Scan OpenSource libraries free with Mend

Background

Using free and open-source libraries can foster innovation in a number of ways. For one, it allows developers to easily incorporate pre-existing code into their projects, saving them time and effort that they can then redirect towards developing new features and functionality. Additionally, the open-source model promotes collaboration and sharing, which can lead to the creation of more powerful and sophisticated libraries as developers from around the world contribute their skills and knowledge. Finally, open-source libraries often have large and active communities of users and developers, which can provide valuable support, inspiration, and feedback for those looking to push the boundaries of innovation.

There are a few potential risks to be aware of when using open source libraries. One risk is the potential for vulnerabilities or security issues in the library code. It's important to regularly check for and update to the latest versions of the library to minimize this risk. We will see how to use Mend to scan open-source libraries for free. It integrates with GitHub making it very easy for developers to get real-time updates related to the open source dependencies.

Quick overview of Mend 

Mend is an open source library management platform that helps developers identify, track, and secure the open source libraries used in their projects. It provides real-time alerts for any potential security vulnerabilities or license compliance issues, and offers integration with a variety of tools such as GitHub and Azure DevOps. With Mend, developers can easily see the open source libraries they are using and ensure that they are up to date and secure, reducing the risks associated with using open source software. Mend is the next version of WhiteSource Bolt, and aims to provide a simple and effective way for developers to manage their open source dependencies.

Integrate Mend with GitHub

Mend helps developers get real-time security alerts and compliance issues on open source dependencies within GitHub. Once Mend is configured to a GitHub repository, it will continuously scan the codebase and identify any open source libraries that are being used. It will then check for any known vulnerabilities or license compliance issues associated with those libraries, and provide alerts to the developers through the GitHub interface. Apart from notifications within the GitHub interface, Mend is configured to automatically create issues related to the vulnerabilities. 

This allows developers to quickly and easily see any potential issues with the open source dependencies they are using, and take steps to address them. Mend is configured to automatically open issues with suggested fixes for any identified vulnerabilities, streamlining the process of addressing them. 

Enable Mend Bolt for GitHub

It is very easy to integrate Mend with GitHub. There is a GitHub application available named Mend Bolt for GitHub. We can configure it for all the repositories under a GitHub organisation or selectively configure Mend for individual repositories.

YouTube video showing Mend configuration and usage

Refer to the YouTube video which explains in detail the different steps required for configuring Mend for a GitHub repository.

Details shown in Mend issue related to vulnerabilities

For each of the vulnerabilities reported by mend, it provides detailed information with a summary, CVE information, transitive dependencies and recommended fixes if any. The screenshots below show these different characteristics of the Mend issue

How to fix vulnerabilities reported by Mend

If you have received a report of vulnerabilities from Mend, it is important to address them as soon as possible in order to secure your system and prevent potential attacks. The first step is to carefully review the report and understand the nature of the vulnerabilities and the potential risks they pose. Next, you should determine the best course of action to fix the vulnerabilities. It is also a good idea to test the fixes to ensure that they effectively address the vulnerabilities and do not cause any unintended issues. It is important to keep in mind that vulnerabilities can be exploited quickly, so it is crucial to prioritize and address them in a timely manner.

In the YouTube video above, I showed how to fix the reported vulnerability by upgrading the dependency version to a higher version with a fix. This is a manual step. In another video, I took this a step further and used another open source tool which integrates with GitHub named Dependabot to automatically update the outdated dependencies. Check out this video if you are interested to know more about it.

Advantages of using Mend

Mend helps organizations identify and address vulnerabilities in their systems. Some of the advantages of using Mend include:

Improved security: By regularly scanning for vulnerabilities, Mend can help organizations identify and fix potential security weaknesses before they can be exploited by attackers.

Risk management: Mend can help organizations prioritize vulnerabilities based on their severity and the potential risks they pose, allowing them to focus their efforts on the most critical issues first.

Compliance: Many organizations are required to meet certain security standards in order to comply with regulations or industry standards. By using Mend, organizations can ensure that their systems are in compliance with these requirements.

Time and cost savings: Fixing vulnerabilities can be time-consuming and costly, especially if they are discovered after an attack has occurred. By using Mend to proactively identify and address vulnerabilities, organizations can save time and resources that would otherwise be spent on remediation.

Conclusion

Mend can help organizations improve their security posture and mitigate the risk of cyber attacks by identifying and fixing vulnerabilities in a timely and cost-effective manner. Cyber attacks are becoming more sophisticated and frequent, and it is important to have tools in place to protect yourself and your organization from these threats. Mend is a powerful tool that can help you identify and address vulnerabilities in your systems before they can be exploited by attackers. By using Mend, you can improve your security posture, mitigate the risk of cyber attacks, and save time and resources that would otherwise be spent on remediation. Protecting your systems and data is crucial in today's digital world, and Mend is an excellent tool to help you do so.

Until next time, Code with Passion and Strive for Excellence.

Share: