Dependency Audit

Audit project dependencies for security vulnerabilities, outdated packages, license compliance, bundle size impact, and unused packages. Produce an actionable report with prioritized upgrade recommendations.

Workflow

Step 1: Detect the Ecosystem

Identify the package manager and dependency files:

• Node.js: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml
• Python: requirements.txt, Pipfile, pyproject.toml, poetry.lock
• Rust: Cargo.toml, Cargo.lock
• Go: go.mod, go.sum
• Java/Kotlin: pom.xml, build.gradle, build.gradle.kts
• Ruby: Gemfile, Gemfile.lock

Read the primary dependency file to understand direct vs. transitive dependencies.

Step 2: Security Vulnerability Scan

Run ecosystem-specific audit tools:

Node.js:

npm audit --json
# or
pnpm audit --json
# or for more detailed analysis
npx audit-ci --config audit-ci.json

Python:

pip-audit --format=json
# or
safety check --json

Rust:

cargo audit --json

Go:

govulncheck ./...

For each vulnerability found, document:

• Package name and installed version
• Vulnerability ID (CVE, GHSA)
• Severity (Critical, High, Medium, Low)
• Fixed version (if available)
• Whether it is a direct or transitive dependency
• Whether the vulnerable code path is actually reachable in the project

Step 3: Outdated Package Analysis

Check for outdated dependencies:

Node.js:

npm outdated --json
# or
npx npm-check-updates --format group

Python:

pip list --outdated --format=json

Rust:

cargo outdated --format json

Categorize updates by risk:

• Patch updates (1.2.3 -> 1.2.4): Bug fixes, safe to update.
• Minor updates (1.2.3 -> 1.3.0): New features, backward compatible. Review changelog.
• Major updates (1.2.3 -> 2.0.0): Breaking changes. Requires migration planning.

Flag packages that are:

• Multiple major versions behind (high risk of security issues).
• Unmaintained (no commits in 12+ months, no response to issues).
• Deprecated (package author has published a successor).

Step 4: License Compliance

Check dependency licenses for compatibility:

Node.js:

npx license-checker --json --production
# or
npx license-report --output=json

License categories:

Flag:

• Any GPL/AGPL dependencies in proprietary projects.
• Dependencies with no license specified (legally risky).
• License conflicts between dependencies.
• Dependencies with custom or unusual licenses requiring legal review.

Step 5: Bundle Size Impact

For frontend projects, analyze the bundle size contribution of each dependency:

Node.js/Frontend:

# Check individual package sizes
npx bundle-phobia <package-name>

# Analyze the full bundle
npx source-map-explorer dist/main.js
# or
npx webpack-bundle-analyzer dist/stats.json

Identify:

• Large dependencies that could be replaced with smaller alternatives.
• Dependencies imported for a single function (lodash vs. lodash-es, moment vs. date-fns).
• Duplicate packages at different versions in the bundle.
• Dependencies that should be dynamically imported (code-split).

Common replacements for bundle size reduction:

Step 6: Unused Dependency Detection

Find dependencies that are installed but never imported:

Node.js:

npx depcheck
# or
npx knip

Python:

# Check for unused imports that may indicate unused dependencies
pylint --disable=all --enable=W0611 .

For each unused dependency, verify:

• Is it a CLI tool used in scripts (not imported in code)?
• Is it a type-only dependency (@types/* packages)?
• Is it used in configuration files (plugins for ESLint, Babel, PostCSS)?
• Is it a peer dependency required by another package?

Only recommend removing dependencies that are truly unused after this verification.

Step 7: Produce the Report

Compile all findings into a prioritized report.

Output Format

## Dependency Audit Report

**Project**: <name>
**Ecosystem**: <npm/pip/cargo/etc>
**Total dependencies**: <direct> direct, <transitive> transitive
**Date**: <date>

### Security Vulnerabilities

| Severity | Package | Version | CVE/GHSA | Fixed In | Direct? |
|----------|---------|---------|----------|----------|---------|
| CRITICAL | <name> | <ver> | <id> | <ver> | Yes/No |
| HIGH | <name> | <ver> | <id> | <ver> | Yes/No |

**Action required**: <count> critical, <count> high severity issues need immediate attention.

### Outdated Packages

#### Major Updates (breaking changes)
| Package | Current | Latest | Age Behind | Migration Notes |
|---------|---------|--------|------------|-----------------|

#### Minor Updates (features, backward compatible)
| Package | Current | Latest |
|---------|---------|--------|

#### Patch Updates (bug fixes, safe)
| Package | Current | Latest |
|---------|---------|--------|

### License Compliance

**Status**: PASS / FAIL / REVIEW NEEDED

| Package | License | Risk Level | Notes |
|---------|---------|------------|-------|

### Bundle Size Analysis

**Total bundle**: <size>
**Top 5 heaviest dependencies**:
| Package | Size (gzipped) | % of Bundle | Alternative |
|---------|---------------|-------------|-------------|

### Unused Dependencies
| Package | Type | Recommendation |
|---------|------|----------------|

### Recommended Actions (priority order)
1. **[Critical]** <action>
2. **[High]** <action>
3. **[Medium]** <action>

Examples

User: "Audit my project dependencies" Action: Detect the ecosystem, run security audit, check for outdated packages, verify licenses, detect unused dependencies, produce a comprehensive report.

User: "Are there any security vulnerabilities in our dependencies?" Action: Run npm audit or equivalent, categorize findings by severity, check if vulnerable code paths are reachable, provide fix commands.

User: "Check our licenses for GPL contamination" Action: Run license checker on production dependencies, flag any copyleft licenses, identify license conflicts, recommend alternatives for problematic dependencies.

User: "Our bundle is 2MB, what can we trim?" Action: Analyze bundle composition, identify heavy dependencies, suggest lighter alternatives, recommend code-splitting strategies, estimate savings.

Best Practices

• Run dependency audits in CI on every PR, not just occasionally. Use npm audit --audit-level=high as a gate.
• Separate production and dev dependencies strictly. Dev dependencies should never be in the production bundle.
• Pin exact versions in lock files (default behavior) but use ranges in package.json for libraries.
• Review changelogs before major version upgrades. Automated tools like Dependabot or Renovate can help, but a human should review breaking changes.
• Prefer packages with active maintenance, a large user base, and a clear license. Check the package's GitHub for open issues, last commit date, and bus factor.
• For license compliance, audit production dependencies separately from dev dependencies. Dev-only tools with GPL licenses are usually acceptable.
• Keep a dependency policy document that specifies allowed licenses, blocked packages, and approval process for new dependencies.
• Consider vendoring critical dependencies if they are small and maintenance is uncertain.
• Use npm ls <package> or pnpm why <package> to understand why a transitive dependency is present before trying to remove it.
• Set up automated dependency update PRs (Renovate or Dependabot) with auto-merge for patch versions that pass CI.