SCA Scan

Software Composition Analysis (SCA) identifies known vulnerabilities (CVEs) in your project’s third-party libraries and dependencies. Gerion uses Google’s OSV-Scanner, which queries the OSV database.

Run

gerion sca-scan [PATH]

# Scan the current directory
gerion sca-scan .

# Save results as JSON
gerion sca-scan . --format json --output-file sca.json

# Send results to the Gerion API
gerion sca-scan . --api-url $GERION_API_URL --api-key $GERION_API_KEY

Supported ecosystems

Ecosystem	Recognized files
Node.js	package-lock.json, yarn.lock, pnpm-lock.yaml
Python	requirements.txt, Pipfile.lock, poetry.lock, pyproject.toml
Go	go.mod, go.sum
Rust	Cargo.lock
Java / Maven	pom.xml
Java / Gradle	gradle.lockfile
Ruby	Gemfile.lock
PHP	composer.lock
.NET	packages.lock.json, packages.config
Swift	Package.resolved
Dart / Flutter	pubspec.lock
Conan (C/C++)	conan.lock
Linux (Alpine)	installed system packages
Linux (Debian/Ubuntu)	dpkg database

Tip

For accurate results, include lock files in your repository. Without them, the scanner may not be able to determine exact versions.

Options

Option	Description
--format	Output format: json | markdown | sarif
--output-file	Save results to a file (disables API submission)
--api-url	Gerion API Gateway URL
--api-key	M2M API key
--timeout	Timeout in seconds (default: 180)
--log-level	debug | info | warning | error

Automatic false positives

If the installed package version is greater than or equal to the version that fixes the vulnerability, Gerion automatically marks the finding as a false positive and does not include it in the results.