SwiftDependencyChecker
SwiftDependencyChecker can be installed with homebrew with the following commands:
brew tap kristiinara/SwiftDependencyChecker
brew install SwiftDependencyChecker
When installed SwiftDependencyChecker can be run as follows, this prints out info about vulnerable library versions used:
SwiftDependencyChecker analyse --action all
Selecting the sourceanalysis action prints out warnings related to use of vulnerable library versions in source files.
SwiftDependencyChecker analyse --action sourceanalysis
Run script build phase
Recommended usage is to add the following as a new “Run script” under “Build phases” in the Xcode project. Output is then displayed as warnings in Xcode. Using SwiftDependencyChecker this way makes it possible to automatically check for new vulnerabilities without any user interaction.
SwiftDependencyChecker analyse --action sourceanalysis
Here is a blogpost with explanations of how the tool is built: https://medium.com/@kristiina_28701/swiftdependencychecker-check-cocoapods-carthage-and-swift-pm-dependencies-for-known-def2fba890c