How to Build a Python-Based Dependency Vulnerability Scanner from Scratch

·1 views

A tutorial published on DEV Community walks developers through building a lightweight dependency vulnerability scanner using Python. The scanner parses a project's requirements.txt file and queries the National Vulnerability Database (NVD) API to identify known CVEs in listed packages. Unlike existing tools such as pip-audit or safety, a custom-built scanner gives teams full control over output formats, CI pipeline integration, and risk-tolerance logic. The project requires only Python and the requests library, keeping dependencies minimal. The guide is aimed at developers looking to strengthen supply-chain security awareness and integrate vulnerability checks directly into their workflows.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Game Developers Should Plan World Logic Before Creating Any 3D Assets

A new perspective in game environment development argues that worldbuilding should precede asset production, rather than the other way around. Developers are encouraged to document a location's purpose, history, materials, and environmental influences before opening tools like Blender, Maya, or Unreal Engine. Addressing these foundational questions early is said to bring consistency across the entire production pipeline. The approach offers practical benefits including more coherent architecture, faster asset prioritization, and reduced unnecessary prop creation. Ultimately, the argument is that every 3D model should emerge as part of a deliberate, interconnected world system rather than as an isolated creation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How NumPy Math Tricks Cut Memory and Speed Up Face Recognition Databases

As person-recognition knowledge bases grow, computing pairwise distances between face and body embeddings becomes a major computational bottleneck. A step-by-step optimization study compares naive Python nested loops against progressively smarter NumPy-based approaches. While NumPy broadcasting eliminates inner loops elegantly, it creates large temporary tensors that consume excessive memory for high-dimensional embeddings. The most effective solution exploits a squared Euclidean distance identity to compute only the final N×M distance matrix, bypassing bulky intermediate tensors. Benchmarks on an Intel i9-14900HX laptop show this final approach delivers a 2.8× to 3.4× speedup over the original Python loop implementation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Adapts Multi-Stage Docker Builds to Work Around Legacy v1.29 Constraints

A developer faced compatibility challenges while standardizing Docker builds across nine microservices — including auth, booking, and payment — using legacy Docker v1.29.2. The older daemon lacked BuildKit support, meaning modern caching flags failed and all build stages were processed sequentially rather than selectively. Without root access to upgrade the Docker engine, upgrading the environment was not an option. The team resolved the issue by reordering Dockerfile.base so JVM runtime stages appeared before heavier GraalVM compilation steps, preventing unnecessary processing. Explicit build targets were also declared in docker-compose.yml to force the legacy engine to stop cleanly at the required JVM stage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Better AI prompts beat bigger models for most everyday tasks, developers say

A software development perspective published on DEV Community argues that poor prompt design — not model limitations — is the primary reason AI features underperform. The article identifies four core prompting techniques: providing clear context, using input-output examples (few-shot prompting), specifying the exact output format, and assigning a concrete role to the model. According to the author, teams frequently waste time on model comparisons when a more precise prompt would have solved the problem with the existing model. Explicit formatting instructions, such as requesting valid JSON with defined keys, can also improve output quality by forcing the model to commit to specific answers rather than hedging. The piece concludes that prompt improvements are both free and faster to implement than switching to a larger, costlier model.

0 comments Read more at DEV Community