What's missing or awkward today?
sprig only detects security misconfiguration (source/config patterns). It has no visibility into whether the project's actual dependency versions carry known CVEs, even though that's often reported alongside misconfiguration findings by similar tools.
Proposed change
Cross-reference the scanned project's resolved dependency versions (starting with Maven, via pom.xml) against a CVE feed (e.g. OSV.dev API) and surface matches as findings alongside sprig's own rules. Roadmap item from README; needs a decision on data source and whether this belongs in sprig itself vs. staying a job for Dependabot/OSV-Scanner run alongside it.
What's missing or awkward today?
sprig only detects security misconfiguration (source/config patterns). It has no visibility into whether the project's actual dependency versions carry known CVEs, even though that's often reported alongside misconfiguration findings by similar tools.
Proposed change
Cross-reference the scanned project's resolved dependency versions (starting with Maven, via
pom.xml) against a CVE feed (e.g. OSV.dev API) and surface matches as findings alongside sprig's own rules. Roadmap item from README; needs a decision on data source and whether this belongs in sprig itself vs. staying a job for Dependabot/OSV-Scanner run alongside it.