/RetireJsLibraryTest.java |
Adds unit coverage for new naming/identifier preference behavior (GHSA, summary rules, CVE handling). |
core/src/test/java/org/owasp/dependencycheck/analyzer/RetireJsAnalyzerIT.java |
Updates integration assertions and adds DOMPurify coverage to validate GHSA/CVE naming behavior end-to-end. |
core/src/test/java/org/owasp/dependencycheck/analyzer/RetireJsAnalyzerFiltersTest.java |
Adjusts filter tests to use the new “safe” JS fixtures. |
core/src/test/resources/javascript/jquery.safe.js |
Minimal jQuery fixture for version detection without bundling full library content. |
core/src/test/resources/javascript/angular.safe.js |
Trims Angular fixture to a minimal header while retaining version detection. |
core/src/test/resources/javascript/ember.safe.js |
Minimal Ember fixture for version detection. |
core/src/test/resources/javascript/dompurify.safe.js |
Minimal DOMPurify fixture for version detection. |
src/site/markdown/related.md |
Removes OSVDB from listed vulnerability sources. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <[email protected]>
chadlwilson
commented
Apr 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of Change
Currently the RetireJS support does not understand the newer
githubIDidentifier type within the retireJS repository schema, so if there is no CVE ID known, it will use a generic identifier rather than a stable, global known GHSA ID as the vulnerability name.Additionally if a
summaryidentifier is present (and theres no other "better" id to use) it uses it as the vulnerability name even if it is some massive multi-line string, as is the case for many GHSAs where it is raw markdown text.summaryis mainly intended as a description value, and is just intended as a fallback in RetireJS land.This PR modernizes the RetireJS support to reflect the current RetireJS DB and usage:
Behaviour changes when determining vulnerability name
githubIDis present, it is preferred to the secondary legacy project-specific identiifiers (issue,PR,bugetc)osvdbidentifiers. OSVDB is dead, and these IDs help no-one :-)summaryidentifiers are ignored if > 100 chars OR multi-lineBefore:
CVE --> osvdb-id --> indeterminateChoiceOf(project-issue, project-bug, project-PR) --> summary --> "Vulnerability in <library>"After:
CVE --> GHSA-id --> project-issue --> project-bug --> project-PR --> ifSensible(summary) --> "Vulnerability in <library>"These changes mean folks suppressing via
vulnerabilityNamemay need to update their suppressions. I think this is minor because the RetireJS DB is not particularly large, and the same happens already if RetireJS add/update IDs to existing vulns, due to the vulnerability naming preference logic. I checked our base suppressions and we don't seem to have any that refer to RetireJS.Related issues
Have test cases been added to cover the new functionality?
yes