{"id":46650751,"url":"https://github.com/humancto/happy-scan-scala","last_synced_at":"2026-03-08T06:06:47.182Z","repository":{"id":342826427,"uuid":"1175300863","full_name":"humancto/happy-scan-scala","owner":"humancto","description":"Scala/SBT dependency risk scanner — vulnerability detection, license compliance, SBOM generation, unused dep analysis, policy-as-code, and more","archived":false,"fork":false,"pushed_at":"2026-03-07T16:59:55.000Z","size":124,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-07T20:58:15.845Z","etag":null,"topics":["cli","dependency-scanner","license-compliance","open-source","rust","sbom","sbt","scala","security","vulnerability-scanner"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/humancto.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-07T14:21:14.000Z","updated_at":"2026-03-07T16:59:58.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/humancto/happy-scan-scala","commit_stats":null,"previous_names":["humancto/happy-scan-scala"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/humancto/happy-scan-scala","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/humancto%2Fhappy-scan-scala","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/humancto%2Fhappy-scan-scala/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/humancto%2Fhappy-scan-scala/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/humancto%2Fhappy-scan-scala/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/humancto","download_url":"https://codeload.github.com/humancto/happy-scan-scala/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/humancto%2Fhappy-scan-scala/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30246626,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-08T00:58:18.660Z","status":"online","status_checked_at":"2026-03-08T02:00:06.215Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","dependency-scanner","license-compliance","open-source","rust","sbom","sbt","scala","security","vulnerability-scanner"],"created_at":"2026-03-08T06:06:47.111Z","updated_at":"2026-03-08T06:06:47.172Z","avatar_url":"https://github.com/humancto.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://img.shields.io/badge/language-Rust-orange?style=flat-square\" alt=\"Rust\"\u003e\n  \u003cimg src=\"https://img.shields.io/badge/license-Apache--2.0-blue?style=flat-square\" alt=\"License\"\u003e\n  \u003cimg src=\"https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey?style=flat-square\" alt=\"Platform\"\u003e\n  \u003cimg src=\"https://img.shields.io/badge/scala-2.11%20%7C%202.12%20%7C%202.13%20%7C%203-red?style=flat-square\" alt=\"Scala\"\u003e\n\u003c/p\u003e\n\n# scala-dep-scan\n\nA fast, zero-dependency Rust CLI for scanning Scala/Play/SBT projects for vulnerable, outdated, and unused dependencies. Built for teams maintaining legacy codebases.\n\n**One binary. No JVM required. Scans in seconds, not minutes.**\n\n```\n$ scala-dep-scan /path/to/project --osv\n\n  Project: /path/to/project\n  Dependencies: 54 direct  +  362 transitive\n    i  32 deps from private/internal orgs -- not scannable against public vuln databases\n  Risk flags: 17 Critical  15 High  16 Medium  33 Low\n\n  CRITICAL  com.typesafe.play:play-json:2.3.2 [KNOWN-CVE]\n    -\u003e Multiple RCE and CSRF vulnerabilities in Play \u003c 2.8\n    CVEs: CVE-2019-17598, CVE-2018-6003\n    Fix: Upgrade to \u003e= 2.8.0\n    10 file(s) reference this dependency\n\n  CRITICAL  mysql:mysql-connector-java:5.1.31 [OSV-ADVISORY]\n    -\u003e Improper Access Control in MySQL Connectors Java\n    CVEs: GHSA-2xxh-f8r3-hvvr\n\n  -- Dependency Usage Analysis --\n\n    0 Unused    0 Dead import    49 Active    5 Runtime\n```\n\n## Real-World Tested\n\nValidated against **39 production Scala/Play microservices** (1,083 direct + 8,867 transitive dependencies):\n\n| Metric                         | Result                         |\n| ------------------------------ | ------------------------------ |\n| Risk flags detected            | 2,328 across 39 repos          |\n| Critical vulnerabilities       | 597                            |\n| Unused dep false positive rate | \u003c5% (43 flagged, all verified) |\n| Scan time per repo             | \u003c3 seconds                     |\n| Transitive deps discovered     | 8,867 via lock.sbt parsing     |\n\n## Why scala-dep-scan?\n\n| Feature                 | scala-dep-scan | sbt-dependency-check |  Snyk   | Dependabot |\n| ----------------------- | :------------: | :------------------: | :-----: | :--------: |\n| No JVM required         |      yes       |          no          |   no    |     no     |\n| Scan speed              |      \u003c5s       |       minutes        | minutes |   async    |\n| Unused dep detection    |      yes       |          no          |   no    |     no     |\n| Transitive dep scanning |      yes       |         yes          |   yes   |    yes     |\n| Code reference scanning |      yes       |          no          |   no    |     no     |\n| Auto-fix unused deps    |      yes       |          no          |   no    |     no     |\n| SBOM generation         |      yes       |         yes          |   yes   |     no     |\n| Offline mode            |      yes       |          no          |   no    |     no     |\n| License compliance      |      yes       |          no          |   yes   |     no     |\n| Interactive TUI         |      yes       |          no          |   no    |     no     |\n| Multi-module SBT        |      yes       |         yes          |   yes   |    yes     |\n| CI exit codes           |      yes       |         yes          |   yes   |     no     |\n| Single binary           |      yes       |          no          |   no    |     no     |\n| Free \u0026 open source      |      yes       |         yes          |   no    |    yes     |\n\n## Quick Start\n\n### Install\n\n```bash\n# From crates.io (recommended)\ncargo install scala-dep-scan\n\n# macOS (Homebrew)\nbrew install humancto/tap/scala-dep-scan\n\n# From source\ngit clone https://github.com/humancto/happy-scan-scala.git\ncd happy-scan-scala\ncargo install --path .\n\n# Pre-built binaries\n# Download from GitHub Releases for your platform\n```\n\n### Basic Usage\n\n```bash\n# Scan current directory\nscala-dep-scan .\n\n# Full scan with OSV advisory lookup (network required)\nscala-dep-scan /path/to/project --osv\n\n# Show only HIGH+ severity\nscala-dep-scan . -s high\n\n# JSON output for CI pipelines\nscala-dep-scan . -f json | jq '.summary'\n\n# Interactive TUI explorer\nscala-dep-scan . --tui\n\n# Quiet mode for CI (exit code only)\nscala-dep-scan . -q -s critical\n```\n\n## Features\n\n### Vulnerability Detection\n\nThree-tier detection engine with 87 embedded rules:\n\n1. **Embedded database** - 87 known-bad dependencies covering Log4Shell, Spring4Shell, Jackson deserialization, commons-collections RCE, H2 RCE, Text4Shell, XStream, Jetty, Netty, BouncyCastle, Apache Shiro, and many more\n2. **Staleness heuristics** - Pre-release versions, date-versioned artifacts, deprecated packages\n3. **OSV.dev API** - Live advisory lookup against the Open Source Vulnerability database (`--osv` flag)\n\n```bash\n# Full scan with network advisory lookup\nscala-dep-scan . --osv\n\n# With response caching (24h default TTL)\nscala-dep-scan . --osv           # first run: queries API\nscala-dep-scan . --osv           # second run: uses cache\nscala-dep-scan . --osv --no-cache  # bypass cache\n```\n\n### Unused Dependency Detection\n\n4-pass deep analysis with \u003c5% false positive rate:\n\n1. **Import scanning** - Matches `import` statements to dependency package prefixes\n2. **Symbol profiling** - 50+ library profiles mapping artifacts to their CamelCase class names\n3. **Body analysis** - Confirms imported symbols are actually called in code\n4. **Fallback grep** - Searches all source files (.scala, .java, .conf, .xml, .properties) for artifact name references\n\nCategories:\n\n- **Unused** - No imports, no symbol references, no config references anywhere in code\n- **Dead imports** - Imported but symbols never actually called\n- **Active** - Symbols confirmed used in code (with reference counts)\n- **Runtime-only** - Injected at runtime (Guice, logback, HikariCP, test frameworks) -- not false-flagged\n\n```bash\n# Usage analysis is always on -- shown in every scan\nscala-dep-scan .\n\n# Auto-remove unused deps from build.sbt\nscala-dep-scan . --fix-unused --dry-run   # preview changes\nscala-dep-scan . --fix-unused             # apply changes (creates .bak backup)\n```\n\n### Transitive Dependency Scanning\n\nParses both `lock.sbt` (sbt-lock plugin) and Coursier lockfile formats to discover and scan the full transitive dependency tree:\n\n```bash\nscala-dep-scan .\n# Dependencies: 54 direct  +  362 transitive\n# All 416 dependencies scanned for vulnerabilities\n```\n\n### Private Dependency Detection\n\nInternal/private org dependencies (e.g. `com.yourcompany:*`) are automatically identified and reported separately. They cannot be scanned against public vulnerability databases, and the tool clearly marks them:\n\n```\n  i  32 deps from private/internal orgs -- not scannable against public vuln databases\n```\n\n### Code Reference Scanning\n\nFinds every `.scala` and `.java` file that imports flagged dependencies, showing exactly where risky code lives:\n\n```\n  CRITICAL  com.typesafe.play:play-json:2.3.2 [KNOWN-CVE]\n    10 file(s) reference this dependency:\n      .../StickerImageActor.scala:16 -\u003e play.api.libs.json.Json\n      .../RedisBrowseNodeProducer.scala:9 -\u003e play.api.libs.json.Json\n      .../OfferPublisherActor.scala:20 -\u003e play.api.libs.json.Json\n      ... and 7 more\n```\n\n### Dependency Graph\n\nVisualize your dependency tree in multiple formats:\n\n```bash\n# Colorful ASCII tree in terminal (default)\nscala-dep-scan .\n\n# Graphviz DOT file\nscala-dep-scan . --dot deps.dot\ndot -Tsvg deps.dot -o deps.svg   # render to SVG\n\n# JSON adjacency list\nscala-dep-scan . --graph-json deps.json\n```\n\n### Config \u0026 Ignore File\n\nAcknowledge known risks and set project-level policy:\n\n```bash\n# Generate config with all current findings pre-populated\nscala-dep-scan . --init\n\n# Edit .scala-dep-scan.yaml to acknowledge accepted risks\n```\n\n```yaml\n# .scala-dep-scan.yaml\nversion: 1\nseverity_threshold: low\nignore:\n  - coord: \"com.typesafe.play:play\"\n    reason: \"Migration to Play 2.8 scheduled for Q2\"\n    expires: \"2026-06-01\"\n  - cve: \"CVE-2015-6420\"\n    reason: \"Not exploitable in our deployment\"\n    expires: \"2026-12-31\"\n```\n\n### SBOM Generation\n\nGenerate Software Bill of Materials in industry-standard formats:\n\n```bash\n# CycloneDX 1.5 JSON\nscala-dep-scan . --sbom cyclonedx --sbom-output sbom-cdx.json\n\n# SPDX 2.3 JSON\nscala-dep-scan . --sbom spdx --sbom-output sbom-spdx.json\n```\n\n### License Compliance\n\nScan and enforce license policies:\n\n```bash\n# Show license info for all dependencies\nscala-dep-scan . --license\n\n# Enforce license policy\nscala-dep-scan . --license --license-policy \"allow:MIT,Apache-2.0 deny:GPL-3.0\"\n```\n\n### Upgrade Advisor\n\nGet actionable migration guidance with effort estimates:\n\n```bash\nscala-dep-scan . --upgrade-plan\n```\n\n```\n  Upgrade Plan (prioritized by risk and effort):\n\n  1. com.typesafe.play:play  2.3.2 -\u003e 2.8.19\n     Risk: CRITICAL | Effort: ~40 hours | 193 code references\n     Breaking changes:\n       - play.api.mvc.Controller removed, use BaseController\n       - play.api.libs.json.Json.parse throws on invalid JSON\n       - Configuration API changed to typesafe config\n     Migration guide: https://www.playframework.com/documentation/2.8.x/Migration28\n\n  2. mysql:mysql-connector-java  5.1.31 -\u003e 8.0.33\n     Risk: CRITICAL | Effort: ~4 hours | 27 code references\n     Breaking changes:\n       - Package renamed to com.mysql.cj.jdbc\n       - SSL enabled by default\n```\n\n### Policy-as-Code\n\nDefine and enforce organizational dependency policies:\n\n```yaml\n# .scala-dep-scan.yaml\npolicies:\n  - name: \"no-ancient-deps\"\n    rule: \"version_age_months \u003c 36\"\n    severity: high\n    message: \"Dependencies must be updated within 3 years\"\n  - name: \"no-pre-release\"\n    rule: \"version !~ /^0\\\\./\"\n    severity: medium\n```\n\n```bash\nscala-dep-scan . --policy org-policy.yaml\n```\n\n### HTML Dashboard\n\nGenerate shareable reports:\n\n```bash\nscala-dep-scan . --html report.html\n```\n\nSelf-contained single HTML file with executive summary, interactive dependency tree, searchable risk table, and usage analysis charts.\n\n### Scan Comparison / Diff\n\nTrack remediation progress across commits:\n\n```bash\n# Save baseline\nscala-dep-scan . --save-baseline baseline.json\n\n# Compare against baseline (e.g., in PR)\nscala-dep-scan . --compare baseline.json\n# Shows: 2 NEW findings, 3 RESOLVED, 11 UNCHANGED\n# Exit code: fail only on NEW critical/high\n```\n\n### Interactive TUI Explorer\n\nNavigate dependencies interactively:\n\n```bash\nscala-dep-scan . --tui\n```\n\nThree-panel terminal UI with:\n\n- Scrollable dependency list with severity icons\n- Detail view with risk info, CVEs, usage, code references\n- Search, filter by severity, sort by name/risk/usage\n- Keyboard-driven: `j/k` navigate, `/` search, `f` filter, `q` quit\n\n### CI Integration\n\n```yaml\n# GitHub Actions\n- name: Scan dependencies\n  run: |\n    cargo install scala-dep-scan\n    scala-dep-scan . --osv -s high -q\n    # exits 1 on HIGH, 2 on CRITICAL\n\n# Generate CI config automatically\nscala-dep-scan --generate-ci github \u003e .github/workflows/dep-scan.yml\nscala-dep-scan --generate-ci gitlab \u003e .gitlab-ci.yml\n```\n\nExit codes:\n\n- `0` - Clean (no HIGH/CRITICAL findings)\n- `1` - HIGH severity findings detected\n- `2` - CRITICAL severity findings detected\n\n### Multi-Module SBT Projects\n\nAutomatically detects and scans multi-module builds:\n\n```bash\nscala-dep-scan /path/to/monorepo\n# Discovers modules/*/build.sbt, project/Dependencies.scala, lock.sbt\n# Scans all subprojects, groups findings by module\n```\n\nSupports:\n\n- `build.sbt` with `lazy val` subprojects\n- `project/Build.scala` and `project/Dependencies.scala`\n- `.dependsOn()` and `.aggregate()` relationships\n- `lock.sbt` (sbt-lock plugin) for transitive deps\n- Nested `modules/*/build.sbt` subprojects\n\n## Output Formats\n\n### Terminal (default)\n\nColor-coded ASCII tree + risk findings with CVE IDs, fix suggestions, code references, and usage analysis.\n\n### JSON (`-f json`)\n\n```json\n{\n  \"summary\": {\n    \"direct_deps\": 54,\n    \"transitive_deps\": 362,\n    \"total_flags\": 82,\n    \"critical\": 17,\n    \"high\": 15,\n    \"medium\": 16,\n    \"low\": 33,\n    \"unused_deps\": 0,\n    \"dead_import_deps\": 0,\n    \"private_deps\": 229,\n    \"private_deps_note\": \"Private/internal dependencies cannot be scanned against public vulnerability databases\"\n  },\n  \"risk_flags\": [...],\n  \"dependency_usage\": [\n    {\"coord\": \"com.example:lib\", \"verdict\": \"Unused\", \"usage_count\": 0},\n    {\"coord\": \"com.example:used-lib\", \"verdict\": \"Active\", \"usage_count\": 15, \"symbols_found\": [\"Json\", \"Reads\"]}\n  ],\n  \"code_references\": { \"org:name\": [...] },\n  \"graph\": { \"nodes\": [...], \"edges\": [...] }\n}\n```\n\n### DOT graph (`--dot`)\n\nGraphviz format with color-coded risk nodes. Render with `dot -Tsvg`.\n\n### HTML (`--html`)\n\nSelf-contained dashboard report.\n\n### SBOM (`--sbom`)\n\nCycloneDX 1.5 or SPDX 2.3 JSON.\n\n## Architecture\n\n```\nsrc/\n+-- main.rs          # CLI entry, orchestration\n+-- types.rs         # Shared data structures\n+-- config.rs        # Config/ignore file (.scala-dep-scan.yaml)\n+-- parser/mod.rs    # build.sbt + lock.sbt + lockfile parsers\n+-- risk.rs          # Risk engine: known-bad DB + heuristics + OSV\n+-- graph.rs         # petgraph dep graph + DOT/ASCII/JSON renderers\n+-- scanner.rs       # 4-pass usage analysis + code reference scanner\n+-- report.rs        # Terminal + JSON report formatters\n+-- rewriter.rs      # build.sbt rewriter (--fix-unused)\n+-- sbom.rs          # SBOM generation (CycloneDX, SPDX)\n+-- license.rs       # License compliance checking\n+-- staleness.rs     # Dependency age/staleness scoring\n+-- advisor.rs       # Upgrade path advisor with migration guides\n+-- policy.rs        # Policy-as-code engine\n+-- html_report.rs   # HTML dashboard generator\n+-- diff.rs          # Scan diff/comparison mode\n+-- ci_templates.rs  # CI config generators\n+-- tui.rs           # Interactive TUI explorer (ratatui)\ndata/\n+-- risky_deps.json  # Embedded risk database (87 entries, compiled into binary)\ntests/\n+-- *.rs             # 62 tests covering all modules\n```\n\n## Risk Database\n\n87 entries covering the most critical JVM vulnerabilities, with verified CVE references. Updated periodically.\n\n| Category            | Libraries                                                                                    | Key CVEs                                       |\n| ------------------- | -------------------------------------------------------------------------------------------- | ---------------------------------------------- |\n| **Frameworks**      | Play Framework, Spring (core/web/security), Akka HTTP                                        | CVE-2019-17598, CVE-2022-22965, CVE-2024-22257 |\n| **Logging**         | Log4j (Log4Shell), Logback (classic + core)                                                  | CVE-2021-44228, CVE-2023-6378                  |\n| **Serialization**   | Jackson, XStream, SnakeYAML, Kryo, Gson, Avro, protobuf-java                                 | CVE-2020-36518, CVE-2021-39144, CVE-2024-7254  |\n| **Apache Commons**  | collections, text (Text4Shell), compress, fileupload, beanutils, configuration               | CVE-2015-7501, CVE-2022-42889, CVE-2024-26308  |\n| **HTTP/Networking** | Netty (handler, codec-http2), Jetty, OkHttp, HttpClient, Undertow, Tomcat, Async HTTP Client | CVE-2021-43797, CVE-2023-44487, CVE-2024-53990 |\n| **Databases**       | MySQL, PostgreSQL, H2 (RCE), SQLite, Elasticsearch                                           | CVE-2021-42392, CVE-2022-21724, CVE-2023-31419 |\n| **Crypto/Security** | BouncyCastle (bcprov/bcpkix), Apache Shiro (core/web), Nimbus JOSE+JWT                       | CVE-2024-30172, CVE-2023-34478, CVE-2025-53864 |\n| **XML/Templating**  | dom4j, Woodstox, Velocity, FreeMarker, Thymeleaf, Xalan, Batik                               | CVE-2020-10683, CVE-2023-38286                 |\n| **Document**        | Apache POI, Apache Tika, PDFBox, iText                                                       | CVE-2023-45648                                 |\n| **ORM**             | Hibernate (core/validator)                                                                   | CVE-2020-25638                                 |\n\nPlus live lookups via **OSV.dev API** for real-time advisory data on all 8,000+ Maven advisories.\n\n## Publishing\n\n### crates.io\n\n```bash\n# Login (one-time)\ncargo login\n\n# Publish\ncargo publish\n```\n\n### Homebrew\n\nUsers can install via the Homebrew tap:\n\n```bash\nbrew tap humancto/tap\nbrew install scala-dep-scan\n```\n\nTo set up the tap, create a formula at `humancto/homebrew-tap`:\n\n```ruby\nclass ScalaDepScan \u003c Formula\n  desc \"Dependency risk scanner for Scala/Play/SBT projects\"\n  homepage \"https://github.com/humancto/happy-scan-scala\"\n  url \"https://github.com/humancto/happy-scan-scala/archive/refs/tags/v0.3.0.tar.gz\"\n  license \"Apache-2.0\"\n\n  depends_on \"rust\" =\u003e :build\n\n  def install\n    system \"cargo\", \"install\", *std_cargo_args\n  end\n\n  test do\n    assert_match \"scala-dep-scan\", shell_output(\"#{bin}/scala-dep-scan --version\")\n  end\nend\n```\n\n## Contributing\n\nWe welcome contributions! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Write tests for your changes\n4. Run the test suite (`cargo test`)\n5. Submit a pull request\n\n## License\n\nLicensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) for details.\n\n## Acknowledgements\n\n- [OSV.dev](https://osv.dev/) for vulnerability advisory data\n- [petgraph](https://github.com/petgraph/petgraph) for dependency graph algorithms\n- [ratatui](https://github.com/ratatui-org/ratatui) for the terminal UI framework\n- [clap](https://github.com/clap-rs/clap) for CLI argument parsing\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhumancto%2Fhappy-scan-scala","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhumancto%2Fhappy-scan-scala","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhumancto%2Fhappy-scan-scala/lists"}