dependency-audit

When to use

• After adding, upgrading, or unpinning a dependency.
• Before cutting a release or merging to a protected branch.
• When the user asks "are any of our packages vulnerable?" or "is <package> safe to install?"
• When a Dependabot/Renovate alert or CVE lands.

Process

1. Identify the ecosystem(s) from lockfiles present: package-lock.json/pnpm-lock.yaml/yarn.lock (npm), requirements.txt/poetry.lock/uv.lock (Python), go.sum (Go), Cargo.lock (Rust), Gemfile.lock (Ruby).
2. Run the native auditor for each ecosystem:
   • npm: npm audit --omit=dev (or pnpm audit / yarn npm audit)
   • Python: pip-audit (or uv pip audit); fall back to safety check if needed
   • Go: govulncheck ./...
   • Rust: cargo audit
   • Ruby: bundle audit check --update
3. Optionally run a cross-ecosystem SCA pass (osv-scanner -r .) to catch anything the native tool misses.
4. Triage each finding by severity AND reachability — a critical CVE in an unused transitive dep is lower urgency than a medium one in a hot path.
5. Manually eyeball newly added packages for supply-chain red flags (see checklist).
6. Propose the minimal safe upgrade and re-run the auditor to confirm the fix.

What to check

• Known CVEs / advisories in direct and transitive dependencies, with a fixed version available.
• Typosquats — names one edit away from a popular package (reqeusts, python-dateutil vs dateutil, lodahs).
• Unmaintained deps — no release in 2+ years, archived repo, single maintainer, or deprecated on the registry.
• Supply-chain smells — install/postinstall scripts, brand-new package with sudden version jumps, maintainer handover, obfuscated code, network calls at install time.
• License risk — copyleft (GPL/AGPL) creeping into a permissive-licensed product.
• Lockfile integrity — lockfile committed, hashes present, and no latest/floating ranges in production deps.

How to fix

• Bump to the patched version (npm update <pkg>, pip install -U <pkg>, edit + re-lock). Prefer the smallest semver jump that clears the advisory.
• If no fix exists: pin away from the bad range, apply an override/resolution to force a safe transitive version, or replace the package.
• Remove dead dependencies entirely rather than carrying their risk.
• Add an overrides/resolutions (npm) or constraints file (pip) to hold transitive deps at safe versions.
• Wire the auditor into CI so regressions are caught automatically.

Report back

List findings as a short table: package, current → fixed version, severity, CVE/advisory ID, and direct-vs-transitive. State which you upgraded, which need a manual decision (breaking change, no fix), and any typosquat/unmaintained flags. End with a clear "audit clean" or "N issues remaining" verdict.