Repolode
Submit
fabric8-analytics

fabric8-analytics/fabric8-analytics-vscode-extension

VS Code extension from Red Hat that flags known vulnerabilities and license issues in your project's dependencies as you edit manifest files.

Open-source alternative to:Snyk

View on GitHubWebsite
Stars
258
Forks
195
Open issues
9
Last commit
6 days ago

What is it?

Red Hat Dependency Analytics (RHDA) is a Visual Studio Code extension that shows security vulnerabilities in your software supply chain while you write code. When you open a manifest file such as pom.xml, package.json, go.mod, requirements.txt, pyproject.toml, or Cargo.toml, it sends the dependency list to a Red Hat-hosted backend and marks affected packages inline with vulnerability counts and severity. It supports Maven, npm, pnpm, Yarn, Go, Python (pip, Poetry, uv), Gradle, and Cargo.

Beyond inline vulnerability markers, the extension offers quick fixes that suggest Red Hat-recommended package versions, a detailed HTML report per manifest, and a batch command for analyzing all packages in a JavaScript or Cargo workspace. It also checks license mismatches between manifests and LICENSE files, can generate a CycloneDX SBOM, and can scan Dockerfile base images when syft and skopeo are installed.

Dependencies can be excluded from analysis with `exhortignore` comments, and dev or test scopes are skipped by default. The extension relies on the external package manager binaries on your system, and it sends manifest data to the online service.

Key features

  • 01Inline vulnerability markers on dependencies in supported manifest files.
  • 02Quick Fix suggestions that can switch to Red Hat-recommended package versions.
  • 03License mismatch and incompatible dependency license detection.
  • 04Batch analysis of JavaScript/TypeScript monorepos and Cargo workspaces.
  • 05CycloneDX SBOM generation from manifest files.
  • 06Dockerfile base image scanning with syft and skopeo.

Use cases

  • Catching known vulnerable dependencies while editing pom.xml or package.json.
  • Checking a Python project managed by pip, Poetry, or uv before committing dependency changes.
  • Generating an SBOM for a Maven or npm project to share with a security team.
  • Auditing every package in a pnpm or Cargo monorepo in one run.

Quick start

  1. 1

    Install Visual Studio Code

  2. 2

    Open the Extensions view from the View menu

  3. 3

    Search the Marketplace for Red Hat Dependency Analytics and click Install

Things to know

  • It requires the package manager for your project type (such as mvn, npm, pip, or cargo) to be installed and available on your PATH.
  • It is an online service hosted by Red Hat, so it needs network access to analyze dependencies.
  • Maven and Gradle recommendations and remediation require adding Red Hat's GA repository to your project.

In collections

Security scanners, audits & threat intel tools

Topics

#security#vulnerability-scanning#dependency-management#sbom#supply-chain-security#vscode-extension#software-composition-analysis#cve#dependency-analytics#ide-extension

FAQ

What is fabric8-analytics-vscode-extension?
VS Code extension from Red Hat that flags known vulnerabilities and license issues in your project's dependencies as you edit manifest files. Red Hat Dependency Analytics (RHDA) is a Visual Studio Code extension that shows security vulnerabilities in your software supply chain while you write code. When you open a manifest file such as pom.xml, package.json, go.mod, requirements.txt, pyproject.toml, or Cargo.toml, it sends the dependency list to a Red Hat-hosted backend and marks affected packages inline with vulnerability counts and severity. It supports Maven, npm, pnpm, Yarn, Go, Python (pip, Poetry, uv), Gradle, and Cargo.
Is fabric8-analytics-vscode-extension free to use? What license does it have?
fabric8-analytics-vscode-extension is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is fabric8-analytics-vscode-extension still maintained?
Actively maintained. The last commit to fabric8-analytics-vscode-extension was on Nov 2, 2026.
What can I use fabric8-analytics-vscode-extension for?
Catching known vulnerable dependencies while editing pom.xml or package.json. Checking a Python project managed by pip, Poetry, or uv before committing dependency changes. Generating an SBOM for a Maven or npm project to share with a security team. Auditing every package in a pnpm or Cargo monorepo in one run.
How do I install fabric8-analytics-vscode-extension?
Install Visual Studio Code Open the Extensions view from the View menu Search the Marketplace for Red Hat Dependency Analytics and click Install
Where can I get fabric8-analytics-vscode-extension?
The source code and installation instructions are on GitHub: https://github.com/fabric8-analytics/fabric8-analytics-vscode-extension

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects