Audit deps

Dependency Audit

Scan all project dependencies for security vulnerabilities, outdated major versions, and license issues.

Step 1: Detect package managers and lockfiles

Scan the project root and workspaces for all package managers in use:

# Node
ls package.json package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null
# Python
ls requirements.txt requirements*.txt Pipfile.lock poetry.lock 2>/dev/null
# Go
ls go.mod go.sum 2>/dev/null
# Rust
ls Cargo.toml Cargo.lock 2>/dev/null
# Ruby
ls Gemfile Gemfile.lock 2>/dev/null
# Monorepo workspaces
find . -name "package.json" -not -path "*/node_modules/*" -maxdepth 3 2>/dev/null

Run all applicable audits. Do not skip a package manager just because it's not the primary one.

Step 2: Security vulnerabilities

Run the native audit tool for each detected package manager:

Node (npm/yarn/pnpm):

npm audit --json 2>/dev/null
# or
yarn audit --json 2>/dev/null
# or
pnpm audit --json 2>/dev/null

Python:

pip-audit --format json 2>/dev/null
# fallback:
safety check --json 2>/dev/null

Go:

govulncheck ./... 2>/dev/null

Rust:

cargo audit --json 2>/dev/null

Ruby:

bundle audit check --update 2>/dev/null

For each vulnerability found, extract:

• Package name and current version
• CVE ID and severity (critical / high / medium / low)
• Affected versions and fixed version
• Whether a fix is available

Step 3: Outdated major versions

Check for packages on outdated major versions (breaking change territory):

Node:

npm outdated --json 2>/dev/null

Filter for packages where current major < latest major (e.g., "3.x.x" → "4.x.x"). Minor/patch outdated packages are noise — only flag major version gaps.

Python:

pip list --outdated --format json 2>/dev/null

Go:

go list -u -m all 2>/dev/null

Step 4: License scan

Check for licenses that may conflict with your project's license or usage:

Node:

npx license-checker --json --production 2>/dev/null

Flag packages with:

• Copyleft licenses (GPL, AGPL, LGPL) in a non-open-source project — may require your code to be open-sourced
• Unknown or unlicensed packages — legal risk
• Licenses requiring attribution (MIT, Apache 2.0 with NOTICE) — ensure compliance

Step 5: Produce prioritized report

🔴 Critical — act immediately

CVEs with critical/high severity that have a fix available. Format: <package>@<current> → <fixed> | CVE-XXXX-XXXX | <one-line description>

🟡 Should address

• High/medium CVEs without an immediate fix (monitor for patch)
• Major version gaps on core dependencies (framework, ORM, auth library)
• Copyleft license conflicts

🟢 Good to know

• Low severity CVEs
• Minor/patch outdated packages
• Attribution-required licenses (ensure compliance, not a blocker)

✅ Clean

Categories with no findings — call them out explicitly so you know what was checked.

Step 6: Suggested actions

For each 🔴 finding, provide the exact command to fix it:

npm install <package>@<fixed-version>
# or
pip install "<package>>=<fixed-version>"

For major version upgrades, note: "Review changelog for breaking changes before upgrading."