Check package dependencies for known CVEs

Looks up package/version pairs from a dependency report, or from a character vector of package names, using an injectable vulnerability lookup function. The default lookup uses oysteR when installed; tests and offline checks should pass a fake lookup function.

Usage

check_dependency_risk(x, lookup = oysteR_lookup)

Arguments

x

An insider_dependencies object returned by resolve_dependencies(), or a character vector of package names.

lookup

A function taking (package_name, version) and returning NULL for no known vulnerabilities, or a data frame with vulnerability details.

Value

An object of class insider_dependency_risk.

Examples

fake_lookup <- function(package_name, version) NULL
check_dependency_risk(c("utils"), lookup = fake_lookup)
#> 
#> ── insideR dependency risk ─────────────────────────────────────────────────────
#> 1 of 1 package checked, 0 vulnerable
#> • utils 4.6.1: no known vulnerabilities found for utils 4.6.1 in the OSS Index
#> -> no action needed