check-deps-vulnerabilities

Check Dependency Vulnerabilities

Scan the current Gradle project for known CVE/GHSA advisories on Gradle-resolved direct production dependencies and offer remediation through targeted version updates. Requires gradlew at the project root.

Step 1 — Collect coordinates via MCP (preferred)

Option A (full audit): call audit_project_dependencies with includeVulnerabilities: true and productionOnly: true (unless the user asks to include test scopes). Use the per-dependency vulnerabilities from the result.

Option B (vulns only):

1. Call scan_project_dependencies with projectPath (default cwd).
2. Keep production-scoped, versioned coordinates (exclude test configurations unless asked).
3. Call get_dependency_vulnerabilities with those {groupId, artifactId, version} entries (and projectPath so Gradle plugin markers resolve to implementation GAVs).

Use the tool output fields as-is: id, summary, severity, fixedVersion, malicious, safeUpgrade, and resolvedImplementation when present. Do not re-derive severity/summary from a raw OSV querybatch response while the MCP tool works.

Step 2 — Build the report

Filter to dependencies with non-empty vulnerabilities.

Sort: CRITICAL → HIGH → MEDIUM → LOW → unknown, then lexicographic by groupId:artifactId.

Render a markdown table (one row per dependency × finding):

Link advisories as https://osv.dev/vulnerability/{id}.

Summary line: Total: N findings across M packages (X critical, Y high, Z medium, W low). Scanned: K dependencies total. Test configurations excluded.

If none:

No known vulnerabilities found in production dependencies. (Scanned K dependencies. Test configurations were excluded.)

Then stop — no remediation prompt.

Disclaimer (always print once):

Note: OSV does not cover shaded/uber JARs. Dependencies bundled inside a fat JAR may carry CVEs that this scan will not surface.