Aller au contenu
AppArch AppArch Docs

Vulnerable dependency (ARCH9142)

Ce contenu n’est pas encore disponible dans votre langue.

Key swift.security.vulnerable-component · Severity error · Category security · CWE CWE-1104

A dependency whose installed version falls inside a published vulnerable window carries a directly exploitable weakness into the application (OWASP A06: Vulnerable and Outdated Components).

The match is made by the AppArch Api, not by the runner: it cross-references the package list every ArchScan run already reports against the installation’s own advisory catalog. The product ships a curated baseline and an operator refreshes it by importing an OSV export, so the data can move without rebuilding a collector image, and nothing in a customer’s CI has to reach a CVE service.

Incorrect

Section titled “Incorrect”
Package.swift
.package(url: "https://github.com/apple/swift-nio-http2.git", from: "1.27.0")

Correct

Section titled “Correct”
Package.swift
.package(url: "https://github.com/apple/swift-nio-http2.git", from: "1.28.0")

Fix

Section titled “Fix”

Upgrade the package to the version the advisory names. When no fix exists, remove the dependency or pin a safe alternative. An operator refreshes the advisory catalog under Management → Security advisories.