dependency-scanning

Dependency Scanning on Mobile

Instructions

Most reported mobile CVEs live in dependencies — third-party SDKs, networking libs, image loaders, JSON parsers. A weekly cadence beats a one-off audit.

1. Inventory First

You can't scan what you can't see. Produce an SBOM per build:

• Android: CycloneDX Gradle plugin (org.cyclonedx.bom) produces bom.json.
• iOS: cyclonedx-cocoapods / cyclonedx-swift for SwiftPM.
• Flutter: cyclonedx_dart or parse pubspec.lock.
• React Native: @cyclonedx/cdxgen handles npm + native.

Archive the SBOM with the release artifact. You will want it the day a new CVE drops.

2. Gradle / Android

gradle-versions-plugin flags outdated direct dependencies:

// build.gradle.kts
plugins { id("com.github.ben-manes.versions") version "0.51.0" }

// Run: ./gradlew dependencyUpdates -Drevision=release

For CVEs, OWASP Dependency-Check or Snyk:

plugins { id("org.owasp.dependencycheck") version "11.1.0" }
dependencyCheck {
    failBuildOnCVSS = 7.0f // fail on high / critical
    suppressionFile = "config/owasp-suppressions.xml"
}

3. CocoaPods / SwiftPM

• pod outdated for CocoaPods outdated check.
• bundler-audit / custom script hitting the GitHub Security Advisory DB for CVEs.
• SwiftPM: Xcode 14+ shows a "Package Dependencies" pane; integrate Snyk / Socket for deeper checks.
• Carthage: dying, migrate.

4. Flutter / pub.dev

• dart pub outdated on every PR.
• Monitor pubspec.lock in review — large transitive changes often hide breaking updates.
• pana scores each package on health / maintenance; good signal for low-maintenance abandons.

5. React Native / npm

• npm audit / pnpm audit / yarn npm audit on every install.
• Pin via a lockfile (package-lock.json / pnpm-lock.yaml). Never "^"-float sensitive deps in production.
• Watch for postinstall scripts from dependencies — supply-chain attacks increasingly target these.
• socket.dev or snyk provides behavioral analysis (network access, file writes from a JS package).

6. GitHub Dependabot

Enable across platforms:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: gradle
    directory: "/"
    schedule: { interval: weekly }
    groups:
      non-major: { update-types: [minor, patch] }
  - package-ecosystem: cocoapods
    directory: "/ios"
    schedule: { interval: weekly }
  - package-ecosystem: pub
    directory: "/"
    schedule: { interval: weekly }
  - package-ecosystem: npm
    directory: "/"
    schedule: { interval: weekly }
  - package-ecosystem: github-actions
    directory: "/"
    schedule: { interval: weekly }

Group non-major updates so you get one PR a week, not fifty.

7. Triage Policy

Not every HIGH CVE is exploitable in your app. Have a documented triage policy:

• CVSS ≥ 9 or actively exploited in the wild → patch within 7 days, release out-of-band if needed.
• CVSS 7–9 → patch within 30 days.
• CVSS < 7 → next scheduled release.
• Not applicable (e.g., CVE in a code path you don't use) → document suppression with link to reasoning, review quarterly.

8. Transitive Dependency Attacks

The 2021–2024 wave of typosquat / account-takeover attacks on npm, PyPI, and RubyGems applies to mobile too. Defenses:

• Lockfile + integrity hashes (--frozen-lockfile, pod install --deployment).
• Block CI from installing from non-registry sources unless whitelisted.
• Review diffs on major dep bumps — not just semver; read the changelog.

9. Native Libraries (AAR / .framework / .xcframework)

Binary SDKs are a black box. Mitigations:

• Prefer SDKs that publish source.
• Pin versions by checksum (sha256 in lockfile where supported).
• On major vendor upgrades, run the APK / IPA through MobSF to check for new permissions / classes.

10. Kotlin / Swift Version Churn

Bumping Kotlin or Swift often cascades into every dependency. Plan for this in the Gradle / Xcode upgrade issues — not every PR.

Checklist

• [ ] An SBOM is generated per release build and archived with the artifact.
• [ ] OWASP Dependency-Check (or Snyk) fails the build on unsuppressed high/critical CVEs.
• [ ] gradle-versions / pod outdated / dart pub outdated / npm audit run on every PR.
• [ ] Dependabot is enabled for every ecosystem in the repo.
• [ ] Lockfiles are committed and CI uses --frozen-lockfile or equivalent.
• [ ] A triage policy with SLAs by CVSS is documented and followed.
• [ ] Binary SDKs are pinned by checksum where supported and re-scanned on upgrade.
• [ ] Suppression entries link to a rationale and have a review date.