Dependency Audit

Audit project dependencies for license compatibility, outdated versions, and known vulnerabilities.

Iron Law

FLAG ALL COPYLEFT LICENSES IN PERMISSIVE PROJECTS. If the project uses MIT/Apache/BSD, any dependency using GPL/AGPL/LGPL/MPL must be explicitly flagged as a compatibility risk.

Step 1: Detect Package Manager

Scan the repo root for manifest files to determine the ecosystem:

If multiple ecosystems are detected, audit each one separately.

Step 2: Detect Project License

Read the LICENSE file or the license field in the package manifest to determine the project's own license. This is needed for compatibility analysis in Step 4.

Step 3: Check for Outdated Dependencies

Run the appropriate command for the detected package manager:

If the command is unavailable, fall back to reading the lock file and comparing versions via the registry API.

Step 4: Identify Dependency Licenses

Determine licenses for each dependency:

License Compatibility Matrix

When the project license is permissive (MIT, Apache-2.0, BSD):

Step 5: Check for Known Vulnerabilities

Run the appropriate audit command:

If the tool is unavailable, note it as SKIPPED in the report.

Output Format

Present the report as:

# Dependency Audit Report

**Project**: {name}
**Project License**: {license}
**Ecosystem**: {ecosystem}
**Total Dependencies**: {count}
**Audited**: {date}

## Summary

| Category | Count |
|----------|-------|
| Up to date | X |
| Outdated (minor) | X |
| Outdated (major) | X |
| Vulnerable | X |
| License incompatible | X |
| License caution | X |

## Vulnerabilities

| Package | Installed | Severity | Advisory | Fix |
|---------|-----------|----------|----------|-----|
| {name} | {version} | CRITICAL/HIGH/MEDIUM/LOW | {CVE or advisory ID} | Upgrade to {version} |

## License Issues

| Package | Version | License | Status | Risk |
|---------|---------|---------|--------|------|
| {name} | {version} | {license} | INCOMPATIBLE/CAUTION/RISK | {explanation} |

## Outdated Dependencies

| Package | Current | Latest | Type |
|---------|---------|--------|------|
| {name} | {current} | {latest} | major/minor/patch |

## Recommendations

1. **[CRITICAL]** {action} -- {why}
2. **[IMPORTANT]** {action} -- {why}
3. **[MAINTENANCE]** {action} -- {why}

Anti-Patterns

• Do NOT install dependencies or modify lock files. Read-only analysis.
• Do NOT run npm install, composer install, etc. Work with what is already installed or use registry APIs.
• Do NOT assume all commands are available. Check first and gracefully skip unavailable tools.
• Do NOT report patch-level outdated dependencies as urgent. Focus on major version gaps and security issues.
• Do NOT conflate "outdated" with "vulnerable." Outdated is maintenance; vulnerable is security.