Understanding Dependency Risk Findings

An SBOM tells you what you depend on; dependency risk findings tell you which of those dependencies deserve attention. This article explains the Dependency Risk scanner in Vibgrate, what its findings mean, and how it works together with your Software Bill of Materials. It is for developers triaging supply-chain risk and leaders prioritizing remediation.

What the Dependency Risk scanner does

The Dependency Risk scanner classifies packages by the kinds of risk they carry, such as:

• Deprecated packages — dependencies the maintainer has marked end-of-life or abandoned.
• Native modules — packages with compiled native components, which often cause build breakage across platforms and Node versions.
• Platform-specific dependencies — packages tied to a particular OS or architecture that can fail in other environments.

These categories predict where upgrades and migrations are most likely to hurt, which is why they feed into your overall upgrade risk picture.

How it relates to the SBOM

The SBOM is the inventory; the risk findings are the analysis layered on top of that inventory. Both come from the same scan of the same dependency graph, so a component flagged as deprecated in your findings is the same component listed in your SBOM. Together they let you move from "here is everything" to "here is what to fix first."

Running a scan

Dependency risk is part of the extended scanners that run during a normal scan:

vg scan

To gate a pipeline on findings, use a fail threshold:

vg scan --fail-on error

You can export the SBOM alongside the scan to capture the inventory those findings refer to:

vg sbom export --format cyclonedx --out sbom.cdx.json

Reading the findings

Each finding identifies the package and the reason it was flagged. Treat deprecated and abandoned packages as the highest priority — they will not receive security fixes. Native and platform-specific packages are upgrade-risk signals: plan extra testing when you bump them.

Acting on findings

• Replace or remove deprecated packages where feasible.
• For native modules, confirm prebuilt binaries exist for your target platforms.
• Track remediation over time by pushing scans to Vibgrate Cloud, where trends and risk registers are available.

Related

• "Detecting Vulnerable Dependencies" covers known-vulnerability findings.
• "Verifying Your Supply-Chain Posture" ties findings, SBOMs, and gates together.
• See the Dependency Risk Scanner documentation for the full classification list.