Dependency check scanning monorepository

[sametr35]

Select Topic Area

Question

Body

Hello,

I'm working with a monorepo containing multiple applications, and I'm currently running separate dependency checks for each application. I've noticed that the same vulnerabilities are being reported for each app. However, I know that updating a dependency to fix a vulnerability will resolve the issue for all app scans. Is there a way to consolidate the scans for all apps and receive a single report for each unique dependency instead of duplicating them for each app?

[carogalvin]

There is not a way to do this right now. You can upvote & follow the related open issue in the Dependabot core repo for updates: dependabot/dependabot-core#1595

[sametr35]

Thanks for the reply. I meant dependency check and I think dependabot is different software and technology.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬