depreach 0.1.0

SCA with reachability — find out if vulnerable code is actually reachable

DepReach

SCA with reachability — find out if vulnerable code is actually reachable

What is DepReach?

DepReach is a Software Composition Analysis (SCA) tool that goes beyond listing CVEs: it tells you whether vulnerable code is reachable from your project. It builds call graphs, maps fixes from GitHub diffs to affected functions and marks issues as reachable or not — so you can prioritize what actually matters.

Preview

Features

Feature	Description
SBOM	CycloneDX via cyclonedx-py (Python) or cdxgen (Docker)
Vulnerability lookup	Local VDB (e.g. appthreat-vulnerability-db)
Reachability	Call graph + AST + GitHub diff → which vuln code is reachable
Caching	SQLite cache for reachability results
HTML report	Interactive dependency graph, filter by package, zoom, “hide clean”

Requirements

• Python 3.10+
• Docker (optional) — only if using cdxgen for SBOM
• Git — for reachability (GitHub diffs)

Install

pip install depreach

Requires Python 3.10+.

Usage

depreach -i <path_to_project> -o report.json [options]

Reports are written to reports/<project_name>/ (JSON, SBOM, HTML). Optionally use --sarif <file> to output SARIF 2.1.

Option	Description
-i, --input	Source code directory (required)
-o, --output	Report filename; output dir is reports/<project_name>/
--skip-update	Skip VDB update
--cache	Cache reachability in SQLite
-j, --jobs	Parallel jobs for reachability (default: 6)
--ignore	Comma-separated package names to ignore (e.g. flask,requests)
--sarif	Write SARIF 2.1 file (reachability in result.properties) for ASPM/Code Scanning

Exit codes: 0 = no vulns, 1 = vulns but none reachable, 2 = at least one reachable.

Example

depreach -i ./my-app -o report.json --cache --ignore "flask" --sarif report.sarif

Output

Artifact	Path	Description
JSON report	reports/<name>/report.json	Vulns with CVE, severity, description, references, reachability
SBOM	reports/<name>/<name>_sbom.json	CycloneDX SBOM
HTML report	reports/<name>/report.html	Interactive graph, filter by package, zoom
Console	—	Rich table with reachability status
Log	depreach.log	Debug log
SARIF	path from --sarif	SARIF 2.1 with isReachable in result properties (for ASPM)

Use as a library

from depreach import run

vulns, exit_code = run(
    input_dir="./my-app",
    output_file="report.json",
    skip_update=False,
    cache=True,
    jobs=6,
    ignore="flask,requests",
    sarif_path="report.sarif",
)
# exit_code: 0 = ok, 1 = vulns, 2 = reachable vulns