Vulnfy: Open-Source Python Tool Scans Dependencies and Containers in CI/CD Pipelines

·1 views

A developer has released Vulnfy, a free and open-source vulnerability scanner written in Python, designed to integrate into CI/CD pipelines. The tool automatically detects project configuration files across multiple ecosystems, including Python, Node.js, Go, PHP, Rust, and Docker. It queries the OSV batch API to check for known CVEs and can send instant alerts to Discord or Telegram channels. Vulnfy exits with a non-zero status code when vulnerabilities are found, making it suitable as a security gate in automated workflows. The project is available on GitHub and can be installed via pip.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

DeepSeek Leads Chinese AI Model Shootout on Price-Performance, Kimi Tops Reasoning

A developer conducted a hands-on comparison of four prominent Chinese AI models — DeepSeek, Qwen, Kimi, and GLM — testing them through a unified API endpoint across coding, reasoning, language, and speed tasks. DeepSeek V4 Flash emerged as the top pick for overall value, priced at $0.25 per million output tokens, while Kimi K2.5 led on reasoning benchmarks at a higher $3.00–$3.50 per million token cost. Qwen, developed by Alibaba, offered the broadest model range with prices spanning $0.01 to $3.20 per million tokens, catering to both budget and premium use cases. GLM from Zhipu AI stood out for Chinese-language tasks, with its GLM-5 model priced at $1.92 per million tokens. All four models support OpenAI-compatible APIs, allowing developers to switch between them without rewriting existing codebases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Fictional Vietnamese Café Landing Page for Frontend Challenge

A developer created Balan Coffee & Roastery, a fictional Vietnamese café landing page, as a submission for the Frontend Challenge - Comfort Food Edition. The project is inspired by Saigon café culture, featuring sections for the menu, café story, and visit information, all styled with warm cream and coffee-brown tones. A standout feature is Pixel Phin Brew, a lightweight interactive mini-game that walks users through the traditional Vietnamese phin coffee brewing process step by step. The site was built using React, TypeScript, and Vite with custom CSS, deliberately avoiding heavy animation or game libraries to keep it lightweight. Accessibility considerations such as reduced-motion support, visible interaction states, and consistent tabular numerals for prices and hours were also incorporated throughout the design.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Debate Over Formal Verification in Software Revisited Five Decades On

A recent article revisits longstanding criticisms of formal verification as a method for ensuring software correctness. The piece reflects on arguments that have persisted for roughly 50 years in computer science circles. It examines the social and procedural dimensions of software development that formal methods may fail to address. The discussion has drawn attention on Hacker News, prompting community commentary on the topic. The article is authored by Ivan Gavran and is available on his personal website.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Why AI Agents Fail in Production: The Five Control Layers Most Teams Ignore

A technical analysis argues that most AI agent failures in production stem not from poorly written prompts but from neglected architectural layers further up the stack. The framework identifies five distinct control layers — prompt, context, harness, loop, and graph — each responsible for a different aspect of agent reliability. Most engineering teams focus almost exclusively on the prompt layer, leaving failures in tool usage, retry logic, and workflow routing unaddressed. Graph engineering, described as the least understood layer, governs how components are sequenced, when human approval is required, and how work is routed between agents. The piece uses a real-world coding agent scenario to illustrate how a single task can fail across four separate layers simultaneously, none of which a better prompt could have fixed.

0 comments Read more at DEV Community