fix: migrate the NodeAuditAnalyzer to supported API via use of npm audit via CLI

[chadlwilson]

Description of Change

This reinstates the NodeAuditAnalyzer by implementing the approach suggested at #8422 (comment) to replace the manual package-lock parsing with use of npm ls --json (inventory) and npm audit --json (analysis).

(edit: since this PR was raised, GitHub have re-enabled the legacy API they said they had "permanently" decommed on 17 July 2026, so the as-is NodeAuditAnalyzer is now functional again, making the term "reinstates" potentially misleading here)

This has been largely done with guided use of Claude, alongside some tweaks and edits made by me, but still needs testing & validation of approach - and more careful review of the code. Initially raising a PR for transparency & feedback, and anyone who wants to help smoke test it, since the automated testing within ODC is probably somewhat limited.

I evaluated other approaches to avoid manual package-lock parsing and could not find any decent Java libraries to do so.

Design guidelines/constraints

• largely based from the same approach as existing yarn and pnpm analyzers
  • with the addition of npm ls --json to retain the full inventory support of the previous analyzer (yarn and pnpm analyzers do not support this full inventory)
• Integration test should not need expectation changes to pass
• All ODC configuration should work as before
  • unnecessary configuration flags from integrations can be removed and undocumented when specifying them unnecessarily is a no-op
• Should support use of locked npm versions via corepack, as with the yarn and pnpm analyzers
• for now, the NodePackageAnalyzer is untouched, and still does manual parsing (although Claude found many bugs with this)
  • should be addressed in follow-up PRs to either remove manual parsing or fix it
• all unused code should be removed
• The pnpm CLI and yarn CLI-based parsers should be reviewed for de-duplication and consistency with npm

TODO

• more detailed review of post-CLI JSON parsing approach and its complexity to maintain
• additional smoke testing with real projects and integrations
• review interactions with the NodePackageAnalyzer to ensure they still make sense.

Related issues

• fixes Remove legacy NodeAuditAnalyzer dependency on NPM audit legacy /quick API #8422

Have test cases been added to cover the new functionality?

yes

[Copilot]

Pull request overview

Reinstates Node Audit analysis using the local npm CLI, replacing the retired legacy audit API integration and addressing #8422.

Changes:

• Uses npm audit and npm ls for vulnerability and dependency data.
• Adds npm executable configuration across supported integrations.
• Removes legacy API code and adds npm audit v2 parser tests and documentation.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
utils/src/test/resources/dependencycheck.properties	Removes the retired API URL.
utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java	Deprecates the API URL and adds npm path configuration.
src/site/markdown/dependency-check-gradle/configuration.md	Updates Gradle Node Audit documentation.
src/site/markdown/dependency-check-gradle/configuration-aggregate.md	Updates aggregate Gradle documentation.
src/site/markdown/analyzers/node-audit-analyzer.md	Documents npm CLI requirements and supported files.
src/site/markdown/analyzers/index.md	Updates the Node Audit analysis method.
maven/src/site/markdown/configuration.md	Documents Maven npm path configuration.
maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java	Wires Maven npm path settings.
Dockerfile	Enables and prepares npm through Corepack.
core/src/test/resources/nodeaudit/npm-audit-report.json	Adds an npm audit v2 fixture.
core/src/test/resources/dependencycheck.properties	Removes the retired test API URL.
core/src/test/java/org/owasp/dependencycheck/data/nodeaudit/NpmPayloadBuilderTest.java	Removes obsolete payload-builder tests.
core/src/test/java/org/owasp/dependencycheck/data/nodeaudit/NpmCliAuditParserTest.java	Tests npm audit v2 parsing.
core/src/test/java/org/owasp/dependencycheck/data/nodeaudit/NodeAuditSearchTest.java	Removes obsolete API search tests.
core/src/main/resources/dependencycheck.properties	Removes the retired URL default.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/package-info.java	Updates package documentation.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmPayloadBuilder.java	Removes legacy API payload generation.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NpmCliAuditParser.java	Adds npm audit v2 report parsing.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/NodeAuditSearch.java	Removes direct API communication.
core/src/main/java/org/owasp/dependencycheck/data/nodeaudit/Advisory.java	Centralizes GHSA extraction.
core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java	Reuses centralized GHSA extraction.
core/src/main/java/org/owasp/dependencycheck/analyzer/NodeAuditAnalyzer.java	Runs npm audit and inventory commands.
core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractNpmAnalyzer.java	Removes legacy search initialization.
cli/src/site/markdown/arguments.md	Documents the --npm option.
cli/src/main/java/org/owasp/dependencycheck/CliParser.java	Adds the npm path CLI argument.
cli/src/main/java/org/owasp/dependencycheck/App.java	Applies the CLI npm path setting.
ant/src/site/markdown/configuration.md	Documents Ant npm path configuration.
ant/src/main/java/org/owasp/dependencycheck/taskdefs/Check.java	Wires Ant npm path settings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremylong]

@chadlwilson is this still a draft?

[chadlwilson]

@jeremylong yes. Not fully reviewed or tested, and no feedback from anyone as to approach. It is functional, but probably needs some manual tests of some sort. I haven't tested it outside the automated tests.

It also got a bit messier because after creating this, GitHub turned on the API again (the one they said would be permanently turned off in July) so the existing analyzer became functional again.

[marcelstoer]

Sorry Chad, I missed that you had requested my review. At work, we moved away from the (not-so-)defunct API this summer. All projects are now required to use Yarn Berry.

I think before anyone spends time testing and later maintaining this code, we should decide whether we want to support said API or not. I'd vote to not reinstate this code but of course that's primarily Jeremy's call.

[chadlwilson]

I think before anyone spends time testing and later maintaining this code, we should decide whether we want to support said API or not. I'd vote to not reinstate this code but of course that's primarily Jeremy's call.

Sorry? I don’t understand what you are talking about here.

This PR has nothing to do with supporting any deprecated or removed-then-reinstated APi. The current version npm CLI obviously uses the new bulk APis, the same APIs underneath as yarn berry or modern pnpm, and the PR migrates to use that CLI (and thus the bulk APi) by removing all ODC custom lock parsing and API invocation logic, the same as I outlined in the original issue proposal.

if you use npm, you need to use a tool that understands npm lock files. If you use yarn, you need to use a tool that understands yarn lock files. So if you use yarn, this PR is not relevant to you anyway.

[chadlwilson]

Anyway, with the current state, I am highly likely to abandon this PR and all associated work anyway. I don’t use npm day-to-day, and could not personally care less if it is broken in ODC.

As far as I can see the user base only care about something when it breaks, and there is zero input into how we should (or should not) support it. I received no substantive design feedback on #8422, none on proposal at #8422 (comment) and no feedback here. I’m not going to keep throwing effort into the ether.

[Copilot]

🟡 Changes recommended

Dependency-Check proxy and timeout settings are no longer propagated to npm, breaking previously configured environments.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

core/src/main/java/org/owasp/dependencycheck/analyzer/NodeAuditAnalyzer.java:431

• This helper is also used for npm ls, so an I/O failure while collecting the inventory is incorrectly reported as an “npm audit failure.” Use a command-neutral message or pass the command name into the helper so users can identify which invocation failed.

            throw new AnalysisException("npm audit failure; this error can be ignored if you are not analyzing "
                    + "projects with an npm lockfile.", ioe);

core/src/main/java/org/owasp/dependencycheck/analyzer/NodeAuditAnalyzer.java:301

• The npm child process does not inherit Dependency-Check's configured networking settings. The removed HTTP implementation used Downloader, which honors proxy.server/port/credentials and connection timeouts, whereas ProcessBuilder only inherits OS environment variables. Consequently CLI --proxyserver, Ant proxy settings, and Maven proxy configuration can stop working for Node Audit, contrary to the stated constraint that existing configuration continue to work. Propagate these settings as npm configuration/environment values (including credentials, bypass hosts, and timeouts), or explicitly define and document the breaking migration.

        final ProcessBuilder builder = new ProcessBuilder(args);
        builder.directory(folder);

• Files reviewed: 28/28 changed files
• Comments generated: 1
• Review effort level: Balanced