docs: update comparison.md with DependencyCheck and dep-scan analysis… - #720
Conversation
sonukapoor
left a comment
sonukapoor
left a comment
There was a problem hiding this comment.
The complementary-tools framing in the closing sections is the right call for peer OWASP projects - that tone works well. One factual correction needed in the DependencyCheck mechanism before I can approve.
Clarify that the npm analyzer uses the REST API directly, while pnpm and Yarn require their respective CLIs. Ensure internet access requirements are explicitly stated for all three.
|
Heyy! @sonukapoor The documentation has been updated to clarify the npm REST API mechanism and accurately scope the CLI/internet requirements for pnpm and Yarn. Let me know if it's good to go! |
sonukapoor
left a comment
sonukapoor
left a comment
There was a problem hiding this comment.
Good work on the mechanism fix - the NodeAuditAnalyzer explanation (REST API for npm, CLI required for pnpm/Yarn) is accurate and well-written. Two more items to address before this can merge.
…RX-72/cve-lite-cli into docs/issue-295-tool-comparison
|
Heyy! @sonukapoor The SARIF status for DependencyCheck has been updated to ✅, and the hygiene auditing row is restored with the correct values. Let me know if anything else is needed! |
|
Merged — thank you @MRX-72! |
2 participants
Closes #295
Summary
This PR expands the tool comparison documentation (
website/docs/comparison.md) to include comprehensive, research-backed sections for OWASP DependencyCheck and OWASP dep-scan.Why this change
As noted in #295, both DependencyCheck and dep-scan are OWASP projects sitting in roughly the same niche as CVE Lite CLI. It is important to clearly document the architectural and philosophical differences—specifically highlighting CVE Lite's lockfile-native parsing vs. CPE analysis, and its developer-focused terminal output vs. ASPM/SBOM generation—so developers can choose the right tool for their specific workflow.
What changed
Practical comparisonmatrix table to include capability columns for both tools.Offline supportmatrix table to accurately reflect the offline capabilities/limitations of both tools.## CVE Lite CLI vs OWASP DependencyChecksection.## CVE Lite CLI vs OWASP dep-scansection.Validation
npm testsuccessfully.npm run buildto ensure the documentation site compiles without errors or broken links.User-facing impact
Does this change:
Notes
Expanding this comparison page helps lay the groundwork for the eventual structural split proposed in #362.