How to Build a Two-Stage Dependency Vulnerability Scanning Strategy in CI Pipelines

·2 views

Modern software projects face growing security risks from outdated or vulnerable dependencies, making automated scanning in CI pipelines essential. A practical approach involves two distinct stages: blocking builds on critical or high-severity vulnerabilities while only reporting medium and low ones for later review. For Python projects, combining pip-audit and safety provides broader coverage by drawing from multiple advisory databases. JavaScript and TypeScript projects benefit from pairing npm audit with Snyk, applying similar hard-gate and report-only logic. This layered strategy helps teams maintain security standards without slowing down development velocity.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Releases Open-Source AI-Powered Penetration Testing Framework

A developer has launched shiftGrid, an open-source prompt engine designed to automate agentic penetration testing with human oversight. The tool works by pointing an AI agent at shiftGrid's API, which then follows predefined prompts and checklists within a defined testing scope. It maintains transparency through test observations, notes, and a findings log, allowing operators to monitor every action the agent takes. Users can switch between AI agents or take over testing manually at any point during an engagement. While built for security testing, the developer notes shiftGrid could potentially serve as a task harness for broader use cases beyond pentesting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer fixes overly broad error guard in open-source test automation tool

A developer building TestFlow Agent, an open-source tool that converts plain-English test cases into automated tests, discovered a flawed error-handling guard in the backend code. The guard was designed to return a friendly 503 error when the tool's live browser feature was run in a Docker environment lacking a display server. However, the string-matching condition included the phrase 'has been closed', which Playwright also throws for unrelated failures like crashed contexts or killed browsers, causing those errors to be wrongly diagnosed as display issues. The fix narrowed the regex to match only genuine display-related markers such as 'XServer', 'X server', and '$DISPLAY', ensuring unrelated Playwright errors surface correctly. The bug was caught during an AI-assisted code review via GitHub Copilot before the pull request was merged.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hardcoded localhost breaks Docker app — service-name DNS is the fix

A developer building TestFlow Agent, a three-service side project, discovered that a 'Run Enrollment Flow' button worked perfectly in native local development but consistently failed after the app was containerised with Docker Compose. The root cause was a hardcoded 'localhost:4000' URL in the backend code, which correctly pointed to the mock API on a single machine but resolved to the container itself once Dockerised, finding nothing on that port. Inside Docker Compose, containers communicate via service names on an internal network rather than through localhost, so the backend was effectively calling itself and receiving no response. The fix involved making the target URL configurable via an environment variable, defaulting to 'localhost:4000' for native runs while the Compose file sets it to the mock API's service name, ensuring both environments work without code changes. The developer noted that hardcoded localhost addresses are a silent liability that only surface when a network boundary shifts, and that making such values configurable with sensible defaults is the correct long-term approach.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Releases Python Agent Development Kit 2.0 with Major Architecture Upgrades

Google has launched Python ADK 2.0 (google-adk>=2.0.0), a significant update to its Agent Development Kit for building AI agents, officially available at adk.dev/2.0/. The new version introduces a unified google.adk namespace, replacing legacy module imports, and adds a standardized tool_context parameter for consistent session state and user identity management across tools. ADK 2.0 supports both Python code-defined agents and declarative YAML-configured agents, while also introducing native directed acyclic graph (DAG) workflows for multi-step agent pipelines. A unified CLI consolidates commands for running, testing, and deploying agents, including streamlined serverless deployment to Google Cloud Run. The release also brings auto-detected Vertex AI authentication, async session persistence, and framework-managed retry and human-in-the-loop capabilities that previously required manual implementation.

0 comments Read more at DEV Community