Libraries, Vulnerabilities and Licenses
The Libraries panel reads your project’s dependency declarations and builds one inventory across all modules. Two separate scans work on that inventory: Vulnerabilities checks every version against a public advisory database, and Licenses reads the license of every library from your machine.
Libraries is a PRO feature. The vulnerability scan and the license scan are separate permissions; a tab you do not have access to is not shown.
The panel has three tabs:
| Tab | Shows | Network |
|---|---|---|
| Structure | Repositories, projects and modules with their dependencies, grouped by scope | none |
| Vulnerabilities | Libraries with known advisories, their severity and the version that fixes them | OSV.dev |
| Licenses | Every library grouped by license risk and SPDX license | none |
A tab’s badge shows ✓ after a clean scan, or the count of findings in the colour of the worst one. One search field
covers projects, libraries, licenses and advisories, and the filter chips narrow everything to Vulnerable,
Copyleft or Unknown license, Hide dev/test, or a chosen set of Projects….
What is read
Genexy detects modules from the dependency files in the project:
| Ecosystem | Detected from | Version pinned from |
|---|---|---|
| Maven | pom.xml | pom.xml properties |
| Gradle | build.gradle, build.gradle.kts | declared coordinates |
| npm | package.json | package-lock.json when present |
| Go | go.mod | go.mod |
| Python | requirements.txt | poetry.lock when present |
| Rust | Cargo.toml | Cargo.lock when present |
| .NET | *.csproj | declared Version |
A project with several modules produces one entry per module, so a monorepo does not collapse into a single flat list.
Dependencies are grouped by scope (compile, runtime, dev, test, provided, optional), because a finding in a test-only
dependency rarely carries the same weight as one in a shipped dependency. Directories excluded by .gitignore,
dependency caches and build outputs are skipped. Opening the panel, or pressing reload, only reads these files.
Vulnerabilities
Nothing is queried until you press Scan for vulnerabilities. The scan bar then shows its progress and, when it is done, how many libraries are vulnerable, how many advisories matched and when it ran. Stop keeps the results found so far; Rescan runs it again.
The vulnerability scan sends the ecosystem, name and version of each dependency to OSV.dev so it can return matching advisories. Source code, file contents and project names are not sent. If that request is unacceptable in your environment, do not run this scan; the license scan stays offline.
Severities are CRITICAL, HIGH, MEDIUM, LOW and UNKNOWN (shown as unscored), derived from the advisory’s
CVSS score where one is published and from the publisher’s rating otherwise. A library shows its highest severity and
either upgrade → <version> or no fix yet. Expanding it lists each advisory with its identifier, CVSS score and
summary; Details shows the full text, the CVSS vector and alternative identifiers such as the CVE number.
✦ Fix with AI prepares a prompt in the AI chat that upgrades the library. It is not sent until you review it and press send.
Licenses
Scan licenses reads the license of every dependency from what is already installed on your machine:
node_modules, the Go module cache, ~/.m2 and the Gradle caches, the Cargo registry, ~/.nuget/packages and a
Python virtual environment. Licenses are normalised to SPDX identifiers, so “The Apache Software License, Version 2.0”
and Apache-2.0 count as the same license. Nothing leaves your machine.
| Category | Meaning |
|---|---|
| Strong copyleft | GPL, AGPL and similar: distributing software that includes them usually requires releasing your source under the same license |
| Weak copyleft | LGPL, MPL, EPL and similar: changes to these libraries themselves must be shared; using them unchanged is usually fine |
| Other / custom | Not a recognised open source license: read the terms |
| Unknown | No license found locally |
| Permissive | MIT, Apache, BSD, ISC and similar: allowed in closed-source software with attribution |
For an expression such as MIT OR GPL-3.0 the least restrictive option counts; for AND the strictest one. The bar
at the top shows the distribution, and the ? next to each category explains what it allows, requires and what to
watch out for.
A library that is not installed yet shows as Unknown. Install the dependencies (npm install,
go mod download, or build the project once) and rescan.
The categories are information, not legal advice, and there is no policy that blocks a license. Whether a license fits depends on how you distribute your software; ask someone qualified when it matters.
Versions the scan could not pin down
An advisory lookup needs one concrete version. Where a manifest declares a range (^4.17.15, >=4.2,<5.0) and no
lockfile is present, the panel scans the lowest version of the range and marks the entry with ~; matches are then a
best-effort approximation of what is actually installed. Where no version can be derived at all (an unresolved Maven
property, a workspace:/git/path dependency, Central Package Management, a Gradle version catalog entry), the
dependency is listed with a no version marker and is deliberately not scanned, rather than scanned against a guess.
Limits
Both scans work on declared dependencies; this is not a full build-time resolution, so a transitive dependency that only your build tool knows about may be missing. A clean vulnerability result means “nothing matched in the advisory database”, not “no vulnerabilities exist”, and when a lookup failed the panel says the result is incomplete. Treat both scans as a fast first pass, not as a compliance report.