<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Dependency Scanning — API Reference

## OSV-Scanner

```bash
# Recursive directory scan
osv-scanner -r . --format json

# Specific lockfile
osv-scanner --lockfile=package-lock.json --format json

# Scan SBOM
osv-scanner --sbom=sbom.cdx.json --format json

# Scan Docker image
osv-scanner --docker image:tag
```

## Snyk CLI

```bash
# Test project
snyk test --severity-threshold=high --json

# Monitor (continuous tracking)
snyk monitor --org=my-org --project-name=my-app

# Auto-fix
snyk fix

# Specific file
snyk test --file=requirements.txt --json

# Ignore vulnerability
snyk ignore --id=SNYK-JS-LODASH-590103 --reason="mitigated"

# List issues
snyk test --json | jq '.vulnerabilities[] | {id, severity, title, from}'
```

## Trivy Filesystem

```bash
# Project scan
trivy fs . --severity HIGH,CRITICAL --format json

# Ignore unfixed
trivy fs . --ignore-unfixed --format json

# Specific lockfile
trivy fs package-lock.json --format json

# With exit code
trivy fs . --severity CRITICAL --exit-code 1
```

## Dependabot / Renovate

```yaml
# Dependabot (.github/dependabot.yml)
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
```

```json
// Renovate (renovate.json)
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":semanticCommits"],
  "vulnerabilityAlerts": { "enabled": true },
  "packageRules": [
    { "matchUpdateTypes": ["patch"], "automerge": true }
  ]
}
```

## Severity Mapping

| Rating | CVSS Score | Action |
|--------|-----------|--------|
| Critical | 9.0-10.0 | Immediate fix |
| High | 7.0-8.9 | Fix within sprint |
| Medium | 4.0-6.9 | Fix within quarter |
| Low | 0.1-3.9 | Track and plan |
